A hybrid privacy protection method for federated learning based on edge computing
By using real symmetric matrices, differential privacy, and homomorphic encryption technology to interfere with and encrypt the parameters of the federated learning model in an edge computing environment, the problems of insufficient privacy protection and high computational overhead in federated learning are solved, and efficient privacy protection and model performance guarantee are achieved.
Patent Information
- Application Number
- CN202411278184.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-12
- Publication Date
- 2025-10-03
- Estimated Expiration
- 2044-09-12
AI Technical Summary
Existing federated learning methods have limited privacy protection, high computational overhead, and poor model performance, and cannot effectively address the challenge of attackers inferring sensitive information.
A hybrid privacy protection method for federated learning based on edge computing is adopted. Real symmetric matrices are used to interfere with model parameters. Differential privacy, homomorphic encryption, and bilinear pairing technology are combined to add noise and encrypt model parameters. The privacy protection and accuracy of model parameters are ensured through verification and decryption by the edge server.
It improves the level of privacy protection, reduces computational overhead, and ensures model performance, making it suitable for federated learning tasks with high security requirements.
Smart Images
Figure CN119254400B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of federated learning, and specifically relates to a hybrid privacy protection method for federated learning based on edge computing. Background Art
[0002] With the development of big data and computer technology, federated learning, as a distributed machine learning technology, allows participants to train models and share model parameters without uploading local data, which can solve the "data island" problem. Although federated learning does not require uploading local data and plays a certain role in privacy protection, with the rapid development of information technology, federated learning still faces many challenges. Participants are resource-constrained and cannot further strengthen data privacy protection.
[0003] Moreover, research has shown that attackers can attempt to infer sensitive information from model training data by analyzing model parameters, model outputs, or other related information. Therefore, the level of privacy protection provided by relying solely on a single privacy protection strategy based on federated learning is very limited. Further strengthening of data privacy protection is very necessary, but existing hybrid privacy protection strategies have problems such as high computational overhead and poor model performance. Summary of the Invention
[0004] The purpose of this invention is to solve the problems of limited privacy protection level, high computational overhead and poor performance of the obtained model in existing methods, and propose a hybrid privacy protection method for federated learning based on edge computing.
[0005] The technical solution adopted by the present invention to solve the above technical problems is: a hybrid privacy protection method for federated learning based on edge computing, which specifically includes the following steps:
[0006] Step 1: Randomly select two large prime numbers p and q, and satisfy gcd(pq,(p-1)(q-1))=1, gcd(·,·) represents the calculation of the greatest common divisor, calculate n=pq, λ=lcm(p-1,q-1), lcm(·,·) represents the calculation of the least common multiple, randomly select an integer r, and calculate h=r n modn 2 and v = λ -1 modn,r n modn 2 Represents r n Divide by n 2 The remainder, λ -1 modn represents λ -1 The remainder of the division by n is used to generate the homomorphic encryption public key pk = (n, h) based on h and n, and the private key sk = (λ, v) based on λ and v;
[0007] Initialize the generators g1, g2 and the bilinear mapping function e, and initialize the real symmetric matrix A of dimension N×N and the maximum privacy budget ε max and the minimum privacy budget ε min , where g1∈G1, g2∈G2, G1 and G2 are both multiplicative groups;
[0008] The bilinear mapping function e, homomorphic encryption public key pk, private key sk, generator g1, g2, maximum privacy budget ε max and the minimum privacy budget ε min Distribute to each edge server and transform the i-th row A of the real symmetric matrix A into i Distribute to the i-th terminal device, where N is the total number of terminal devices;
[0009] Step 2: Initialize the number of training rounds t=1;
[0010] Step 3: Each terminal device is deployed with a local model, and after training the local model using its own local data, the trained weight parameters and accuracy of the local model of each terminal device are obtained;
[0011] Each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, and then uploads the processed weight parameters and accuracy to the edge server;
[0012] Step 4: The edge server aggregates the received weight parameters and accuracy to obtain the sub-aggregation model weight parameters and sub-aggregation accuracy;
[0013] According to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameters, and use the homomorphic encryption public key to homomorphically encrypt the noise-added sub-aggregation model weight parameters to obtain the ciphertext sub-aggregation model weight parameters;
[0014] Upload the ciphertext sub-aggregation model weight parameters and sub-aggregation accuracy to the central server;
[0015] Step 5: The central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the ciphertext aggregation model weight parameters; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregate accuracy rate;
[0016] The weight parameters and aggregation accuracy of the ciphertext aggregation model are sent to the edge server;
[0017] Step 6: The edge server uses the private key sk to decrypt the ciphertext aggregation model weight parameters and verifies the decrypted aggregation model weight parameters;
[0018] If the verification is successful, the decrypted aggregate model weight parameter is divided by the aggregate accuracy to obtain the global model parameter, and the global model parameter is sent to each terminal device. The local model deployed on each terminal device updates the weight parameter according to the received global model parameter, and then executes step 7;
[0019] If the verification fails, go directly to step 7;
[0020] Step 7: Determine whether the current number of training rounds t is equal to T;
[0021] If t is not equal to T, set t=t+1 and return to step 3;
[0022] If t is equal to T, the training ends and each terminal device uses the weight parameters obtained by the last update as the final local model weight parameters.
