Verifiable federal learning smart medical privacy protection system and method

Abstract

The invention relates to the technical field of privacy protection, in particular to a verifiable federal learning smart medical privacy protection system and method.The system comprises a certificate authentication center, a user, an edge computing node and a cloud server, and the user is supported to independently verify the correctness of an aggregation result returned by the server without assistance of a third party. Specifically, a secure communication transmission channel is established by using a TLS protocol, the integrity in a data transmission process is ensured while a message is encrypted, and a key used for encrypting the message cannot be obtained by any one party except for two communication parties. Gradient privacy is protected by using a double-masking form, and verifiability is provided for the scheme by using a linear homomorphic hash function, so that a user can independently verify the correctness of an aggregation result returned by a server. According to the method, a dual aggregation verification mode is utilized, the computing overhead of the user side can be effectively reduced, the user is supported to exit in the training process, and extra computing burden cannot be caused to the cloud server.

Description

Technical Field

[0001] The present invention relates to the field of privacy protection technology, and in particular to a verifiable federated learning smart medical privacy protection system and method. Background Art

[0002] In the medical industry, big data and artificial intelligence can be used to improve judgment, treatment, and patient management. However, traditional machine learning methods require data to be stored in a centralized manner, which may involve privacy risks. Medical data contains a large amount of sensitive patient information, such as medical history, diagnosis results, treatment plans, and genetic information. Leaking this information may lead to serious consequences.

[0003] Federated learning is a new type of machine learning method that allows multiple parties to jointly train models without sharing local data but only sharing gradients, which protects user privacy to a certain extent. This feature is particularly suitable for the field of smart healthcare, which improves the utilization of medical data while protecting patient privacy. However, current studies have shown that there is still a risk of user privacy leakage when only gradients are uploaded. For example, attackers can infer part of the original data from the shared gradients through reverse engineering. On the other hand, malicious cloud servers may deceive consumers or directly tamper with the aggregation results by reducing the gradient aggregation of one or more users in order to save computing costs out of their own interests. Incorrect aggregation results will pollute the global model, reduce the performance of the model, and even cause the model to produce malicious results.

[0004] In order to protect the privacy of federated learning, most of them currently use homomorphic encryption or differential privacy technology to ensure it. Homomorphic encryption technology is widely used in federated learning because of its unique homomorphic addition properties. However, homomorphic encryption requires a trusted third party to generate public and private keys and distribute them to users. This requires that the entity of this trusted third party must have absolute authority, that is, he will not collude with any user and will not disclose the public and private keys for any reason. But this entity is obviously an ideal model. Once this entity is broken, the data of all users will no longer be safe. In addition, homomorphic encryption requires a large number of modular exponentiation operations, which leads to high computational overhead. Differential privacy protects user privacy by adding noise, and the computational overhead is low. The more popular method is that each user negotiates with other users to obtain a symmetric matrix, and each user uses the sum of one row or one column as noise to protect the local gradient. Although this can effectively protect data privacy, once a user withdraws, the computational overhead will increase exponentially as the number of users withdraws. Currently, the technology for protecting data integrity, that is, providing verifiability for users, is mostly based on bilinear aggregation technology, but this will require users to have a certain amount of computing power, which is very unfriendly to users with weak computing power. Summary of the invention

[0005] The purpose of the present invention is to provide a verifiable federated learning smart medical privacy protection system and method, which supports users to independently verify the correctness of the aggregation results returned by the server without the assistance of a third party, and can effectively reduce the computing overhead on the user side.

[0006] To achieve the above objectives, the present invention provides a verifiable federated learning smart medical privacy protection method, comprising the following steps:

[0007] Step 1: The architecture includes the privacy protection system of the certificate authentication center, users, edge computing nodes and cloud servers;

[0008] Step 2: Entity registration of the privacy protection system;

[0009] Step 3: Identity authentication and key negotiation based on TLS protocol;

[0010] Step 4: The user performs masking gradient;

[0011] Step 5: The cloud server collects information aggregation;

[0012] Step 6: Each user independently verifies the aggregated result returned by the cloud server.

[0013] Optionally, during the execution of step 2, EID is used to represent the private identity of the edge computing node, PID is used to represent the private identity of the user, and Cert E Indicates the digital certificate issued by the certificate authority to the edge computing node. P Indicates the digital certificate issued by the certificate authority to the user;

[0014] The edge computing node selects a random number r E ←{0,1} λ , calculate Where p and q are two large prime numbers, Hello E = {r E ,X E ,p,q,EID}, the edge computing node sends Hello to the certificate authentication center E information.

