Internet of Things edge computing security aggregation method and system based on differential privacy

Abstract

The invention discloses an Internet of Things edge computing security aggregation method and system based on differential privacy. The method comprises the steps that a trusted authorization mechanism client generates and distributes a unique equipment public key and a unique equipment private key; each Internet of Things device encrypts a machine learning model parameter of the Internet of Things device by using a device private key and a public parameter of the Internet of Things device to generate a ciphertext; each piece of Internet of Things equipment adds noise to the ciphertext according to the privacy requirement of the Internet of Things equipment, and local differential privacy is achieved; the Internet of Things equipment uploads the machine learning model parameters added with the noise to an edge computing server; the edge computing server is used for aggregating all the machine learning model parameters added with the noise; the edge computing server issues a decrypted result to the Internet of Things equipment; the Internet of Things equipment updates local machine learning model parameters based on the decrypted aggregation calculation result; and in the parameter updating process, limiting the parameter updating amplitude of the local machine learning model based on the gradient constraint value.

Description

Technical Field

[0001] The present invention relates to the field of edge data privacy protection computing technology in the Internet of Things, and in particular to an Internet of Things edge computing security aggregation method and system based on differential privacy. Background Art

[0002] With the development of IoT technology, IoT devices (such as industrial robots, smart home devices, and Internet of Vehicles) and their application data are increasing, and a large amount of real-time data is generated in the IoT every day. The data processed in IoT devices contains a large amount of sensitive privacy information, such as the identity, status, location, and other privacy information of the device. In the IoT computing architecture, directly sharing the original data with other nodes without any security protection will lead to serious privacy leakage problems. Once this information is maliciously exchanged with others or the node is sold, the privacy information of the device can be inferred. This behavior will seriously endanger the security of information and cause serious consequences.

[0003] In IoT communication, the requester device collects the perception data of other devices, and then uses the shared data to calculate and complete the task locally. The sharing of raw perception data will inevitably lead to the problem of device privacy leakage. Federated learning, as a distributed machine learning technology, distributes the collaborative training model to each participant. Without sharing the original data, the IoT device performs local training and only sends a small amount of model parameters obtained through training to the central server for aggregation, which greatly reduces the communication overhead and privacy leakage problems.

[0004] However, it is still possible to obtain the privacy information of other participating devices by implementing attacks such as model reversal and member reasoning during the model aggregation process. At present, some schemes use secret sharing and homomorphic encryption to theoretically achieve secure aggregation of federated learning. However, on the one hand, considering the real IoT device environment, it may cause a lot of communication and computing overhead, and on the other hand, its stable member structure is difficult to meet the fast and dynamic environment requirements required by some IoT devices. Summary of the invention

[0005] In order to address the deficiencies in the prior art, the present invention provides an IoT edge computing security aggregation method and system based on differential privacy. By adopting this method, the privacy protection of IoT edge data is achieved while ensuring the performance of IoT edge computing, which is of great significance to the sustainable development of the IoT in the future.

[0006] On the one hand, a secure aggregation method for IoT edge computing based on differential privacy is provided, including:

[0007] The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0008] Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters and generate ciphertext; each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy; according to the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update; finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server;

[0009] The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain the aggregated result; the edge computing server uses the private key provided by all IoT devices to decrypt the aggregated result, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the update amplitude of the local machine learning model parameters is limited based on the gradient constraint value, and then returns to the previous step.

[0010] On the other hand, an IoT edge computing security aggregation system based on differential privacy is provided, including: a trusted authority client, several IoT devices and an edge computing server;

[0011] The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0012] Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters and generate ciphertext; each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy; according to the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update; finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server;

[0013] The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain the aggregated result; the edge computing server uses the private key provided by all IoT devices to decrypt the aggregated result, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the update amplitude of the local machine learning model parameters is limited based on the gradient constraint value, and then returns to the previous step.

[0014] The above technical solution has the following advantages or beneficial effects:

[0015] (1) The present invention uses multi-input function encryption to achieve ciphertext aggregation in mobile edge computing. By improving the key distribution algorithm, different public keys are generated and distributed to each device, solving the problem of privacy leakage that may be caused by public key leakage.

