Privacy protection federated learning method and device based on multi-key fully homomorphic encryption

Abstract

The invention provides a privacy protection federated learning method and device based on multi-key fully homomorphic encryption, and the method comprises the steps: obtaining a public key matrix and a private key matrix corresponding to each client, and enabling the public key matrix and the private key matrix to be determined based on the public parameters of a global model in a server; carrying out aggregation processing on the public key matrixes of different clients to obtain an aggregated public key; acquiring a local model parameter of each client after encryption processing based on the aggregated public key; performing homomorphic encryption evaluation on local model parameters of different clients to obtain an aggregation ciphertext; partial decryption results of different clients are obtained, and the partial decryption results are obtained after the clients decrypt the aggregated ciphertext based on the private key matrix; and carrying out aggregation processing on the partial decryption results of different clients to obtain target model parameters, and updating the global model based on the target model parameters. Therefore, the communication overhead can be effectively reduced while the model precision is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer science and technology, and in particular to a privacy-preserving federated learning method and device based on multi-key fully homomorphic encryption. Background Art

[0002] The core idea of ​​federated learning is that each device (or node) trains the model locally using the data it holds, and only sends model updates (such as gradients or parameter updates) to the server. The server is responsible for aggregating these update information, updating the global model, and then distributing the improved model back to each participating device. In this way, the data does not need to leave the local device, which can effectively protect the privacy of the user and break the dilemma of "data islands". However, studies have shown that in federated learning, although the data is retained locally, the model updates (such as gradients or weights) exchanged during model training may indirectly leak sensitive information about the original data.

[0003] Among related technologies, privacy-preserving federated learning further reduces potential privacy risks by introducing technologies such as differential privacy and secure multi-party computing. However, the noise added by differential privacy will inevitably reduce the accuracy of the model during the aggregation process of the model, and secure multi-party computing usually requires complex encryption operations and frequent network communications. Summary of the invention

[0004] The present disclosure aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the purpose of the present disclosure is to propose a privacy-preserving federated learning method, apparatus, computer device and storage medium based on multi-key fully homomorphic encryption, thereby effectively reducing communication overhead while improving model accuracy.

[0006] To achieve the above objectives, the privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed in the first aspect of the present disclosure includes:

[0007] Obtaining a public key matrix and a private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on public parameters of a global model in the server;

[0008] Aggregating the public key matrices of different clients to obtain an aggregated public key;

[0009] Obtaining local model parameters of each client after encryption based on the aggregate public key;

[0010] Performing homomorphic encryption evaluation on the local model parameters of different clients to obtain an aggregated ciphertext;

[0011] Obtaining partial decryption results of different clients, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix;

[0012] The partial decryption results of different clients are aggregated to obtain target model parameters, and the global model is updated based on the target model parameters.

[0013] To achieve the above-mentioned purpose, the privacy-preserving federated learning device based on multi-key fully homomorphic encryption proposed in the second aspect of the present disclosure includes:

[0014] A first acquisition module is used to acquire a public key matrix and a private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on public parameters of a global model in a server;

[0015] A first processing module, configured to aggregate the public key matrices of different clients to obtain an aggregated public key;

[0016] A second acquisition module is used to obtain local model parameters of each client after encryption based on the aggregate public key;

[0017] A second processing module is used to perform homomorphic encryption evaluation on the local model parameters of different clients to obtain an aggregated ciphertext;

[0018] A third acquisition module is used to obtain partial decryption results of different clients, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix;

[0019] The third processing module is used to aggregate the partial decryption results of different clients to obtain target model parameters, and update the global model based on the target model parameters.

[0020] The computer device proposed in the third aspect embodiment of the present disclosure includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the privacy-preserving federated learning method based on multi-key fully homomorphic encryption as proposed in the first aspect embodiment of the present disclosure is implemented.

[0021] The fourth aspect embodiment of the present disclosure proposes a non-temporary computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, it implements the privacy-preserving federated learning method based on multi-key fully homomorphic encryption as proposed in the first aspect embodiment of the present disclosure.

