Federal learning hybrid privacy protection method based on edge computing

Abstract

The invention discloses a federated learning mixed privacy protection method based on edge computing, and belongs to the field of federated learning. According to the method, the problems that the privacy protection level is limited, the calculation overhead is high and the performance of an obtained model is poor in an existing method are solved. According to the method, before the participant uploads the model parameters to the edge server, the model parameters are interfered by using the real symmetric matrix, so that the effect of aggregation offset masking is realized. The edge server uses a Laplacian mechanism based on differential privacy and homomorphic encryption to reinforce privacy protection on the sub-aggregation model, even if an attacker colludes with the edge server, global parameters added with noise are obtained, privacy protection can be further improved, and the privacy protection efficiency is improved. And the edge server decrypts the ciphertext global model after receiving the ciphertext global model, verifies the signature, and issues the signature to each terminal device after the verification is passed. The method can be applied to privacy protection of federal learning.

Description

Technical Field

[0001] The present invention belongs to the field of federated learning, and specifically relates to a hybrid privacy protection method for federated learning based on edge computing. Background Art

[0002] With the development of big data and computer technology, federated learning, as a distributed machine learning technology, allows participants to train models and share model parameters without uploading local data, which can solve the "data island" problem. Although federated learning does not require uploading local data and plays a certain role in privacy protection, with the rapid development of information technology, federated learning still faces many challenges. Participants are resource-constrained and cannot further strengthen data privacy protection.

[0003] Moreover, research shows that attackers can try to infer sensitive information in the model training data by analyzing model parameters, model outputs, or other related information. Therefore, the level of privacy protection for data provided by a single privacy protection strategy relying solely on federated learning is very limited. It is very necessary to further strengthen the privacy protection of data. However, existing hybrid privacy protection strategies have problems such as high computational overhead and poor model performance. Summary of the invention

[0004] The purpose of the present invention is to solve the problems of limited privacy protection level, high computational overhead and poor performance of the obtained model in existing methods, and propose a hybrid privacy protection method for federated learning based on edge computing.

[0005] The technical solution adopted by the present invention to solve the above technical problems is: a hybrid privacy protection method for federated learning based on edge computing, which specifically includes the following steps:

[0006] Step 1: Randomly select two large prime numbers p and q, and satisfy gcd(pq,(p-1)(q-1))=1, gcd(·,·) means calculating the greatest common divisor, calculate n=pq, λ=lcm(p-1,q-1), lcm(·,·) means calculating the least common multiple, randomly select an integer r, and calculate h=r n modn 2 and v = λ -1 modn,r n modn 2 Represents r n Divide by n 2 The remainder, λ -1 modn represents λ -1 The remainder after dividing by n is obtained, and a homomorphic encryption public key pk = (n, h) is generated based on h and n, and a private key sk = (λ, v) is generated based on λ and v;

[0007] Initialize the generators g1, g2 and the bilinear mapping function e, and initialize the real symmetric matrix A with dimension N×N and the maximum privacy budget ε max and the minimum privacy budget ε min , where g1∈G1, g2∈G2, G1 and G2 are both multiplicative groups;

[0008] The bilinear mapping function e, homomorphic encryption public key pk, private key sk, generator g1, g2, maximum privacy budget ε max and the minimum privacy budget ε min Distribute to each edge server and transform the i-th row A of the real symmetric matrix A i Distribute to the i-th terminal device, N is the total number of terminal devices;

[0009] Step 2: Initialize the number of training rounds t=1;

[0010] Step 3: Each terminal device is deployed with a local model, and after training the local model using its own local data, the trained weight parameters and accuracy of the local model of each terminal device are obtained;

[0011] Each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, and then uploads the processed weight parameters and accuracy to the edge server;

[0012] Step 4: The edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates;

[0013] According to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameter, and use the homomorphic encryption public key to homomorphically encrypt the sub-aggregation model weight parameter with added noise to obtain the ciphertext sub-aggregation model weight parameter;

[0014] Upload the ciphertext sub-aggregation model weight parameters and sub-aggregation accuracy to the central server;

[0015] Step 5: The central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the weight parameters of the ciphertext aggregation model; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregation accuracy rate;

