Medical data privacy protection method based on block chain credible consensus and differential privacy

Abstract

The invention provides a medical data privacy protection method based on block chain credible consensus and differential privacy. The method solves various security threats such as privacy disclosure, data tampering, poisoning attack, Sybil attack and trust problems in a BFL sharing framework based on block chains and federated learning. According to the method, firstly, an adaptive differential privacy algorithm is designed to adjust the amount of noise added to the gradient, so that balance is obtained between privacy budget and precision reduction, and an attacker is prevented from reversely deducing training data through the gradient; secondly, poisoning attacks are detected by utilizing a Multi-Krum algorithm, and safe aggregation is carried out based on digital signatures, so that the authenticity and integrity of data sources are ensured; finally, the invention provides a practical Byzantine fault-tolerant consensus protocol Trust-PFBT based on trust, trust evaluation is performed by comprehensively considering a trust value, trust consistency and trust deviation, a consensus committee is established, and the trust attack influence of malicious nodes is reduced.

Description

Technical Field

[0001] The present invention relates to a data privacy protection method, and in particular to a medical data privacy protection method based on blockchain trusted consensus and differential privacy. Background Art

[0002] Medical data is highly privacy-sensitive. How to share medical data while protecting data privacy is an important issue to fully realize the value of medical data. In medical research, only a large amount of multi-party and multi-source big data can support the high applicability and accuracy of medical research models. However, current biomedical data is closely related to personal privacy. How to reasonably protect personal sensitive information and effectively share biomedical data, conduct joint analysis, and integrate multi-medical data without leaking privacy information is one of the key research topics in the current medical information field. The BFL (Blockchain-Federated-Learning) framework based on blockchain and federated learning is a suitable solution to the contradiction between medical data sharing and privacy protection. Privacy computing technology represented by federated learning provides an effective solution for the "available but invisible" data in the medical sharing process. The sharing framework BFL based on blockchain and federated learning can perfectly meet the data processing requirements in the field of medical and health care, and has become a new trend in medical data sharing. However, the BFL sharing model still has the following threats:

[0003] Threat 1. Data privacy leakage. On the one hand, the data provider node, such as the medical information system of the hospital, may cause the local medical data to be leaked due to internal or external attacks. On the other hand, during the training process of federated learning, the characteristics of the local medical data may infer important information of the local data through gradient reverse inference, thus causing the patient's privacy data to be leaked.

[0004] Threat 2: Data tampering. A large number of federated learning participants may have malicious data providers who upload tampered gradients, thus affecting the accuracy of the global model. In addition, data is intercepted and tampered by man-in-the-middle attacks during transmission. At the blockchain level, if attackers can control enough computing power or consensus nodes, they can tamper with the model updates.

[0005] Threat 3: Poisoning attack. The institution that owns the data may be malicious. Malicious nodes can upload harmful or biased model updates, causing the global model to make incorrect predictions or decisions in specific situations. It is called model poisoning or backdoor attack. Malicious parties may also affect the quality of local models through data poisoning, thereby affecting the accuracy of the global model.

[0006] Threat 4: Sybil attack: Attackers create multiple fake medical institution identities or multiple fake nodes and send meaningless or even false data to the blockchain in an attempt to gain improper control or influence in the distributed system, thereby reducing the data availability on the blockchain network.

[0007] Threat 5: Trust issues. On the one hand, the node trust mechanism is maliciously exploited, causing the system to trust the wrong node. On the other hand, attackers may tamper with the trust value and increase the trust value of malicious nodes. Summary of the invention

[0008] In view of the above threats existing in the BFL medical data sharing model, the purpose of the present invention is to provide a medical data privacy protection method based on blockchain trusted consensus and differential privacy. The present invention first designs an adaptive differential privacy algorithm to adjust the amount of noise added to the gradient to strike a balance between the privacy budget and the decrease in precision, and prevents attackers from inferring training data through gradients. Secondly, the Multi-Krum algorithm is used to detect poisoning attacks, and secure aggregation is performed based on digital signatures to ensure the authenticity and integrity of the data source; finally, the present invention proposes a practical Byzantine fault-tolerant consensus protocol Trust-PFBT based on trust, comprehensively considers trust value, trust consistency and trust deviation to conduct trust assessment, and forms a consensus committee to reduce the influence of trust attacks on malicious nodes. From the perspective of security analysis, the adaptive differential privacy algorithm and the secure aggregation algorithm protect the privacy of the data, and Trust-PFBT is robust to double-flower attacks, witch attacks, and similarity attacks. Through experiments, it is found that the invention method can achieve similar accuracy to the original federated learning, and has the ability to reduce privacy budget consumption and resist attacks.

[0009] In order to achieve the above-mentioned purpose, the medical data privacy protection method based on blockchain trusted consensus and differential privacy described in the present invention is composed of the following parts: multiple medical alliances, blockchain;

[0010] The medical alliance includes hospital alliance, pharmaceutical enterprise alliance, scientific research institution alliance, and insurance company alliance. Each medical alliance is composed of multiple institutions.

