Cross-chain technology-based federated learning privacy protection method

Abstract

The application provides a cross-chain technology-based federated learning privacy protection method, which distributes independent encryption keys and decryption keys for clients and aggregators through a key authorization center, thereby improving the security of data. The client encrypts the local model before uploading it to the server. When the aggregator downloads the encrypted model, it needs to verify whether the encrypted model has been tampered with before partially decrypting it, thereby ensuring the accuracy and security of the data in the encrypted model to be aggregated. The aggregator partially decrypts the encrypted model and aggregates it, so that the aggregator cannot access all the data in the encrypted model, avoiding the training data of the encrypted model from being restored from the aggregator. The client aggregates the partially decrypted global model downloaded from the server, so that the client cannot access the original data used by other client training models, thereby improving the privacy of federated learning.

Description

Technical Field

[0001] This application relates to the field of machine learning technology, and in particular to a privacy-preserving method for federated learning based on cross-chain technology. Background Technology

[0002] With the development of machine learning technology, artificial intelligence (AI) technology has been applied in multiple industries. Training AI models requires acquiring vast amounts of data, necessitating the integration of data from various sources. However, due to constraints related to laws, regulations, policies, trade secrets, and personal privacy, some industries find it nearly impossible to integrate data from different companies.

[0003] Currently, most of the above problems can be avoided by adopting federated learning. Federated learning technology can encrypt and upload the local models trained by different clients, and then aggregate the encrypted models uploaded by multiple clients through an aggregator to form a global model.

[0004] However, existing privacy protection methods for federated learning often only focus on privacy protection in a single training round. They aggregate the local model uploaded by the client through a single aggregator that can directly access the global model. This allows the local model to be recovered from the global model by the aggregator after multiple training rounds, resulting in privacy leakage for the client. Summary of the Invention

[0005] In view of this, the purpose of this application is to propose a privacy protection method for federated learning based on cross-chain technology.

[0006] To achieve the above objectives, this application provides a privacy-preserving method for federated learning based on cross-chain technology. The method is implemented by a key authorization center, a server, an aggregator, and a client. The method includes: the key authorization center generating an encryption key for the client and a decryption key corresponding to the encryption key for the aggregator; the client encrypting a pre-trained local model using the encryption key to generate an encrypted model and uploading it to the server; the aggregator downloading the encrypted model from the server and verifying whether the encrypted model has been tampered with; in response to the encrypted model not being tampered with, the aggregator partially decrypting the encrypted model using the decryption key to generate a partially decrypted global model and uploading the partially decrypted global model to the server; the client downloading the partially decrypted global model from the server and verifying whether the partially decrypted global model has been tampered with; in response to the partially decrypted global model not being tampered with, the client aggregating the partially decrypted global model into a global model and optimizing the local model based on the global model.

[0007] In some embodiments, there are multiple clients and aggregators. A client chain and an aggregator chain are constructed based on blockchain technology. The client chain and the aggregator chain are connected based on a relay chain protocol. All clients register on the client chain, and all aggregators register on the aggregator chain.

[0008] In some embodiments, after generating the cryptographic model and uploading it to the server, the method further includes: the client calculating a first hash value based on the first file information of the cryptographic model; the client obtaining a first signature key from a key authorization center, generating a first digital signature based on the first hash value and the first signature key; and packaging the first file information, the first hash value, and the first digital signature into a first transaction and uploading it to the client's blockchain.

[0009] In some embodiments, verifying whether the cryptographic model has been tampered with further includes: the aggregator accessing the client chain based on the relay chain protocol to obtain a first transaction; obtaining second file information based on the cryptographic model downloaded from the server, calculating a second hash value of the second file information, and comparing the second hash value with the first hash value; the aggregator obtaining a first verification key from a key authorization center, generating a second digital signature based on the first verification key and the second hash value, and comparing the second digital signature with the first digital signature; and if the second hash value is equal to the first hash value, and the second digital signature is the same as the first digital signature, then the cryptographic model has not been tampered with.

[0010] In some embodiments, after uploading the partially decrypted global model to the server, the method further includes: the aggregator calculating a third hash value based on the third file information of the partially decrypted global model; the aggregator obtaining a second signature key from the key authorization center, generating a third digital signature based on the third hash value and the second signature key; and packaging the third file information, the third hash value, and the third digital signature into a second transaction and uploading it to the aggregator chain.

