Federal learning privacy protection method based on cross-chain technology

Abstract

According to the federated learning privacy protection method based on the cross-chain technology provided by the invention, the independent encryption key and decryption key are distributed to the client and the aggregator through the key authorization center, so that the data security is improved. A client encrypts a local model and then uploads the local model to a server, and when an aggregator downloads an encryption model, whether the encryption model is tampered or not needs to be verified and then partial decryption needs to be carried out, so that the accuracy and security of data in the encryption model to be aggregated are ensured; the encryption model is partially decrypted and aggregated through the aggregator, so that the aggregator cannot access all data in the encryption model, and training data of the encryption model is prevented from being restored from the aggregator; and the client side aggregates the partial decryption global model downloaded from the server, so that the client side cannot contact original data used by other client side training models, and the privacy of federal learning is improved.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to a method for protecting the privacy of federated learning based on cross-chain technology. Background Art

[0002] With the development of machine learning technology, artificial intelligence technology has been applied in many industries. Since training artificial intelligence models requires a large amount of data, it is necessary to integrate data from multiple parties. However, due to the constraints of relevant laws and regulations, policy supervision, commercial secrets, personal privacy and other data privacy security, some industries are almost unable to integrate data from different companies.

[0003] Currently, most of the above problems can be circumvented by adopting federated learning. Federated learning technology can encrypt and upload local models trained by different clients, and then aggregate the encrypted models uploaded by multiple clients through an aggregator to form a global model.

[0004] However, in existing federated learning privacy protection methods, they often only focus on privacy protection in a single training round. The local models uploaded by the client are aggregated through a single aggregator that can directly access the global model. After multiple rounds of training, the local model can be restored from the global model by the aggregator, which leads to the privacy leakage of the client. Summary of the invention

[0005] In view of this, the purpose of this application is to propose a federated learning privacy protection method based on cross-chain technology.

[0006] Based on the above purpose, the present application provides a method for privacy protection of federated learning based on cross-chain technology, wherein the method is implemented by a key authorization center, a server, an aggregator and a client. The method includes: the key authorization center generates an encryption key for the client, and generates a decryption key corresponding to the encryption key for the aggregator. The client encrypts the pre-trained local model based on the encryption key, generates an encrypted model and uploads it to the server. The aggregator downloads the encrypted model from the server and verifies whether the encrypted model has been tampered with. In response to the encryption model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key, generates a partially decrypted global model, and uploads the partially decrypted global model to the server. The client downloads the partially decrypted global model from the server and verifies whether the partially decrypted global model has been tampered with. In response to the partially decrypted global model not being tampered with, the client aggregates the partially decrypted global model into a global model, and optimizes the local model based on the global model.

[0007] In some embodiments, there are multiple clients and aggregators, and the client chain and the aggregator chain are constructed based on blockchain technology. The client chain and the aggregator chain are connected based on the relay chain protocol. All clients are registered on the client chain, and all aggregators are registered on the aggregator chain.

[0008] In some embodiments, after the encryption model is generated and uploaded to the server, the method further includes: the client calculates a first hash value based on the first file information of the encryption model. The client obtains a first signature key from a key authorization center, generates a first digital signature based on the first hash value and the first signature key. The first file information, the first hash value and the first digital signature are packaged into a first transaction and uploaded to the client chain.

[0009] In some embodiments, verifying whether the encryption model has been tampered with further includes: the aggregator accesses the client chain based on the relay chain protocol to obtain the first transaction. Based on the encryption model downloaded from the server, the second file information is obtained, a second hash value of the second file information is calculated, and the second hash value is compared with the first hash value. The aggregator obtains the first verification key from the key authority, generates a second digital signature based on the first verification key and the second hash value, and compares the second digital signature with the first digital signature. In response to the second hash value being equal to the first hash value, the second digital signature is the same as the first digital signature, and the encryption model has not been tampered with.

[0010] In some embodiments, after uploading the partially decrypted global model to the server, the method further includes: the aggregator calculates a third hash value based on the third file information of the partially decrypted global model. The aggregator obtains a second signature key from the key authority, generates a third digital signature based on the third hash value and the second signature key. The third file information, the third hash value and the third digital signature are packaged as a second transaction and uploaded to the aggregator chain.

