A privacy-preserving federated learning secure aggregation method for medical data

Abstract

The present invention belongs to the technical field of data privacy protection, and discloses a privacy-preserving federated learning security aggregation method for medical data. First, before uploading their own medical data, medical institutions will use randomly generated secrets to perturb model parameters, and then use a secret sharing mechanism to share secrets to solve the disconnection problem caused by the heterogeneity of medical institutions in federated learning. Secondly, homomorphic encryption technology is used to encrypt the secret fragments received by medical institutions from other medical institutions to ensure data security. Finally, a decryption server is used to generate homomorphic encryption-related parameters and decrypt the encrypted secret fragments uploaded by each medical institution to ensure that the aggregation server cannot decrypt the model parameters, solving the problem that malicious servers may snoop on private data. The method of the present invention realizes secure aggregation in a multi-key environment for medical data and effectively resists user privacy leakage and malicious server problems in the federated learning aggregation process.

Description

Technical Field

[0001] The present invention belongs to the technical field of data privacy protection, and in particular relates to a privacy-preserving federated learning security aggregation method for medical data. Background Art

[0002] The current massive growth of medical data allows machine learning to learn the characteristics of a disease through a large amount of medical imaging data and perform intelligent identification. The results of machine learning intelligent identification can be used as a basis to assist doctors in diagnosing the diseases that patients may suffer from, thereby improving the efficiency of diagnosis and treatment. However, the data of a single medical institution itself cannot meet the training requirements of machine learning. At the same time, because medical data contains a large amount of patient privacy information, data interaction among various medical institutions becomes very difficult. At present, most medical institutions still store medical data in a centralized manner, which not only causes data isolation between different medical institutions, but also this centralized storage method is prone to single point failure problems.

[0003] Federated learning solves the data privacy problem to a certain extent by training models on multiple devices in a distributed network. However, federated learning still faces many challenges in practical applications, such as user disconnection, privacy leakage, and communication overhead. Federated learning protects the privacy of user data to a certain extent, but it also brings new privacy issues. For example, the model gradient that users need to upload in federated learning may contain some local data information. If it is not encrypted, it may be used by attackers to obtain the user's private information. In the centralized federated learning structure, the central aggregation server can access the uploaded data of all users, which may also lead to privacy leakage. Attackers steal the parameters by eavesdropping on the communication on the central aggregation server, resulting in privacy leakage. In addition, due to the influence of client heterogeneity in federated learning, there is a possibility that the client will be disconnected at any time, which will cause the aggregation process to fail to complete normally.

[0004] In order to solve the problem of privacy leakage in federated learning, some researchers have proposed a federated learning solution that replaces the central server with blockchain. In addition, researchers have also proposed a series of privacy protection technologies, such as homomorphic encryption, differential privacy, and secure multi-party computing. Although the above solutions improve privacy protection, they do not fully consider the computational efficiency and the complexity of actual deployment. For example, the use of blockchain to implement decentralized federated learning does not take into account the performance bottlenecks of the blockchain itself, such as transaction speed and scalability limitations, which may affect the real-time update and large-scale deployment of federated learning models. When using privacy protection technologies, the computational overhead and communication overhead brought by these technologies have not been taken into account, and their impact on model accuracy. For example, differential privacy requires the addition of noise to protect data, which may increase the complexity and running time of model training and affect the accuracy of the final training. Homomorphic encryption requires a lot of computing resources during encryption and decryption, which may lead to reduced training efficiency.

[0005] In order to solve the problem that the client may be disconnected at any time, researchers have proposed a variety of solutions, such as asynchronous federated learning, multi-task learning, model averaging, etc. In addition, in order to reduce communication overhead, researchers have added some communication optimization techniques, such as sparse updates and parameter quantization. Although these technologies reduce communication costs, they do not fully consider the accuracy loss after model compression, especially in terms of the balance between maintaining high accuracy and reducing model complexity. Therefore, how to reduce communication overhead and improve training efficiency while ensuring user privacy and model accuracy is still a problem that needs to be solved in federated learning.