[0022] The fifth aspect embodiment of the present disclosure proposes a computer program product. When the instructions in the computer program product are executed by a processor, the privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed in the first aspect embodiment of the present disclosure is executed.

[0023] The privacy-preserving federated learning method, apparatus, computer equipment and storage medium based on multi-key fully homomorphic encryption provided by the present disclosure obtains the public key matrix and private key matrix corresponding to each client, wherein the public key matrix and private key matrix are determined based on the public parameters of the global model in the server; aggregates the public key matrices of different clients to obtain an aggregated public key; obtains the local model parameters of each client after encryption based on the aggregated public key; homomorphically encrypts and evaluates the local model parameters of different clients to obtain an aggregated ciphertext; obtains partial decryption results of different clients, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix; aggregates the partial decryption results of different clients to obtain the target model parameters, and updates the global model based on the target model parameters. Thus, the communication overhead can be effectively reduced while improving the model accuracy.

[0024] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will be obvious from the following description or learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and / or additional aspects and advantages of the present disclosure will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0026] Figure 1 It is a flowchart of a privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed in an embodiment of the present disclosure;

[0027] Figure 2 It is a main flow chart of a privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed in the present disclosure;

[0028] Figure 3 is a schematic diagram of a privacy-preserving federated learning model based on multi-key fully homomorphic encryption proposed in the present disclosure;

[0029] Figure 4 It is a structural diagram of a privacy-preserving federated learning device based on multi-key fully homomorphic encryption proposed in one embodiment of the present disclosure;

[0030] Figure 5 A block diagram of an exemplary computer device suitable for implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0031] Embodiments of the present disclosure are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present disclosure, and are not to be construed as limitations of the present disclosure. On the contrary, the embodiments of the present disclosure include all changes, modifications, and equivalents that fall within the spirit and connotation of the appended claims.

[0032] Figure 1 It is a flowchart of a privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed in an embodiment of the present disclosure.

[0033] Among them, it should be noted that the executor of the privacy-preserving federated learning method based on multi-key fully homomorphic encryption in this embodiment is a privacy-preserving federated learning device based on multi-key fully homomorphic encryption. The device can be implemented by software and / or hardware. The device can be configured in a computer device. The computer device may include but is not limited to a terminal, a server, etc. For example, the terminal may be a mobile phone, a PDA, etc.

[0034] like Figure 1 As shown in FIG. 1 , the privacy-preserving federated learning method based on multi-key fully homomorphic encryption includes:

[0035] S101: Obtain a public key matrix and a private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on public parameters of a global model in a server.

[0036] The client can refer to the device or node that participates in the training and provides local data during the federated learning process, while the server can refer to the central server that coordinates and aggregates the client model updates.

[0037] The public key matrix may refer to a matrix used in the encryption process in a matrix-based public key cryptographic system, and the private key matrix may refer to a matrix used in the decryption process, which corresponds to the public key matrix and usually needs to be kept confidential.

[0038] The global model refers to the model maintained by the server, which aggregates model updates from all clients. It represents the common knowledge of the entire system and can provide more comprehensive prediction capabilities after multiple rounds of training and updates.

[0039] Among them, public parameters can refer to some parameters of the global model, which are uniformly managed by the server. They are shared between the client and the server to ensure that model updates from different clients can be effectively integrated and applied. All clients use the same public parameters for local training.

[0040] Optionally, in some embodiments, the public parameter includes at least one of the following: ciphertext modulus; number of lattice bits; error distribution.

[0041] Among them, the ciphertext modulus, the ciphertext modulus (q) is an integer used to perform modular operations on encrypted data. It is a large prime or composite number selected during the encryption process. Through modular (q) operations, the value of the ciphertext is limited to a fixed range, which helps control errors in the calculation process and ensure the security of encryption. A larger (q) can improve security, but it will also increase the complexity of the calculation and storage requirements.