[0011] In some embodiments, verifying whether the partially decrypted global model has been tampered with further includes: the client accessing the aggregator chain based on the relay chain protocol to obtain a second transaction; obtaining fourth file information based on the partially decrypted global model downloaded from the server; calculating a fourth hash value for the fourth file information; and comparing the fourth hash value with a third hash value. The client obtains a second verification key from the key authorization center, calculates a fourth digital signature based on the second verification key and the fourth hash value, and compares the fourth digital signature with a third digital signature. If the fourth hash value is equal to the third hash value, and the fourth digital signature is identical to the third digital signature, then the partially decrypted global model has not been tampered with.

[0012] In some embodiments, in response to the encryption model not being tampered with, the aggregator partially decrypts the encryption model based on the decryption key to generate a partially decrypted global model. Specifically, this includes: distributing the encryption model to multiple aggregators for partial decryption based on a multi-client threshold function encryption scheme; aggregating the partially decrypted encryption model based on all aggregators to generate a partially decrypted global model; and uploading the partially decrypted global model to the server.

[0013] In some embodiments, the partial decryption of encryption models is aggregated based on the full aggregator, specifically including: setting weights for encryption models from different clients, and aggregating encryption models with different weights according to a multi-client threshold function encryption scheme.

[0014] In some embodiments, optimizing the local model based on the global model specifically includes: using the global model as the local model and performing a new round of training on the local model.

[0015] In some embodiments, before the key authorization center generates an encryption key for the client, the method further includes: setting an iteration number and repeatedly executing the above method based on the iteration number.

[0016] As can be seen from the above, the federated learning privacy protection method based on cross-chain technology provided in this application improves data security by distributing independent encryption and decryption keys to clients and aggregators through a key authorization center. Clients encrypt their local models before uploading them to the server. When the aggregator downloads the encrypted model, it first verifies whether the encrypted model has been tampered with, and then partially decrypts the tamper-proof encrypted model, thus ensuring the accuracy and security of the data within the encrypted model to be aggregated. By having the aggregator partially decrypt and aggregate the encrypted model, the aggregator cannot access all the data within the encrypted model, preventing the training data of the encrypted model from being restored from the aggregator. The aggregator encrypts the partially decrypted global model and uploads it to the server. The client then verifies the partially decrypted global model downloaded from the server and aggregates the verified partially decrypted global model, thus preventing the client from accessing the original data used by other clients to train their models, improving the privacy of federated learning. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1This is a flowchart illustrating a privacy protection method for federated learning based on cross-chain technology, as described in an embodiment of this application.

[0019] Figure 2 This is a schematic diagram illustrating the process of uploading encrypted model information according to another embodiment of this application;

[0020] Figure 3 A schematic diagram illustrating the process of verifying encrypted model information provided in another embodiment of this application;

[0021] Figure 4 This is a schematic diagram illustrating the process of uploading partially decrypted global model information, provided in another embodiment of this application.

[0022] Figure 5 This is a schematic diagram illustrating the process of partially decrypting global model information verification provided in another embodiment of this application. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0024] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0025] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0026] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0027] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0028] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0029] Existing federated learning methods typically focus only on privacy protection within a single training epoch, relying on a single aggregator with direct access to the decrypted global model. However, after multiple training epochs, local models may be able to recover from the global model. To address this issue, we can distribute the single aggregator into multiple aggregators. Each aggregator holds only a partially decrypted global model, and the combination of multiple partially decrypted joint models can form the complete global model. Using the tMCFE scheme, we can achieve client-side aggregation of encrypted partial global models from multiple aggregators, as well as aggregator aggregation of encrypted local models from multiple clients.

[0030] The multi-client threshold function encryption scheme, also known as the tMCFE scheme, stands for threshold multi-client functional encryption. Function encryption means that given a ciphertext of a message x, the decryptor can directly obtain the function value f(x) related to x without knowing x itself. Multi-client means that the ciphertext of the input x comes from multiple parties, i.e., f(x1, x2, ..., xn). Threshold means that the function f is not performed by a single entity, but requires the collaboration of multiple entities to achieve its function.