[0016] And send the ciphertext aggregation model weight parameters and aggregation accuracy to the edge server;

[0017] Step 6: The edge server uses the private key sk to decrypt the ciphertext aggregation model weight parameter and verifies the decrypted aggregation model weight parameter;

[0018] If the verification is successful, the decrypted aggregate model weight parameter is divided by the aggregate accuracy to obtain the global model parameter, and the global model parameter is sent to each terminal device. The local model deployed on each terminal device updates the weight parameter according to the received global model parameter, and then executes step seven;

[0019] If the verification fails, go directly to step 7;

[0020] Step 7: Determine whether the current training round number t is equal to T;

[0021] If t is not equal to T, set t=t+1 and return to step 3;

[0022] If t is equal to T, the training is terminated, and each terminal device uses the weight parameters obtained by the last update as the final local model weight parameters.

[0023] Furthermore, the initial weight parameters of the local model deployed by each terminal device are issued by the central server.

[0024] Furthermore, the local model deployed by each terminal device is trained using a stochastic gradient descent method.

[0025] Furthermore, each terminal device processes the local weight parameter and accuracy rate using the elements in the received real symmetric matrix, specifically:

[0026] The i-th terminal device uses the A allocated to it i The weight parameters and accuracy are processed to generate the processed weight parameters and accuracy:

[0027]

[0028] Among them, w ki represents the weight parameter of the terminal device numbered i under the kth edge server, Acc ki A represents the accuracy of the local model training deployed on the terminal device numbered i under the kth edge server, ij Indicates A i The jth column of , PRG(·) represents a pseudo-random number generator, represents the weight parameter after processing by the terminal device numbered i under the kth edge server, It indicates the accuracy of the processing of the terminal device numbered i under the kth edge server.

[0029] Furthermore, the edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates; specifically:

[0030]

[0031] Among them, w k is the sub-aggregation model weight parameter of the kth edge server, Acc k is the sub-aggregation accuracy of the kth edge server, and n′ is the number of terminal devices under the kth edge server.

[0032] Furthermore, according to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameter, and use the homomorphic encryption public key to homomorphically encrypt the sub-aggregation model weight parameter with added noise to obtain the ciphertext sub-aggregation model weight parameter; specifically:

[0033] Add Laplace noise to the sub-aggregation model weight parameters:

[0034]

[0035] Among them, t represents the current training round number, T represents the total training round number, is the Laplace noise, Δf is the global sensitivity, ε is the intermediate variable, is the weight parameter of the sub-aggregation model of the kth edge server after adding noise;

[0036] Edge server k selects a random number r k , and calculate the public key Then hash the weight parameters of the noisy sub-aggregation model And generate a signature Broadcast the public key and signature among the edge servers;

[0037] Use the public key pk to homomorphically encrypt the weight parameters of the noisy sub-aggregation model:

[0038]

[0039] in, is the weight parameter of the ciphertext sub-aggregation model of the kth edge server.

[0040] Further, the central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the weight parameters of the ciphertext aggregation model; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregation accuracy rate; specifically:

[0041]

[0042] in, represents ciphertext multiplication, E(W) represents the weight parameter of the ciphertext aggregation model, Acc represents the aggregation accuracy, and K is the number of edge servers.

[0043] Furthermore, the edge server decrypts the ciphertext aggregation model weight parameter using the private key sk, and verifies the decrypted aggregation model weight parameter, specifically:

[0044] W=v·L(W λ modn 2 )modn

[0045] Among them, W is the decrypted aggregation model weight parameter, L(W λ modn 2 )=W λ modn 2 -1 / n;

[0046] Edge server calculates the aggregate model hash value And calculate whether it satisfies h'

[0047] If satisfied The verification is successful;

[0048] If not satisfied The verification fails.

[0049] Furthermore, the decrypted aggregation model weight parameter is divided by the aggregation accuracy to obtain the global model parameter:

[0050]

[0051] Among them, W global is the global model parameter, and N is the number of terminal devices.