[0011] In some embodiments, verifying whether the partially decrypted global model has been tampered with further includes: the client accesses the aggregator chain based on the relay chain protocol to obtain a second transaction. Based on the partially decrypted global model downloaded from the server, fourth file information is obtained, a fourth hash value of the fourth file information is calculated, and the fourth hash value is compared with the third hash value. The client obtains a second verification key from the key authority, calculates a fourth digital signature based on the second verification key and the fourth hash value, and compares the fourth digital signature with the third digital signature. In response to the fourth hash value being equal to the third hash value, the fourth digital signature is the same as the third digital signature, and the partially decrypted global model has not been tampered with.

[0012] In some embodiments, in response to the encrypted model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key to generate a partially decrypted global model, specifically including: distributing the encrypted model to multiple aggregators for partial decryption based on a multi-client threshold function encryption scheme, aggregating the partially decrypted encrypted model based on all aggregators to generate a partially decrypted global model, and uploading the partially decrypted global model to the server.

[0013] In some embodiments, partially decrypted encryption models are aggregated based on all aggregators, specifically including: setting weights for encryption models from different clients, and aggregating encryption models with different weights according to a multi-client threshold function encryption scheme.

[0014] In some embodiments, the local model is optimized based on the global model, specifically including: taking the global model as the local model and performing a new round of training on the local model.

[0015] In some embodiments, before the key authority generates an encryption key for the client, the method further includes: setting an iteration number, and repeatedly executing the above method based on the iteration number.

[0016] From the above, it can be seen that the federated learning privacy protection method based on cross-chain technology provided by the present application distributes independent encryption keys and decryption keys to the client and aggregator through the key authorization center, thereby improving the security of the data; the client encrypts the local model and then uploads it to the server. When the aggregator downloads the encrypted model, it is necessary to first verify whether the encrypted model has been tampered with, and then partially decrypt the encrypted model that has not been tampered with, so as to ensure the accuracy and security of the data in the encrypted model to be aggregated; the encrypted model is partially decrypted and aggregated by the aggregator, so that the aggregator cannot access all the data in the encrypted model, and the training data of the encrypted model is prevented from being restored from the aggregator; the aggregator encrypts the partially decrypted global model and uploads it to the server, and the client then verifies the partially decrypted global model downloaded from the server, and aggregates the verified partially decrypted global model, so that the client cannot access the original data used by other client training models, thereby improving the privacy of federated learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1This is a flowchart of a method for protecting privacy in federated learning based on cross-chain technology according to an embodiment of the present application;

[0019] Figure 2 A schematic diagram of a process for uploading encrypted model information provided in another embodiment of the present application;

[0020] Figure 3 A schematic diagram of a flow chart of encryption model information verification provided by another embodiment of the present application;

[0021] Figure 4 A schematic diagram of a process for uploading partially decrypted global model information provided by another embodiment of the present application;

[0022] Figure 5 A schematic diagram of a process for partially decrypting global model information verification provided in another embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0024] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0025] It is understandable that before using the technical solutions of each embodiment of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0026] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can independently choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0027] As an optional but non-limiting implementation, in response to receiving the user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0028] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0029] Federated learning methods in the prior art usually only focus on privacy protection within a single training round, relying on a single aggregator that has direct access to the decrypted global model. However, after multiple training rounds, the local model may be able to recover from the global model. To solve this problem, we can disperse the single aggregator into multiple aggregators. Each aggregator only holds a partially decrypted global model, and the combination of multiple partially decrypted federated models can form a complete global model. Using the tMCFE scheme, we can achieve the aggregation of encrypted partial global models of multiple aggregators by clients and the aggregation of encrypted local models of multiple clients by aggregators.

[0030] The multi-client threshold functional encryption scheme is also called the tMCFE scheme, which stands for threshold multi-client functional encryption. Functional encryption means that given the ciphertext of a message x, the decryptor can directly obtain the function value f(x) about x without knowing x. Multi-client means that the ciphertext of the input x comes from multiple parties, that is, f(x1,x2,..,xn), and the threshold means that the function f is not completed by a single entity, but multiple entities can realize the function of f together.