[0023] Furthermore, the initial weight parameters of the local models deployed by each terminal device are issued by the central server.
[0024] Furthermore, the local model deployed in each terminal device is trained using a stochastic gradient descent method.
[0025] Furthermore, each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, specifically:
[0026] The i-th terminal device uses the A allocated to it i Process the weight parameters and accuracy to generate the processed weight parameters and accuracy:
[0027]
[0028] Among them, w ki Acc represents the weight parameter of the terminal device numbered i under the kth edge server, ki A represents the accuracy of the local model trained on the terminal device numbered i under the kth edge server. ij Indicates A i The jth column of , PRG(·) represents the pseudo-random number generator, It represents the weight parameter after processing by the terminal device numbered i under the k-th edge server. It represents the accuracy of the processing of the terminal device numbered i under the k-th edge server.
[0029] Furthermore, the edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates; specifically:
[0030]
[0031] Among them, w k is the sub-aggregation model weight parameter of the kth edge server, Acc k is the sub-aggregation accuracy of the k-th edge server, and n′ is the number of terminal devices under the k-th edge server.
[0032] Furthermore, the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameters, and use the homomorphic encryption public key to homomorphically encrypt the noise-added sub-aggregation model weight parameters to obtain the ciphertext sub-aggregation model weight parameters; specifically:
[0033] Add Laplace noise to the sub-aggregation model weight parameters:
[0034]
[0035] Among them, t represents the current training round number, T represents the total training round number, is the Laplace noise, Δf is the global sensitivity, ε is the intermediate variable, is the weight parameter of the sub-aggregation model of the kth edge server after noise addition;
[0036] Edge server k selects a random number r k , and calculate the public key Then hash the weight parameters of the sub-aggregation model after noise addition And generate a signature Broadcast the public key and signature among the edge servers;
[0037] Use the public key pk to homomorphically encrypt the weight parameters of the noisy sub-aggregation model:
[0038]
[0039] in, is the weight parameter of the ciphertext sub-aggregation model of the kth edge server.
[0040] Furthermore, the central server aggregates the ciphertext sub-aggregation model weight parameters uploaded by each edge server to obtain the ciphertext aggregation model weight parameters; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregate accuracy rate; specifically:
[0041]
[0042] in, represents ciphertext multiplication, E(W) represents the weight parameter of the ciphertext aggregation model, Acc represents the aggregation accuracy, and K is the number of edge servers.
[0043] Furthermore, the edge server decrypts the ciphertext aggregation model weight parameter using the private key sk and verifies the decrypted aggregation model weight parameter, specifically:
[0044] W=v·L(W λ modn 2 )modn
[0045] Among them, W is the decrypted aggregation model weight parameter, L(W λ modn 2 )=W λ modn 2 -1 / n;
[0046] The edge server calculates the aggregate model hash value And calculate whether it satisfies h'
[0047] If satisfied The verification is successful;
[0048] If not satisfied The verification fails.
[0049] Furthermore, the decrypted aggregation model weight parameter is divided by the aggregation accuracy to obtain the global model parameter:
[0050]
[0051] Among them, W global is the global model parameter, and N is the number of terminal devices.