[0031] The tMCFE scheme includes six algorithms:

[0032] (1) Setup: Initialize and generate public parameter pp and master key msk. The public parameter is available to all entities, while the master key is available only to the key authorization center.

[0033] (2) SKDistribute: Encryption key generation;

[0034] (3) DKGenerate: Decryption key generation;

[0035] (4) Encrypt: Information encryption;

[0036] (5) ShareDecrypt: Partial decryption;

[0037] (6)CombineDecrypt: Complete decryption.

[0038] See Figure 1 This invention provides a privacy protection method for federated learning based on cross-chain technology. The method is implemented by a key authorization center, a server, an aggregator, and a client, and includes the following steps:

[0039] S1, the key authorization center generates an encryption key for the client and a decryption key corresponding to the encryption key for the aggregator.

[0040] In this embodiment, the key authorization center is used to distribute encryption and decryption keys during the process of clients and aggregators uploading or downloading data to the server. To ensure data security, the encryption and decryption keys are preferably asymmetric encryption keys.

[0041] Specifically, the methods for generating encryption and decryption keys include:

[0042] The key authorization center runs an initialization algorithm to generate public parameters pp and the master key msk. Given security parameters λ as input, a group (G, p, g) is chosen, where G is a cyclic group, p is a prime order group, and g is a generator. A vector and two matrices are randomly generated, represented as follows: and Finally, output the public parameters pp = (G, p, g) and the master secret key.

[0043] The key authorization center runs an encryption key generation algorithm to generate an encryption key ek for client i. i The encryption key is output by taking the public parameter pp, the master secret key msk, and the client identifier i∈[n] as input.

[0044] The key authorization center runs a decryption key generation algorithm to generate the decryption key dk for the aggregator j. j The common parameters are pp, the master secret key is msk, and the function vector is y = (y1, y2, ..., y3). n The aggregator identifier j∈[s] and the threshold t are used as inputs, and a set of polynomial functions are defined as follows: in The function decryption key dk for calculating aggregator j∈[s] j =(v j,0 ,v j,1 The following is an example: v j,0 =f (0) (j),v j,1 ={f (i) (j)} i∈[n] .

[0045] S2: The client encrypts the pre-trained local model using an encryption key, generates an encrypted model, and uploads it to the server.

[0046] The client is deployed locally within the participating organization. It encrypts the pre-trained local model using an encryption key generated by the key authorization center before uploading the encrypted model to the server, thus preventing unauthorized devices from directly accessing the local model. The local model can be trained on the client or trained on a separate model training device before being input to the client; users can choose the appropriate training method based on their specific application needs.

[0047] Specifically, the pre-trained local model x i The encryption algorithm also includes: the client running the encryption algorithm based on the encryption key ek. i and local model x i Calculate the encryption model ct i =(ct i,0 ,ct i,1 )as follows: Where r i ←Z p .

[0048] S3, the aggregator downloads the encrypted model from the server and verifies whether the encrypted model has been tampered with. If the encrypted model has not been tampered with, the aggregator partially decrypts the encrypted model based on the decryption key, generates a partially decrypted global model, and uploads the partially decrypted global model to the server.

[0049] The aggregator is used to decrypt and aggregate the encrypted model, so that the aggregator can aggregate the encrypted model without obtaining the client's local model, thus avoiding the local model training data from being restored. Furthermore, by verifying the encrypted model, it prevents erroneous data from interfering with the generation of the global model.

[0050] Specifically, the aggregator partially decrypts the encryption model based on the decryption key, and the generation of the partially decrypted global model also includes: using public parameters pp and the encryption model {ct} j} i∈[n] Decryption key {dk j} j∈S As input, the computation part decrypts the global model {ct′ j} j∈S .

[0051] S4, the client downloads a partially decrypted global model from the server and verifies whether the partially decrypted global model has been tampered with. If the partially decrypted global model has not been tampered with, the client aggregates the partially decrypted global model into a global model and optimizes the local model based on the global model.

[0052] In this process, after the client obtains a partial decryption global model from the server, it verifies the partial decryption global model. After confirming that the obtained partial decryption global model has not been tampered with, it decrypts the partial decryption global model into a global model and uses the global model to further optimize the local model.