[0031] Among them, the tMCFE scheme includes six algorithms:

[0032] (1) Setup: Initialization, generating public parameters pp and master key msk. The public parameters are available to all entities, while the master key is available only to the key authorization center.

[0033] (2)SKDistribute: encryption key generation;

[0034] (3)DKGenerate: Decryption key generation;

[0035] (4)Encrypt: information encryption;

[0036] (5) ShareDecrypt: partial decryption;

[0037] (6)CombineDecrypt: Complete decryption.

[0038] See also Figure 1 The embodiment of the present invention provides a method for protecting privacy in federated learning based on cross-chain technology, wherein the method is implemented by a key authorization center, a server, an aggregator, and a client, and includes the following steps:

[0039] S1, the key authorization center generates an encryption key for the client and generates a decryption key corresponding to the encryption key for the aggregator.

[0040] In this embodiment, the key authorization center is used to distribute encryption and decryption keys when the client and the aggregator upload or download data to the server. In order to ensure the security of the data, the encryption and decryption keys are preferably asymmetric encryption keys.

[0041] Specifically, the method of generating the encryption key and the decryption key includes:

[0042] The key authority runs the initialization algorithm to generate the public parameter pp and the master key msk. Given the security parameter λ as input, a group (G, p, g) is selected, where G is a cyclic group, p is a prime number, and g is a generator. A vector and two matrices are randomly generated, represented as and Finally, output the public parameters pp = (G, p, g) and the master secret key

[0043] The key authorization center runs the encryption key generation algorithm to generate an encryption key ek for client i i . Take the public parameter pp, the master secret key msk and the client identifier i∈[n] as input and output the encryption key

[0044] The key authorization center runs the decryption key generation algorithm to generate a functional decryption key dk for aggregator j j . With public parameters pp, master secret key msk, function vector y=(y1,y2,…,y n ), the aggregator identifier j∈[s] and the threshold t are taken as input, and a set of polynomial functions are defined as follows: in Compute the functional decryption key dk of aggregator j∈[s] j =(v j,0 ,v j,1 ) is as follows: j,0 =f (0) (j),v j,1 ={f (i) (j)} i∈[n] .

[0045] S2, the client encrypts the pre-trained local model based on the encryption key, generates an encrypted model and uploads it to the server.

[0046] The client is deployed locally in the organization participating in the training, and the pre-trained local model is encrypted based on the encryption key generated by the key authorization center, and then the encrypted model is uploaded to the server, thereby preventing unauthorized devices from directly accessing the local model. The local model can be trained on the client, or it can be trained on a separate model training device and then input to the client. Users can make reasonable choices for model training methods based on actual application needs.

[0047] Specifically, the pre-trained local model x i The encryption algorithm also includes: the client runs the encryption algorithm based on the encryption key ek i and local model x i , calculate the encryption model ct i =(ct i,0 ,ct i,1 )as follows: where r i ←Z p .

[0048] S3, the aggregator downloads the encrypted model from the server and verifies whether the encrypted model has been tampered with. In response to the encrypted model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key, generates a partially decrypted global model, and uploads the partially decrypted global model to the server.

[0049] Among them, the aggregator is used to partially decrypt and aggregate the encrypted model, so that the aggregator can aggregate the encrypted model without obtaining the client's local model, avoiding the restoration of the local model training data, and verifying the encrypted model to avoid erroneous data from interfering with the generation of the global model.

[0050] Specifically, the aggregator partially decrypts the encrypted model based on the decryption key, and generating the partially decrypted global model also includes: using the public parameter pp, the encrypted model {ct j} i∈[n] , decryption key {dk j} j∈S As input, we compute the partially decrypted global model {ct′ j} j∈S .

[0051] S4, the client downloads the partially decrypted global model from the server and verifies whether the partially decrypted global model has been tampered with. In response to the partially decrypted global model not being tampered with, the client aggregates the partially decrypted global model into a global model and optimizes the local model based on the global model.

[0052] Among them, after the client obtains the partially decrypted global model from the server, it verifies the partially decrypted global model. After confirming that the obtained partially decrypted global model has not been tampered with, it decrypts the partially decrypted global model into a global model, and uses the global model to further optimize the local model.