[0052] The beneficial effects of the present invention are:
[0053] Before participants upload model parameters to the edge server, this method uses a real symmetric matrix to perturb the model parameters. This ensures that when the edge server aggregates the received perturbed model parameters, it produces the same result as the aggregated original model parameters. To further enhance privacy protection, the edge server adds noise to the sub-aggregated model parameters and encrypts them. Even if an attacker colludes with the edge server, they only obtain the noisy global parameters. Furthermore, the edge server signs the noisy sub-aggregated model parameters to verify the correctness of the model aggregation.
[0054] Real symmetric matrices are used to protect the local model parameters of terminal devices, and the Laplace mechanism based on differential privacy and homomorphic encryption are used to strengthen privacy protection of the sub-aggregation model. Homomorphic hashing and bilinear pairing are used to ensure the accuracy of the aggregation model. It can be used for federated learning tasks with high security requirements and improves the level of privacy protection.
[0055] This invention simultaneously applies single masking, differential privacy, homomorphic encryption, and bilinear pairing techniques to federated learning. When a terminal device uploads local model parameters, it uses a real symmetric matrix for masking and achieves the effect of aggregation offsetting the masking. When uploading sub-aggregate model parameters to an edge server, differential privacy and homomorphic encryption are used to further enhance privacy protection. Upon receiving the ciphertext global model, the edge server decrypts it and verifies the signature. Once verified, it is distributed to each terminal device. Furthermore, this method reduces computational overhead while ensuring model performance. BRIEF DESCRIPTION OF THE DRAWINGS
[0056] Figure 1 It is an architectural diagram of the method of the present invention. DETAILED DESCRIPTION
[0057] Specific implementation method 1: Combination Figure 1 This embodiment describes a hybrid privacy protection method for federated learning based on edge computing, which specifically includes the following steps:
[0058] Step 1: The trusted institution randomly selects two large prime numbers p and q (prime numbers p and q are at least 1024-bit binary numbers) that satisfy gcd(pq, (p-1)(q-1)) = 1, where gcd(·,·) represents the calculation of the greatest common divisor. Calculate n = pq and λ = lcm(p-1, q-1). lcm(·,·) represents the calculation of the least common multiple. Randomly select an integer r and calculate h = r n modn 2 and v = λ - 1 modn,r n modn 2 Represents r n Divide by n 2 The remainder, λ -1 modn represents λ -1 The remainder of the division by n is obtained, and the homomorphic encryption public key pk = (n, h) is generated based on h and n, and the private key sk = (λ, v) is generated based on λ and v. That is, h and n are packaged into pk, and λ and v are packaged into sk;
[0059] Initialize the generators g1, g2 and the bilinear mapping function e, and initialize the real symmetric matrix A of dimension N×N and the maximum privacy budget ε max and the minimum privacy budget ε min , where g1∈G1, g2∈G2, G1 and G2 are both multiplicative groups, and the bilinear mapping function satisfies e(a x ,b y )=e(a,b) xy =e(a y ,b x );
[0060] The bilinear mapping function e, homomorphic encryption public key pk, private key sk, generator g1, g2, maximum privacy budget ε max and the minimum privacy budget ε min Distribute to each edge server and transform the i-th row A of the real symmetric matrix A into i Distribute to the i-th terminal device (where each terminal device can be numbered in sequence), N is the total number of terminal devices;
[0061] Step 2: Initialize the number of training rounds t=1;
[0062] Step 3: Each terminal device is deployed with a local model, and after training the local model using its own local data, the trained weight parameters and accuracy of the local model of each terminal device are obtained;
[0063] Each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, and then uploads the processed weight parameters and accuracy to the edge server;
[0064] Step 4: The edge server aggregates the received weight parameters and accuracy to obtain the sub-aggregation model weight parameters and sub-aggregation accuracy; according to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameters, and use the homomorphic encryption public key to homomorphically encrypt the noise-added sub-aggregation model weight parameters to obtain the ciphertext sub-aggregation model weight parameters;
[0065] Upload the ciphertext sub-aggregation model weight parameters and sub-aggregation accuracy to the central server;
[0066] Step 5: The central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the ciphertext aggregation model weight parameters; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregate accuracy rate;
[0067] The weight parameters and aggregation accuracy of the ciphertext aggregation model are sent to the edge server;
[0068] Step 6: The edge server uses the private key sk to decrypt the ciphertext aggregation model weight parameters and verifies the decrypted aggregation model weight parameters;
[0069] If the verification is successful, the decrypted aggregate model weight parameter is divided by the aggregate accuracy to obtain the global model parameter, and the global model parameter is sent to each terminal device. The local model deployed on each terminal device updates the weight parameter according to the received global model parameter, and then executes step 7;
[0070] If the verification fails, go directly to step 7;
[0071] Step 7: Determine whether the current number of training rounds t is equal to T;
[0072] If t is not equal to T, set t=t+1 and return to step 3;
[0073] If t is equal to T, the training ends and each terminal device uses the weight parameters obtained by the last update as the final local model weight parameters.