[0011] The blockchain consists of multiple blocks, including ordinary nodes, accounting nodes and master nodes;

[0012] The ordinary nodes are all nodes that participate in the medical blockchain network but do not have special permissions or roles;

[0013] The accounting node is the alliance leader selected in the medical alliance based on the trust evaluation within the alliance;

[0014] The master node is the accounting node that selects the highest trust evaluation value based on the trust evaluation results between alliances;

[0015] The medical data privacy protection method based on blockchain trusted consensus and differential privacy includes two working stages: blockchain stage and federated learning stage;

[0016] In the blockchain stage, the blockchain replaces the central server of federated learning to store the global model and provide a secure data exchange environment for medical data sharing. This method reduces the risk of single point failure.

[0017] In the federated learning phase, trusted data providers are selected as local federated learning clients based on the trust mechanism. An iterative process of client-server interaction is called a learning round. A complete round of training can be described as the following steps:

[0018] Step-1, Initialization: As data requesters, hospitals, pharmaceutical companies, scientific research institutions and medical insurance departments submit medical data usage requests to the blockchain network, including training objectives and parameters; the blockchain generates a new block and distributes it to all ordinary nodes for initialization; the main information of the generated block includes: ① Initial parameter w0: initial weight and learning rate of the model; ② Total number of training rounds T: total number of training rounds of federated learning; ③ Public key: public keys of all parties involved, used for signing; ④ Initial trust value: initial trust value of the data provider node; ⑤ Trust update function: function used to update the trust value;

[0019] Step-2, Data preparation: Trusted data providers screened based on trust mechanism: The federated learning client prepares local medical data, and other nodes wait for the subsequent learning round to start; the accounting node collects and records the system status, including the number of participating nodes, initial model information, and trust value;

[0020] Step-3, Data training: The federated learning client uses local medical data and global model parameters for local training, and adds adaptive differential privacy noise to the local gradient to protect data privacy;

[0021] Step-4, Gradient upload: The federated learning client digitally signs the noise gradient and uploads the signed noise gradient to the accounting node; the master node generates a nonce random number for each training record to ensure the uniqueness of the record; calculates the hash value of the training record hash(K,nonce), where K represents the summary of the training data;

[0022] Step-5, secure aggregation: the accounting node verifies the legitimacy of the uploaded gradient signature; selects a verification committee composed of high-trust value nodes. The committee detects whether the local gradient contains malicious updates, uses the Multi-Krum algorithm for aggregation, and updates the global model;

[0023] Step-6, New block generation: Based on the trust mechanism, the master node is selected to generate a new block, which contains the current training results and model parameters. The verification committee verifies the correctness and integrity of the new block. Broadcast the valid block and synchronize the ledgers of all accounting nodes.

[0024] Step-7, global model update; ordinary nodes download the latest block from the accounting node, including the global gradient; ordinary nodes update the local model according to the global gradient;

[0025] Step-8: The next round of training starts from Step-2 until the model converges or the maximum number of training rounds T is reached.

[0026] Preferably, the blockchain medical alliance includes a hospital alliance, a pharmaceutical company alliance, a scientific research institution alliance, and an insurance company alliance, and each medical alliance is composed of multiple institutions.

[0027] Preferably, the trusted consensus is a consensus mechanism of a practical Byzantine fault-tolerant algorithm based on trust evaluation (Trust-PBFT); the consensus is mainly divided into two stages; first, in the initial stage of federated learning, ordinary nodes combine the trust mechanism calculation results of each data provider and vote to select a group of accounting nodes among the participants of the federated learning task; to ensure the fairness of the accounting nodes, each accounting node has accounting rights; in this group of accounting nodes, the trust consistency value θ, the comprehensive trust value BT t and trust bias d p,q , select the leader with the highest trust score, the lowest trust consistency value and the lowest trust deviation value as the master node, also known as the aggregator; the master node broadcasts to other accounting nodes when generating a block and initiates a consensus request; the accounting node that receives the request verifies the block and returns the verification result to the master node; when more than 2 / 3 of the accounting nodes verify the block, it means that the consensus is reached; otherwise, re-select the master node from all the accounting nodes and continue the above consensus process; during the verification phase, the accounting node is verified by the trust of the node.

[0028] Preferably, the adaptive differential factor protection mechanism introduces an adaptive differential privacy protection mechanism based on local users in the federated learning stage to reduce the negative impact of noise on model accuracy.

[0029] Preferably, the Multi-Krum algorithm is used to detect poisoning attacks and perform security aggregation based on digital signatures.

[0030] Preferably, the federated learning client in Step-3 utilizes local medical data including: medical records and experimental data.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] 1. This paper proposes an adaptive differential privacy algorithm, which adjusts noise according to the training process, balances privacy and model accuracy, and implements dynamic privacy protection of intermediate gradient parameters of federated learning through differential privacy based on Gaussian mechanism.

[0033] 2. The present invention proposes a security aggregation based on digital signature and Multi-Krum algorithm. The Multi-Krum algorithm is used to detect poisoning attacks, and the digital signature is used to verify the validity of the node.