[0053] Specifically, aggregating the partially decrypted global model into a global model further includes: using the public parameter pp and the partially decrypted global model {ct′ j} j∈S As input, verify whether If the verification passes, the global model x is calculated as follows:

[0054]

[0055] x=logx′

[0056] In some embodiments, there are multiple clients and aggregators, and the client chain and the aggregator chain are constructed based on blockchain technology. The client chain and the aggregator chain are connected based on the relay chain protocol. All clients are registered on the client chain, and all aggregators are registered on the aggregator chain.

[0057] In this embodiment, multiple clients respectively encrypt and upload local models trained based on the data of their own organizations, and implement federated machine learning by aggregating multiple encrypted models through an aggregator; by setting up multiple aggregators, the encrypted models uploaded by the client are dispersed in multiple aggregators for decryption and aggregation processing, thereby increasing the difficulty of recovering the local model.

[0058] Among them, by constructing a client chain and an aggregator chain, and making all clients register on the client chain, and all aggregators register on the aggregator chain, both clients and aggregators can be identified through on-chain information, preventing malicious users from forging devices or hijacking on-chain devices, causing additional losses.

[0059] In some embodiments, Figure 2 As shown, after S2, it also includes:

[0060] S21, the client calculates a first hash value based on the first file information of the encryption model.

[0061] In this embodiment, the first file information info i Includes: Encrypted model index on the serveri , the model file ct of the encrypted model i , and the number of iterations of the encryption model τ, where i is the serial number of the client that uploaded the encryption model. Set the first file information info i =(τ,ct i ,ind i ), then the first hash value htx is calculated based on the first information i =H(info i ). The first hash value is used to represent the state of the encrypted model after it is uploaded. When the encrypted model is tampered with after it is uploaded, the hash value calculated based on the file information of the tampered encrypted model will also change accordingly. By calculating the hash value of the encrypted model from the server and comparing it with the first hash value, the encrypted model can be prevented from being tampered with.

[0062] S22, the client obtains a first signing key from a key authorization center, generates a first digital signature based on the first hash value and the first signing key.

[0063] Among them, the first signature key sgk i The first digital signature σ used to generate the encryption model i , calculate the first digital signature σ through the digital signature scheme DS i =DS.Sign(sgk i ,htx i ), since the first digital signature is calculated based on the first hash value, and the first signature key sgk obtained by different clients from the key authority center i Therefore, by reading the first digital signature, the serial number of the client that uploaded the current encryption model can be determined.

[0064] S23, packaging the first file information, the first hash value and the first digital signature into a first transaction and uploading it to the client chain.

[0065] Among them, set the first transaction By putting the first file information info i 、The first hash value htx i With the first digital signature σ i Packaged as the first transaction It is uploaded to the client chain and blockchain technology is used to prevent file information from being tampered with, so that subsequent access to the encrypted model only requires verifying the first transaction corresponding to it on the client chain to confirm whether the encrypted model has been tampered with.

[0066] In some embodiments, Figure 3 As shown, S3 also includes:

[0067] S31, the aggregator accesses the client chain based on the relay chain protocol to obtain the first transaction.

[0068] In this embodiment, since the aggregator cannot directly access the information on the client chain, it is necessary to perform cross-chain operations based on the relay chain protocol, with the aggregator chain as the source chain and the client chain as the target chain. By obtaining the first transaction, the original information after the encrypted model is uploaded to the server is obtained, which is convenient for subsequent comparison operations. After obtaining the first transaction, it is also necessary to obtain the first transaction obtained from the client chain. Parse it and it is parsed as (τ, ind i ,htx i ,i,σ i ). When τ is the same as the number of iterations τ′ currently processed by the aggregator, that is, τ′=τ, it is determined that the first transaction and its corresponding encryption model are the encryption models that the aggregator needs to process in the current round. In some optional embodiments, the verification operation for the number of iterations can also be set before downloading the encryption model, thereby reducing the bandwidth consumption of downloading the encryption model.

[0069] S32, obtaining second file information based on the encryption model downloaded from the server, calculating a second Hash value of the second file information, and comparing the second Hash value with the first Hash value.