[0053] Specifically, aggregating the partially decrypted global model into a global model also includes: using the common parameter pp and the partially decrypted global model {ct′ j} j∈S As input, verify whether All are equal. If the validation passes, the global model x is calculated as follows:

[0054]

[0055] x = logx'

[0056] In some embodiments, there are multiple clients and aggregators. A client chain and an aggregator chain are constructed based on blockchain technology. The client chain and the aggregator chain are connected based on a relay chain protocol. All clients register on the client chain, and all aggregators register on the aggregator chain.

[0057] In this embodiment, multiple clients encrypt and upload their local models trained based on data from their respective organizations. Federated machine learning is achieved by aggregating multiple encrypted models through an aggregator. By setting up multiple aggregators, the encrypted models uploaded by the clients are distributed across multiple aggregators for decryption and aggregation, thereby increasing the difficulty of recovering the local models.

[0058] By constructing a client chain and an aggregator chain, and having all clients register on the client chain and all aggregators register on the aggregator chain, both clients and aggregators can be identified through on-chain information, preventing malicious users from forging devices or hijacking on-chain devices and causing additional losses.

[0059] In some embodiments, such as Figure 2 As shown, after S2, it also includes:

[0060] S21, the client calculates the first hash value based on the first file information of the encryption model.

[0061] In this embodiment, the first file information info i Includes: the index (ind) of the encryption model on the server.i The encrypted model file ct i And the number of iterations τ of the encryption model, where i is the sequence number of the client that uploaded the encryption model. Set the first file information info. i =(τ,ct) i ,ind i Then, based on the first information, the first hash value htx is calculated. i =H(info) i The first hash value represents the state of the encrypted model after it has been uploaded. When the encrypted model is tampered with after being uploaded, the hash value calculated based on the file information of the tampered encrypted model also changes. By calculating the hash value of the encrypted model from the server and comparing it with the first hash value, tampering of the encrypted model can be prevented.

[0062] S22, the client obtains the first signature key from the key authorization center, generates the first digital signature based on the first hash value and the first signature key.

[0063] Among them, the first signing key sgk i The first digital signature σ used to generate the cryptographic model i The first digital signature σ is calculated using the digital signature scheme DS. i =DS.Sign(sgk i ,htx i Since the first digital signature is calculated based on the first hash value, and different clients obtain the first signature key sgk from the key authorization center. i Since they are all different, the client sequence number that uploaded the current encryption model can be determined by reading the first digital signature.

[0064] S23, package the first file information, the first hash value and the first digital signature into the first transaction and upload it to the client chain.

[0065] Among them, the first transaction is set. By using the first file information info i First hash value htx i With the first digital signature σ i Packaged as the first transaction It is then uploaded to the client chain, using blockchain technology to prevent file information from being tampered with. This allows subsequent access to the encrypted model to confirm whether the encrypted model has been tampered with simply by verifying the first transaction corresponding to it on the client chain.

[0066] In some embodiments, such as Figure 3 As shown, S3 also includes:

[0067] S31, the aggregator accesses the client chain based on the relay chain protocol to obtain the first transaction.

[0068] In this embodiment, since the aggregator cannot directly access information on the client chain, cross-chain operations are required based on the relay chain protocol, with the aggregator chain serving as the source chain and the client chain as the target chain. By obtaining the first transaction, the original information of the encrypted model after it was uploaded to the server is obtained, facilitating subsequent comparison operations. After obtaining the first transaction, it is also necessary to process the first transaction obtained from the client chain... The parsing process yields (τ, ind) i ,htx i ,i,σ i Specifically, when τ is the same as the current iteration number τ′ processed by the aggregator (i.e., τ′=τ), it is determined that the first transaction and its corresponding encryption model are the encryption models that the aggregator needs to process in the current round. In some optional embodiments, the verification operation for the iteration number can also be set before downloading the encryption model, thereby reducing the bandwidth consumption of downloading the encryption model.

[0069] S32, based on the encryption model downloaded from the server, obtain the second file information, calculate the second hash value of the second file information, and compare the second hash value with the first hash value.