[0016] (2) The present invention avoids the risks of traditional centralized differential privacy by setting local differential privacy and adding noise independently in each IoT device. The required adaptive noise addition is achieved by using an adaptive clipping scheme, so that the gradient norm constraint C is within a reasonable range, effectively limiting the sensitivity of the aggregation to the addition or deletion of any user data, and improving the practicality of the model;

[0017] (3) The present invention uses the public keys of devices that are independently generated by a trusted authorization agency, and the mobile edge computing server can obtain the public parameters of all devices. By setting an appropriate inner product function for encrypted aggregation calculation, the leaving and joining of any device will not affect the participation of other devices in the aggregation calculation, thereby realizing the dynamic participation of IoT devices and meeting the dynamic participation requirements of IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0019] Figure 1 It is a schematic diagram of the process of the present invention;

[0020] Figure 2 It is a principle framework diagram of the method of the present invention. DETAILED DESCRIPTION

[0021] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0022] Embodiment 1

[0023] This embodiment provides an IoT edge computing security aggregation method based on differential privacy;

[0024] like Figure 1 and Figure 2 As shown in the figure, the IoT edge computing security aggregation method based on differential privacy includes:

[0025] S101: The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0026] S102: Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext; each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy; according to the current training status of the machine learning model, an adaptive clipping scheme is used to dynamically adjust the gradient constraint value of the machine learning model update; finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server;

[0027] S103: The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain an aggregated result; the edge computing server decrypts the aggregated result using the private key provided by all IoT devices, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the update amplitude of the local machine learning model parameters is limited based on the gradient constraint value, and then returns to S102.

[0028] Furthermore, the S101: the trusted authorization agency client generates and distributes a unique device public key and a unique device private key for each IoT device, specifically including:

[0029] S101-1: The trusted authority client generates public parameters PP, master public key mpk and master private key msk;

[0030] S101-2: The trusted authority client generates a unique ID and device public key mpk for each IoT device i And device private key msk i ;

[0031] S101-3: The trusted authority client will generate a unique ID for each IoT device, as well as the device public key mpk i And device private key msk i , assigned to the corresponding IoT devices.

[0032] Furthermore, the S101-1: the trusted authority client generates the public parameter PP, the master public key mpk and the master private key msk, which is implemented based on the Setup(λ) function.

[0033] Among them, the Setup (λ) function comes from Abdalla M, Catalano D, Fiore D, et al. Multi-input functional encryption for inner products: Function-hiding realizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part I 38. Springer International Publishing, 2018: 597-627.

[0034] Furthermore, in S101-2, the trusted authorization agency client generates a unique ID and a device public key mpk for each IoT device. i And device private key msk i , which is implemented based on the function key generation PubGen(mpk,msk,i) function.

[0035] Among them, PubGen (mpk, msk, i) function includes:

[0036] (1) Input parameters: mpk: master public key, msk: master private key, i: index used to distinguish different key pairs;

[0037] (2) Starting from i=0, until all n key pairs are traversed;

[0038] (3) Call the Setup(λ) function to generate a new pair of keys (mpk i ,msk i );

[0039] (4) The key pair (mpk i ,msk i ) is stored as the public key pk i =(mpk i ,msk i );

[0040] (5) The public key pk i Distribute to the corresponding IoT device, i=i+1; return to (2).

[0041] It should be understood that by adding the device public key distribution step PubGen(mpk,msk,i), each device generates its own ID and corresponding device public key and private key, and the mobile edge computing server does not need to combine all the participating user partial decryption keys together to generate a decryption key. This solves the problem of reduced security caused by the leakage of the system public key.

[0042] Furthermore, in S102, each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext, including:

[0043] S102-11: Each IoT device generates a function key using its own device private key and public parameters;

[0044] S102-12: Encrypt the local machine learning model parameters based on the function key to generate ciphertext.

[0045] Furthermore, the S102-11: each IoT device uses its own device private key and public parameters to generate a function key, which is implemented based on the KenGen (msk, y) function.

[0046] Among them, the KenGen(msk,y) function comes from Abdalla M, Catalano D, Fiore D, etal.Multi-input functional encryption for inner products: Function-hidingrealizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference,Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part I 38. Springer International Publishing, 2018: 597-627.