[0070] The encryption model stored on the server may be tampered with due to special circumstances. The encryption model downloaded from the server may be different from the encryption model uploaded by the client. Therefore, it is necessary to verify the encryption model downloaded from the server and verify the integrity of the encryption model by calculating the hash value of the file. Specifically, the second file information info′ is set i =(τ′,ct′ i ,ind′ i ), where ct′ i is the encrypted model downloaded by the aggregator from the server, ind′ i Get ct′ for the aggregator j Based on the second file information info' j Calculate the second hash value htx′ j =H(info′ i ), when htx′ i =htx i , it confirms that the encrypted model downloaded from the server has not been tampered with.

[0071] S33, the aggregator obtains the first verification key from the key authorization center, generates a second digital signature based on the first verification key and the second hash value, and compares the second digital signature with the first digital signature.

[0072] The key authorization center issues the corresponding first verification key {vk i} i∈[n] , the aggregator obtains the corresponding first verification key vk i Generate a second digital signature. When the second digital signature Dk.Verify(vk i ,htx i ,σ i )=1, the first signature is determined to be a legitimate signature, thereby verifying that the client that uploaded the corresponding encryption model is not a forged client.

[0073] S34, in response to the second hash value being equal to the first hash value, the second digital signature being identical to the first digital signature, and the encryption model not being tampered with.

[0074] In some embodiments, Figure 4 As shown, after S3, it also includes:

[0075] S301, the aggregator calculates a third hash value based on the third file information of the partially decrypted global model.

[0076] In this embodiment, similar to the above steps, after the aggregator uploads the partially decrypted global model to the server, it is also necessary to obtain the partially decrypted global model ct′ j The third file information info j =(τ,ct′ j ,ind j ), where ind j is the index of the partially decrypted global model on the server. Where j is the serial number of the aggregator that uploaded the partially decrypted global model. Then the hash value is calculated based on the third file information, htx j =H(info j ).

[0077] S302, the aggregator obtains the second signature key from the key authorization center, generates a third digital signature based on the third hash value and the second signature key.

[0078] Among them, the second signature key sgk j The third digital signature σ used to generate the partially decrypted global model j , calculate the third digital signature σ through the digital signature scheme DS j =DS.Sign(sgk j ,htx j ).

[0079] S303, package the third file information, the third hash value and the third digital signature into a second transaction and upload it to the aggregator chain.

[0080] Among them, set the second transaction By passing the third file information info j 、The third hash value htx j With the third digital signature σ j Packaged as the second transaction And upload to the aggregator chain.

[0081] In some embodiments, Figure 5 As shown, step S4 also includes:

[0082] S41, the client accesses the aggregator chain based on the relay chain protocol to obtain the second transaction.

[0083] In this embodiment, similar to the above steps, the client needs to perform cross-chain operations based on the relay chain protocol, using the client chain as the source chain and the client chain as the target chain to obtain the second transaction And parse the second transaction as (τ′, ind j ,htx j ,j,σ j ), when τ′=τ, it is determined that the second transaction and its corresponding partial decryption global model are the partial decryption global models that the client needs to obtain in the current round.

[0084] S42, obtaining fourth file information based on the partially decrypted global model downloaded from the server, calculating a fourth Hash value of the fourth file information, and comparing the fourth Hash value with the third Hash value.

[0085] Among them, the fourth file information info' is set j =(τ,ct″ j ,ind′ j ), where ct″ j The decrypted global model for the part downloaded by the client from the server, ind′ j Get ct″ for the client j Based on the fourth file information info' j Calculate the fourth hash value htx′ j =H(info′ j ), when htx′ j =htx j , it is confirmed that the partially decrypted global model downloaded from the server has not been tampered with.

[0086] S43, the client obtains a second verification key from the key authorization center, calculates a fourth digital signature based on the second verification key and the fourth hash value, and compares the fourth digital signature with the third digital signature.

[0087] The key authorization center issues the corresponding second verification key {vk j} j∈[s] , the client obtains the corresponding second verification key vk j Generate a fourth digital signature. When the fourth digital signature DS.Verify(vk j ,htx′ j ,σ′ j )=1, the third signature is determined to be a legitimate signature, thereby verifying that the aggregator that uploaded the corresponding part of the decrypted global model is not a forged aggregator.

[0088] S44, in response to the fourth hash value being equal to the third hash value, and the fourth digital signature being identical to the third digital signature, the partially decrypted global model has not been tampered with.