[0015] The certificate authority receives the Hello E After the message is received, a public-private key pair (sk E ,pk E ), where sk E Used to generate digital signature, pk E Used to verify digital signatures.

[0016] Optionally, the execution process of step 3 includes the following steps:

[0017] Step 3.1: Verify the identity of the edge computing node;

[0018] Step 3.2: The user calculates the shared key;

[0019] Step 3.3: Generate user certificate;

[0020] Step 3.4: Verify user identity;

[0021] Step 3.5: The edge computing node calculates the shared key;

[0022] Step 3.6: Key negotiation is complete.

[0023] Optionally, during the generation of the user certificate, the shared key will be handed over to the user's TLS record layer; the user handshake completion message fin P The calculation formula is:

[0024] fin P =PRF(ms,H(Hello E ||Hello P ||σ E ||σ P )

[0025] Among them, H is the hash function specified in the negotiated list, Hello P = {r P ,X P ,PID},σ E , σ P For digital signature.

[0026] Optionally, the expression of the user masked local gradient in step 4 is as follows:

[0027]

[0028] Among them, n is the online user in this round of training, g n is the local gradient held by the user, L is the number of edge nodes in the region, s nl Random number generated for edge computing nodes.

[0029] Optionally, the aggregation result in step 5 is calculated as follows:

[0030]

[0031] in, Receive information from R regions for the cloud server Obtained after decryption.

[0032] Optionally, in step 6, the cloud server obtains the aggregation result g * , and calculate its hash value LHH(g * ) is returned to all users, who then perform a second verification aggregation to verify whether the following equation holds:

[0033]

[0034] If true, the verification passes and enters the next round of training; if not, the verification fails, the user terminates the training and exits.

[0035] The present invention also proposes a verifiable federated learning smart medical privacy protection system, which is used for the verifiable federated learning smart medical privacy protection method, including a certificate authentication center, a user, an edge computing node and a cloud server;

[0036] The certificate authentication center is responsible for issuing certificates, verifying and reviewing the identity of certificate applicants, ensuring that the public key contained in the certificate and the identity information of its owner are authentic, and is responsible for initializing model parameters to generate a linear homomorphic hash function and broadcasting it to all participants;

[0037] The user is the data owner, who collects patient information and performs local training;

[0038] The edge computing nodes are close to the end users to share the computing overhead of the cloud server;

[0039] The cloud server is responsible for aggregating the gradients uploaded by the edge computing nodes and generating a label through the aggregation results for users to verify the aggregation results.

[0040] The present invention provides a verifiable federated learning smart medical privacy protection system and method. The system includes a certificate authentication center, users, edge computing nodes and cloud servers, and supports users to independently verify the correctness of the aggregated results returned by the server without the assistance of a third party. Specifically, the TLS protocol is used to establish a secure communication transmission channel to ensure the integrity of the data transmission process while encrypting the message. The key used for the encrypted message cannot be obtained by any other party except the two communicating parties. Double masking is used to protect gradient privacy, and a linear homomorphic hash function is used to provide verifiability for the scheme, so that users can independently verify the correctness of the aggregated results returned by the server. The present invention uses a double aggregation verification method to effectively reduce the computational overhead of the user end, and supports users to exit during the training process without causing additional computational burden on the cloud server. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is a schematic diagram of the architecture of a verifiable federated learning intelligent medical privacy protection system of the present invention.

[0043] Figure 2 It is a flow chart of a verifiable federated learning intelligent medical privacy protection method of the present invention.

[0044] Figure 3 It is a schematic diagram of the information transmission process of identity authentication and key negotiation in a verifiable federated learning smart medical privacy protection method of the present invention. DETAILED DESCRIPTION

[0045] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0046] The present invention provides a verifiable federated learning intelligent medical privacy protection system, such as Figure 1 As shown in the figure, the entities include the certificate authority (CA), users (Users), edge nodes (ECN) and cloud servers (CS). The following parts use English names to specify the corresponding entities. Assume that the set of users P in federated learning is U, and the users are divided into T sub-areas U by network delay. i , Each sub-region has n t (t=1,…,T) users, the number of users in each sub-area is random. In each sub-area, K edge computing nodes are randomly and uniformly deployed to collect local training parameters of users in the area and collaborate with the iteration of the global model, where K≥3.

[0047] Certificate Authority (CA): The certificate authority is trustworthy, that is, it will not collude with any party. It is responsible for issuing certificates, verifying and auditing the identity of certificate applicants, and ensuring that the public key contained in the certificate and the identity information of its owner are authentic. At the same time, it is responsible for initializing the model parameters to generate a linear homomorphic hash function LHH and broadcast it to all participants.