[0047] Furthermore, the S102-12: encrypting the local machine learning model parameters based on the function key to generate ciphertext includes:

[0048] Using encryption function Encrypt(pk i ,i,x1), based on the device function key, the local machine learning model parameters are encrypted to generate ciphertext.

[0049] Among them, Encrypt(pk i ,i,x1), derived from Abdalla M, Catalano D, Fiore D, et al.Multi-input functional encryption for inner products: Function-hiding realizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference,Santa Barbara,CA,USA,August19–23,2018,Proceedings,Part I 38. Springer International Publishing, 2018: 597-627.

[0050] Furthermore, in S102, each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy, including:

[0051] S102-21: Determine noise parameters: set the mean (usually 0) and standard deviation σ of Gaussian noise;

[0052] S102-22: Based on the mean and standard deviation σ, a random number generator is used to generate a Gaussian distributed random number to obtain a Gaussian noise, which is expressed as: noise = N (0, σ 2 ), where N is a Gaussian distribution, 0 is the mean, σ 2 is the variance;

[0053] S102-23: Add the generated noise noise to the local update parameters of the machine learning model. The process of adding noise is expressed as: Δω'=Δω+noise, where Δω' is the update parameter after adding noise, Δω is the update parameter of the local model, and noise is Gaussian noise.

[0054] Furthermore, the process of adding noise includes:

[0055] N(0,S 2 σ 2 ) is divided into Gaussian noise is added to each IoT device Gaussian noise, where n is the number of IoT devices involved in the calculation, and the final return value

[0056] It should be understood that in Gaussian mechanism blinding, the Gaussian distribution formula N(0,S 2 σ 2 ) to determine Gaussian noise, where S 2 represents the variance of the distribution, and σ represents the sensitivity of the query, that is, the contribution of a single record to the variance.

[0057] Noise parameter S:

[0058]

[0059] Where ε is the main privacy budget and δ is the supplementary privacy budget, i.e., the acceptable probability of privacy leakage.

[0060] Sensitivity to queries σ: Determined by the maximum impact of a single record, i.e., the maximum absolute value of the record. In differential privacy, queries usually refer to computational or analytical operations performed on data.

[0061] It should be understood that Gaussian blinding is a technique used in differential privacy to protect data privacy, which achieves privacy protection by adding Gaussian noise to the data, thereby allowing analysis and statistics of the data set without leaking individual data.

[0062] In the aggregation theorem of differential privacy, if every local process Q k Satisfy (ε k ,δ k )-DP and Then the global process Q=Q1,Q2,...,Q n satisfy Therefore, step S102 adds noise before the local model is updated and uploaded. k represents the primary privacy budget of differential privacy in the kth operation, which is used to quantify the level of privacy protection, δ k represents the supplementary privacy budget of differential privacy in the kth operation, which is used to deal with small probability events that cannot be completely avoided under ε protection, (ε k ,δ k )-DP means that the privacy protection level provided by the algorithm is a combination of ε-DP and δ-DP. Represents all operations ε k The accumulated privacy loss does not exceed the total privacy budget ε. ε represents the main privacy budget of differential privacy, which is used to quantify the level of privacy protection. δ represents the supplementary privacy budget of differential privacy, which is used to deal with low-probability events that cannot be completely avoided under the protection of ε. (ε,δ)-DP represents the privacy protection combination provided by the global process. represents the sum of the main privacy budget, represents the comprehensive supplementary privacy budget

[0063] Furthermore, the S102: dynamically adjusting the gradient constraint value updated by the machine learning model using an adaptive clipping scheme according to the training status of the current machine learning model, includes:

[0064] S102-31: Before training begins, initialize the global model and set an initial gradient constraint value C;

[0065] S102-32: The IoT device updates the local model parameters and calculates the gradient g of the model update;

[0066] S102-33: Calculate the L2 norm of the gradient to determine the size of the updated gradient g;

[0067] S102-34: Use adaptive clipping rules to adjust the gradient constraint value C:

[0068]

[0069] Among them, C t+1 represents the clipping value at time step t+1, which is used to limit the gradient size to achieve adaptive noise addition, C t represents the clipping value at time step t, represents the empirical fraction of samples with the maximum value C, η C is the learning rate, γ is a hyperparameter and γ∈[0,1].

