IoT edge computing security aggregation method and system based on differential privacy

Abstract

The present invention discloses an Internet of Things edge computing security aggregation method and system based on differential privacy, including: a trusted authorization agency client generates and distributes a unique device public key and a device private key; each Internet of Things device uses its own device private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext; each Internet of Things device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy; the Internet of Things device uploads the machine learning model parameters after adding noise to the edge computing server; the edge computing server aggregates all the machine learning model parameters after adding noise; the edge computing server sends the decrypted results to the Internet of Things device; the Internet of Things device updates the local machine learning model parameters based on the decrypted aggregated calculation results; during the parameter update process, the amplitude of the local machine learning model parameter update is limited based on the gradient constraint value.

Description

Technical Field

[0001] The present invention relates to the field of edge data privacy protection computing technology in the Internet of Things, and in particular to an Internet of Things edge computing security aggregation method and system based on differential privacy. Background Art

[0002] With the development of IoT technology, the number of IoT devices (such as industrial robots, smart home devices, and connected vehicles) and their application data continues to increase, generating massive amounts of real-time data daily. The data processed by IoT devices contains a significant amount of sensitive private information, such as device identity, status, and location. In IoT computing architectures, directly sharing raw data with other nodes without any security protection can lead to serious privacy leaks. If this information is maliciously exchanged with others or nodes are sold, the device's private information can be inferred. This behavior can seriously compromise information security and lead to serious consequences.

[0003] In IoT communications, requester devices collect sensory data from other devices and then use this shared data to perform local computations and complete tasks. Sharing raw sensory data inevitably leads to device privacy leaks. Federated learning, a distributed machine learning technology, distributes collaborative training models to each participant. Without sharing raw data, IoT devices perform local training and only send a small amount of trained model parameters to a central server for aggregation. This significantly reduces communication overhead and privacy leaks.

[0004] However, during the model aggregation process, it is still possible to obtain the private information of other participating devices through attacks such as model reversal and membership inference. Currently, some schemes use secret sharing and homomorphic encryption to theoretically achieve secure aggregation of federated learning. However, considering the real environment of IoT devices, this may incur significant communication and computational overhead. Moreover, the stable membership structure required by these schemes cannot meet the rapidly changing environment requirements of some IoT devices. Summary of the Invention

[0005] In order to address the shortcomings of the existing technology, the present invention provides an IoT edge computing security aggregation method and system based on differential privacy. By adopting this method, the privacy protection of IoT edge data is achieved while ensuring the performance of IoT edge computing, which is of great significance to the sustainable development of the future IoT.

[0006] On the one hand, a secure aggregation method for IoT edge computing based on differential privacy is provided, including:

[0007] The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0008] Each IoT device uses its own private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext. Each IoT device adds noise to the ciphertext based on its own privacy requirements to achieve local differential privacy. Based on the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update. Finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server.

[0009] The edge computing server uses function encryption to aggregate all the machine learning model parameters after adding noise to obtain the aggregated result; the edge computing server uses the private key provided by all IoT devices to decrypt the aggregated result, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the amplitude of the local machine learning model parameter update is limited based on the gradient constraint value, and then returns to the previous step.

[0010] On the other hand, an IoT edge computing security aggregation system based on differential privacy is provided, including: a trusted authority client, several IoT devices and an edge computing server;

[0011] The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0012] Each IoT device uses its own private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext. Each IoT device adds noise to the ciphertext based on its own privacy requirements to achieve local differential privacy. Based on the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update. Finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server.

[0013] The edge computing server uses function encryption to aggregate all the machine learning model parameters after adding noise to obtain the aggregated result; the edge computing server uses the private key provided by all IoT devices to decrypt the aggregated result, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the amplitude of the local machine learning model parameter update is limited based on the gradient constraint value, and then returns to the previous step.

[0014] The above technical solution has the following advantages or beneficial effects:

[0015] (1) The present invention uses multi-input function encryption to achieve ciphertext aggregation in mobile edge computing. By improving the key distribution algorithm, different public keys are generated and distributed to each device, solving the problem of privacy leakage caused by public key leakage.