[0034] 3. The present invention designs a trust-based practical Byzantine fault-tolerant consensus mechanism Trust-PBFT, which comprehensively considers trust value, trust consistency and trust deviation, forms a consensus committee, encourages reliable nodes to contribute their data and computing power to federated learning, and effectively improves the system's fault tolerance. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 For: Threat model in BFL medical sharing model;

[0036] Figure 2 is: a flow chart of the present invention;

[0037] Figure 3 The following is the workflow diagram of the Trust-PBFT trusted consensus algorithm. DETAILED DESCRIPTION

[0038] The present invention is further described in detail below in conjunction with specific implementation modes.

[0039] The present invention proposes a trusted privacy protection method for medical data based on blockchain and federated learning. The system uses blockchain to aggregate data, models and transaction records in the federated learning process, and realizes data privacy calculation and value sharing under the dual protection of trust mechanism and privacy protection.

[0040] like Figure 2As shown in the figure, we considered different medical alliance groups, each of which consists of several medical-related institutions. The model includes ordinary nodes, data provider nodes, accounting nodes and master nodes within the alliance, such as hospitals, pharmaceutical companies, scientific research institutions, insurance institutions, etc. In the blockchain stage, the blockchain replaces the central server of federated learning to provide a secure data exchange environment for federated learning. This method reduces the risk of single point failure. The traceability of the blockchain is used to help federated learning find malicious participants and stop losses and punish them in time. All interactions between participants are recorded as transactions and packaged into blocks on the blockchain for auditability and auditability. The blockchain provides standard processing, aggregation models, and describes the global computing process. If there is a lack of trust between medical institutions, cooperation is impossible, which is one of the motivations of our research. Therefore, only a few nodes with more computing resources and high trust values ​​are allowed to participate in the consensus and mining process and global model training in the process of medical data sharing. Trusted data providers are screened as local federated learning clients based on the trust mechanism. The consensus protocol of the blockchain ensures that both conflicts between nodes and propagation between forked nodes are minimized. This paper proposes a trust-based consensus protocol Trust-PFBT for block creation and verification. Trust value, trust deviation and trust consistency are comprehensively considered to ensure the credibility of the selected nodes. Each medical alliance selects an alliance leader to become a bookkeeping node based on the trust evaluation within the alliance. All bookkeeping nodes select the master node (aggregator) with the highest rating based on the trust evaluation between alliances.

[0041] In the federated learning phase, trusted data providers are selected as local federated learning clients based on the trust mechanism. An iterative process of client-server interaction is called a learning round. A complete round of training can be described as the following steps:

[0042] Step-1, Initialization: Hospitals, pharmaceutical companies, scientific research institutions and medical insurance departments, as data requesters, submit medical data usage requests to the blockchain network, including training objectives and parameters. The blockchain generates a new block and distributes it to all ordinary nodes for initialization. The main information of the generated block includes: ① Initial parameters w0: initial model weights and learning rates, etc. ② Total number of training rounds T: total number of training rounds for federated learning. ③ Public key: public keys of all parties involved, used for signing. ④ Initial trust value: initial trust value of the data provider node. ⑤ Trust update function: function used to update the trust value.

[0043] Step-2, Data Preparation: Trusted data providers (federated learning clients) screened based on the trust mechanism prepare local medical data, and other nodes wait for the subsequent learning rounds to start. Accounting nodes collect and record system status, including the number of participating nodes, initial model information, trust value, etc. to deal with threat 5;

[0044] Step-3, data training: The federated learning client uses local medical data (such as medical records, experimental data, etc.) to perform local training using global model parameters, and adds adaptive differential privacy noise to the local gradient to protect data privacy; to deal with threat 1;

[0045] Step-4, Gradient upload: The federated learning client digitally signs the noisy gradient and uploads the signed noisy gradient to the accounting node. The master node generates a nonce random number for each training record to ensure that the record is unique. Calculate the hash value of the training record hash(K,nonce), where K represents the summary of the training data; to deal with threat 4;

[0046] Step-5, secure aggregation: The accounting node verifies the legitimacy of the uploaded gradient signature. Select a verification committee composed of high-trust nodes. The committee detects whether the local gradient contains malicious updates, aggregates based on the Multi-Krum algorithm, and updates the global model to deal with threat 3;

[0047] Step-6, New block generation: Based on the trust mechanism, the master node is selected to generate a new block, which contains the current training results and model parameters. The verification committee verifies the correctness and integrity of the new block. Broadcast the valid block and synchronize the ledgers of all accounting nodes. To deal with threat 2;

[0048] Step-7, global model update. Ordinary nodes download the latest block from the accounting node, including the global gradient. Ordinary nodes update the local model according to the global gradient;

[0049] Step-8: The next round of training starts from Step-2 until the model converges or the maximum number of training rounds T is reached.