[0070] S102-35: According to the adaptively adjusted C t+1 Value, clip the gradient, if the norm of the gradient is greater than C, the gradient is scaled:

[0071]

[0072] Where g represents the original gradient calculated based on the current model parameters and data in each iteration, g′ represents the clipped gradient, ||g||2 represents the L2 norm of the current gradient g, and C represents the gradient constraint value;

[0073] S102-36: Upload the clipped gradients to the edge computing server, and the edge computing server aggregates the uploaded gradients to update the global model;

[0074] S102-37: Repeat steps S102-32 to S102-36 to perform iterative training.

[0075] Furthermore, the S102-32: the IoT device updates the local model parameters and calculates the gradient g of the model update, including:

[0076] The gradient g is obtained by taking the partial derivative of each parameter of the loss function L(w) and is expressed by the following formula:

[0077]

[0078] in, It means to find the partial derivative of L(w), Represents the loss function L relative to the weight W i The partial derivative of , where n is the number of model parameters.

[0079] The loss function is a function that measures the difference between the model's predicted value and the actual value. The loss function is: Cross-Entropy Loss:

[0080]

[0081] Among them, L represents the loss value, y is the true label vector, is the probability distribution vector predicted by the model, i represents the i-th element, y i represents the i-th element in the label vector (indicating whether the sample belongs to the i-th category), Represents the i-th element of the output predicted by the model (indicates the probability that the model predicts that the sample belongs to the i-th category).

[0082] Furthermore, the S102-33: calculating the L2 norm of the gradient to determine the size of the updated gradient g includes:

[0083] Calculate each partial derivative in the gradient, square each partial derivative in the gradient, sum all the squared partial derivatives, take the square root of the sum, and get the L2 norm of the gradient:

[0084]

[0085] Among them, ||g||2, represents the L2 norm of the gradient g, Represents the loss function L relative to the weight W i The partial derivative of .

[0086] When the gradient norm constraint C is set too low as a hyperparameter, the information contained in the gradient magnitude will be discarded, resulting in high bias. When the gradient norm constraint C is set too high, it will destroy the practicality of the model and add more noise. Therefore, an adaptive clipping scheme is used to achieve adaptive noise addition.

[0087] Under the adaptive clipping scheme, the updated quartile values ​​of the normal distribution are used. Instead of a fixed constant value, it reduces the impact of individual users on the global model and improves the practicality of the model.

[0088] It should be understood that an adaptive differential privacy method is designed to protect the data security of the local model while adaptively adjusting the gradient clipping threshold to reduce the impact on the model accuracy. Finally, the encrypted and noisy local model parameters are uploaded to the mobile edge computing server to complete the upload of the local model parameters. Dynamic adjustments are made according to the current model training situation to reduce the impact of differential privacy noise on model performance.

[0089] The effect of the above scheme is to reduce the influence of individual users on the global model. Adaptive pruning scheme is used to dynamically adjust the gradient constraint value of model update to reduce the impact of differential privacy on model accuracy.

[0090] Furthermore, in S103, the edge computing server aggregates all the machine learning model parameters after adding noise using a function encryption method to obtain an aggregated result, including:

[0091] In the aggregate calculation scheme of function encryption, multiple encrypted data items are aggregated and calculated through the inner product function to obtain the aggregate result ct i ;

[0092] The inner product function f((x1,x2,...,x n ),y) are as follows:

[0093]

[0094] where x1,x2,...,x n Represents the input vector sequence, where each x i is a vector, y represents another input vector, f((x1,x2,...,x n ),y) represents the inner product function itself, which accepts parameters x1,x2,...,x n and y to return the result, n represents the total number of input sources, i and j represent the index variables of the sum operation used to traverse the vector sequence and the elements inside each vector, x ij represents the i-th vector x i The jth element in y represents an element in y, whose position is determined by the index j between the previous sum and the number of elements in the current vector, |y| represents the length of the vector y, that is, the total number of elements in y, and η i Represents the length x of each input vector i The total number of dim(y) represents the dimension of vector y, dim(x i ) represents the vector x i Dimension.