[0042] The lattice bit number refers to the dimension of the lattice, or in lattice-based encryption, it refers to the dimension of a lattice vector space. The lattice bit number affects the security and efficiency of the encryption system. A larger lattice bit number enhances the system's ability to resist attacks, but it also increases the requirements for computing and storage.

[0043] Error distribution refers to the statistical characteristics of random errors introduced during the encryption and decryption process. It describes the range and distribution type of errors and how they affect the ciphertext and decryption results. Error distribution is very important in homomorphic encryption because it affects the error accumulation in the encryption process and the accuracy of the decryption results. Reasonable error distribution can ensure that the encryption system can still provide correct results after a long period of calculation and enhance the security of the system.

[0044] In the disclosed embodiment, the common parameters may also include any other parameters applicable to federated learning, such as model weights and biases, etc., without limitation.

[0045] Optionally, in some embodiments, the public parameters are determined based on the following method: initializing the global model, and determining the ciphertext modulus, lattice bit number and error distribution of the global model according to preset security parameters and maximum circuit depth.

[0046] Among them, security parameters usually refer to various parameters that affect the security of the encryption system, including key length, modulus size, error distribution standards, etc. The selection of these parameters is directly related to the ability of the encryption system to resist attacks.

[0047] In homomorphic encryption systems, circuit depth refers to the length of the longest path from input to output in a computational circuit, or the number of layers of logic gates required in a circuit. The maximum circuit depth is the maximum number of layers allowed for a circuit to execute.

[0048] That is to say, the public parameter (ciphertext modulus, number of lattice bits, and error distribution) setting in the disclosed embodiment can be matched with the system's security requirements (such as the ability to resist attacks) and the maximum circuit depth (computational complexity) to ensure the overall performance and security of the encryption model.

[0049] In the disclosed embodiment, when the public key matrix and the private key matrix corresponding to each client are obtained, a reliable encryption and decryption tool can be provided for the subsequent homomorphic encryption processing process.

[0050] S102: Aggregate the public key matrices of different clients to obtain an aggregated public key.

[0051] The aggregated public key may refer to a public key obtained by aggregating the public key matrices of different clients. In the embodiment of the present disclosure, when the public key matrices of different clients are aggregated to obtain the aggregated public key, at least the following technical effects can be achieved:

[0052] Simplified management: By aggregating multiple public keys, the system can use a single aggregated public key to process data from multiple clients, simplifying the complexity of public key management and distribution.

[0053] Improved efficiency: Aggregating public keys can make the encryption and decryption process more efficient, because processing aggregated public keys is usually computationally simpler than processing a single public key matrix.

[0054] Enhanced privacy protection: Aggregated public keys allow the specific public key information of a single client to be hidden in cryptographic calculations, thereby improving the privacy protection capabilities of the system.

[0055] Support batch processing: In applications such as homomorphic encryption, aggregated public keys can make batch encryption, calculation, and decryption of multiple client data more efficient.

[0056] S103: Obtain local model parameters of each client after encryption based on the aggregate public key.

[0057] The local model parameters may refer to the model parameters obtained after the client trains the global model based on local data.

[0058] Optionally, in some embodiments, when obtaining local model parameters of each client after encryption based on the aggregate public key, the server may send the public parameters to the client, and the client may perform model training based on local data to obtain initial model parameters, and encrypt the initial model parameters based on the aggregate public key to obtain local model parameters. In this way, the privacy and security of local model parameters in the federated learning process can be effectively improved.

[0059] S104: Perform homomorphic encryption evaluation on local model parameters of different clients to obtain aggregated ciphertext.

[0060] The aggregated ciphertext refers to the encrypted model parameters obtained after aggregating the local model parameters of different clients.

[0061] That is to say, in the embodiments of the present disclosure, after homomorphic encryption evaluation is performed on the local model parameters of different clients to obtain the aggregated ciphertext, at least the following technical effects can be achieved:

[0062] Privacy protection: Homomorphic encryption ensures that the client's model parameters remain encrypted during data transmission and processing, preventing the leakage of sensitive information. Even if the data is processed on the server, the server cannot see the specific model parameter content.