[0016] (2) This invention avoids the risks of traditional centralized differential privacy by setting up local differential privacy and adding noise independently in each IoT device. By using an adaptive pruning scheme to achieve the required adaptive noise addition, the gradient norm constraint C is kept within a reasonable range, effectively limiting the sensitivity of the aggregation to the addition or removal of any user data, and improving the practicality of the model;

[0017] (3) The present invention utilizes the fact that the public keys of all devices are independently generated by a trusted authority, and the mobile edge computing server can obtain the public parameters of all devices. By setting an appropriate inner product function for encrypted aggregate calculation, the leaving or joining of any device will not affect the participation of other devices in the aggregate calculation, thereby realizing the dynamic participation of IoT devices and meeting the dynamic participation requirements of IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0019] Figure 1 Schematic diagram of the process of the present invention;

[0020] Figure 2 This is a principle framework diagram of the method of the present invention. DETAILED DESCRIPTION

[0021] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0022] Example 1

[0023] This embodiment provides a secure aggregation method for IoT edge computing based on differential privacy;

[0024] like Figure 1 and Figure 2 As shown in the figure, the IoT edge computing security aggregation method based on differential privacy includes:

[0025] S101: The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0026] S102: Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext. Each IoT device adds noise to the ciphertext based on its own privacy requirements to achieve local differential privacy. Based on the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update. Finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server.

[0027] S103: The edge computing server aggregates all the machine learning model parameters after adding noise using a function encryption method to obtain an aggregated result; the edge computing server decrypts the aggregated result using the private key provided by all IoT devices, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the update amplitude of the local machine learning model parameters is limited based on the gradient constraint value, and then returns to S102.

[0028] Furthermore, the step S101: the trusted authority client generates and distributes a unique device public key and device private key for each IoT device, specifically including:

[0029] S101-1: The trusted authority client generates public parameters PP, master public key mpk and master private key msk;

[0030] S101-2: The trusted authority client generates a unique ID and device public key mpk for each IoT device i and device private key msk i ;

[0031] S101-3: The trusted authority client will generate a unique ID for each IoT device, as well as the device public key mpk i and device private key msk i , assigned to the corresponding IoT devices.

[0032] Furthermore, the S101-1: the trusted authority client generates the public parameter PP, the master public key mpk and the master private key msk, which is implemented based on the Setup(λ) function.

[0033] Among them, the Setup (λ) function comes from Abdalla M, Catalano D, Fiore D, et al. Multi-input functional encryption for inner products: Function-hiding realizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part I 38. Springer International Publishing, 2018: 597-627.

[0034] Furthermore, in S101-2, the trusted authority client generates a unique ID and a device public key mpk for each IoT device. i and device private key msk i , which is implemented based on the function key generation PubGen(mpk,msk,i) function.

[0035] Among them, the PubGen(mpk,msk,i) function includes:

[0036] (1) Input parameters mpk master public key, msk master private key, i is used to distinguish the index of different key pairs;

[0037] (2) Starting from i=0, traverse all n key pairs;

[0038] (3) Call the Setup(λ) function to generate a new pair of keys (mpk i ,msk i );

[0039] (4) The key pair (mpk i ,msk i ) is stored as the public key pk i =(mpk i ,msk i );

[0040] (5) The public key pk i Distribute to the corresponding IoT device, i=i+1; return to (2).

[0041] It should be understood that by adding the device public key distribution step PubGen(mpk,msk,i), each device generates its own ID and corresponding device public and private keys. This eliminates the need for the mobile edge computing server to combine all participating users' partial decryption keys to generate a decryption key. This solves the security issue caused by the leakage of the system public key.

[0042] Furthermore, in S102, each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext, including:

[0043] S102-11: Each IoT device generates a function key using its own device private key and public parameters;

[0044] S102-12: Encrypt the local machine learning model parameters based on the function key to generate ciphertext.

[0045] Furthermore, the S102-11: each IoT device uses its own device private key and public parameters to generate a function key, which is implemented based on the KenGen(msk,y) function.

[0046] Among them, the KenGen(msk,y) function comes from Abdalla M, Catalano D, Fiore D, etal.Multi-input functional encryption for inner products: Function-hidingrealizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference,Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part I 38. Springer International Publishing, 2018: 597-627.

[0047] Furthermore, the S102-12: encrypting the local machine learning model parameters based on the function key to generate ciphertext includes:

[0048] Using encryption function Encrypt(pk i ,i,x1), based on the device function key, the local machine learning model parameters are encrypted to generate ciphertext.

[0049] Among them, Encrypt(pk i ,i,x1), derived from Abdalla M, Catalano D, Fiore D, et al.Multi-input functional encryption for inner products: Function-hiding realizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference,Santa Barbara,CA,USA,August19–23,2018,Proceedings,Part I 38. Springer International Publishing, 2018: 597-627.