[0006] None of the above solutions can maintain high security and low computing and communication overhead in a multi-key environment, and meet the needs of users to exit at any time. In addition, some solutions will affect the accuracy of the results. Summary of the invention

[0007] The purpose of the present invention is to propose a privacy-preserving federated learning secure aggregation method for medical data, which can ensure security in a multi-key environment while maintaining low communication and computing overhead; at the same time, it can still complete decryption when the medical institution client may exit at any time, and the whole process will not affect the accuracy of the result, effectively resisting the privacy leakage of medical institution data and malicious central server problems in the federated learning aggregation process.

[0008] In order to achieve the above object, the present invention adopts the following technical scheme:

[0009] A privacy-preserving federated learning secure aggregation method for medical data, which is applicable to the environment where multiple parties including medical institution clients, aggregation servers and decryption servers participate in the federated learning system;

[0010] The medical institution client is responsible for local training and uploading its model parameters; the aggregation server is responsible for collecting information and aggregating it in a ciphertext environment; the decryption server can only obtain the aggregated secret shared shard ciphertext for decryption;

[0011] The privacy-preserving federated learning secure aggregation method for medical data includes the following steps:

[0012] Step 1. The aggregation server generates and initializes the global model, and the decryption server uses the BCP encryption algorithm to generate public parameters and broadcasts them to each medical institution client in the federated learning system;

[0013] Step 2. Each client in the federated learning system randomly generates its own encryption key using the BCP homomorphic encryption algorithm based on the received public parameters, and each client randomly generates a secret for secret sharing;

[0014] Step 3. Each client performs local training and masks the model parameters to be uploaded using the secret mask generated by Shamir secret sharing. Each client broadcasts the secret shard of its own secret sharing to other clients in the federated learning system.

[0015] Each client uploads the encrypted model parameters and the secret shared shards sent by other clients encrypted with its own key to the aggregation server;

[0016] Step 4. Considering that the client may be offline, after receiving the data uploaded by some of the clients, the aggregation server aggregates the encrypted model parameters, aggregates the encrypted secret sharing shards of each client, and sends the aggregated secret shards to the decryption server;

[0017] Step 5. The decryption server decrypts the encrypted secret sharing shards, restores the secret sum generated by each client through secret sharing, and finally returns the restored secret sum to the aggregation server;

[0018] Step 6. The aggregation server subtracts the aggregate model parameter ciphertext from the secret sum sent by the decryption server to obtain the plaintext of the aggregation result, and then broadcasts the plaintext of the aggregation result to all clients in the federated learning system for the next round of training;

[0019] Step 7. Repeat steps 2 to 6 until the preset training rounds or accuracy requirement is reached.

[0020] The present invention has the following advantages:

[0021] As described above, the present invention relates to a privacy-preserving federated learning security aggregation method for medical data, which uses BCP homomorphic encryption and Shamir secret sharing to protect the privacy of medical institution data and the problem that medical institutions in the system may be offline at any time. Among them, in view of the problem that malicious servers may snoop on medical privacy, the present invention separates the aggregation process and the decryption process, so that the aggregation server cannot decrypt user data and can only perform aggregation operations on user data on ciphertext. In view of the problem that medical institution clients in the system are offline, the present invention adopts the Shamir secret sharing scheme. As long as there are more than the number of medical institutions with a secret sharing threshold value uploading data to the aggregation server for aggregation, the decryption server can restore the secret and obtain the aggregated plaintext. The method of the present invention improves the BCP homomorphic encryption algorithm, allowing all medical institution clients to generate their own keys in the number domain generated by the same public parameters, so that the decryption server can be guaranteed to decrypt with the same master key, but each medical institution client cannot decrypt other people's ciphertexts with its own private key, so that security can be guaranteed in a multi-key environment. In addition, because each round of iteration does not upload more parameters in addition to uploading model parameters and does not increase the number of additional communications between the server and the medical institution client, the method of the present invention can also maintain low communication and computing overhead. In addition, since the method of the present invention uses the Shamir secret sharing scheme, as long as the number of medical institution clients that upload data meets the preset minimum threshold for recovering the secret, the secret used as a mask by each medical institution client can still be restored and the secret can be removed after the aggregation is completed. Therefore, the method of the present invention can also complete decryption even if the medical institution client may exit at any time, and the entire process will not affect the accuracy of the result. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of a privacy-preserving federated learning secure aggregation method for medical data in an embodiment of the present invention;