[0070] The encryption model stored on the server may be tampered with under special circumstances. The encryption model downloaded from the server may differ from the encryption model uploaded by the client. Therefore, it is necessary to verify the encryption model downloaded from the server by calculating the file's hash value to verify its integrity. Specifically, the second file information info' is set. i =(τ′,ct′) i ,ind′ i ), where ct′ i The encrypted model downloaded by the aggregator from the server, ind′ i Get ct′ for the aggregator j Location index. Based on second file information info′ j Calculate the second hash value htx′ j =H(info′) i When htx′ i =htx i If so, it confirms that the encrypted model downloaded from the server has not been tampered with.

[0071] S33, the aggregator obtains the first verification key from the key authorization center, generates a second digital signature based on the first verification key and the second hash value, and compares the second digital signature with the first digital signature.

[0072] Among them, the key authorization center issues the corresponding first verification key {vk} to the aggregator for the encryption model uploaded by the client with different serial numbers. i} i∈[n] The aggregator obtains the corresponding first verification key vk i Generate a second digital signature when the second digital signature is verified by Dk.Verify(vk i ,htx i ,σ i When ) = 1, the first signature is determined to be a valid signature, thus verifying that the client that uploaded the corresponding encryption model is not a forged client.

[0073] S34, in response to the second hash value being equal to the first hash value and the second digital signature being the same as the first digital signature, the encryption model has not been tampered with.

[0074] In some embodiments, such as Figure 4 As shown, after S3, it also includes:

[0075] S301, the aggregator calculates the third hash value based on the third file information of the partially decrypted global model.

[0076] In this embodiment, similar to the steps described above, after the aggregator uploads a portion of the decrypted global model to the server, it also needs to obtain a portion of the decrypted global model ct′. j Third document information info j =(τ,ct′) j ,ind j ), where ind j This is the index of the partially decrypted global model on the server. Here, j is the sequence number of the aggregator that uploaded the partially decrypted global model. Then, a hash value is calculated based on the third file information, htx j =H(info) j ).

[0077] S302, the aggregator obtains the second signature key from the key authorization center, generates a third digital signature based on the third hash value and the second signature key.

[0078] Among them, the second signature key sgk j The third digital signature σ used to generate a partially decrypted global model. j The third digital signature σ is calculated using the digital signature scheme DS. j =DS.Sign(sgk j ,htx j ).

[0079] S303 packages the third file information, the third hash value, and the third digital signature into a second transaction and uploads it to the aggregator chain.

[0080] Among them, a second transaction is set up. By using third-party file information info j The third hash value htx j With third digital signature σ j Packaged as a second transaction And upload it to the aggregator chain.

[0081] In some embodiments, such as Figure 5 As shown, step S4 further includes:

[0082] S41, the client accesses the aggregator chain based on the relay chain protocol to obtain the second transaction.

[0083] In this embodiment, similar to the steps described above, the client needs to perform cross-chain operations based on the relay chain protocol, using the client chain as the source chain and the client chain as the target chain, in order to obtain the second transaction. The second transaction is parsed as (τ′, ind) j ,htx j ,j,σ j When τ′=τ, it is determined that the second transaction and its corresponding partial decryption global model are the partial decryption global model that the client needs to obtain in the current round.

[0084] S42, based on the partially decrypted global model downloaded from the server, obtain the fourth file information, calculate the fourth hash value of the fourth file information, and compare the fourth hash value with the third hash value.

[0085] Among them, setting the fourth file information info′ j =(τ,ct″) j ,ind′ j ), where ct″ j Decrypt the global model partially downloaded by the client from the server, ind′ j Get ct″ for the client j Location index. Based on fourth file information info′ j Calculate the fourth hash value htx′ j =H(info′) j When htx′ j =htx j If so, it confirms that the portion of the decrypted global model downloaded from the server has not been tampered with.

[0086] S43, the client obtains the second verification key from the key authorization center, calculates the fourth digital signature based on the second verification key and the fourth hash value, and compares the fourth digital signature with the third digital signature.