[0052] The beneficial effects of the present invention are:

[0053] The present invention uses a real symmetric matrix to interfere with the model parameters before the participants upload them to the edge server, so that after the edge server aggregates the interfered model parameters received, the same result as the aggregated original model parameters is obtained. To further improve privacy protection, the edge server adds noise to the sub-aggregate model parameters and encrypts them. Even if the attacker colludes with the edge server, the global parameters with added noise are obtained. In addition, the edge server signs the noisy sub-aggregate model parameters to verify the correctness of the model aggregation.

[0054] Real symmetric matrices are used to protect the local model parameters of terminal devices, the Laplace mechanism based on differential privacy and homomorphic encryption are used to strengthen privacy protection of the sub-aggregation model, and homomorphic hashing and bilinear pairing are used to ensure the accuracy of the aggregation model. It can be used for federated learning tasks with high security requirements and improves the level of privacy protection.

[0055] The present invention simultaneously applies single mask, differential privacy, homomorphic encryption and bilinear pairing technology to federated learning. When the terminal device uploads the local model parameters, a real symmetric matrix is ​​used for masking and the aggregation offsets the masking effect. When uploading the sub-aggregation model parameters on the edge server, differential privacy and homomorphic encryption technology are used to further improve privacy protection. After receiving the ciphertext global model, the edge server decrypts and verifies the signature. After the verification is passed, it is sent to each terminal device. In addition, the method of the present invention can reduce the computational overhead while ensuring the performance of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a structural diagram of the method of the present invention. DETAILED DESCRIPTION

[0057] Specific implementation method 1: Combination Figure 1 This embodiment describes a hybrid privacy protection method for federated learning based on edge computing, and the method specifically includes the following steps:

[0058] Step 1: The trusted institution randomly selects two large prime numbers p and q (prime numbers p and q are at least 1024-bit binary numbers) and satisfies gcd(pq,(p-1)(q-1))=1, gcd(·,·) represents the calculation of the greatest common divisor, calculates n=pq, λ=lcm(p-1,q-1), lcm(·,·) represents the calculation of the least common multiple, randomly selects an integer r, and calculates h=r n modn 2 and v = λ - 1 modn,r n modn 2 Represents r n Divide by n 2 The remainder, λ -1 modn represents λ -1 The remainder of the division by n is obtained, and a homomorphic encryption public key pk = (n, h) is generated based on h and n, and a private key sk = (λ, v) is generated based on λ and v, that is, h and n are packaged into pk, and λ and v are packaged into sk;

[0059] Initialize the generators g1, g2 and the bilinear mapping function e, and initialize the real symmetric matrix A with dimension N×N and the maximum privacy budget ε max and the minimum privacy budget ε min , where g1∈G1, g2∈G2, G1 and G2 are both multiplicative groups, and the bilinear mapping function satisfies e(a x ,b y )=e(a,b) xy =e(a y ,b x );

[0060] The bilinear mapping function e, homomorphic encryption public key pk, private key sk, generator g1, g2, maximum privacy budget ε max and the minimum privacy budget ε min Distribute to each edge server and transform the i-th row A of the real symmetric matrix A i Distribute to the i-th terminal device (where each terminal device can be numbered in sequence), N is the total number of terminal devices;

[0061] Step 2: Initialize the number of training rounds t=1;

[0062] Step 3: Each terminal device is deployed with a local model, and after training the local model using its own local data, the trained weight parameters and accuracy of the local model of each terminal device are obtained;

[0063] Each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, and then uploads the processed weight parameters and accuracy to the edge server;

[0064] Step 4: The edge server aggregates the received weight parameters and accuracy to obtain the sub-aggregation model weight parameters and sub-aggregation accuracy; according to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameter, and use the homomorphic encryption public key to homomorphically encrypt the sub-aggregation model weight parameter with added noise to obtain the ciphertext sub-aggregation model weight parameter;

[0065] Upload the ciphertext sub-aggregation model weight parameters and sub-aggregation accuracy to the central server;

[0066] Step 5: The central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the weight parameters of the ciphertext aggregation model; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregation accuracy rate;

[0067] And send the ciphertext aggregation model weight parameters and aggregation accuracy to the edge server;

[0068] Step 6: The edge server uses the private key sk to decrypt the ciphertext aggregation model weight parameter and verifies the decrypted aggregation model weight parameter;

[0069] If the verification is successful, the decrypted aggregate model weight parameter is divided by the aggregate accuracy to obtain the global model parameter, and the global model parameter is sent to each terminal device. The local model deployed on each terminal device updates the weight parameter according to the received global model parameter, and then executes step seven;

[0070] If the verification fails, go directly to step 7;

[0071] Step 7: Determine whether the current training round number t is equal to T;

[0072] If t is not equal to T, set t=t+1 and return to step 3;

[0073] If t is equal to T, the training is terminated, and each terminal device uses the weight parameters obtained by the last update as the final local model weight parameters.