[0050] Trust Mechanism

[0051] Lack of trust between medical institutions makes it difficult to establish a safe and reliable cooperation mechanism. The trust mechanism proposed in this invention has a trust value T t is defined as follows:

[0052] T t =τ t μ t (1)

[0053] Among them, τ t is the trustworthiness of the person being evaluated at time t, μ t is the trust coefficient of the person being evaluated in the tth period, 0<μ t ≤1. If μ t ≥0.5, then the person being evaluated had high credibility in the past.

[0054]

[0055] Where T is the number of cycles, τ t With μ t The trust cooperation reward of medical institutions is CR, which means that data is shared among medical institutions, and these data are recorded as transactions in the blockchain, and each medical institution pays with CR. Trust cooperation value T c The definition of is as follows.

[0056]

[0057] Where N is the number of institutions in the alliance group, i and j represent the evaluator and the evaluated, respectively, and F i,j It represents the feedback information from evaluator i to evaluated person j.

[0058] Definition 1: Similarity. Similarity quantifies the relationship or difference between two data samples. To prevent sparsity and misjudgment of feedback, we quantify the two feedback F p and F q The similarity between them is S(F p ,F q ), where the subscripts p and q represent current feedback and past feedback, respectively. p ,F q ) is a scalar, if S(F p ,F q )=1, it means the feedback data F p and F q are related and very similar and vice versa. p With F q The smaller the distance between them, the greater the similarity. The calculation method of trust deviation and trust similarity is:

[0059]

[0060] S(F p ,F q )=2(d p,q ) 2 -4d p,q +1(6)

[0061] A given similarity S(·) becomes a metric if and only if it satisfies the following conditions:

[0062] 1. Non-negativity: S(F p ,F q )≥0, for any two different trust feedbacks of any medical institution

[0063] 2. Symmetry: S(F p ,F q )=S(Fq ,F p )

[0064] 3. Triangle inequality: S(F p ,F q )=S(F p ,F r )+S(F q ,F r ), for all F p ,F q ,F r

[0065] 4. S(F p ,F q )=0, only when F p =F q

[0066] Definition 2: Trust consistency. Trust consistency θ is based on two feedbacks F p and F q The calculation method of trust consistency θ is as follows:

[0067]

[0068] Among them, θ∈[0,1], η is an adjustable parameter to adjust the consistency of feedback. The higher the value of θ, the higher the F q and F q The greater the consistency.

[0069] Before calculating any trust value, the node's validator checks for trust distortion. Trust distortion means that the trust value has been tampered with by a malicious evaluator, and the degree of distortion can only be given probabilistically, which means that a random distribution rate is added to the trust value. If S(F p ,F q )=1, it means F p and F q There is similarity between them. Otherwise, if S(F p ,F q )=0, then F p and F q There is no similarity between them. If S(F p ,F q ) is small, then F p and F q It's more consistent.

[0070] In order to determine the feedback accuracy, S(F p ,F q ) range is denoted as e. If S(F p ,F q )<e, then we can quantify F pand F q If e is large, it means that F p and F q There are inconsistencies between them, which should be ignored. Algorithm 1 illustrates the specific process of the trust mechanism.

[0071]

[0072]

[0073] Adaptive Differential Privacy

[0074] Differential Privacy (DP) is a method in cryptography and a strictly provable mathematical framework. The basic idea of ​​DP is to add carefully designed noise to the input or output of a function, so that the modification of any single sample in the data set will not have a significant impact on the output, making it difficult for attackers to infer a piece of data in the data set based on the differences in multiple query results.

[0075] Definition 3 (ε, δ) Differential Privacy: For two adjacent datasets D and D', a random algorithm A, and for any output All satisfy the following equation, and algorithm A implements (ε,δ) differential privacy protection.

[0076] Pr[A(D)∈O]≤Pr[A(D')∈O]×e ε +δ (8)

[0077] Among them, Pr represents the probability of an event occurring, where the probability depends on the randomness of the algorithm, ε represents the privacy protection budget, and δ represents the failure rate. The smaller (ε,δ), the higher the privacy. Generally speaking, the parameter δ will take a fairly small value to improve availability while keeping privacy roughly unchanged.

[0078] At present, differential privacy can be divided into centralized differential privacy and localized differential privacy. The mainstream method to achieve differential privacy protection is to add disturbance noise, generally using Laplace noise and exponential noise. How much noise does different random algorithms A need to add to provide (ε, δ) differential privacy protection, which is related to the global sensitivity S(f) = max||A(D)-A(D')|| 1og2 related.

[0079] Definition 4 Gaussian mechanism: Let function f, random algorithm A satisfy A=f(D)+L, where L~Gaussian(0,σ 2 ), the probability density function of the added random noise follows a Gaussian distribution, Δf is the global sensitivity S(f) = max||A(D)-A(D')||2, then algorithm A provides (ε,δ) differential privacy.

[0080] The present invention proposes an adaptive differential privacy protection mechanism based on local users, which flexibly adjusts the clipping threshold according to the training process to reduce the negative impact of noise on model accuracy.