[0089] In some embodiments, in response to the encrypted model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key to generate a partially decrypted global model, specifically including:

[0090] Based on the multi-client threshold function encryption scheme, the encrypted model is distributed to multiple aggregators for partial decryption, the partially decrypted encrypted model is aggregated based on all aggregators, a partially decrypted global model is generated, and the partially decrypted global model is uploaded to the server.

[0091] In this embodiment, multiple encrypted models uploaded by multiple clients are distributed to multiple aggregators, so that each aggregator cannot obtain all the information included in the global model when aggregating the encrypted models, thereby ensuring the security of the original data used by the client to train the local model. As a preferred implementation, during multiple rounds of training, different encrypted model data from different clients or different client combinations can also be distributed to the same aggregator, thereby greatly increasing the difficulty for the aggregator to recover the original data of the client.

[0092] In some embodiments, partially decrypted encryption models are aggregated based on all aggregators, specifically including: setting weights for encryption models from different clients, and aggregating encryption models with different weights according to a multi-client threshold function encryption scheme.

[0093] In this embodiment, the values ​​of encrypted models uploaded by different clients vary greatly due to the influence of computing power, data set characteristics and other related factors in different organizations. Therefore, by setting different weights for different clients, during the aggregation process, clients under organizations with stronger computing power or richer data sets have higher weights, thereby improving the accuracy of model aggregation.

[0094] Specifically, setting weights for encryption models from different clients and aggregating encryption models with different weights according to the multi-client threshold function encryption scheme also includes: using the public parameter pp, the encryption model {ct j} i∈[n] , function vector y=(y1,y2,…,y n ), aggregator S, decryption key {dk j} j∈S and threshold t as input, if |S| ≥ t, then the partial decryption global model {ct′ j} j∈S as follows:

[0095]

[0096] Where L j (0) is a Lagrange polynomial, defined as

[0097] In some embodiments, the local model is optimized based on the global model, specifically including: taking the global model as the local model and performing a new round of training on the local model.

[0098] In this embodiment, the local model is further optimized by replacing the global model with the local model and performing a new round of training on the local model based on the data generated by the organization where the client is located.

[0099] In some embodiments, before the key authority generates an encryption key for the client, the method further includes: setting an iteration number, and repeatedly executing steps S1 to S4 based on the iteration number.

[0100] In this embodiment, the number of iterations is set and steps S1 to S4 are repeatedly performed according to the number of iterations, so that the output result of the global model gradually converges. The number of iterations can be reasonably selected according to actual application needs.

[0101] It can be seen from the above embodiments of the present application that the federated learning privacy protection method based on cross-chain technology provided by the present application distributes independent encryption keys and decryption keys to the client and the aggregator through the key authorization center, thereby improving the security of the data; the client encrypts the local model and then uploads it to the server. When the aggregator downloads the encrypted model, it is necessary to first verify whether the encrypted model has been tampered with, and then partially decrypt the encrypted model that has not been tampered with, so as to ensure the accuracy and security of the data in the encrypted model to be aggregated; the encrypted model is partially decrypted and aggregated by the aggregator, so that the aggregator cannot access all the data in the encrypted model, thereby avoiding the training data of the encrypted model from being restored from the aggregator; the aggregator encrypts the partially decrypted global model and uploads it to the server, and the client then verifies the partially decrypted global model downloaded from the server, and aggregates the verified partially decrypted global model, so that the client cannot access the original data used by other client training models, thereby improving the privacy of federated learning.

[0102] In addition, in the present application, the file information generated by the client and the aggregator is recorded by blockchain technology. The client or aggregator obtains information from the target chain based on cross-chain technology and verifies the model obtained from the server to ensure the security of the file; and multiple aggregators are set up, and the encrypted models from multiple clients are partially decrypted and aggregated through multiple aggregators, so that any single aggregator cannot obtain all the information of the encrypted model, thereby avoiding the client's local model from being restored from the aggregator and preventing user privacy leakage; and then by setting weights for different clients, the weight of clients with higher model value in the aggregation is increased, thereby accelerating the convergence of the global model; and by setting the number of iterations, steps S1-S4 are repeatedly executed to increase the accuracy of the model.