[0087] Specifically, the key authorization center issues a corresponding second verification key {vk} to the client for each aggregator's uploaded partial decryption global model with different serial numbers. j} j∈[s] The client obtains the corresponding second verification key vk j Generate a fourth digital signature when the fourth digital signature DS.Verify(vk j ,htx′ j ,σ′ j When ) = 1, the third signature is determined to be a valid signature, thus verifying that the aggregator that uploads the corresponding part of the decryption global model is not a forged aggregator.

[0088] S44, in response to the fourth hash value being equal to the third hash value and the fourth digital signature being the same as the third digital signature, then the partially decrypted global model has not been tampered with.

[0089] In some embodiments, in response to the cryptographic model not being tampered with, the aggregator partially decrypts the cryptographic model based on the decryption key to generate a partially decrypted global model, specifically including:

[0090] The encryption scheme based on multi-client threshold function distributes the encryption model to multiple aggregators for partial decryption. Based on all aggregators, the partially decrypted encryption model is aggregated to generate a partially decrypted global model, which is then uploaded to the server.

[0091] In this embodiment, by distributing multiple encrypted models uploaded by multiple clients to multiple aggregators, each aggregator cannot obtain all the information included in the global model when aggregating the encrypted models, thus ensuring the security of the original data used by the clients to train their local models. As a preferred implementation, during multiple rounds of training, different encrypted model data from different clients or combinations of different clients can also be distributed to the same aggregator, significantly increasing the difficulty for the aggregator to recover the original client data.

[0092] In some embodiments, the partial decryption of encryption models is aggregated based on the full aggregator, specifically including: setting weights for encryption models from different clients, and aggregating encryption models with different weights according to a multi-client threshold function encryption scheme.

[0093] In this embodiment, the value of the encrypted models uploaded by different clients varies significantly due to differences in computing power, dataset characteristics, and other related factors across different organizations. Therefore, by assigning different weights to different clients, clients belonging to organizations with stronger computing power or richer datasets are given higher weights during the aggregation process, thereby improving the accuracy of model aggregation.

[0094] Specifically, setting weights for encryption models from different clients and aggregating encryption models with different weights according to a multi-client threshold function encryption scheme also includes: using common parameters pp and encryption models {ct} j} i∈[n] The function vector y = (y1, y2, ..., y3) n ), aggregator S, decryption key {dk j} j∈S Using a threshold t as input, if |S|≥t, then compute the partial decryption of the global model {ct′}. j} j∈S as follows:

[0095]

[0096] Where L j (0) is a Lagrange polynomial, defined as

[0097] In some embodiments, optimizing the local model based on the global model specifically includes: using the global model as the local model and performing a new round of training on the local model.

[0098] In this embodiment, the local model is further optimized by replacing the global model with the local model and training the local model again based on the data generated by the organization to which the client is located.

[0099] In some embodiments, before the key authorization center generates an encryption key for the client, the method further includes: setting an iteration number and repeating steps S1-S4 based on the iteration number.

[0100] In this embodiment, by setting the number of iterations and repeating steps S1-S4 according to the number of iterations, the output of the global model gradually converges. The number of iterations can be reasonably selected according to the actual application needs.

[0101] As can be seen from the above embodiments of this application, the federated learning privacy protection method based on cross-chain technology provided in this application distributes independent encryption and decryption keys to clients and aggregators through a key authorization center, thereby improving data security. The client encrypts its local model before uploading it to the server. When the aggregator downloads the encrypted model, it first verifies whether the encrypted model has been tampered with, and then partially decrypts the tamper-proof encrypted model, thereby ensuring the accuracy and security of the data within the encrypted model to be aggregated. By partially decrypting and aggregating the encrypted model through the aggregator, the aggregator cannot access all the data within the encrypted model, preventing the training data of the encrypted model from being restored from the aggregator. The aggregator encrypts the partially decrypted global model and uploads it to the server. The client then verifies the partially decrypted global model downloaded from the server and aggregates the verified partially decrypted global model, thus preventing the client from accessing the original data used by other clients to train their models, improving the privacy of federated learning.