[0095] Furthermore, S103: the edge computing server uses the private key provided by all devices to decrypt the aggregation result, and then the edge computing server sends the decrypted result to the IoT device, including:

[0096] Decrypt({ct i} i∈n ,sk i ) to decrypt the aggregation result.

[0097] Among them, decryption Decrypt({ct i} i∈n ,sk i ), derived from Abdalla M, Catalano D, Fiore D, et al.Multi-input functional encryption for inner products: Function-hidingrealizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference,Santa Barbara,CA,USA,August19–23,2018,Proceedings,Part I 38. Springer International Publishing, 2018: 597-627.

[0098] Furthermore, the S103: the IoT device updates the local machine learning model parameters based on the decrypted aggregate calculation result, including:

[0099] The edge computing server sends the decrypted aggregated update to each IoT device, and the IoT device combines the received global update with the local model to update the local model parameters.

[0100] Furthermore, in S103: during the parameter updating process, based on the gradient constraint value, limiting the amplitude of the local machine learning model parameter update includes:

[0101] The gradient vector is scaled by the gradient constraint value C to ensure that its norm does not exceed C. The norm of the gradient is limited to a set range to ensure that the step size is not too large when the parameter is updated due to the size of the gradient value.

[0102] Furthermore, the method further includes: repeating S101-S103 until the model reaches expected performance or satisfies a condition.

[0103] Aiming at the problems of insufficient security and high communication and computing overhead in the existing privacy computing of edge data in the Internet of Things, the present invention discloses a secure aggregation method for edge computing of the Internet of Things based on function encryption and differential privacy, which relates to the field of edge data privacy computing and includes the following steps: initializing the system, generating a unique public key and private key for each Internet of Things device through a trusted authorization agency, and the device encrypting the model parameters using its public key to generate ciphertext; adding an appropriate amount of noise to the device according to its own privacy requirements to achieve local differential privacy, using an adaptive clipping scheme to dynamically adjust the gradient constraint value of the model update, and finally uploading the encrypted and noise-added model parameters to the server; the server obtains the ciphertext of the aggregation result using the function encryption technology, and the server decrypts the aggregation result using the private key provided by the device to obtain the final aggregation calculation result. The present invention achieves the improvement of edge data privacy security while ensuring the performance requirements of the Internet of Things devices.

[0104] Steps S101 and S103 depend on the following algorithm functions: initialization Setup(λ), public key distribution PubGen(mpk,msk,i), function key generation KenGen(msk,y), encryption Encrypt(pk i ,i,x1) and decryptDecrypt({ct i} i∈n ,sk i ).

[0105] Among them, Setup(λ): is run by a trusted authority, generates and outputs public parameters pp, and generates the master public key mpk and the master private key msk;

[0106] PubGen(mpk,msk,i): Register with a trusted authority. The algorithm uses the ID of the IoT device to generate its own mpk i and msk i , returns the public key pk i =(mpk i ,msk i );

[0107] KenGen(msk,y): The algorithm first splits y into (y1||y2||...||y n ), where |y i |=η i , then generate and output the device's public key pk i The corresponding key sk i ;

[0108] Encrypt(pk i ,i,x1): The algorithm uses the public key pk i , encrypt a plaintext value x1 and output the ciphertext ct i ;

[0109] Decrypt({ct i} i∈n ,sk i ): Calculates the ciphertext result and returns the inner product result of the discrete logarithm.

[0110] The public key of each device is independently generated by a trusted authority, and the mobile edge computing server can obtain the public parameters of all devices. Therefore, in step S103, the departure or joining of any device will not affect the participation of other devices in aggregate computing, thereby realizing the dynamic participation of IoT devices.

[0111] Initialize the system to generate public parameters, and provide the necessary master public key and master private key parameters for subsequent operations. Use multi-input function encryption to achieve ciphertext aggregation for mobile edge computing. When setting, the number of clients and functions is fixed. Keys are distributed to each IoT device through a trusted authorization agency, and different public and private keys are generated for each device. The device uses its own public key to encrypt its model parameters and generate ciphertext.