[0023] Figure 2 It is a structural block diagram of a privacy-preserving federated learning secure aggregation method for medical data in an embodiment of the present invention;

[0024] Figure 3 This is a timing diagram of the privacy-preserving federated learning secure aggregation method for medical data in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0026] like Figure 1As shown, in the environment of federated learning with multiple participants, the single-key decryption limitation and client disconnection in the traditional homomorphic encryption scheme (that is, the traditional homomorphic encryption scheme cannot realize multi-key encryption, which limits its application in the multi-participant federated learning scenario, and the client disconnection problem affects the continuity and efficiency of the federated learning model training) and other problems, this embodiment describes a privacy-protected federated learning security aggregation method for medical data, which introduces a federated learning security aggregation method based on BCP homomorphic encryption and Shamir secret sharing. The plaintext is encrypted based on BCP encryption technology to realize multi-key encryption and single-key decryption, and the homomorphic nature of the BCP algorithm is used to directly perform aggregation operations on the ciphertext. The secret sharing method is used to solve the disconnection problem that may occur to users during the training process. A dual-server architecture is adopted to separate the decryption and aggregation processes to prevent malicious servers from snooping on user privacy. The present invention realizes secure aggregation in a multi-key environment, and the plaintext can still be decrypted even if a user is offline, and the whole process will not affect the accuracy of the result.

[0027] Based on the above invention concept, the present invention first builds a federated learning system including a medical institution client, an aggregation server and a decryption server, and its structural block diagram is as follows: Figure 2 shown.

[0028] There are multiple medical institution clients, that is, one medical institution client is deployed in each medical institution. Each medical institution client is responsible for local training, generating secrets and encrypting model parameters, and uploading the encrypted model parameters to the aggregation server. The aggregation server is responsible for aggregating the encrypted model parameters uploaded by the client and passing the encrypted results to the decryption server. The decryption server is a trusted third party and can only obtain the aggregated secret sharing shard ciphertext for decryption. The decryption server is responsible for decrypting the aggregated encrypted secret sent by the aggregation server and passing the decrypted secret to the aggregation server, so that the aggregation server can obtain the aggregated model parameter plaintext and send the aggregated model parameter plaintext to the medical institution client for the next round of training.

[0029] The method of the present invention is mainly divided into three stages, namely, an initialization stage, a local training stage and an aggregation stage.

[0030] Among them, the initialization phase needs to generate the initial parameters of the algorithm; in the local training phase, the client needs to train the model parameters in the local data set and encrypt them; in the aggregation phase, the aggregation server needs to cooperate with the decryption server to obtain the aggregated plaintext.

[0031] The following is combined with Figure 1 The privacy-preserving federated learning secure aggregation method for medical data is described in detail. Figure 1As shown in FIG. 1 , the privacy-preserving federated learning secure aggregation method for medical data includes the following steps:

[0032] Step 1. The aggregation server generates and initializes the global model, and the decryption server uses the BCP encryption algorithm to generate public parameters and broadcasts them to each medical institution client in the federated learning system.

[0033] Define the decryption server as S1, S1 distributes public parameters To each client.

[0034] Where N is a safe prime number, that is, N can only be decomposed into the product of two prime numbers. , ; and are two large prime numbers generated by S1, , , and is also a prime number, Represents the modulo operation.

[0035] Random Selection , Indicates less than And with The set of relatively prime integers.

[0036] The decryption server only generates the public parameters used for BCP encryption. The encryption is completed on the client. After obtaining the public parameters, each client will generate its own private key based on these parameters, and then use its own private key to encrypt the secret shared shard.

[0037] Before uploading their own medical data, medical institutions will use randomly generated secrets to perturb the model parameters, and then use a secret sharing mechanism to share the secrets, which is helpful in solving the disconnection problem caused by the heterogeneity of medical institutions in federated learning.

[0038] Step 2. Each client in the federated learning system randomly generates its own encryption key using the BCP homomorphic encryption algorithm based on the received public parameters, and each client randomly generates a secret for secret sharing.