[0063] Secure model aggregation: In federated learning, model parameters of individual clients usually need to be aggregated on a central server (e.g., calculating the average). Homomorphic encryption evaluation allows these aggregation operations to be performed on ciphertext, ensuring that the entire process is performed in an encrypted state, thereby protecting the privacy of client data.

[0064] Avoid data exposure: Aggregation ciphertext is an encrypted aggregation result that can be calculated and analyzed on the server without revealing the specific data or model parameters of a single client. The decrypted result will show the actual aggregation information.

[0065] Ensure data integrity: Homomorphic encryption ensures that data has not been tampered with during the calculation process. Any operation on the ciphertext can guarantee the correctness of the calculation, even if these operations are performed in an encrypted state.

[0066] Support for distributed computing: Aggregated ciphertext allows computing to be performed on different computing nodes (such as central servers or cloud computing platforms) without requiring each node to have the original data. This approach supports distributed computing and federated learning models.

[0067] S105: Obtain partial decryption results of different clients, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix.

[0068] That is to say, in the embodiment of the present disclosure, after obtaining the aggregated ciphertext after homomorphic encryption evaluation of the local model parameters of different clients, partial decryption results of different clients can be obtained, thereby providing reliable data support for the subsequent determination of the target model parameters.

[0069] S106: Aggregate partial decryption results from different clients to obtain target model parameters, and update the global model based on the target model parameters.

[0070] Optionally, in some embodiments, when the partial decryption results of different clients are aggregated to obtain the target model parameters, the partial decryption results of different clients may be aggregated to obtain the sum of local model parameters; and according to the sum of local model parameters, the average model parameters are calculated and determined as the target model parameters. In this way, the optimization effect of the obtained target model parameters on the global model can be guaranteed.

[0071] In this embodiment, by obtaining the public key matrix and private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on the public parameters of the global model in the server; the public key matrices of different clients are aggregated to obtain the aggregated public key; the local model parameters of each client after encryption based on the aggregated public key are obtained; the local model parameters of different clients are homomorphically encrypted and evaluated to obtain the aggregated ciphertext; the partial decryption results of different clients are obtained, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix; the partial decryption results of different clients are aggregated to obtain the target model parameters, and the global model is updated based on the target model parameters. In this way, the communication overhead can be effectively reduced while improving the model accuracy.

[0072] Optionally, in some embodiments, after updating the global model based on the target model parameters, the method further includes: if the updated global model reaches the convergence condition, stopping the model training; if the updated global model does not reach the convergence condition, using the target model parameters as new common parameters for the next round of model training. Thus, when the updated global model does not reach the convergence condition, the global model can be iteratively updated to ensure the training effect of the global model.

[0073] The convergence condition refers to the condition pre-configured for the global model to determine whether the model has achieved the expected training effect.

[0074] Based on the above embodiments, the privacy-preserving federated learning method based on multi-key homomorphic encryption proposed by the present disclosure allows each participating party to use different keys for encryption and decryption, preventing an attacker from colluding with the server and using the same key to decrypt the private inputs of honest participating parties. However, existing related schemes in the semi-honest environment have limitations in terms of security and application conditions. First, in extreme cases, at least two participating parties (i.e., k < N - 1, where N is the total number of participating parties) need to not collude with the attacker to prevent the leakage of private data, resulting in insufficient security. Second, they only support homomorphic addition and do not support homomorphic multiplication, which imposes many restrictions on the federated learning algorithms used in applications and is not flexible enough. For this reason, the privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed by the present disclosure performs homomorphic encryption on model updates before shared aggregation, and only all contributing parties can cooperate to decrypt the aggregation result. Therefore, this method is robust against attacks from participants and collusion attacks between participants and the server. This method is based on fully homomorphic encryption, supports both homomorphic addition and homomorphic multiplication, and ensures security by requiring encrypted aggregation public keys and decrypting shares; it supports embedding multiple plaintext messages into one ciphertext, thereby improving the encryption and decryption efficiency.