[0050] Furthermore, in S102, each IoT device adds noise to the ciphertext according to its own privacy requirements to achieve local differential privacy, including:

[0051] S102-21: Determine noise parameters: set the mean (usually 0) and standard deviation σ of Gaussian noise;

[0052] S102-22: Based on the mean and standard deviation σ, a random number generator is used to generate Gaussian distributed random numbers to obtain Gaussian noise. The formula is: noise = N(0,σ 2 ), where N is a Gaussian distribution, 0 is the mean, σ 2 is the variance;

[0053] S102-23: Add the generated noise to the local update parameters of the machine learning model. The process of adding noise is expressed as: Δω'=Δω+noise, where Δω' is the update parameter after adding noise, Δω is the update parameter of the local model, and noise is Gaussian noise.

[0054] Furthermore, the process of adding noise includes:

[0055] N(0,S 2 σ 2 ) is divided into Gaussian noise is added to each IoT device Gaussian noise, where n is the number of IoT devices involved in the calculation, and the final return value

[0056] It should be understood that in the Gaussian mechanism blinding, the Gaussian distribution formula N(0,S 2 σ 2 ) to determine Gaussian noise, where S 2 represents the variance of the distribution, and σ represents the sensitivity of the query, that is, the contribution of a single record to the variance.

[0057] Noise parameter S:

[0058]

[0059] Where ε is the primary privacy budget and δ is the supplementary privacy budget, i.e., the acceptable probability of privacy leakage.

[0060] Sensitivity to queries σ: Determined by the maximum influence of a single record, i.e., the maximum absolute value of the record. In differential privacy, queries usually refer to computational or analytical operations performed on data.

[0061] It should be understood that Gaussian blinding is a technique used in differential privacy to protect data privacy. Privacy protection is achieved by adding Gaussian noise to the data, thereby allowing analysis and statistics of the data set without leaking individual data.

[0062] In the aggregation theorem of differential privacy, if every local process Q k Satisfy (ε k ,δ k )-DP and Then the global process Q=Q1,Q2,...,Q n satisfy Therefore, step S102 adds noise before the local model is updated and uploaded. k represents the primary privacy budget of differential privacy in the kth operation, which is used to quantify the level of privacy protection, δ k represents the supplementary privacy budget of differential privacy in the kth operation, which is used to deal with low-probability events that cannot be completely avoided under ε protection, (ε k ,δ k )-DP means that the privacy protection level provided by the algorithm is a combination of ε-DP and δ-DP. Represents all operations ε k The cumulative privacy loss does not exceed the total privacy budget ε. ε represents the primary privacy budget of differential privacy, which is used to quantify the level of privacy protection. δ represents the supplementary privacy budget of differential privacy, which is used to handle low-probability events that cannot be completely avoided under the protection of ε. (ε,δ)-DP represents the privacy protection combination provided by the global process. represents the sum of the main privacy budget, represents the comprehensive supplementary privacy budget

[0063] Furthermore, the step S102: dynamically adjusting the gradient constraint value of the machine learning model update using an adaptive clipping scheme according to the current training status of the machine learning model, includes:

[0064] S102-31: Before training begins, initialize the global model and set an initial gradient constraint value C;

[0065] S102-32: The IoT device updates the local model parameters and calculates the gradient g of the model update;

[0066] S102-33: Calculate the L2 norm of the gradient to determine the size of the updated gradient g;

[0067] S102-34: Use adaptive clipping rules to adjust the gradient constraint value C:

[0068]

[0069] Among them, C t+1 Represents the clipping value at time step t+1, which is used to limit the gradient size to achieve adaptive noise addition, C t represents the clipping value at time step t, represents the empirical fraction of samples with the maximum value C, η C is the learning rate, γ is a hyperparameter and γ∈[0,1].

[0070] S102-35: According to the adaptively adjusted C t+1 Value, clip the gradient, if the norm of the gradient is greater than C, the gradient is scaled:

[0071]

[0072] Where g represents the original gradient calculated based on the current model parameters and data in each iteration, g′ represents the clipped gradient, ||g||2 represents the L2 norm of the current gradient g, and C represents the gradient constraint value;

[0073] S102-36: Upload the clipped gradients to the edge computing server, which aggregates the uploaded gradients and updates the global model.