[0081] As an optimization of the gradient descent algorithm, the RMSProp optimization algorithm mainly speeds up the convergence speed by adjusting the step size. Its iterative update formula is as follows:

[0082] S[g 2 ] t ←(1-γ)S[g 2 ] t-1 +γ(g t ) 2 (9)

[0083]

[0084] where ρ t represents the model parameters in the tth round of training, g t represents the model gradient, ν is the learning rate, and χ0 is to ensure that the divisor is not zero, which is generally set to 10 -8 , S[g 2 ] t-1 Used to estimate the cumulative square of historical gradients. Given the continuity and gradualness of the optimization process, historical gradients can usually be used to estimate the value of the current gradient. Therefore, S[g 2 ] t-1 It can be regarded as prior knowledge of the current gradient.

[0085] Algorithm threshold To achieve the near-optimal cropping effect, according to the training process, the user cannot obtain the global gradient of the current training round before uploading the gradient. Therefore, this method draws on the idea of ​​RMSProp optimization algorithm and uses prior knowledge Predict the global gradient of this round And use it as the clipping threshold C of this round t ,Right now Where β is the local clipping factor, and the prior knowledge S[g 2 ] t-1 The calculation formula is as follows:

[0086]

[0087] Note that in the first round of training, the prior knowledge Will cause It cannot be used for gradient clipping. Therefore, another prior threshold G is set: when the prior knowledge of the gradient is insufficient at the beginning of training (i.e. ), let the gradient clipping threshold take a fixed value C; when training continues until the prior knowledge satisfies When , let the gradient clipping threshold be

[0088] In summary, in the tth round of training, user i (1≤i≤K) clips the gradient g on the local side i,t And the process of adding noise can be expressed as follows:

[0089]

[0090] From formula (12), we can see that as the model continues to converge, the local clipping threshold C t Will follow The decrease of will make the noise added to the gradient ξ~N(0,(C,σ) 2 I) also becomes smaller and smaller, which helps the model converge in the later stages of training.

[0091] Secure aggregation based on digital signature and Multi-Krum algorithm

[0092] Since the data collected by local users may contain their privacy information and training models requires computing resources, some users are unwilling to participate in data sharing, and some malicious users may even upload false parameters to destroy data sharing. Therefore, when performing global aggregation, it is necessary to remove poisonous updates as much as possible before aggregation. In order to attract more users to share high-quality data and perform computing tasks honestly, this method uses the Multi-Krum algorithm to detect poisoning attacks and performs secure aggregation based on digital signatures.

[0093] Multi-Krum evolved from the Krum aggregation algorithm, a Byzantine fault-tolerant machine learning algorithm based on Euclidean distance. It is an algorithm that ensures that it can still converge in distributed learning when there are Byzantine faults. The algorithm removes possible malicious gradients based on the distance between the gradients uploaded by users. The Krum aggregation algorithm refers to selecting a model that is similar to other models as a global model among several local models. Here, the Euclidean distance is used as the criterion for similarity. Multi-Krum is to execute the Krum algorithm multiple times. Specifically, the Krum algorithm is first executed once, the obtained gradient is deleted from the total, and then the Krum algorithm is iterated again. Finally, the gradient selected in each iteration is subjected to the Krum algorithm to select the final global model. The Multi-Krum algorithm can solve the problem that there are f Byzantine users (2f+2≤R) among the R users participating in the distributed gradient descent algorithm, which coincides with the distributed framework of federated learning. Its core idea is "the minority obeys the majority", that is, those vectors with a smaller sum of square distances to most vectors are taken as legitimate vectors. The Multi-Krum algorithm is as follows:

[0094] In the medical blockchain, assuming that the number of registered users is m and the number of Byzantine users is n, the Euclidean distance between the gradient uploaded by the data provider and its nearest mn-2 gradients is added as the quality score of the gradient:

[0095]

[0096] Among them, i→j represents Belong to One of the most recent mn-2 gradients. Finally, the mn gradients with the lowest quality scores are selected as legitimate updates, signed and aggregated, and the remaining gradients are deleted. At this point, the data provider node DP k The Euclidean distance between the received shares is calculated as:

[0097]

[0098] Use private key sk k right Signature obtained Node DP k Will Upload to the blockchain.

[0099] In the blockchain aggregation phase, the blockchain receives the data provider node DP k After uploading the message, first check the node's identity EID k and timestamp DPt kIs it valid? If valid, verify the validity of the signature using the equation:

[0100]

[0101] Batch verification is performed to reduce the computational overhead on the blockchain. If the verification is successful, the blockchain uses K (k>t) accounting nodes to upload The Euclidean distance between the gradient of the i-th user and the gradient of the j-th user can be reconstructed through Lagrange interpolation, and the legal updated user list L can be selected according to the Multi-Krum algorithm. k Download list L from blockchain, accounting node DP k Locally upload the share f uploaded by the legitimate user i (a k ), i∈L is summed and uploaded to the blockchain, which can reconstruct the aggregation result through Lagrange interpolation. The accounting node downloads the aggregated model parameters from the blockchain and sends them to the users in the area. The users use the updated model parameters for the next round of training, and iterate until the model converges or reaches the ideal model accuracy.