[0103] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0104] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] It should be noted that the embodiments of the present application can be further described in the following manner:

[0106] The present application provides a method for privacy protection of federated learning based on cross-chain technology, wherein the method is implemented by a key authorization center, a server, an aggregator, and a client. The method includes: the key authorization center generates an encryption key for the client, and generates a decryption key corresponding to the encryption key for the aggregator. The client encrypts the pre-trained local model based on the encryption key, generates an encrypted model and uploads it to the server. The aggregator downloads the encrypted model from the server and verifies whether the encrypted model has been tampered with. In response to the encryption model not being tampered with, the aggregator partially decrypts the encryption model based on the decryption key, generates a partially decrypted global model, and uploads the partially decrypted global model to the server. The client downloads the partially decrypted global model from the server and verifies whether the partially decrypted global model has been tampered with. In response to the partially decrypted global model not being tampered with, the client aggregates the partially decrypted global model into a global model, and optimizes the local model based on the global model.

[0107] Optionally, there are multiple clients and aggregators, and the client chain and aggregator chain are built based on blockchain technology. The client chain and the aggregator chain are connected based on the relay chain protocol. All clients are registered on the client chain, and all aggregators are registered on the aggregator chain.

[0108] Optionally, after the encryption model is generated and uploaded to the server, the method further includes: the client calculates a first hash value based on the first file information of the encryption model. The client obtains a first signature key from a key authorization center, generates a first digital signature based on the first hash value and the first signature key. The first file information, the first hash value and the first digital signature are packaged into a first transaction and uploaded to the client chain.

[0109] Optionally, verifying whether the encryption model has been tampered with also includes: the aggregator accesses the client chain based on the relay chain protocol to obtain the first transaction. Based on the encryption model downloaded from the server, the second file information is obtained, a second hash value of the second file information is calculated, and the second hash value is compared with the first hash value. The aggregator obtains the first verification key from the key authority, generates a second digital signature based on the first verification key and the second hash value, and compares the second digital signature with the first digital signature. In response to the second hash value being equal to the first hash value, the second digital signature is the same as the first digital signature, and the encryption model has not been tampered with.

[0110] Optionally, after uploading the partially decrypted global model to the server, the method further includes: the aggregator calculates a third hash value based on the third file information of the partially decrypted global model. The aggregator obtains a second signature key from the key authorization center, generates a third digital signature based on the third hash value and the second signature key. The third file information, the third hash value and the third digital signature are packaged as a second transaction and uploaded to the aggregator chain.

[0111] Optionally, verifying whether the partially decrypted global model has been tampered with further includes: the client accesses the aggregator chain based on the relay chain protocol to obtain a second transaction. Based on the partially decrypted global model downloaded from the server, fourth file information is obtained, a fourth hash value of the fourth file information is calculated, and the fourth hash value is compared with the third hash value. The client obtains a second verification key from the key authority, calculates a fourth digital signature based on the second verification key and the fourth hash value, and compares the fourth digital signature with the third digital signature. In response to the fourth hash value being equal to the third hash value, and the fourth digital signature being the same as the third digital signature, the partially decrypted global model has not been tampered with.

[0112] Optionally, in response to the encrypted model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key to generate a partially decrypted global model, specifically including: distributing the encrypted model to multiple aggregators for partial decryption based on a multi-client threshold function encryption scheme, aggregating the partially decrypted encrypted model based on all aggregators to generate a partially decrypted global model, and uploading the partially decrypted global model to the server.

[0113] Optionally, partially decrypted encryption models are aggregated based on all aggregators, specifically including: setting weights for encryption models from different clients, and aggregating encryption models with different weights according to a multi-client threshold function encryption scheme.

[0114] Optionally, the local model is optimized based on the global model, specifically including: taking the global model as the local model and performing a new round of training on the local model.

[0115] Optionally, before the key authorization center generates an encryption key for the client, the method further includes: setting an iteration number, and repeatedly executing the above method based on the iteration number.