[0074] In the present invention, the local data of each terminal device is used to train the local model in batches. When the verification result of a certain iterative process fails, the data of other batches are used to train the local model parameters after the previous update. When the verification result of a certain iterative process passes, the data of other batches are used to train the local model parameters after this update.
[0075] Specific implementation method 2: This implementation method is different from specific implementation method 1 in that the initial weight parameters of the local model deployed by each terminal device are issued by the central server.
[0076] Other steps and parameters are the same as those in the first embodiment.
[0077] In this embodiment, the central server sends the initial model parameters to each edge server, and the edge server then sends the initial model parameters to each terminal device.
[0078] Specific implementation method three: This implementation method is different from specific implementation methods one or two in that the local model deployed by each terminal device is trained using stochastic gradient descent (SGD).
[0079] Other steps and parameters are the same as those in the first or second embodiment.
[0080] Specific embodiment 4: This embodiment differs from any one of specific embodiments 1 to 3 in that each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, specifically:
[0081] The i-th terminal device uses the A allocated to it i Process the weight parameters and accuracy to generate the processed weight parameters and accuracy:
[0082]
[0083] Among them, w ki Acc represents the weight parameter of the terminal device numbered i under the kth edge server, kiA represents the accuracy of the local model trained on the terminal device numbered i under the kth edge server. ij Indicates A i The jth column of , PRG(·) represents the pseudo-random number generator, It represents the weight parameter after processing by the terminal device numbered i under the k-th edge server. It represents the accuracy of the processing of the terminal device numbered i under the k-th edge server.
[0084] The other steps and parameters are the same as those in the first to third embodiments.
[0085] Using a real symmetric matrix to perturb the model parameters, the edge server aggregates the received perturbed model parameters, achieving the same result as the original model parameters. To reduce communication, key exchange and shared keys are performed only between end devices belonging to the same edge server. Adding the shared key to the local model weight parameters and accuracy masked the true values.
[0086] Specific embodiment 5: This embodiment differs from any one of specific embodiments 1 to 4 in that the edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates; specifically:
[0087]
[0088] Among them, w k is the sub-aggregation model weight parameter of the kth edge server, Acc k is the sub-aggregation accuracy of the k-th edge server, and n′ is the number of terminal devices under the k-th edge server.
[0089] The other steps and parameters are the same as those in the first to fourth embodiments.
[0090] Specific embodiment 6: This embodiment differs from any one of the specific embodiments 1 to 5 in that the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameters, and use the homomorphic encryption public key to homomorphically encrypt the noise-added sub-aggregation model weight parameters to obtain the ciphertext sub-aggregation model weight parameters; specifically:
[0091] Add Laplace noise to the sub-aggregation model weight parameters:
[0092]
[0093] Among them, t represents the current training round number, T represents the total training round number, is the Laplace noise, Δf is the global sensitivity, ε is the intermediate variable, is the weight parameter of the sub-aggregation model of the kth edge server after noise addition;
[0094] Edge server k selects a random number r k , and calculate the public key Then hash the weight parameters of the sub-aggregation model after noise addition And generate a signature Broadcast the public key and signature among the edge servers;
[0095] Use the public key pk to homomorphically encrypt the weight parameters of the noisy sub-aggregation model:
[0096]
[0097] in, is the weight parameter of the ciphertext sub-aggregation model of the kth edge server.
[0098] The other steps and parameters are the same as those in the first to fifth embodiments.
[0099] This method uses a real symmetric matrix to perturb model parameters, enabling edge servers to aggregate the received perturbed model parameters and obtain the same results as the original model parameters. Even if an attacker colludes with the edge server, they only obtain the global parameters with added noise, thus improving privacy protection.