[0074] In the present invention, the local data of each terminal device is used to train the local model in batches. When the verification result of a certain iterative process fails, the data of other batches are used to train the local model parameters after the previous update. When the verification result of a certain iterative process passes, the data of other batches are used to train the local model parameters after the current update.

[0075] Specific implementation method 2: This implementation method is different from specific implementation method 1 in that the initial weight parameters of the local model deployed by each terminal device are issued by the central server.

[0076] The other steps and parameters are the same as those in the first embodiment.

[0077] In this implementation, the central server sends the initial model parameters to each edge server, and the edge server then sends the initial model parameters to each terminal device.

[0078] Specific implementation method three: This implementation method is different from specific implementation methods one or two in that the local model deployed by each terminal device is trained using stochastic gradient descent (SGD).

[0079] The other steps and parameters are the same as those in the first or second embodiment.

[0080] Specific implementation mode 4: This implementation mode is different from any one of specific implementation modes 1 to 3 in that each terminal device processes the local weight parameter and accuracy rate using the elements in the received real symmetric matrix, specifically:

[0081] The i-th terminal device uses the A allocated to it i The weight parameters and accuracy are processed to generate the processed weight parameters and accuracy:

[0082]

[0083] Among them, w ki represents the weight parameter of the terminal device numbered i under the kth edge server, Acc kiA represents the accuracy of the local model training deployed on the terminal device numbered i under the kth edge server, ij Indicates A i The jth column of , PRG(·) represents a pseudo-random number generator, represents the weight parameter after processing by the terminal device numbered i under the kth edge server, It indicates the accuracy of the processing of the terminal device numbered i under the kth edge server.

[0084] The other steps and parameters are the same as those in Specific Embodiments 1 to 3.

[0085] The model parameters are disturbed by using a real symmetric matrix, so that the edge server can obtain the same result as the original model parameters after aggregating the received disturbed model parameters. In order to reduce communication, only the terminal devices belonging to the same edge server exchange keys and generate shared keys. The real values ​​can be masked by adding shared keys to the local model weight parameters and accuracy.

[0086] Specific implementation mode 5: This implementation mode is different from any one of specific implementation modes 1 to 4 in that the edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates; specifically:

[0087]

[0088] Among them, w k is the sub-aggregation model weight parameter of the kth edge server, Acc k is the sub-aggregation accuracy of the kth edge server, and n′ is the number of terminal devices under the kth edge server.

[0089] The other steps and parameters are the same as those in Specific Embodiments 1 to 4.

[0090] Specific implementation method 6: This implementation method is different from the specific implementation methods 1 to 5 in that the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameter, and use the homomorphic encryption public key to homomorphically encrypt the sub-aggregation model weight parameter with added noise to obtain the ciphertext sub-aggregation model weight parameter; specifically:

[0091] Add Laplace noise to the sub-aggregation model weight parameters:

[0092]

[0093] Among them, t represents the current training round number, T represents the total training round number, is the Laplace noise, Δf is the global sensitivity, ε is the intermediate variable, is the weight parameter of the sub-aggregation model of the kth edge server after adding noise;

[0094] Edge server k selects a random number r k , and calculate the public key Then hash the weight parameters of the noisy sub-aggregation model And generate a signature Broadcast the public key and signature among the edge servers;

[0095] Use the public key pk to homomorphically encrypt the weight parameters of the noisy sub-aggregation model:

[0096]

[0097] in, is the weight parameter of the ciphertext sub-aggregation model of the kth edge server.

[0098] The other steps and parameters are the same as those in Specific Implementation Methods 1 to 5.