[0102] Trusted Consensus Mechanism (Trust-PFBT)

[0103] The consensus mechanism is a mechanism to ensure that all node data in a distributed environment are consistent. As the core part of the underlying technology of blockchain, it ensures the security and consistency of data. In order to achieve the traceability and review of the parameters of the federated learning model, the global model parameters of each round of iterative training are encrypted and uploaded to the blockchain for storage. Therefore, it is necessary to select a node to record the transaction information of this model parameter update and generate blocks, which involves the consensus mechanism of the blockchain. In the update of the federated learning model, the faster the global parameters are updated, the faster the federated learning process will be completed.

[0104] The present invention proposes a consensus mechanism of a practical Byzantine fault-tolerant algorithm based on trust evaluation (Trust-PBFT). The present invention proposes an iterative committee based on a trust mechanism. First, the system trains the data with a committee of data providers and identifies its convergence trend. Then, any committee member who uploads local updates and contributes to convergence will obtain a higher trust value, and vice versa. In this way, the system can gradually eliminate the negative impact of poisoning attacks. The consensus is mainly divided into two stages. First, in the initial stage of federated learning, ordinary nodes combine the trust mechanism calculation results of each data provider and vote for a group of accounting nodes among the participants of the federated learning task. In order to ensure the fairness of the accounting nodes, each accounting node has the right to account. In this group of accounting nodes, the trust consistency value θ, the comprehensive trust value BT are comprehensively considered. t and trust bias dp,q , select the leader with the highest trust score, trust consistency value and lowest trust deviation value as the master node, also known as the aggregator. The master node broadcasts to other accounting nodes when issuing a block and initiates a consensus request. The accounting node that receives the request verifies the block and returns the verification result to the master node. When more than 2 / 3 of the accounting nodes verify the block, it means that consensus is reached. Otherwise, re-select the master node from all the accounting nodes and continue the above consensus process. During the verification phase, the accounting node is verified by the trust of the node. The Trust-PBFT consensus protocol includes the following stages, such as Figure 3 shown.

[0105] (1) Request stage

[0106] In this phase, the data requester sends a data request message m to the master node.

[0107] (2) Pre-prepare stage

[0108] The master node replays the request to the data provider nodes, sending it using the message digest Digest(m) so that each node gets the original request message.

[0109] (3) Prepare stage

[0110] After receiving the broadcast message from the master node, the accounting node sends the message as a reply to all nodes including the aggregator. If a node receives 2f+1 prepare messages, it is considered "prepared", which means that most nodes have recognized this m.

[0111] (4) Commit phase

[0112] Use Digest(m) to send. If a node receives 2f+1 commits, it means that most nodes have "executed" these m and put the latest block cached by the local node on the chain.

[0113] (5) Reply stage

[0114] Commit means that the node is willing to respond to the master node and other nodes by confirming. This means that if the node receives a commit message by responding to a 2f+1 request, the commit message is sent. The entire process of verifying and validating the message follows the distributed system. In addition, digital signatures are used to prevent the problem of non-repudiation.

[0115] The proposed Trust-PBFT consensus protocol uses trust values ​​to assemble nodes in a federation group, providing fault tolerance, such as the failure of a specific node does not affect the accuracy of the trust management system. There is a leader in each federation group, and the leader with the largest trust value becomes the aggregator, while the leaders of other groups serve as backup nodes. The master node becomes a federation server, which serves requests from client nodes (federation clients) and acts as an arbitrator between backup nodes and client nodes. The leader of the federation group is able to communicate with the nodes within its federation. In addition, the leader can also reach a consensus on the overall changes of the network based on the majority decision principle. The federation client sends a request to the federation server, and the leader node broadcasts the request to the backup nodes. All backup nodes operate on the request and send a response to the federation client, while the client waits for responses from all backup nodes with the same result. The problem of low efficiency of the original Byzantine Fault Tolerance (BFT) algorithm is solved, and the algorithm complexity is reduced from exponential to polynomial level, making the Byzantine Fault Tolerance algorithm feasible in practical system applications.

[0116] Security Analysis

[0117] The security of the proposed system model is proved based on the threat model, and the security of the proposed solution is analyzed from the two aspects of privacy and credibility.

[0118] (1) Privacy Analysis

[0119] Given a privacy budget, it is critical to calculate the privacy loss of differential privacy during training. Based on the moment statistics, the privacy loss of this method is proportional to the number of users and the number of global training rounds. Assuming that the number of users is K and the number of global training rounds is T, the moment statistics of user i (1≤i≤k) in the tth round of training is Total time statistics for

[0120]

[0121] in, This is reflected in the user adding Gaussian noise ξ~N(0,(C t σ) 2 I), The calculation process is as follows:

[0122] Let u0 be a Gaussian distribution N(0,(C t σ) 2 ) is the probability density function of u1 is Gaussian distribution N(1,(C t σ) 2 ) is the probability density function of u is a Gaussian distribution of a mixture of u0 and u1, u = (1-q)u0 + qu1, where q is the sampling probability of the user during local training, then in E2=S x-u [((u(x) / u0(x)) λ ]

[0123] Algorithm satisfies - Differential privacy. In the actual operation of the algorithm, the value range of integer time λ is usually 0≤λ≤100. Since all users add noise ξ~N(0,(C t σ) 2 I) is the same, so all users Same here.