[0074] S102-37: Repeat steps S102-32 to S102-36 to perform iterative training.

[0075] Furthermore, the S102-32: IoT device updates local model parameters and calculates the gradient g of the model update, including:

[0076] The gradient g is obtained by taking the partial derivative of each parameter of the loss function L(w) and is expressed as follows:

[0077]

[0078] in, Indicates the partial derivative of L(w), Represents the loss function L relative to the weight W i The partial derivative of , where n is the number of model parameters.

[0079] The loss function is a function that measures the difference between the model's predicted value and the actual value. The loss function is: Cross-Entropy Loss:

[0080]

[0081] Among them, L represents the loss value, y is the true label vector, is the probability distribution vector predicted by the model, i represents the i-th element, y i represents the i-th element in the label vector (indicating whether the sample belongs to the i-th category), Represents the i-th element of the output predicted by the model (indicates the probability that the model predicts that the sample belongs to the i-th category).

[0082] Furthermore, the S102-33: calculating the L2 norm of the gradient to determine the size of the updated gradient g includes:

[0083] Calculate each partial derivative in the gradient, square each partial derivative in the gradient, sum all the squared partial derivatives, and take the square root of the sum to get the L2 norm of the gradient:

[0084]

[0085] Among them, ||g||2, represents the L2 norm of the gradient g, Represents the loss function L relative to the weight W i The partial derivative of .

[0086] Setting the gradient norm constraint C too low as a hyperparameter discards information contained in the gradient magnitude, leading to high bias. Setting it too high can undermine the usefulness of the model and add more noise. Therefore, an adaptive clipping scheme is used to achieve adaptive noise addition.

[0087] Under the adaptive clipping scheme, the updated quartile values ​​of the normal distribution are used. Instead of a fixed constant value, it reduces the impact of individual users on the global model and improves the practicality of the model.

[0088] As you can understand, an adaptive differential privacy method has been designed to protect the security of local model data while adaptively adjusting the gradient clipping threshold to reduce the impact on model accuracy. Finally, the encrypted and noisy local model parameters are uploaded to the mobile edge computing server, completing the upload of local model parameters. Dynamic adjustments are made based on the current model training status to reduce the impact of differential privacy noise on model performance.

[0089] The above solution reduces the impact of individual users on the global model. Adaptive pruning is used to dynamically adjust the gradient constraint values ​​for model updates, thereby reducing the impact of differential privacy on model accuracy.

[0090] Furthermore, in S103, the edge computing server aggregates all the machine learning model parameters after adding noise using a function encryption method to obtain an aggregated result, including:

[0091] In the aggregation calculation scheme of function encryption, multiple encrypted data items are aggregated and calculated through the inner product function to obtain the aggregated result ct i ;

[0092] Inner product function f((x1,x2,...,x n ),y) are as follows:

[0093]

[0094] Among them, x1,x2,...,x n Represents the input vector sequence, where each x i is a vector, y represents another input vector, f((x1,x2,...,x n ),y) represents the inner product function itself, which accepts parameters x1,x2,...,x n and y to return the result, n represents the total number of input sources, i and j represent the index variables of the sum operation used to traverse the vector sequence and the elements within each vector, x ij Represents the i-th vector x i The jth element in y represents an element in y, whose position is determined by the index j between the previous sum and the number of elements in the current vector, |y| represents the length of the vector y, that is, the total number of elements in y, and η i Represents the length x of each input vector i The total number of dim(y) represents the dimension of vector y, dim(x i ) represents the vector x i dimension.

[0095] Furthermore, the step S103: the edge computing server decrypts the aggregated result using the private key provided by all devices, and then sends the decrypted result to the IoT device, including:

[0096] Use decryptionDecrypt({ct i} i∈n ,sk i ) to decrypt the aggregation result.

[0097] Among them, Decrypt({ct i} i∈n ,sk i ), derived from Abdalla M, Catalano D, Fiore D, et al.Multi-input functional encryption for inner products: Function-hidingrealizations and constructions without pairings[C] / / Advances in Cryptology–CRYPTO 2018:38th Annual International Cryptology Conference,Santa Barbara,CA,USA,August19–23,2018,Proceedings,Part I 38. Springer International Publishing, 2018: 597-627.

[0098] Furthermore, the S103: IoT device updates local machine learning model parameters based on the decrypted aggregate calculation result, including:

[0099] The edge computing server sends the decrypted aggregated update to each IoT device. The IoT device combines the received global update with the local model and updates the local model parameters.