[0075] Referring to the FedAvg algorithm, the general process of the privacy-preserving federated learning scheme based on multi-key fully homomorphic encryption proposed by the present disclosure is as follows:

[0076] Initialization: The central server initializes the global model, executes the Setup(·) function, sets the ciphertext modulus q, the lattice dimensions n, m, the error distribution χ, and the length t of the message according to the security parameter λ and the maximum circuit depth L, and selects a uniformly random matrix Returns the public parameters params = (n, q, χ, m), the public matrix B, and t. Each remote device client P i (i ∈ [N]) selects samples to generate the private key matrix

[0077]

[0078] where is the key corresponding to the j-th message, j ∈ [t]. Subsequently, select e j ← χ m×1 and calculate b j = B · a j + e (modq) , generate and return the public key matrix to the central server

[0079]

[0080] After the central server receives the public key matrices sent by all participating devices, it calculates the aggregated public key

[0081]

[0082] And return the aggregate public key PK to all participating devices (ie clients).

[0083] Step 1: Local training: At the beginning of each aggregation round, each participant (i.e., client) P i Receive global model weights (i.e. public parameters) w from the central server global , use their own local data to train the model. After enough epochs, the participant P i Generate a local model whose weight (i.e. initial model parameter) is w i .

[0084] Step 2: Model weight encryption: Let t-bit message u i ∈{0,1} is w i The encoded plaintext input and generate the corresponding plaintext matrix M i ;Participant P i Sampling a uniform matrix R i ←{0,1} m×M , and use the aggregate public key PK = A to M i Encrypt and get the ciphertext

[0085]

[0086] And C i Sent to the central server.

[0087] Step 3: Homomorphic calculation: After receiving the ciphertext of the model weights sent by each participant, the central server performs homomorphic evaluation on the ciphertext. Here, this article takes homomorphic addition as an example to derive the encryption and

[0088]

[0089] The server will then Send to all participants.

[0090] If we want to perform homomorphic multiplication, taking two parties as an example, it is:

[0091]

[0092] Step 4: Calculation of decryption shares: In multi-key homomorphic encryption, the decryption of ciphertext requires the cooperation of all participants. To decrypt, each participant P needs i Using its private key matrix S i Calculate its decryption share (i.e. partial decryption result) di :

[0093]

[0094] in is the random vector matrix, σ′ j is the error vector selected from χ.

[0095] Step 5: Model aggregation: The central server obtains the decrypted shares d of all participants i After that, the sum of the decrypted shares is calculated

[0096]

[0097] in The server then calculates Get the decrypted message And decode U to obtain the sum of the local model weights of each participant, and calculate the average weight (i.e., the average model parameter), which is used as the updated model weight (i.e., the new public parameter) for the next round.

[0098] The privacy-preserving federated learning scheme based on multi-key fully homomorphic encryption proposed in the present invention ensures security by requiring aggregated public keys for encryption and decryption sharing; supports encryption, decryption and homomorphic evaluation of multi-bit messages at one time, reduces the complexity of NAND gates and improves efficiency; supports homomorphic addition and homomorphic multiplication of ciphertext, improving application flexibility.

[0099] In addition, the proposed method ensures the confidentiality of model updates in a semi-honest environment by encrypting model updates using multi-key fully homomorphic encryption. The scheme is robust to attacks from participants and collusion attacks between k=N-1 participants and the server.

[0100] For example, Figure 2 As shown, Figure 2 This is a schematic diagram of the main process of a privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed in this disclosure, which can be divided into an initialization phase and a training phase, as follows:

[0101] In the initialization phase, the central server needs to initialize the global model, generate the public parameters required by the fully homomorphic encryption algorithm, and send the public parameters to all federated learning participants;

[0102] After receiving the public parameters, each participant generates their own public key and private key matrix and returns the public key matrix to the server;

[0103] The server calculates the aggregate public key, sends it to each participant, and enters the training phase.