[0099] The present invention uses a real symmetric matrix to interfere with the model parameters, so that after the edge server aggregates the interfered model parameters received, the same result as the aggregated original model parameters is obtained. Even if the attacker colludes with the edge server, what is obtained is the global parameter with added noise, which improves the privacy protection level.

[0100] Specific implementation method 7: This implementation method is different from any one of specific implementation methods 1 to 6 in that the central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the ciphertext aggregation model weight parameters; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregation accuracy rate; specifically:

[0101]

[0102] in, represents ciphertext multiplication, E(W) represents the weight parameter of the ciphertext aggregation model, Acc represents the aggregation accuracy, and K is the number of edge servers.

[0103] The other steps and parameters are the same as those in Specific Embodiments 1 to 6.

[0104] Specific implementation eight: This implementation differs from any one of specific implementations one to seven in that the edge server decrypts the ciphertext aggregation model weight parameter using the private key sk and verifies the decrypted aggregation model weight parameter, specifically:

[0105] W=v·L(W λ modn2 )modn

[0106] Among them, W is the decrypted aggregation model weight parameter, L(W λ modn 2 )=W λ modn 2 -1 / n;

[0107] Edge server calculates the aggregate model hash value And calculate whether it satisfies h'

[0108] If satisfied The verification is successful;

[0109] If not satisfied The verification fails.

[0110] That is, this embodiment uses bilinear pairing to verify the correctness of the aggregation model. If the verification passes, the global model is calculated and issued.

[0111] The other steps and parameters are the same as those in Specific Embodiments 1 to 7.

[0112] Specific implementation method 9: This implementation method is different from any one of specific implementation methods 1 to 8 in that the decrypted aggregation model weight parameter is divided by the aggregation accuracy to obtain the global model parameter:

[0113]

[0114] Among them, W global is the global model parameter, and N is the number of terminal devices.

[0115] The other steps and parameters are the same as those in Specific Embodiments 1 to 8.

[0116] The above calculation examples of the present invention are only used to explain the calculation model and calculation process of the present invention in detail, and are not intended to limit the implementation methods of the present invention. For ordinary technicians in the relevant field, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the implementation methods here. All obvious changes or modifications derived from the technical solution of the present invention are still within the scope of protection of the present invention.

Claims

1. A hybrid privacy protection method for federated learning based on edge computing, characterized in that: The method specifically comprises the following steps: Step 1: Randomly select two large prime numbers p and q, and satisfy gcd(pq,(p-1)(q-1))=1, gcd(·,·) means calculating the greatest common divisor, calculate n=pq, λ=lcm(p-1,q-1), lcm(·,·) means calculating the least common multiple, randomly select an integer r, and calculate h=r n modn 2 and v = λ -1 modn,r n modn 2 Represents r n Divide by n 2 The remainder of -1 modn represents λ -1 The remainder after dividing by n is obtained, and a homomorphic encryption public key pk = (n, h) is generated based on h and n, and a private key sk = (λ, v) is generated based on λ and v; Initialize the generators g1, g2 and the bilinear mapping function e, and initialize the real symmetric matrix A with dimension N×N and the maximum privacy budget ε max and the minimum privacy budget ε min , where g1∈G1, g2∈G2, G1 and G2 are both multiplicative groups; The bilinear mapping function e, homomorphic encryption public key pk, private key sk, generator g1, g2, maximum privacy budget ε max and the minimum privacy budget ε min Distribute to each edge server and transform the i-th row A of the real symmetric matrix A i Distribute to the i-th terminal device, N is the total number of terminal devices; Step 2: Initialize the number of training rounds t=1; Step 3: Each terminal device is deployed with a local model, and after training the local model using its own local data, the trained weight parameters and accuracy of the local model of each terminal device are obtained; Each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, and then uploads the processed weight parameters and accuracy to the edge server; Step 4: The edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates; According to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameter, and use the homomorphic encryption public key to homomorphically encrypt the sub-aggregation model weight parameter with added noise to obtain the ciphertext sub-aggregation model weight parameter; Upload the ciphertext sub-aggregation model weight parameters and sub-aggregation accuracy to the central server; Step 5: The central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the weight parameters of the ciphertext aggregation model; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregation accuracy rate; And send the ciphertext aggregation model weight parameters and aggregation accuracy to the edge server; Step 6: The edge server uses the private key sk to decrypt the ciphertext aggregation model weight parameter and verifies the decrypted aggregation model weight parameter; If the verification is successful, the decrypted aggregate model weight parameter is divided by the aggregate accuracy to obtain the global model parameter, and the global model parameter is sent to each terminal device. The local model deployed on each terminal device updates the weight parameter according to the received global model parameter, and then executes step seven; If the verification fails, go directly to step 7; Step 7: Determine whether the current training round number t is equal to T; If t is not equal to T, set t=t+1 and return to step 3; If t is equal to T, the training is terminated, and each terminal device uses the weight parameters obtained by the last update as the final local model weight parameters.