[0048] User / Medical Institution (User): The user is the data owner who collects patient information and performs local training. Each user encrypts the local gradient and calculates the gradient hash value and sends it to the edge node during each iteration. Finally, each user verifies whether the aggregated result returned by the cloud server is correct.

[0049] Edge computing nodes (ECN): Edge computing nodes are located close to end users to share the computing overhead of cloud servers. They can represent local computing companies or gateways with certain computing capabilities. Edge nodes are responsible for negotiating with users in their area to generate random numbers for gradient shielding, which are used as seeds. In each round of iteration, edge computing nodes group participants according to whether they upload parameters on time, and return error reports to irregular participants.

[0050] Cloud Server (CS): The cloud server is responsible for aggregating the gradients uploaded by ECN and generating a label based on the aggregation result for users to verify the aggregation result.

[0051] The following is a further explanation based on the verifiable federated learning smart medical privacy protection method:

[0052] See also Figure 2 The present invention provides a verifiable federated learning intelligent medical privacy protection method, comprising the following steps:

[0053] S1: The architecture includes the privacy protection system of the certificate authentication center, users, edge computing nodes, and cloud servers;

[0054] S2: Entity registration of the privacy protection system;

[0055] S3: identity authentication and key negotiation based on TLS protocol;

[0056] S4: User performs masking gradient;

[0057] S5: Cloud server collects information aggregation;

[0058] S6: Each user independently verifies the aggregated result returned by the cloud server.

[0059] Steps S2 to S6 include registration, identity authentication and key exchange, masking gradient, aggregation, and verification stages.

[0060] In step S2, for convenience, EID is used to represent the private identity of the edge computing node, PID is used to represent the private identity of the user, and Cert E Indicates the digital certificate issued by the CA to the edge computing node, Cert P Indicates the digital certificate issued by the CA to the user.

[0061] ECN selects a random number r E ←{0,1} λ , calculate Where p and q are two large prime numbers. E = {r E ,X E ,p,q,EID}. ECN sends Hello to CA E information.

[0062] CA receives Hello E After the message, a public-private key pair (sk E ,pk E ), where sk E Used to generate digital signature, pk E Used to verify digital signatures. CA uses sk E Generate digital signature σ E =SIG.Sign(sk E ,r E ||X E ||p||q||EID) and set pk E Announced. Digital certificates are recorded as Cert E ={σ E ,pk E list,chain}, where list represents a cryptographic suite consisting of a key exchange method, signature, encryption, and MAC algorithm, and chain represents a certificate chain. E Issued to ECN.

[0063] Step S3: The process of identity authentication and key exchange includes the following steps:

[0064] Verify ECN identity:

[0065] ECN receives the digital certificate Cert issued by CA E After that, {Cert E ,Hello E} is sent to user P. P receives {Cert E ,Hello E}, verify SIG.Vfy(pk E ,σ E ||r E ||X E ||p||q||EID==1 is true.

[0066] The user calculates the shared secret:

[0067] If the verification is successful, user P randomly selects r P ←{0,1} λ , calculate Remember Hello P = {r P ,X P ,PID}, user P will send Hello P Then, P calculates the pre-master key The master key ms is further derived from the pre-master key pms = PRF(pms, E ||r P ). After the master key is derived, pms will be erased from memory. After obtaining the master key ms, the key material is calculated. The shared key Used to encrypt and verify data sent from user P to ECN, Used to decrypt and verify data received from ECN.

[0068] Generate a user certificate:

[0069] User P sends Hello P = {r P ,X P ,PID} is sent to CA, and CA generates a digital signature after receiving the message σ P =SIG.Sign(sk P ,r P ||X P ||PID) and set pk P Then, CA issues a digital certificate Cert to P. P ={σ P ,pk P ,list,chain}.

[0070] After completing the above calculations, the shared key The TLS record layer is handed over to user P, which is now able to encrypt and authenticate any data. To signal "encryption started" to the ECN, a byte value of "1" is recorded as a flag. enc And send it to ECN in plain text. Then the user handshake completes the message fin P The authentication encryption composition is used to verify the integrity of the data. The calculation formula is:

[0071] fin P =PRF(ms,H(Hello E ||Hello P ||σE ||σ P ).

[0072] Where H is the hash function specified in the negotiated list.