[0039] During each training, the client generates its own different private key pair based on the fixed public parameters sent for the first time.

[0040] Assume that there are a total of m medical institution clients in the federated learning system.

[0041] Define the i-th client as C i ,i=1,2,…,m,client C i According to the received public parameters , randomly generates its own encryption key , and client C i Randomly generate a The secret used for secret sharing.

[0042] in , Indicates less than And with The set of mutually prime integers, .

[0043] Step 3. Each client performs local training and encrypts the model parameters to be uploaded using Shamir secret sharing. Each client broadcasts the secret shard of its own secret sharing to other clients in the federated learning system. Each client uploads the encrypted model parameters and the secret sharing shards sent by other clients encrypted with its own key to the aggregation server.

[0044] Step 3.1. Each client performs local training, and the i-th client obtains the local model parameters , the local model parameters Secret shared with secret Mask and get the encrypted training result, i.e. ciphertext .

[0045] Ciphertext The calculation formula is as follows: .

[0046] Step 3.2. The i-th client uses Shamir secret sharing to form a secret shard and broadcast it to other clients in the federated learning system. Define the secret sharing shard distributed by the i-th client to the j-th client as .

[0047] Secret sharing expression and the secret sharing shard that the i-th client assigns to the j-th client The expression is calculated as follows:

[0048] ;

[0049] .

[0050] in, represents the polynomial constructed by client i, are random coefficients, Indicates the client number. is the minimum threshold required to recover the secret, Represents the unknown number associated with the client id, e=1,2,…, .

[0051] The jth client will Encrypt with its own key to obtain the encrypted result, that is, the encrypted secret sharing shard .

[0052] Encryption results , ciphertext The calculation formula is as follows:

[0053] ;

[0054] ;

[0055] .

[0056] in, For Clients According to the received public parameters Randomly generates its own encryption key.

[0057] Step 3.3. The jth client sends the ciphertext and share the shard with the encrypted secret Upload to the aggregation server.

[0058] Step 4. Considering that the client may be offline, after receiving the data uploaded by some of the clients, the aggregation server aggregates the encrypted model parameters, aggregates the encrypted secret sharing shards of each client, and sends the aggregated secret shards to the decryption server.

[0059] Step 4.1. Assuming that n clients can successfully upload data, after the aggregation server receives the data uploaded by these n clients, it will send the ciphertext Perform aggregation and obtain the aggregation result Aggregate results The calculation of is as follows:

[0060] .

[0061] Step 4.2. Shard the client-encrypted secret Perform aggregation and obtain the aggregation result as . The calculation of is as follows:

[0062] .

[0063] Step 4.3. Aggregate the results Send to the decryption server.

[0064] Step 5. The decryption server decrypts the encrypted secret sharing shards, and then restores the secret sum generated by each client through secret sharing. Finally, the restored secret sum is returned to the aggregation server, and the aggregation server restores the plaintext of the aggregation model parameters.

[0065] After receiving the data sent by the aggregation server, the decryption server first determines whether the number of clients uploading data in the system is less than the preset minimum threshold for recovering the secret.

[0066] If the number of clients is less than the minimum threshold for recovering the secret, return to step 2.

[0067] Otherwise, if the number of clients is greater than or equal to the minimum threshold for recovering the secret, the decryption server decrypts the encrypted secret sharing fragment and the decryption calculation is:

[0068] ;

[0069] Parameter Y is an intermediate variable, and its calculation process is as follows:

[0070] make ;

[0071]

[0072] .

[0073] Then restore the sum of the secrets generated by each client through secret sharing , and finally send the restored secret sum to the aggregation server.

[0074] Step 6. The aggregation server subtracts the aggregate model parameter ciphertext from the secret sum sent by the decryption server to obtain the plaintext of the aggregation result, and then broadcasts the plaintext of the aggregation result to all clients in the federated learning system for the next round of training.

[0075] The aggregation server restores the plaintext of the aggregation result by using the restored secret sum and the aggregation model parameter ciphertext to obtain .