[0100] Furthermore, the S103: during the parameter update process, limiting the amplitude of the local machine learning model parameter update based on the gradient constraint value includes:

[0101] The gradient vector is scaled by the gradient constraint value C to ensure that its norm does not exceed C. The norm of the gradient is limited to the set range to ensure that the step size is not too large when the parameter is updated due to the size of the gradient value.

[0102] Furthermore, the method further includes: repeating S101-S103 until the model reaches expected performance or satisfies conditions.

[0103] In response to the problems of insufficient security and high communication and computing overhead in existing IoT edge data privacy calculations, the present invention discloses an IoT edge computing security aggregation method based on function encryption and differential privacy, which relates to the field of edge data privacy calculation and includes the following steps: initializing the system, generating a unique public key and private key for each IoT device through a trusted authorization agency, and the device using its public key to encrypt the model parameters to generate ciphertext; adding an appropriate amount of noise to the device according to its own privacy requirements to achieve local differential privacy, using an adaptive clipping scheme to dynamically adjust the gradient constraint value of the model update, and finally uploading the encrypted and noisy model parameters to the server; the server uses function encryption technology to obtain the ciphertext of the aggregation result, and the server uses the private key provided by the device to decrypt the aggregation result to obtain the final aggregation calculation result. The present invention achieves the improvement of edge data privacy security while ensuring the performance requirements of IoT devices.

[0104] Steps S101 and S103 rely on the following algorithm functions: initialization Setup(λ), public key distribution PubGen(mpk,msk,i), function key generation KenGen(msk,y), encryption Encrypt(pk i ,i,x1) and decryptDecrypt({ct i} i∈n ,sk i ).

[0105] Among them, Setup(λ): is run by a trusted authority to generate and output public parameters pp, and generate the master public key mpk and the master private key msk;

[0106] PubGen(mpk,msk,i): Register with a trusted authority. The algorithm uses the ID of the IoT device to generate its own mpk i and msk i , returns the public key pk i =(mpk i ,msk i );

[0107] KenGen(msk,y): The algorithm first splits y into (y1||y2||...||y n ), where |y i |=η i , then generate and output the device's public key pk i The corresponding key sk i ;

[0108] Encrypt(pk i ,i,x1): The algorithm uses the public key pk i , encrypt a plaintext value x1 and output the ciphertext ct i ;

[0109] Decrypt({ct i} i∈n ,sk i ):Calculates the ciphertext result and returns the inner product of discrete logarithms.

[0110] The public key of each device is independently generated by a trusted authority, and the mobile edge computing server can obtain the public parameters of all devices. Therefore, in step S103, the departure or joining of any device will not affect the participation of other devices in the aggregated computing, thereby realizing the dynamic participation of IoT devices.

[0111] Initialize the system to generate public parameters, providing the necessary master public key and master private key parameters for subsequent operations. Multi-input function encryption is used to achieve ciphertext aggregation for mobile edge computing. The number of clients and functions is fixed during setup. Keys are distributed to each IoT device through a trusted authority, generating a unique public and private key for each device. Each device uses its own public key to encrypt its model parameters and generate ciphertext.

[0112] Before uploading local model parameters, we use the differential privacy aggregation theorem to add an appropriate amount of noise to IoT devices based on their privacy needs to meet differential privacy standards. We also use an adaptive pruning scheme to dynamically adjust the model update gradient constraint value C to a reasonable range, minimizing the impact of individual users on the global model. Finally, the encrypted local model parameters are uploaded to the mobile edge computing server.

[0113] Function encryption technology is used to securely aggregate the encrypted model parameters received by the mobile edge computing server to obtain the ciphertext of the aggregation result. The mobile edge computing server uses the private key provided by all devices to decrypt the aggregation result to obtain the final required aggregation calculation result.

[0114] The function encryption aggregation computing solution adds the device public key distribution steps: device public key distribution PubGen (mpk, msk, i) and function key generation KenGen (msk, y) to allow each participating IoT device to use its own public key. At the same time, the public keys are independently generated by a trusted authority. The mobile edge computing server can obtain the public parameters of all devices, thus reducing the possibility of privacy leakage. By encrypting Encrypt (pk i,i,x1) uploads the encrypted model parameters to the mobile edge computing server, and uses the inner product function f((x1,x2,...,x n ),y), to achieve encryption aggregation to obtain the ciphertext of the aggregation result. The mobile edge computing server uses Decrypt({ct i} i∈n ,sk i ) Decrypt the aggregation result using the private key provided by the device to obtain the final aggregation calculation result.