2. According to the hybrid privacy protection method of federated learning based on edge computing according to claim 1, it is characterized in that: The initial weight parameters of the local model deployed by each terminal device are issued by the central server.

3. According to the hybrid privacy protection method of federated learning based on edge computing according to claim 2, it is characterized in that: The local model deployed in each terminal device is trained using the stochastic gradient descent method.

4. According to the hybrid privacy protection method of federated learning based on edge computing according to claim 3, it is characterized in that: Each terminal device processes the local weight parameter and accuracy rate using the elements in the received real symmetric matrix, specifically: The i-th terminal device uses the A allocated to it i The weight parameters and accuracy are processed to generate the processed weight parameters and accuracy: Among them, w ki represents the weight parameter of the terminal device numbered i under the kth edge server, Acc ki A represents the accuracy of the local model training deployed on the terminal device numbered i under the kth edge server, ij Indicates A i The jth column of , PRG(·) represents a pseudo-random number generator, represents the weight parameter after processing by the terminal device numbered i under the kth edge server, It indicates the accuracy of the processing of the terminal device numbered i under the kth edge server.

5. According to the hybrid privacy protection method of federated learning based on edge computing according to claim 4, it is characterized in that: The edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates; specifically: Among them, w k is the sub-aggregation model weight parameter of the kth edge server, Acc k is the sub-aggregation accuracy of the kth edge server, and n′ is the number of terminal devices under the kth edge server.

6. According to the hybrid privacy protection method of federated learning based on edge computing according to claim 5, it is characterized in that: According to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameter, and use the homomorphic encryption public key to homomorphically encrypt the sub-aggregation model weight parameter with added noise to obtain the ciphertext sub-aggregation model weight parameter; specifically: Add Laplace noise to the sub-aggregation model weight parameters: Among them, t represents the current training round number, T represents the total training round number, is the Laplace noise, Δf is the global sensitivity, ε is the intermediate variable, is the weight parameter of the sub-aggregation model of the kth edge server after adding noise; Edge server k selects a random number r k , and calculate the public key Then hash the weight parameters of the noisy sub-aggregation model And generate a signature Broadcast the public key and signature among the edge servers; Use the public key pk to homomorphically encrypt the weight parameters of the noisy sub-aggregation model: in, is the weight parameter of the ciphertext sub-aggregation model of the kth edge server.

7. The hybrid privacy protection method for federated learning based on edge computing according to claim 6 is characterized in that: The central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the weight parameters of the ciphertext aggregation model; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregation accuracy rate; specifically: in, represents ciphertext multiplication, E(W) represents the weight parameter of the ciphertext aggregation model, Acc represents the aggregation accuracy, and K is the number of edge servers.

8. The hybrid privacy protection method for federated learning based on edge computing according to claim 7 is characterized in that: The edge server decrypts the ciphertext aggregation model weight parameter using the private key sk, and verifies the decrypted aggregation model weight parameter, specifically: W=v·L(W λ modern 2 )modern Among them, W is the decrypted aggregation model weight parameter, L(W λ modn 2 )=W λ modn 2 -1 / n; Edge server calculates the aggregate model hash value And calculate whether it satisfies h' If satisfied The verification is successful; If not satisfied The verification fails.

9. The hybrid privacy protection method for federated learning based on edge computing according to claim 8, characterized in that: The decrypted aggregation model weight parameter is divided by the aggregation accuracy to obtain the global model parameter: Among them, W global is the global model parameter, and N is the number of terminal devices.

Images