[0104] During the training phase, the central server sends the global model to each participant, and then each participant performs local training and uploads the encrypted local model weights to the server;

[0105] The server performs homomorphic evaluation on the weighted ciphertexts received from all participants and sends the obtained aggregated ciphertext to the participants;

[0106] Each participant uses the private key matrix to decrypt the aggregated ciphertext, obtains partial decryption results and returns them to the server;

[0107] The server aggregates all partial decryption results, obtains the sum of the local model weights of each participant, and calculates the average weight;

[0108] The server determines whether the model has converged. If so, the training ends. Otherwise, the average weight is used as the new global model weight to start the next round of training.

[0109] For example, Figure 3 As shown, Figure 3 This is a schematic diagram of a privacy-preserving federated learning model based on multi-key fully homomorphic encryption proposed in this disclosure. The details are as follows:

[0110] The model involves two parts: a central server and federated learning participants.

[0111] In the initialization phase, the central server initializes the global model, sets the protocol parameter params according to the security parameter λ and the maximum circuit depth L, selects the uniform random matrix B as the public matrix, and then sends params and B to each client participating in the training. Each client uses params to execute the key generation function, obtains the public key matrix pk and the private key matrix sk, and returns pk to the central server, which performs public key aggregation.

[0112] The server returns the aggregated public key PK and global model parameters to each client, and then starts several rounds of aggregation in an iterative manner.

[0113] In each aggregation round, after receiving the global model, each client uses its own local data to train the model. Each client can independently determine the number of training rounds and parameters based on its own resources and data volume, and encrypt the local model parameters using the aggregate public key PK at the end of this round of training.

[0114] Each client (remote device) returns the encrypted result to the central server, where the ciphertext is aggregated to obtain the ciphertext of the new global model.

[0115] Each client uses the private key matrix and the key obtained from the central server. The calculation is performed to obtain the decrypted share D and return it to the central server.

[0116] The central server aggregates all decrypted shares to obtain the model aggregation results in plain text form, and then uses the corresponding aggregation algorithm method (such as FedAvg) to update the global model. Repeat the above aggregation round steps until the model reaches the predetermined performance standard or completes the specified number of training rounds.

[0117] Figure 4 It is a structural diagram of a privacy-preserving federated learning device based on multi-key fully homomorphic encryption proposed in one embodiment of the present disclosure.

[0118] like Figure 4 As shown, the privacy-preserving federated learning device 40 based on multi-key fully homomorphic encryption includes:

[0119] A first acquisition module 401 is used to acquire a public key matrix and a private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on public parameters of a global model in a server;

[0120] A first processing module 402 is used to aggregate the public key matrices of different clients to obtain an aggregated public key;

[0121] The second acquisition module 403 is used to obtain the local model parameters of each client after encryption based on the aggregate public key;

[0122] The second processing module 404 is used to perform homomorphic encryption evaluation on local model parameters of different clients to obtain aggregated ciphertext;

[0123] The third acquisition module 405 is used to obtain partial decryption results of different clients, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix;

[0124] The third processing module 406 is used to aggregate partial decryption results of different clients to obtain target model parameters, and update the global model based on the target model parameters.

[0125] It should be noted that the aforementioned explanation of the privacy-preserving federated learning method based on multi-key fully homomorphic encryption is also applicable to the privacy-preserving federated learning device based on multi-key fully homomorphic encryption in this embodiment, and will not be repeated here.

[0126] In this embodiment, by obtaining the public key matrix and private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on the public parameters of the global model in the server; the public key matrices of different clients are aggregated to obtain the aggregated public key; the local model parameters of each client after encryption based on the aggregated public key are obtained; the local model parameters of different clients are homomorphically encrypted and evaluated to obtain the aggregated ciphertext; the partial decryption results of different clients are obtained, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix; the partial decryption results of different clients are aggregated to obtain the target model parameters, and the global model is updated based on the target model parameters. In this way, the communication overhead can be effectively reduced while improving the model accuracy.

[0127] Figure 5 A block diagram of an exemplary computer device suitable for implementing embodiments of the present disclosure is shown. Figure 5 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0128] like Figure 5 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0129] The bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnection (PCI) bus.

[0130] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0131] The memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 Not shown, often called a "hard drive").