[0076] Step 7. Repeat steps 2 to 6 until the preset training rounds are reached or the model accuracy converges, and output the model accuracy measured on the test dataset.

[0077] Since all medical institution clients use the same public parameters to generate their own private keys, the private keys of each medical institution client are different, but the decryption server has a master key obtained according to the public parameters, so it is possible to achieve secure aggregation in a multi-key environment. Therefore, the present invention supports secure aggregation in a multi-key environment, and each participant can use their own key to encrypt data, which enhances the flexibility of the system. The sensitive data of the medical institution client participates in the federated learning process in an encrypted state, ensuring the privacy and security of the client and preventing the risk of data leakage. The present invention uses the Shamir secret sharing mechanism, and even if some medical institution clients are offline or exit, the system can still restore the aggregation results through the secret sharing shares of other clients, ensuring the continuity and stability of the training process. The present invention solves the limitations of traditional homomorphic encryption by improving the BCP homomorphic encryption algorithm. Even if the aggregation server is attacked or there is malicious behavior, it cannot decrypt or tamper with the data.

[0078] The method of the present invention, by combining BCP homomorphic encryption technology and Shamir secret sharing technology, provides a privacy-preserving federated learning security aggregation method for medical data, thereby realizing an encryption and decryption scheme of multi-key encryption and single-key decryption, realizing the aggregation of model parameters in a federated learning multi-key environment and effectively resisting the privacy leakage of medical institutions and malicious central servers in the federated learning aggregation process, and also solving the problem of medical institution client disconnection.

[0079] Of course, the above description is only a preferred embodiment of the present invention, and the present invention is not limited to the above embodiments. It should be noted that all equivalent substitutions and obvious deformation forms made by any technician familiar with the field under the guidance of this specification fall within the essential scope of this specification and should be protected by the present invention.

Claims

1. A privacy-preserving federated learning security aggregation method for medical data, applicable to a federated learning system involving multiple parties including a medical institution client, an aggregation server, and a decryption server; characterized in that: The medical institution client is responsible for local training and uploading its model parameters; the aggregation server is responsible for collecting information and aggregating it in a ciphertext environment; the decryption server can only obtain the aggregated secret shared shard ciphertext for decryption; The privacy-preserving federated learning secure aggregation method for medical data includes the following steps: Step 1. The aggregation server generates and initializes the global model, and the decryption server uses the BCP encryption algorithm to generate public parameters and broadcasts them to each medical institution client in the federated learning system; Step 2. Each client in the federated learning system randomly generates its own encryption key using the BCP homomorphic encryption algorithm based on the received public parameters, and each client randomly generates a secret for secret sharing; Step 3. Each client performs local training and masks the model parameters to be uploaded using the secret mask generated by Shamir secret sharing. Each client broadcasts the secret shard of its own secret sharing to other clients in the federated learning system. Each client uploads the encrypted model parameters and the secret shared shards sent by other clients encrypted with its own key to the aggregation server; Step 4. Considering that the client may be offline, after receiving the data uploaded by some of the clients, the aggregation server aggregates the encrypted model parameters, aggregates the encrypted secret sharing slices of each client, and sends the aggregated secret slices to the decryption server; The step 4 is specifically as follows: Step 4.

1. Assuming that n clients can successfully upload data, after the aggregation server receives the data uploaded by n clients, it will send the ciphertext c i Perform aggregation to obtain the aggregation result c; the calculation of the aggregation result c is as follows: Among them, c i The i-th client sets the local model parameter w i The secret k shared using Shamir's secret i The result of masking; Step 4.

2. Share the client-encrypted secret shard E j (k ij ) to perform aggregation, and the aggregation result is recorded as E j (k); E j (k) is calculated as follows: Among them, k ij is the corresponding secret sharing shard distributed from the i-th client to the j-th client, E j (k ij ) means that the jth client will k ij The encrypted result obtained by encrypting with its own key is the encrypted secret sharing shard; Step 4.