[0100] Specific embodiment seven: This embodiment differs from any one of specific embodiments one to six in that the central server aggregates the ciphertext sub-aggregation model weight parameters uploaded by each edge server to obtain the ciphertext aggregation model weight parameters; and aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregate accuracy rate; specifically:
[0101]
[0102] in, represents ciphertext multiplication, E(W) represents the weight parameter of the ciphertext aggregation model, Acc represents the aggregation accuracy, and K is the number of edge servers.
[0103] The other steps and parameters are the same as those in the first to sixth embodiments.
[0104] Specific embodiment eight: This embodiment differs from any one of specific embodiments one to seven in that the edge server decrypts the ciphertext aggregation model weight parameter using the private key sk and verifies the decrypted aggregation model weight parameter, specifically:
[0105] W=v·L(W λ modn2 )modn
[0106] Among them, W is the decrypted aggregation model weight parameter, L(W λ modn 2 )=W λ modn 2 -1 / n;
[0107] The edge server calculates the aggregate model hash value And calculate whether it satisfies h'
[0108] If satisfied The verification is successful;
[0109] If not satisfied The verification fails.
[0110] That is, this embodiment uses bilinear pairing to verify the correctness of the aggregation model. If the verification passes, the global model is calculated and issued.
[0111] The other steps and parameters are the same as those in the first to seventh embodiments.
[0112] Specific embodiment nine: This embodiment differs from any one of specific embodiments one to eight in that the decrypted aggregation model weight parameter is divided by the aggregation accuracy to obtain the global model parameter:
[0113]
[0114] Among them, W global is the global model parameter, and N is the number of terminal devices.
[0115] The other steps and parameters are the same as those in Specific Embodiments 1 to 8.
[0116] The above examples are merely illustrative of the calculation model and process of the present invention and are not intended to limit the embodiments of the present invention. Persons skilled in the art will readily appreciate that other variations or modifications based on the above description are possible. This list of embodiments is not exhaustive; however, any obvious variations or modifications derived from the technical solution of the present invention remain within the scope of protection of the present invention.
Claims
1. A hybrid privacy protection method for federated learning based on edge computing, characterized by: The method specifically comprises the following steps: Step 1: Randomly select two large prime numbers p and q, and satisfy gcd(pq,(p-1)(q-1))=1, gcd(·,·) represents the calculation of the greatest common divisor, calculate n=pq, λ=lcm(p-1,q-1), lcm(·,·) represents the calculation of the least common multiple, randomly select an integer r, and calculate h=r n modn 2 and v = λ -1 modn,r n modn 2 Represents r n Divide by n 2 The remainder, λ -1 modn represents λ -1 The remainder of the division by n is used to generate the homomorphic encryption public key pk = (n, h) based on h and n, and the private key sk = (λ, v) based on λ and v; Initialize the generators g1, g2 and the bilinear mapping function e, and initialize the real symmetric matrix A of dimension N×N and the maximum privacy budget ε max and the minimum privacy budget ε min , where g1∈G1, g2∈G2, G1 and G2 are both multiplicative groups; The bilinear mapping function e, homomorphic encryption public key pk, private key sk, generator g1, g2, maximum privacy budget ε max and the minimum privacy budget ε min Distribute to each edge server and transform the i-th row A of the real symmetric matrix A into i Distribute to the i-th terminal device, where N is the total number of terminal devices; Step 2: Initialize the number of training rounds t=1; Step 3: Each terminal device is deployed with a local model, and after training the local model using its own local data, the trained weight parameters and accuracy of the local model of each terminal device are obtained; Each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, and then uploads the processed weight parameters and accuracy to the edge server; Step 4: The edge server aggregates the received weight parameters and accuracy to obtain the sub-aggregation model weight parameters and sub-aggregation accuracy; According to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameters, and use the homomorphic encryption public key to homomorphically encrypt the noise-added sub-aggregation model weight parameters to obtain the ciphertext sub-aggregation model weight parameters; Upload the ciphertext sub-aggregation model weight parameters and sub-aggregation accuracy to the central server; Step 5: The central server aggregates the weight parameters of the ciphertext sub-aggregation model uploaded by each edge server to obtain the ciphertext aggregation model weight parameters; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregate accuracy rate; The weight parameters and aggregation accuracy of the ciphertext aggregation model are sent to the edge server; Step 6: The edge server uses the private key sk to decrypt the ciphertext aggregation model weight parameters and verifies the decrypted aggregation model weight parameters; If the verification is successful, the decrypted aggregate model weight parameter is divided by the aggregate accuracy to obtain the global model parameter, and the global model parameter is sent to each terminal device. The local model deployed on each terminal device updates the weight parameter according to the received global model parameter, and then executes step 7; If the verification fails, go directly to step 7; Step 7: Determine whether the current number of training rounds t is equal to T; If t is not equal to T, set t=t+1 and return to step 3; If t is equal to T, the training ends and each terminal device uses the weight parameters obtained by the last update as the final local model weight parameters.