[0132] although Figure 5 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a compact disc read only memory (hereinafter referred to as: CD-ROM), a digital versatile disc read only memory (hereinafter referred to as: DVD-ROM) or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0133] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0134] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), one or more devices that enable a human body to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via an input / output (I / O) interface 22. In addition, the computer device 12 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the computer device 12 via a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the computer device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0135] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing the privacy-preserving federated learning method based on multi-key fully homomorphic encryption mentioned in the aforementioned embodiment.

[0136] In order to implement the above-mentioned embodiments, the present disclosure also proposes a non-temporary computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, it implements the privacy-preserving federated learning method based on multi-key fully homomorphic encryption as proposed in the aforementioned embodiments of the present disclosure.

[0137] In order to implement the above embodiments, the present disclosure also proposes a computer program product. When the instruction processor in the computer program product is executed, it executes the privacy-preserving federated learning method based on multi-key fully homomorphic encryption proposed in the aforementioned embodiments of the present disclosure.

[0138] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0139] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

[0140] It should be noted that, in the description of the present disclosure, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present disclosure, unless otherwise specified, the meaning of "plurality" is two or more.

[0141] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present disclosure includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present disclosure belong.

[0142] It should be understood that the various parts of the present disclosure can be implemented in hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0143] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0144] In addition, each functional unit in each embodiment of the present disclosure may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0145] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0146] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0147] Although the embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present disclosure. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present disclosure.

Claims

1. A privacy-preserving federated learning method based on multi-key fully homomorphic encryption, characterized in that: include: Obtaining a public key matrix and a private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on public parameters of a global model in the server; Aggregating the public key matrices of different clients to obtain an aggregated public key; Obtaining local model parameters of each client after encryption based on the aggregate public key; Performing homomorphic encryption evaluation on the local model parameters of different clients to obtain an aggregated ciphertext; Obtaining partial decryption results of different clients, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix; The partial decryption results of different clients are aggregated to obtain target model parameters, and the global model is updated based on the target model parameters.

2. The method according to claim 1, characterized in that The common parameters include at least one of the following: Ciphertext module; Number of grids; Error distribution.

3. The method according to claim 2, characterized in that The common parameters are determined based on the following method: The global model is initialized, and the ciphertext modulus, the number of lattice bits, and the error distribution of the global model are determined according to preset security parameters and a maximum circuit depth.

4. The method according to claim 1, characterized in that The obtaining of local model parameters of each client after encryption based on the aggregate public key comprises: After the server sends the public parameters to the client, the client performs model training based on local data to obtain initial model parameters, and encrypts the initial model parameters based on the aggregated public key to obtain the local model parameters.

5. The method according to claim 1, characterized in that The aggregating the partial decryption results of different clients to obtain target model parameters includes: Aggregating the partial decryption results of different clients to obtain the sum of local model parameters; According to the sum of the local model parameters, an average model parameter is calculated and determined as the target model parameter.

6. The method according to claim 1, characterized in that After the global model is updated based on the target model parameters, the method further includes: If the updated global model reaches the convergence condition, the model training is stopped; If the updated global model does not meet the convergence condition, the target model parameters are used as new common parameters for the next round of model training.

7. A privacy-preserving federated learning device based on multi-key fully homomorphic encryption, characterized in that: include: A first acquisition module is used to acquire a public key matrix and a private key matrix corresponding to each client, wherein the public key matrix and the private key matrix are determined based on public parameters of a global model in a server; A first processing module, configured to aggregate the public key matrices of different clients to obtain an aggregated public key; A second acquisition module is used to obtain local model parameters of each client after encryption based on the aggregate public key; A second processing module is used to perform homomorphic encryption evaluation on the local model parameters of different clients to obtain an aggregated ciphertext; A third acquisition module is used to obtain partial decryption results of different clients, wherein the partial decryption results are obtained by the client after decrypting the aggregated ciphertext based on the private key matrix; The third processing module is used to aggregate the partial decryption results of different clients to obtain target model parameters, and update the global model based on the target model parameters.

8. A computer device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: in, The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

Images