[0124] (2) Credibility Analysis

[0125] The threat actors considered in this study are honest, malicious, and honest but curious. An honest actor is one who legitimately provides accurate trust assessments of the assessed while taking trust factors into account. In contrast, a malicious actor is one who engages in activities that harm the system, including providing false or inaccurate trust assessments. An honest but curious node is one that behaves honestly at some times and maliciously or curiously at other times. This study aims to mitigate possible threats and attacks.

[0126] Definition 5 Trust Malicious Node Detection. Trust Malicious Node Detection occurs when multiple trust relationships exist together with their respective actions. These relationships can be indirect, direct, or recommended trust relationships. These actions can be successful interactions or failed interactions. For each trust relationship, the trust participant performs the following operations:

[0127] 1. Successful interaction: Δ s =v s +1

[0128] 2. Failed interaction: Δ f =v f +1

[0129] 3. No interaction: Δ s =Δ f =0

[0130] Among them, Δs and Δ f are the trust evaluation values ​​of successful and failed interactions, respectively, s and ν f are the trust values ​​of successful and failed interactions, respectively.

[0131] Theorem 1 The trust consensus mechanism Trust-PFBT is robust against Sybil attacks.

[0132] Sybil attack occurs when an attacker in the network creates multiple identities for financial gain or to degrade the proposed system. Here, the attacker tries to disguise himself using different identities. Consider the probability of y success without replacing n nodes from a coalition of r successes and (Nr) failures. This is a hypergeometric distribution (a discrete probability distribution in statistics that describes the number of times that n objects of a specified type are successfully drawn from a finite number of N objects (including M objects of a specified type) (without replacement)), and we determine the number of successes of the attacker when launching a Sybil attack. The expression formula of this hypergeometric function is as follows.

[0133]

[0134] In the formula is the binomial distribution coefficient. We define a threshold Q for the attacker to successfully launch a Sybil attack. In addition, computing resources are also taken into account when performing a Sybil attack, where the attacker is considered to have greater processing power than the authorized nodes in the network. This indicates that the attacker is able to mine and build a fake chain to spread forked nodes with virtual identities throughout the network. p represents the computing power of the attacker, and if p>Q, the attacker will successfully launch Sybil, and vice versa. The Trust-PFBT consensus protocol used in the present invention mitigates Sybil attacks. Before a block is added to the blockchain, it must be verified by the majority of nodes in the network. Only the leader of the alliance organization will be responsible for verification. This means that no other nodes in the network can participate in the consensus process. Here, even if the attacker has a computing resource advantage, he cannot destroy the proposed system because a trust mechanism is used to ensure the credibility of the nodes in the blockchain, and nodes with good credibility participate in the consensus protocol. Therefore, the system is robust to Sybil attacks.

[0135] Theorem 2 The Trust-PFBT consensus mechanism is robust against double-spending attacks.

[0136] When an attacker propagates two transactions using the same token before broadcasting to the entire network, it is called a double-spending attack. This indicates that the attacker will mine two blocks, one of which is real and the other is not. When the validator receives the real block, the attacker will be paid or rewarded, and the fake block and the real block will be mined together. This invention proposes a mechanism to determine the success of a double-spending attack as follows

[0137]

[0138] Among them, Ψ∈[0,1] is the degree of compromise when the double-spending attack is successful, ρ i is the computational cost of the double-spending attack, and M is the number of successful double-spending attacks. If Ψ>Θ, the double-spending attack succeeds; otherwise, it does not succeed. Therefore, the double-spending attack cannot successfully oppose the Trust-PFBT consensus mechanism.

[0139] Theorem 3 The trust consensus mechanism Trust-PFBT has good robustness against similarity attacks.

[0140] When malicious users try to exploit the defects of the trust mechanism, modify the trust value, and generate a false trust consistency value, similarity attacks may occur. The proposed trust consensus mechanism Trust-PFBT solves similarity attacks because the trust value is not used alone to evaluate the node, so factors such as consistency and trust bias are also considered. Consistency ensures that the modified trust value is easy to detect. Assume that the trust consistency value of attacker a is denoted as θ a , if θ a > 0, the attacker successfully launches a similarity attack. However, it is difficult for the attacker to achieve θ a > 0, because for each cycle, F p and F q are evaluated by the verifier, the attacker's S(F p ,F q ) cannot satisfy the similarity metric. Therefore, the proposed Trust-PFBT consensus protocol is robust to similarity attacks.