[0102] Furthermore, this application also uses blockchain technology to record file information generated by clients and aggregators. Clients or aggregators obtain information from the target chain based on cross-chain technology and verify the model obtained from the server, thereby ensuring file security. Multiple aggregators are set up to partially decrypt and aggregate encrypted models from multiple clients, so that no single aggregator can obtain all the information of the encrypted model, thus preventing the client's local model from being restored from the aggregator and preventing user privacy leakage. By setting weights for different clients, the weight of clients with higher model value is increased in the aggregation, thereby accelerating the convergence of the global model. And by setting the number of iterations, steps S1-S4 are repeatedly executed, thereby increasing the accuracy of the model.

[0103] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0104] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] It should be noted that the embodiments of this application can also be further described in the following ways:

[0106] This application provides a privacy-preserving method for federated learning based on cross-chain technology, wherein the method is implemented by a key authorization center, a server, an aggregator, and a client. The method includes: the key authorization center generating an encryption key for the client and a decryption key corresponding to the encryption key for the aggregator. The client encrypts a pre-trained local model based on the encryption key, generating an encrypted model and uploading it to the server. The aggregator downloads the encrypted model from the server and verifies whether the encrypted model has been tampered with. If the encrypted model has not been tampered with, the aggregator partially decrypts the encrypted model based on the decryption key, generating a partially decrypted global model, and uploads the partially decrypted global model to the server. The client downloads the partially decrypted global model from the server and verifies whether the partially decrypted global model has been tampered with. If the partially decrypted global model has not been tampered with, the client aggregates the partially decrypted global model into a global model and optimizes the local model based on the global model.

[0107] Optionally, there are multiple clients and aggregators. Client chains and aggregator chains are built based on blockchain technology. The client chains and aggregator chains are connected based on a relay chain protocol. All clients register on the client chain, and all aggregators register on the aggregator chain.

[0108] Optionally, after generating the cryptographic model and uploading it to the server, the process further includes: the client calculating a first hash value based on the first file information of the cryptographic model; the client obtaining a first signature key from a key authorization center, generating a first digital signature based on the first hash value and the first signature key; and packaging the first file information, the first hash value, and the first digital signature into a first transaction and uploading it to the client's blockchain.

[0109] Optionally, verifying whether the cryptographic model has been tampered with also includes: the aggregator accessing the client chain based on the relay chain protocol to obtain the first transaction; obtaining second file information based on the cryptographic model downloaded from the server, calculating a second hash value for the second file information, and comparing the second hash value with the first hash value; the aggregator obtaining a first verification key from the key authorization center, generating a second digital signature based on the first verification key and the second hash value, and comparing the second digital signature with the first digital signature; if the second hash value is equal to the first hash value, and the second digital signature is identical to the first digital signature, then the cryptographic model has not been tampered with.

[0110] Optionally, after uploading the partially decrypted global model to the server, the process further includes: the aggregator calculating a third hash value based on the third file information of the partially decrypted global model; the aggregator obtaining a second signature key from the key authorization center, generating a third digital signature based on the third hash value and the second signature key; and packaging the third file information, the third hash value, and the third digital signature into a second transaction and uploading it to the aggregator chain.

[0111] Optionally, verifying whether the partially decrypted global model has been tampered with also includes: the client accessing the aggregator chain based on the relay chain protocol to obtain the second transaction; obtaining fourth file information based on the partially decrypted global model downloaded from the server, calculating the fourth hash value of the fourth file information, and comparing the fourth hash value with the third hash value; the client obtaining the second verification key from the key authorization center, calculating the fourth digital signature based on the second verification key and the fourth hash value, and comparing the fourth digital signature with the third digital signature; if the fourth hash value is equal to the third hash value, and the fourth digital signature is the same as the third digital signature, then the partially decrypted global model has not been tampered with.

[0112] Optionally, in response to the encryption model not being tampered with, the aggregator partially decrypts the encryption model based on the decryption key to generate a partially decrypted global model. Specifically, this includes: distributing the encryption model to multiple aggregators for partial decryption based on a multi-client threshold function encryption scheme; aggregating the partially decrypted encryption model based on all aggregators to generate a partially decrypted global model; and uploading the partially decrypted global model to the server.

[0113] Optionally, the partially decrypted encryption models can be aggregated based on the full aggregator, specifically including: setting weights for encryption models from different clients, and aggregating encryption models with different weights according to the multi-client threshold function encryption scheme.