[0115] This adaptive differential privacy scheme sets local differential privacy and leverages the aggregation theorem of differential privacy to independently add noise to each IoT device before uploading the local model update, thus avoiding the risks of traditional centralized differential privacy. Furthermore, by using an adaptive pruning scheme to achieve the required adaptive noise addition, the gradient norm constraint C is kept within a reasonable range, effectively limiting the sensitivity of the encrypted aggregation to the addition or removal of any user data, thereby improving the practicality of the model.

[0116] Example 2

[0117] This embodiment provides an IoT edge computing security aggregation system based on differential privacy, including: a trusted authority client, several IoT devices, and an edge computing server;

[0118] The trusted authority client generates and distributes a unique device public key and device private key for each IoT device;

[0119] Each IoT device uses its own private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext. Each IoT device adds noise to the ciphertext based on its own privacy requirements to achieve local differential privacy. Based on the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update. Finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server.

[0120] The edge computing server uses function encryption to aggregate all the machine learning model parameters after adding noise to obtain the aggregated result; the edge computing server uses the private key provided by all devices to decrypt the aggregated result, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the amplitude of the local machine learning model parameter update is limited based on the gradient constraint value, and then returns to the previous step.

[0121] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A secure aggregation method for IoT edge computing based on differential privacy, characterized by: include: The trusted authority client generates and distributes a unique device public key and device private key for each IoT device; Each IoT device uses its own private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext. Each IoT device adds noise to the ciphertext based on its own privacy requirements to achieve local differential privacy. Based on the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update. Finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server. Based on the current machine learning model training status, an adaptive pruning scheme is used to dynamically adjust the gradient constraint values ​​of the machine learning model update, including: (31) Before training begins, initialize the global model and set an initial gradient constraint value C; (32) The IoT device updates the local model parameters and calculates the gradient of the model update ; (33) Calculate the L2 norm of the gradient to determine the updated gradient size; (34) Use adaptive clipping rules to adjust the gradient constraint value C: ； in, Indicates that at time step The clipping value of is used to limit the gradient size to achieve adaptive noise addition, Indicates that at time step The clipping value of represents the empirical fraction of samples with the maximum value C, is the learning rate, is a hyperparameter and ; (35) According to the adaptive adjustment Value, clip the gradient, if the norm of the gradient is greater than C, the gradient is scaled: ； in, Represents the original gradient calculated based on the current model parameters and data in each iteration, represents the clipped gradient, Represents the current gradient The L2 norm of , C represents the gradient constraint value; (36) The clipped gradients are uploaded to the edge computing server, which aggregates the uploaded gradients and updates the global model; (37) Repeat steps (32) to (36) for iterative training; The edge computing server uses function encryption to aggregate all the machine learning model parameters after adding noise to obtain the aggregated result; the edge computing server uses the private key provided by all IoT devices to decrypt the aggregated result, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the amplitude of the local machine learning model parameter update is limited based on the gradient constraint value, and then returns to the previous step.

2. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1 is characterized in that: The trusted authority client generates and distributes a unique device public key and device private key for each IoT device, including: The trusted authority client generates public parameters PP and master public key and the master private key ; The trusted authority client generates a unique ID and device public key for each IoT device mpk i and device private key msk i ; A unique ID generated by the trusted authority client for each IoT device, along with the device public key mpk i and device private key msk i , assigned to the corresponding IoT devices.

3. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 2 is characterized in that The trust authority client generates public parameters PP, master public key mpk and master private key msk based on Setup( ) function to achieve; The trusted authority client generates a unique ID and device public key for each IoT device mpk i and device private key msk i , is based on the function key generation PubGen( , , ) function to achieve; Among them, PubGen( , , ) functions, including: (1) Input parameters Master public key, Master private key, An index used to distinguish different key pairs; (2) Starting from i=0, traverse all n key pairs; (3) Call Setup( ) function to generate a new pair of keys for each device ( , ); (4) The key pair ( , ) is stored as a public key =( , ); (5) The public key Distribute to the corresponding IoT device, i=i+1; return (2).

4. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1 is characterized in that: Each IoT device uses its own device private key and public parameters to encrypt its own machine learning model parameters and generate ciphertext, including: Each IoT device uses its own device private key and public parameters to generate a function key; Based on the function key, the local machine learning model parameters are encrypted to generate ciphertext.

5. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 4 is characterized in that: Each IoT device uses its own device private key and public parameters to generate a function key based on KenGen ( , ) function to achieve; Based on the function key, the local machine learning model parameters are encrypted to generate ciphertext, including: Using the encryption function Encrypt( , , ), based on the device function key, encrypt the local machine learning model parameters to generate ciphertext.

6. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1, characterized in that: Each IoT device adds noise to the ciphertext based on its own privacy needs to achieve local differential privacy, including: Determine noise parameters: set the mean and standard deviation of Gaussian noise ; Based on mean and standard deviation , use the random number generator to generate Gaussian distributed random numbers to obtain a Gaussian noise, the formula is expressed as: , where N is a Gaussian distribution and 0 is the mean. is the variance; The noise generated Added to the local update parameters of the machine learning model, the process of adding noise is expressed as: ,in, is the updated parameter after adding noise, is the update parameter of the local model, is Gaussian noise.

7. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 6 is characterized in that: The process of adding noise includes: Bundle Gaussian noise, based on the number of IoT devices to split into Gaussian noise is added to each IoT device Gaussian noise, where The final return value is the number of IoT devices involved in the calculation. .

8. The IoT edge computing security aggregation method based on differential privacy as claimed in claim 1, characterized in that: The edge computing server aggregates all the machine learning model parameters after adding noise using function encryption to obtain the aggregated results, including: In the aggregation calculation scheme of function encryption, multiple encrypted data items are aggregated and calculated through the inner product function to obtain the aggregated result. ; Inner product function as follows: ； in, Represents the input vector sequence, where each is a vector, represents another input vector, Represents the inner product function itself, which receives parameters and To return the result, Represents the total number of input sources, i and j represent the index variables of the sum operation used to traverse the vector sequence and the elements within each vector. Represents the i-th vector The jth element in represents an element in y whose position is determined by the index j between the number of elements previously added to the sum plus the current amount, represents the length of vector y, represents the total number of elements in y, Indicates the length of each input vector The total number of , represents the dimension of vector y, Represents a vector dimension.

9. IoT edge computing security aggregation system based on differential privacy, characterized by: include: Trusted authority client, several IoT devices, and edge computing servers; The trusted authority client generates and distributes a unique device public key and device private key for each IoT device; Each IoT device uses its own private key and public parameters to encrypt its own machine learning model parameters to generate ciphertext. Each IoT device adds noise to the ciphertext based on its own privacy requirements to achieve local differential privacy. Based on the current training status of the machine learning model, an adaptive pruning scheme is used to dynamically adjust the gradient constraint value of the machine learning model update. Finally, each IoT device uploads the machine learning model parameters after adding noise to the edge computing server. Based on the current machine learning model training status, an adaptive pruning scheme is used to dynamically adjust the gradient constraint values ​​of the machine learning model update, including: (31) Before training begins, initialize the global model and set an initial gradient constraint value C; (32) The IoT device updates the local model parameters and calculates the gradient of the model update ; (33) Calculate the L2 norm of the gradient to determine the updated gradient size; (34) Use adaptive clipping rules to adjust the gradient constraint value C: ； in, Indicates that at time step The clipping value of is used to limit the gradient size to achieve adaptive noise addition, Indicates that at time step The clipping value of represents the empirical fraction of samples with the maximum value C, is the learning rate, is a hyperparameter and ; (35) According to the adaptive adjustment Value, clip the gradient, if the norm of the gradient is greater than C, the gradient is scaled: ； in, Represents the original gradient calculated based on the current model parameters and data in each iteration, represents the clipped gradient, Represents the current gradient The L2 norm of , C represents the gradient constraint value; (36) The clipped gradients are uploaded to the edge computing server, which aggregates the uploaded gradients and updates the global model; (37) Repeat steps (32) to (36) for iterative training; The edge computing server uses function encryption to aggregate all the machine learning model parameters after adding noise to obtain the aggregated result; the edge computing server uses the private key provided by all IoT devices to decrypt the aggregated result, and then the edge computing server sends the decrypted result to the IoT device; the IoT device updates the local machine learning model parameters based on the decrypted aggregated calculation result; during the parameter update process, the amplitude of the local machine learning model parameter update is limited based on the gradient constraint value, and then returns to the previous step.

Images