[0073] Verify user identity:

[0074] P Complete the encrypted message And {C P ,Cert P ,Hello P} is sent to ECN. ECN receives {C P ,Cert P ,Hello P}, first verify the signature SIG.Vfy(pk E ,σ E ||r E ||X E ||p||q||EID)==1 is true.

[0075] ECN calculates the shared key:

[0076] If the verification passes, the pre-master key is calculated Derived master key ms = PRF (pms, r E ||rP), and then erase the pre-master key pms. After obtaining the master key ms, calculate the key material The shared key ECN handshake complete message fin E The authentication encryption composition is calculated as follows:

[0077] fin E =PRF(ms,H(Hello E ||Hello P ||σ E ||σ P ||fin P ||flag enc )).

[0078] Encrypted Messages ECN Decryption C P ,get

[0079] examine Is it true? If so, receive the shared key. The encrypted message C E Send to user.

[0080] Key negotiation completes:

[0081] User decryption C E ,get if If established, the shared key is accepted

[0082] Notice: Similarly, ECN and CS can also generate a set of shared keys: the key in ECN's hand is expressed as The key in CS's hand is represented as in Shared Secret The key used for symmetric encryption when the user and ECN transmit information. This key is held only by the user and ECN, and even the certificate authority cannot obtain it. Similarly, ECN and CS can also negotiate to generate a set of shared keys. In this way, users and ECN, as well as ECN and CS, use symmetric encryption when transmitting information to establish a secure information transmission channel.

[0083] The information transmission process of identity authentication and key negotiation is as follows: Figure 3 shown.

[0084] Step S4: Masking Gradient

[0085] Suppose there are n t The number of users in the region is L, and the number of online users participating in this round of training is N. After identity authentication, each user P∈U and edge node has a unique ID address known to each other. In each round of training, user P n (n=1,…,N) holds the local gradient g n , and needs to be hidden from other participants. Edge Computing Node ECN l (l∈1,…,L) generates two random numbers s nl , encrypted And send it to user P n . Users can decrypt and get the edge node ECN l With user P n Agreed random number Therefore, each user can encrypt his local gradient as follows.

[0086]

[0087] Afterwards, user P n The local masking gradient Split into And satisfy encryption get User P n The encrypted segmented gradient Sent to the lth edge node ECN l .

[0088] In order to realize the verification function, in the tth area, each user P n The hash value of the local gradient will be calculated And announce it to the participants in the area (including other users and edge nodes in the area).

[0089] Step S5: Aggregation

[0090] In the tth region, each edge node ECN l Decrypt to get the segmentation gradient from the user And sum them Similarly, each edge node can sum the random numbers it negotiates with the user After that, ECN l Eliminate the noise to get and will Encrypted Send to CS.

[0091] CS receives information from T regions Decrypted And calculate the aggregation result g as follows * .

[0092]

[0093] In the tth region, the first verification aggregation is performed: an edge node is randomly selected, and the hash values ​​published by users in this region are aggregated to obtain And publish it to all users in the area.

[0094] Step S6: Verification

[0095] In the tth region, users in the region receive the hash value aggregated by the edge node and verify SLHH(g t ), if the verification is successful, then SLHH(g t ) is published to all participants in the region.

[0096] CS obtains the aggregation result g * , and calculate its hash value LHH(g * ) is returned to all users. Users perform a second verification aggregation: verify whether the following equation holds.

[0097]

[0098] If the above formula is true, the verification is passed and the next round of training begins; if the above formula is not true, the verification fails and the user terminates the training and exits.

[0099] A verifiable federated learning intelligent medical privacy protection system and method based on the present invention can cope with the following threat models:

[0100] Malicious cloud server attacks: The cloud server is malicious, which means it will try to infer the user's private information from the encrypted data, and may also intentionally return wrong aggregation results.

[0101] Semi-honest users or ECN attacks: Semi-honest users or ECNs are curious about the user's private data and will try to infer the private data of other users through the collected parameters and other information.

[0102] Collusion attack: There may be collusion attacks between ECN, CS and a small number of users, inferring the privacy data of other users by sharing information such as model parameters.

[0103] External malicious attack: There is a malicious adversary They will try to obtain useful information from users by all means. For example, It is possible to launch eavesdropping attacks, obtain intermediate parameters of the model, and infer the user's private data.

[0104] In summary, the present invention has the following advantages:

[0105] (1) We design an efficient and verifiable privacy-preserving federated learning scheme to target malicious cloud servers, which allows users to independently verify the correctness of the aggregated results returned by the server without the assistance of a third party.