3. Aggregate the result E j (k) Send to the decryption server; Step 5. The decryption server decrypts the encrypted secret sharing shards, restores the secret sum generated by each client through secret sharing, and finally returns the restored secret sum to the aggregation server; Step 6. The aggregation server subtracts the aggregate model parameter ciphertext from the secret sum sent by the decryption server to obtain the plaintext of the aggregation result, and then broadcasts the plaintext of the aggregation result to all clients in the federated learning system for the next round of training; Step 7. Repeat steps 2 to 6 until the preset training rounds or accuracy requirement is reached.

2. The privacy-preserving federated learning secure aggregation method for medical data according to claim 1 is characterized in that: The step 1 is specifically as follows: Define the decryption server as S1, which distributes public parameters (g, N) to each client in the federated learning system; Where N is a safe prime number, that is, N can only be decomposed into the product of two prime numbers; Let N = pq, g = α 2 modN 2 ; p and q are two large prime numbers generated by S1, p = 2p1+1, q = 2q1+1, p1 and q1 are also two prime numbers, randomly selected Indicates less than N 2 And with N 2 The set of relatively prime integers.

3. The privacy-preserving federated learning secure aggregation method for medical data according to claim 2, characterized in that: The step 2 is specifically as follows: Assume that there are m clients in the federated learning system, and define the i-th client as C i ; Where i = 1, 2, ..., m; Client C i According to the received public parameters (g, N), the BCP homomorphic encryption algorithm is used to randomly generate its own encryption key (x i ,r i ), and the client Ci randomly generates a k i Used as the secret for Shamir's secret sharing; in Indicates less than N 2 And with N 2 The set of mutually prime integers, x i ∈[1,Np1q1].

4. The privacy-preserving federated learning secure aggregation method for medical data according to claim 3 is characterized in that: The step 3 is specifically as follows: Step 3.

1. Each client performs local training, and the i-th client obtains the local model parameter w i , the local model parameter w i The secret k shared using Shamir's secret i Mask and get the encrypted training result, that is, the ciphertext c i ; Step 3.

2. The i-th client uses Shamir secret sharing to form a secret shard and broadcasts it to other clients in the federated learning system; define the corresponding secret sharing shard distributed by the i-th client to the j-th client as k ij ; The jth client will k ij Encrypt with its own key to obtain the encrypted result, that is, the encrypted secret sharing shard E j (k ij ); Step 3.

3. The jth edge node sends the ciphertext c i and share shard E with the encrypted secret j (k ij ) is uploaded to the aggregation server.

5. The privacy-preserving federated learning secure aggregation method for medical data according to claim 4, characterized in that: In step 3, the ciphertext c i The calculation formula is as follows: i =w i +k i .

6. The privacy-preserving federated learning secure aggregation method for medical data according to claim 4, characterized in that: In step 3, the secret sharing expression and the secret sharing shard k allocated by the i-th client to the j-th client ij The expression is calculated as follows: k ij =f i (X j ),j=1,2,3.....m; Among them, f i (X) represents the polynomial constructed by client i, a0 is a random coefficient, t is the minimum threshold required to recover the secret, X represents the client number, X j represents the jth edge node, e=1,2,…,t-1.

7. The privacy-preserving federated learning secure aggregation method for medical data according to claim 4, characterized in that: In step 3, the encryption result E j (k ij )=(A,B,h), the calculation formula of the ciphertext (A,B,h) is as follows: Among them, (x j ,r j ) is client C j The self-encryption key is randomly generated based on the received public parameters (g, N).

8. The privacy-preserving federated learning secure aggregation method for medical data according to claim 1, characterized in that: The step 5 is specifically as follows: After receiving the data sent by the aggregation server, the decryption server first determines whether the number of clients that uploaded data in the system is less than the preset minimum threshold for recovering the secret; If the number of clients is less than the minimum threshold for recovering the secret, return to step 2; Otherwise, if the number of clients is greater than or equal to the minimum threshold for recovering the secret, the decryption server decrypts the encrypted secret sharing fragment and calculates the decryption value: Parameter Y is an intermediate variable, and its calculation process is as follows: Let λ(N)=2p1q1; Then restore the sum of the secrets generated by each client through secret sharing Send the secret sum to the aggregation server; The aggregation server restores the plaintext of the aggregation result by subtracting the aggregated encryption model parameters from the restored secret sum. The specific calculation formula is as follows:

Images