[0112] Before uploading the local model parameters, the differential privacy aggregation theorem is used to add an appropriate amount of noise to the IoT device according to its own privacy needs to meet the differential privacy standard. At the same time, an adaptive pruning scheme is used to dynamically adjust the model update gradient constraint value C to keep it within a reasonable range to reduce the impact of individual users on the global model. Finally, the encrypted local model parameters are uploaded to the mobile edge computing server.

[0113] Function encryption technology is used to securely aggregate the encrypted model parameters received by the mobile edge computing server to obtain the ciphertext of the aggregation result. The mobile edge computing server uses the private key provided by all devices to decrypt the aggregation result to obtain the final required aggregation calculation result.

[0114] The function encryption aggregation computing solution adds the device public key distribution steps: device public key distribution PubGen (mpk, msk, i) and function key generation KenGen (msk, y) to allow each participating IoT device to use its own public key. At the same time, the public keys are independently generated by a trusted authority. The mobile edge computing server can obtain the public parameters of all devices, thus reducing the possibility of privacy leakage. i,i,x1) uploads the encrypted model parameters to the mobile edge computing server, and uses the inner product function f((x1,x2,...,x n ),y), to achieve encrypted aggregation and obtain the ciphertext of the aggregation result. The mobile edge computing server uses Decrypt({ct i} i∈n ,sk i ) Decrypt the aggregation result using the private key provided by the device to obtain the final aggregation calculation result.

[0115] This adaptive differential privacy scheme sets local differential privacy and uses the aggregation theorem of differential privacy to independently add noise before uploading the local model of each IoT device, thus avoiding the risks of traditional centralized differential privacy. At the same time, the adaptive pruning scheme is used to achieve the required adaptive noise addition, so that the gradient norm constraint C is within a reasonable range, effectively limiting the sensitivity of encrypted aggregation to adding or deleting any user data, and improving the practicality of the model.

[0116] Embodiment 2

[0117] This embodiment provides an IoT edge computing security aggregation system based on differential privacy, including: a trusted authorization agency client, several IoT devices and an edge computing server;

[0118] The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0119] Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters and generate ciphertext; each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy; according to the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update; finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server;

[0120] The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain the aggregated result; the edge computing server decrypts the aggregated result using the private key provided by all devices, and then sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the update amplitude of the local machine learning model parameters is limited based on the gradient constraint value, and then returns to the previous step.

[0121] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A secure aggregation method for IoT edge computing based on differential privacy, characterized by: include: The trusted authority client generates and distributes a unique device public key and device private key for each IoT device; Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters and generate ciphertext; each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy; according to the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update; finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server; The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain the aggregated results; The edge computing server uses the private key provided by all IoT devices to decrypt the aggregated results, and then sends the decrypted results to the IoT devices; the IoT devices update the local machine learning model parameters based on the decrypted aggregated computing results; During the parameter update process, based on the gradient constraint value, the update amplitude of the local machine learning model parameters is limited and the process returns to the previous step.

2. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1 is characterized in that: The trusted authority client generates and distributes a unique device public key and device private key for each IoT device, including: The trusted authority client generates public parameters PP, master public key mpk and master private key msk; The trusted authority client generates a unique ID and device public key mpk for each IoT device i And device private key msk i ; The unique ID that the trusted authority client will generate for each IoT device, as well as the device public key mpk i And device private key msk i , assigned to the corresponding IoT devices.

3. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 2 is characterized in that: The trust authority client generates the public parameters PP, the master public key mpk and the master private key msk based on the Setup(λ) function; The trusted authority client generates a unique ID and device public key mpk for each IoT device i And device private key msk i , which is implemented based on the function key generation PubGen(mpk,msk,i); Among them, PubGen (mpk, msk, i) function includes: (1) Input parameters: mpk: master public key, msk: master private key, i: index used to distinguish different key pairs; (2) Starting from i=0, until all n key pairs are traversed; (3) Call the Setup(λ) function to generate a new pair of keys (mpk i ,msk i ); (4) The key pair (mpk i ,msk i ) is stored as the public key pk i =(mpk i ,msk i ); (5) The public key pk i Distribute to the corresponding IoT device, i=i+1; return to (2).

4. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1, characterized in that: Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters and generate ciphertext, including: Each IoT device uses its own device private key and public parameters to generate a function key; Based on the function key, the local machine learning model parameters are encrypted to generate ciphertext.

5. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 4 is characterized in that: Each IoT device uses its own device private key and public parameters to generate a function key, which is implemented based on the KenGen(msk,y) function; Based on the function key, the local machine learning model parameters are encrypted to generate ciphertext, including: Using encryption function Encrypt(pk i ,i,x1), based on the device function key, the local machine learning model parameters are encrypted to generate ciphertext.

6. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1, characterized in that: Each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy, including: Determine noise parameters: set the mean and standard deviation σ of Gaussian noise; Based on the mean and standard deviation σ, a random number generator is used to generate Gaussian distributed random numbers to obtain a Gaussian noise, which is expressed as: noise = N (0, σ 2 ), where N is a Gaussian distribution, 0 is the mean, σ 2 is the variance; The generated noise is added to the local update parameters of the machine learning model. The process of adding noise is expressed as: Δω'=Δω+noise, where Δω' is the update parameter after adding noise, Δω is the update parameter of the local model, and noise is Gaussian noise.

7. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 6 is characterized in that: The process of adding noise includes: N(0,S 2 σ 2 ) is divided into Gaussian noise is added to each IoT device Gaussian noise, where n is the number of IoT devices involved in the calculation, and the final return value 8. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1, characterized in that: According to the current training status of the machine learning model, an adaptive clipping scheme is used to dynamically adjust the gradient constraint value of the machine learning model update, including: (31) Before training begins, initialize the global model and set an initial gradient constraint value C; (32) The IoT device updates the local model parameters and calculates the gradient g of the model update; (33) Calculate the L2 norm of the gradient to determine the size of the updated gradient g; (34) Use adaptive clipping rules to adjust the gradient constraint value C: Among them, C t+1 represents the clipping value at time step t+1, which is used to limit the gradient size to achieve adaptive noise addition, C t represents the clipping value at time step t, represents the empirical fraction of samples with the maximum value C, η C is the learning rate, γ is a hyperparameter and γ∈[0,1]; (35) According to the adaptively adjusted C t+1 Value, clip the gradient, if the norm of the gradient is greater than C, the gradient is scaled: Among them, g represents the original gradient calculated according to the current model parameters and data in each iteration, g represents the clipped gradient, ||g||2 represents the L2 norm of the current gradient g, and C represents the gradient constraint value; (36) The clipped gradients are uploaded to the edge computing server, and the edge computing server aggregates the uploaded gradients and updates the global model; (37) Repeat steps (32) to (36) for iterative training.

9. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1, characterized in that: The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain the aggregated results, including: In the aggregate calculation scheme of function encryption, multiple encrypted data items are aggregated and calculated through the inner product function to obtain the aggregate result ct i ; The inner product function f((x1,x2,...,x n ),y) are as follows: where x1,x2,...,x n Represents the input vector sequence, where each x i is a vector, y represents another input vector, f((x1,x2,...,x n ),y) represents the inner product function itself, which receives parameters x1,x2,...,x n and y to return the result, n represents the total number of input sources, i and j represent the index variables of the sum operation used to traverse the vector sequence and the elements inside each vector, x ij represents the i-th vector x i The jth element in y represents an element in y, whose position is determined by the index j between the previous sum and the number of elements in the current vector, |y| represents the length of vector y, |y| represents the total number of elements in y, and η i Represents the length x of each input vector i The total number of dim(y) represents the dimension of vector y, dim(x i ) represents the vector x i Dimension.

10. The IoT edge computing security aggregation system based on differential privacy is characterized by: include: A trusted authority client, several IoT devices, and an edge computing server; The trusted authority client generates and distributes a unique device public key and device private key for each IoT device; Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters and generate ciphertext; each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy; according to the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update; finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server; The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain the aggregated results; The edge computing server uses the private key provided by all IoT devices to decrypt the aggregated results, and then sends the decrypted results to the IoT devices; the IoT devices update the local machine learning model parameters based on the decrypted aggregated computing results; During the parameter update process, based on the gradient constraint value, the update amplitude of the local machine learning model parameters is limited and the process returns to the previous step.

Images