[0106] (2) Double masking of data segmentation and noise addition is used to protect data security. At the same time, in order to avoid external attacks such as man-in-the-middle attacks and eavesdropping attacks that may exist during data transmission, the present invention uses the TLS protocol to establish a secure transmission channel, which can effectively ensure the security of data during transmission. In addition, it can also resist internal collusion attacks between the server and some users or edge nodes.

[0107] (3) The present invention uses a dual aggregation verification method to effectively reduce the computational overhead of the user end. In addition, it also supports users to exit during the training process and does not cause additional computational burden on the cloud server.

[0108] What is disclosed above is only a preferred embodiment of the present invention, and it certainly cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A verifiable federated learning smart medical privacy protection method, characterized in that: The following steps are involved: Step 1: The architecture includes the privacy protection system of the certificate authentication center, users, edge computing nodes and cloud servers; Step 2: Entity registration of the privacy protection system; Step 3: Identity authentication and key negotiation based on TLS protocol; Step 4: The user performs masking gradient; Step 5: The cloud server collects information aggregation; Step 6: Each user independently verifies the aggregated result returned by the cloud server.

2. The verifiable federated learning smart medical privacy protection method as described in claim 1, characterized in that: During the execution of step 2, EID is used to represent the private identity of the edge computing node, PID is used to represent the private identity of the user, and Cert E Indicates the digital certificate issued by the certificate authority to the edge computing node. P Indicates the digital certificate issued by the certificate authority to the user; The edge computing node selects a random number r E ←{0,1} λ , calculate Where p and q are two large prime numbers, Hello E = {r E ,X E ,p,q,PID}, the edge computing node sends a Hello to the certificate authentication center E information; The certificate authority receives the Hello E After the message is received, a public-private key pair (sk E ,pk E ), where sk E Used to generate digital signature, pk E Used to verify digital signatures; the certificate authority uses sk E Generate digital signature σ E And pk E Publish; digital certificate is called Cert E ={σ E ,pk E list,chain}, where list represents a cipher suite consisting of a key exchange method, signature, encryption, and MAC algorithm, and chain represents a certificate chain; The certificate authority will send the digital certificate Cert E Issued to ECN. Digital certificate is used to prove the identity of ECN.

3. The verifiable federated learning smart medical privacy protection method as described in claim 2, characterized in that: The execution process of step 3 includes the following steps: Step 3.1: Verify the identity of the edge computing node; Step 3.2: The user calculates the shared key; Step 3.3: Generate user certificate; Step 3.4: Verify user identity; Step 3.5: The edge computing node calculates the shared key; Step 3.6: Key negotiation is complete.

4. The verifiable federated learning smart medical privacy protection method as described in claim 3, characterized in that: During the generation of the user certificate, the shared key is handed over to the user's TLS record layer; the user handshake completes the message fin P The calculation formula is: fin P =PRF(ms,H(Hello E ||Hello P ||σ E ||σ P ) Among them, H is the hash function specified in the negotiated list, Hello P = {r P ,X P ,PID},σ E , σ P For digital signature.

5. The verifiable federated learning smart medical privacy protection method as described in claim 4, characterized in that: The expression of the user masked local gradient in step 4 is as follows: Among them, n is the online user in this round of training, g n is the local gradient held by the user, L is the number of edge nodes in the region, s nl Random number generated for edge computing nodes.

6. The verifiable federated learning smart medical privacy protection method as described in claim 5, characterized in that: The aggregation result in step 5 is calculated as follows: in, Receive information from T regions for the cloud server Obtained after decryption.

7. The verifiable federated learning smart medical privacy protection method as described in claim 6, characterized in that: In step 6, the cloud server obtains the aggregation result g * , and calculate its hash value LHH(g * ) is returned to all users, who then perform a second verification aggregation to verify whether the following equation holds: If true, the verification passes and enters the next round of training; if not, the verification fails, the user terminates the training and exits.

8. A verifiable federated learning intelligent medical privacy protection system, used for the verifiable federated learning intelligent medical privacy protection method as claimed in any one of claims 1 to 7, characterized in that: Includes certificate authentication center, users, edge computing nodes and cloud servers; The certificate authentication center is responsible for issuing certificates, verifying and reviewing the identity of certificate applicants, ensuring that the public key contained in the certificate and the identity information of its owner are authentic, and is responsible for initializing model parameters to generate a linear homomorphic hash function and broadcasting it to all participants; The user is the data owner, who collects patient information and performs local training; The edge computing nodes are close to the end users to share the computing overhead of the cloud server; The cloud server is responsible for aggregating the gradients uploaded by the edge computing nodes and generating a label through the aggregation results for users to verify the aggregation results.

Images