[0141] The above descriptions are only some specific implementation methods of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any person familiar with the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. The medical data privacy protection method based on blockchain trusted consensus and differential privacy consists of the following parts: Multiple medical alliances and blockchains; The medical alliance includes hospital alliance, pharmaceutical enterprise alliance, scientific research institution alliance, and insurance company alliance. Each medical alliance is composed of multiple institutions. The blockchain consists of multiple blocks, including ordinary nodes, accounting nodes and master nodes; The ordinary nodes are all nodes that participate in the medical blockchain network but do not have special permissions or roles; The accounting node is the alliance leader selected in the medical alliance based on the trust evaluation within the alliance; The master node is the accounting node that selects the highest trust evaluation value based on the trust evaluation results between alliances; The medical data privacy protection method based on blockchain trusted consensus and differential privacy includes two working stages: blockchain stage and federated learning stage; In the blockchain stage, the blockchain replaces the central server of federated learning to store the global model and provide a secure data exchange environment for medical data sharing. This method reduces the risk of single point failure. In the federated learning phase, trusted data providers are selected as local federated learning clients based on the trust mechanism. An iterative process of client-server interaction is called a learning round. A complete round of training can be described as the following steps: Step-1, Initialization: As data requesters, hospitals, pharmaceutical companies, scientific research institutions and medical insurance departments submit medical data usage requests to the blockchain network, including training objectives and parameters; the blockchain generates a new block and distributes it to all ordinary nodes for initialization; the main information of the generated block includes: ① Initial parameter w0: initial weight and learning rate of the model; ② Total number of training rounds T: total number of training rounds of federated learning; ③ Public key: public keys of all parties involved, used for signing; ④ Initial trust value: initial trust value of the data provider node; ⑤Trust update function: a function used to update the trust value; Step-2, Data preparation: Trusted data providers screened based on the trust mechanism: The federated learning client prepares local medical data, and other nodes wait for the subsequent learning round to start; The accounting node collects and records the system status, including the number of participating nodes, initial model information, and trust value; Step-3, Data training: The federated learning client uses local medical data and global model parameters for local training, and adds adaptive differential privacy noise to the local gradient to protect data privacy; Step-4, Gradient upload: The federated learning client digitally signs the noise gradient and uploads the signed noise gradient to the accounting node; the master node generates a nonce random number for each training record to ensure the uniqueness of the record; Calculate the hash value of the training record hash(K,nonce), where K represents the summary of the training data; Step-5, secure aggregation: the accounting node verifies the legitimacy of the uploaded gradient signature; selects a verification committee composed of high-trust value nodes. The committee detects whether the local gradient contains malicious updates, uses the Multi-Krum algorithm for aggregation, and updates the global model; Step-6, New block generation: Based on the trust mechanism, the master node is selected to generate a new block, which contains the current training results and model parameters. The verification committee verifies the correctness and integrity of the new block. Broadcast the valid block and synchronize the ledgers of all accounting nodes. Step-7, global model update; ordinary nodes download the latest block from the accounting node, including the global gradient; ordinary nodes update the local model according to the global gradient; Step-8: The next round of training starts from Step-2 until the model converges or the maximum number of training rounds T is reached.

2. The medical data privacy protection method based on blockchain trusted consensus and differential privacy according to claim 1 is characterized by: The blockchain medical alliance includes hospital alliances, pharmaceutical company alliances, scientific research institution alliances, and insurance company alliances. Each medical alliance is composed of multiple institutions.

3. The medical data privacy protection method based on blockchain trusted consensus and differential privacy according to claim 1 is characterized by: The trusted consensus is a consensus mechanism based on a practical Byzantine fault-tolerant algorithm for trust evaluation (Trust-PBFT). The consensus is mainly divided into two stages. First, in the initial stage of federated learning, ordinary nodes combine the trust mechanism calculation results of each data provider and vote to select a group of accounting nodes among the participants of the federated learning task. In order to ensure the fairness of the accounting nodes, each accounting node has the right to record accounts. In this group of accounting nodes, the trust consistency value θ, the comprehensive trust value BT and the trust consistency value θ are comprehensively considered. t and trust bias d p,q ,The leader with the highest trust score, the lowest trust consistency value, and the lowest trust deviation value is selected as the master node, also known as the aggregator; When the master node generates a block, it broadcasts it to other accounting nodes and initiates a consensus request. The accounting nodes that receive the request verify the block and return the verification result to the master node. When more than 2 / 3 of the accounting nodes verify the block, it means that the consensus is reached. Otherwise, the master node is reselected from all accounting nodes and the above consensus process continues; during the verification phase, the accounting node is verified through the trustworthiness of the node.

4. The medical data privacy protection method based on blockchain trusted consensus and differential privacy according to claim 1 is characterized by: The adaptive differential factor protection mechanism introduces an adaptive differential privacy protection mechanism based on local users in the federated learning stage to reduce the negative impact of noise on model accuracy.

5. The medical data privacy protection method based on blockchain trusted consensus and differential privacy according to claim 1 is characterized by: The Multi-Krum algorithm is used to detect poisoning attacks and perform secure aggregation based on digital signatures.

6. The medical data privacy protection method based on blockchain trusted consensus and differential privacy according to claim 1 is characterized by: The federated learning client described in Step-3 utilizes local medical data including: medical records and experimental data.

Images