2. A hybrid privacy protection method for federated learning based on edge computing according to claim 1, characterized in that: The initial weight parameters of the local model deployed by each terminal device are issued by the central server.
3. A hybrid privacy protection method for federated learning based on edge computing according to claim 2, characterized in that: The local models deployed in each terminal device are trained using the stochastic gradient descent method.
4. A hybrid privacy protection method for federated learning based on edge computing according to claim 3, characterized in that: Each terminal device processes the local weight parameters and accuracy using the elements in the received real symmetric matrix, specifically: The i-th terminal device uses the A allocated to it i Process the weight parameters and accuracy to generate the processed weight parameters and accuracy: Among them, w ki Acc represents the weight parameter of the terminal device numbered i under the kth edge server, ki A represents the accuracy of the local model trained on the terminal device numbered i under the kth edge server. ij Indicates A i The jth column of , PRG(·) represents the pseudo-random number generator, It represents the weight parameter after processing by the terminal device numbered i under the k-th edge server. It represents the accuracy of the processing of the terminal device numbered i under the k-th edge server.
5. A hybrid privacy protection method for federated learning based on edge computing according to claim 4, characterized in that: The edge server aggregates the received weight parameters and accuracy rates to obtain sub-aggregation model weight parameters and sub-aggregation accuracy rates; specifically: Among them, w k is the sub-aggregation model weight parameter of the kth edge server, Acc k is the sub-aggregation accuracy of the k-th edge server, and n′ is the number of terminal devices under the k-th edge server.
6. A hybrid privacy protection method for federated learning based on edge computing according to claim 5, characterized in that: According to the maximum privacy budget ε max and the minimum privacy budget ε min Add noise to the sub-aggregation model weight parameters, and use the homomorphic encryption public key to homomorphically encrypt the noise-added sub-aggregation model weight parameters to obtain the ciphertext sub-aggregation model weight parameters; specifically: Add Laplace noise to the sub-aggregation model weight parameters: Among them, t represents the current training round number, T represents the total training round number, is the Laplace noise, Δf is the global sensitivity, ε is the intermediate variable, is the weight parameter of the sub-aggregation model of the kth edge server after noise addition; Edge server k selects a random number r k , and calculate the public key Then hash the weight parameters of the sub-aggregation model after noise addition And generate a signature Broadcast the public key and signature among the edge servers; Use the public key pk to homomorphically encrypt the weight parameters of the noisy sub-aggregation model: in, is the weight parameter of the ciphertext sub-aggregation model of the kth edge server.
7. A hybrid privacy protection method for federated learning based on edge computing according to claim 6, characterized in that: The central server aggregates the ciphertext sub-aggregation model weight parameters uploaded by each edge server to obtain the ciphertext aggregation model weight parameters; aggregates the sub-aggregation accuracy rates uploaded by each edge server to obtain the aggregate accuracy rate; specifically: in, represents ciphertext multiplication, E(W) represents the weight parameter of the ciphertext aggregation model, Acc represents the aggregation accuracy, and K is the number of edge servers.
8. A hybrid privacy protection method for federated learning based on edge computing according to claim 7, characterized in that: The edge server decrypts the ciphertext aggregation model weight parameters using the private key sk and verifies the decrypted aggregation model weight parameters, specifically: W=v·L(W λ modern 2 )modern Among them, W is the decrypted aggregation model weight parameter, L(W λ modn 2 )=W λ modn 2 -1 / n; The edge server calculates the aggregate model hash value And calculate whether it satisfies h' If satisfied The verification is successful; If not satisfied The verification fails.
9. A hybrid privacy protection method for federated learning based on edge computing according to claim 8, characterized in that: The decrypted aggregation model weight parameter is divided by the aggregation accuracy to obtain the global model parameter: Among them, W global is the global model parameter, and N is the number of terminal devices.