[0116] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0117] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0118] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0119] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A privacy protection method for federated learning based on cross-chain technology, where: The method is implemented by a key authorization center, a server, an aggregator and a client; The method comprises: The key authorization center generates an encryption key for the client, and generates a decryption key corresponding to the encryption key for the aggregator; The client encrypts the pre-trained local model based on the encryption key, generates an encrypted model and uploads it to the server; The aggregator downloads the encrypted model from the server and verifies whether the encrypted model has been tampered with; in response to the encrypted model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key, generates a partially decrypted global model, and uploads the partially decrypted global model to the server; The client downloads the partially decrypted global model from the server and verifies whether the partially decrypted global model has been tampered with; in response to the partially decrypted global model not being tampered with, the client aggregates the partially decrypted global model into a global model, and optimizes the local model based on the global model.

2. The method for protecting privacy in federated learning based on cross-chain technology according to claim 1, wherein: There are multiple clients and aggregators, and the client chain and the aggregator chain are constructed based on blockchain technology. The client chain and the aggregator chain are connected based on the relay chain protocol. All the clients are registered on the client chain, and all the aggregators are registered on the aggregator chain.

3. The method for protecting privacy in federated learning based on cross-chain technology according to claim 2, wherein: After the encryption model is generated and uploaded to the server, the method further includes: The client calculates a first hash value based on the first file information of the encryption model; The client obtains a first signing key from the key authorization center, and generates a first digital signature based on the first hash value and the first signing key; The first file information, the first hash value and the first digital signature are packaged into a first transaction and uploaded to the client chain.

4. The method for protecting privacy in federated learning based on cross-chain technology according to claim 3, wherein: The verifying whether the encryption model has been tampered with further comprises: The aggregator accesses the client chain based on the relay chain protocol to obtain the first transaction; Acquire second file information based on the encryption model downloaded from the server, calculate a second Hash value of the second file information, and compare the second Hash value with the first Hash value; The aggregator obtains a first verification key from the key authorization center, generates a second digital signature based on the first verification key and the second hash value, and compares the second digital signature with the first digital signature; In response to the second hash value being equal to the first hash value, the second digital signature is identical to the first digital signature, and the encryption model has not been tampered with.

5. The method for protecting privacy in federated learning based on cross-chain technology according to claim 2, wherein: After uploading the partially decrypted global model to the server, the method further includes: The aggregator calculates a third hash value based on the third file information of the partially decrypted global model; The aggregator obtains a second signing key from the key authority, and generates a third digital signature based on the third hash value and the second signing key; The third file information, the third hash value and the third digital signature are packaged into a second transaction and uploaded to the aggregator chain.

6. The method for protecting privacy in federated learning based on cross-chain technology according to claim 5, wherein: The verifying whether the partially decrypted global model has been tampered with further comprises: The client accesses the aggregator chain based on the relay chain protocol to obtain the second transaction; Acquire fourth file information based on the partially decrypted global model downloaded from the server, calculate a fourth Hash value of the fourth file information, and compare the fourth Hash value with the third Hash value; The client obtains a second verification key from the key authorization center, calculates a fourth digital signature based on the second verification key and the fourth hash value, and compares the fourth digital signature with the third digital signature; In response to the fourth hash value being equal to the third hash value, the fourth digital signature is identical to the third digital signature, and the partially decrypted global model has not been tampered with.

7. The method for protecting privacy in federated learning based on cross-chain technology according to claim 2, wherein: In response to the encrypted model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key to generate a partially decrypted global model, specifically comprising: Based on a multi-client threshold function encryption scheme, the encrypted model is distributed to multiple aggregators for partial decryption, the partially decrypted encrypted model is aggregated based on all the aggregators to generate the partially decrypted global model, and the partially decrypted global model is uploaded to the server.

8. The method for protecting privacy in federated learning based on cross-chain technology according to claim 7, wherein: The aggregating the partially decrypted encryption model based on all the aggregators specifically includes: Weights are set for encryption models from different clients, and encryption models with different weights are aggregated according to a multi-client threshold function encryption scheme.

9. The method for protecting privacy in federated learning based on cross-chain technology according to claim 1, wherein: The optimizing the local model based on the global model specifically includes: The global model is used as the local model, and a new round of training is performed on the local model.

10. The method for protecting privacy in federated learning based on cross-chain technology according to claim 9, wherein: Before the key authorization center generates an encryption key for the client, the method further includes: setting an iteration number, and repeatedly executing the method in claim 1 based on the iteration number.

Images