[0114] Optionally, the local model can be optimized based on the global model, specifically by using the global model as the local model and performing a new round of training on the local model.

[0115] Optionally, before the key authorization center generates an encryption key for the client, the method may further include: setting an iteration count and repeatedly executing the above method based on the iteration count.

[0116] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0117] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0118] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0119] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A federated learning privacy protection method based on cross-chain technology, wherein, The method is implemented by a key authorization center, a server, an aggregator and a client; the client and the aggregator are both multiple, a client chain and an aggregator chain are constructed based on a blockchain technology, the client chain and the aggregator chain are connected based on a relay chain protocol, all the clients are registered on the client chain, and all the aggregators are registered on the aggregator chain; The method comprises: The key authorization center generates an encryption key for the client and a decryption key corresponding to the encryption key for the aggregator; The client encrypts a pre-trained local model based on the encryption key, generates an encrypted model and uploads it to the server; The client calculates a first hash value based on first file information of the encrypted model; The client obtains a first signature key from the key authorization center, generates a first digital signature based on the first hash value and the first signature key; The first file information, the first hash value and the first digital signature are packaged into a first transaction and uploaded to the client chain; The aggregator downloads the encrypted model from the server and verifies whether the encrypted model is tampered with; wherein the verification of whether the encrypted model is tampered with further comprises: The aggregator accesses the client chain based on the relay chain protocol and obtains the first transaction; Based on the encrypted model downloaded through the server, second file information is obtained, a second hash value of the second file information is calculated, and the second hash value is compared with the first hash value; The aggregator obtains a first verification key from the key authorization center, generates a second digital signature based on the first verification key and the second hash value, and compares the second digital signature with the first digital signature; In response to the second hash value being equal to the first hash value and the second digital signature being the same as the first digital signature, the encrypted model is not tampered with; In response to the encrypted model not being tampered with, the aggregator partially decrypts the encrypted model based on the decryption key, distributes the encrypted model to multiple aggregators for partial decryption based on a multi-client threshold function encryption scheme, aggregates the partially decrypted encrypted model based on all the aggregators, generates a partially decrypted global model, and uploads the partially decrypted global model to the server; The client downloads the partially decrypted global model from the server and verifies whether the partially decrypted global model is tampered with; in response to the partially decrypted global model not being tampered with, the client aggregates the partially decrypted global model into a global model and optimizes the local model based on the global model.

2. The cross-chain technology-based federated learning privacy protection method according to claim 1, wherein, After uploading the partially decrypted global model to the server, it further comprises: The aggregator calculates a third hash value based on third file information of the partially decrypted global model; The aggregator obtains a second signature key from the key authorization center, generates a third digital signature based on the third hash value and the second signature key; The third file information, the third hash value and the third digital signature are packaged as a second transaction and uploaded to the aggregator chain.

3. The cross-chain technology-based federated learning privacy protection method according to claim 2, wherein, The verifying whether the partially decrypted global model is tampered with further includes: The client accesses the aggregator chain based on the relay chain protocol to obtain the second transaction; Based on the partially decrypted global model downloaded through the server, fourth file information is obtained, a fourth hash value of the fourth file information is calculated, and the fourth hash value is compared with the third hash value; The client obtains a second verification key from the key authorization center, calculates a fourth digital signature based on the second verification key and the fourth hash value, and compares the fourth digital signature with the third digital signature; In response to the fourth hash value being equal to the third hash value and the fourth digital signature being the same as the third digital signature, the partially decrypted global model is not tampered with.

4. The cross-chain technology-based federated learning privacy protection method according to claim 1, wherein, The aggregating the partially decrypted encrypted model based on all the aggregators specifically includes: Weights are set for encrypted models from different clients, and the encrypted models with different weights are aggregated according to a multi-client threshold function encryption scheme.

5. The cross-chain technology-based federated learning privacy protection method according to claim 1, wherein, The optimizing the local model based on the global model specifically includes: The global model is taken as the local model, and the local model is trained for a new round.

6. The cross-chain technology-based federated learning privacy protection method according to claim 5, wherein, Before the key authorization center generates an encryption key for the client, the method further includes setting an iteration number and repeatedly executing the method in claim 1 based on the iteration number.

Images