A verifiable federated learning smart medical privacy protection system and method

Abstract

The present application relates to the technical field of privacy protection, and particularly relates to a verifiable federated learning smart medical privacy protection system and method, the system comprises a certificate authentication center, a user, an edge computing node and a cloud server, and correctness of an aggregated result returned by the server can be independently verified by the user without the assistance of a third party. A secure communication transmission channel is established by using a TLS protocol, the integrity in the data transmission process is ensured while the message is encrypted, and a key used for encrypting the message cannot be obtained by any party except the two parties in communication. Gradient privacy is protected by using a double masking form, a linear homomorphic hash function is used to provide verifiability for the scheme, so that the user can independently verify the correctness of the aggregated result returned by the server. By using the double aggregation verification mode, the present application can effectively reduce the calculation cost of the user end, and the user can quit during the training process, and the cloud server will not be caused additional calculation burden.

Description

Technical Field

[0001] This invention relates to the field of privacy protection technology, specifically to a verifiable federated learning smart healthcare privacy protection system and method. Background Technology

[0002] In the healthcare industry, big data and artificial intelligence can be leveraged to improve the effectiveness of diagnosis, treatment, and patient management. However, traditional machine learning methods require centralized data storage, which may involve privacy risks. Medical data contains a large amount of sensitive patient information, such as medical history, diagnoses, treatment plans, and genetic information; leakage of this information could have serious consequences.

[0003] Federated learning is a novel machine learning method that allows multiple participants to collaboratively train a model without sharing local data, only needing to share gradients. This offers some protection for user privacy. This feature is particularly suitable for the field of smart healthcare, enabling improved utilization of medical data while protecting patient privacy. However, current research indicates that even with only gradients uploaded, user privacy remains at risk. For example, attackers could reverse engineer and infer parts of the original data from the shared gradients. Furthermore, malicious cloud servers might, for their own benefit and to save computational costs, deceive consumers by reducing the aggregation of gradients from one or more users or directly tampering with the aggregation results. Incorrect aggregation results can pollute the global model, degrade its performance, and even cause it to produce malicious results.

[0004] To address privacy concerns in federated learning, most current approaches utilize homomorphic encryption or differential privacy techniques. Homomorphic encryption, due to its unique homomorphic addition property, is widely used in federated learning. However, homomorphic encryption requires a trusted third party to generate public and private keys for distribution to users. This necessitates that this trusted third party possess absolute authority, meaning they will not collude with any user or disclose the public and private keys for any reason. This entity is clearly an ideal model; if compromised, all user data becomes insecure. Furthermore, homomorphic encryption incurs significant computational overhead due to the large number of modular exponentiation operations required. Differential privacy protects user privacy by adding noise, resulting in lower computational overhead. A popular approach involves each user negotiating a symmetric matrix with the others, and each user using the sum of one row or column as noise to protect their local gradient. While this effectively protects data privacy, the computational overhead increases exponentially with the number of users who leave. Currently, most technologies for protecting data integrity, i.e. providing verifiability to users, are based on bilinear aggregation technology. However, this requires users to have a certain amount of computing power, which is very unfriendly to users with weak computing capabilities. Summary of the Invention

[0005] The purpose of this invention is to provide a verifiable federated learning smart healthcare privacy protection system and method, which allows users to independently verify the correctness of the aggregation results returned by the server without third-party assistance, and can effectively reduce the computational overhead on the user side.

[0006] To achieve the above objectives, this invention provides a verifiable method for protecting privacy in federated learning-based smart healthcare, comprising the following steps:

[0007] Step 1: The architecture includes a privacy protection system for certificate authentication centers, users, edge computing nodes, and cloud servers;

[0008] Step 2: Entity registration for the privacy protection system;

[0009] Step 3: Perform identity authentication and key negotiation based on the TLS protocol;

[0010] Step 4: The user performs masking gradient;

[0011] Step 5: Cloud server collects and aggregates information;

[0012] Step 6: Each user independently verifies the aggregated results returned by the cloud server.

[0013] Optionally, during the execution of step 2, EID is used to represent the private identity of the edge computing node, PID represents the private identity of the user, and Cert... E Certification Authority (CA) refers to the digital certificate issued to edge computing nodes. P This refers to the digital certificate issued to the user by the Certificate Authority.

[0014] Edge computing nodes select random number r E ←{0,1} λ , calculate Where p and q are two large prime numbers, denoted as Hello E ={r E ,X E The edge computing node sends a Hello message to the certificate authority (CPA) with the ID (p, q, EID). E information.

[0015] The certificate authority received Hello E Following the message, a public-private key pair (sk) is generated for the edge computing node. E ,pk E ), where sk E Used to generate digital signatures, PK E Used to verify digital signatures.

[0016] Optionally, the execution process of step 3 includes the following steps:

[0017] Step 3.1: Verify the identity of the edge computing node;

[0018] Step 3.2: The user calculates the shared key;

[0019] Step 3.3: Generate user certificate;

[0020] Step 3.4: Verify user identity;

[0021] Step 3.5: Edge computing nodes calculate the shared key;

[0022] Step 3.6: Key negotiation complete.

[0023] Optionally, during the generation of the user certificate, the shared key will be transferred to the user's TLS record layer; the user handshake completion message fin P The calculation formula is:

[0024] fin P =PRF(ms,H(Hello) E Hello P ||σ E ||σ P )

[0025] Where H is the hash function specified in the negotiated list, Hello P ={r P ,X P ,PID},σ E , σ P For digital signatures.

[0026] Optionally, the expression for the user-masked local gradient in step 4 is as follows:

[0027]

[0028] Where n represents the number of online users in this training round, and g n The local gradient held by the user, L is the number of edge nodes in the region, and s nl Random numbers generated for edge computing nodes.

[0029] Optionally, the aggregation result in step 5 can be calculated as follows:

[0030]

[0031] in, Receive information from R regions for the cloud server The result is obtained after decryption.

[0032] Optionally, in step 6, the cloud server obtains the aggregation result g. * And calculate its hash value LHH(g) * The results are returned to all users, who then perform a second verification aggregation to check if the following expression holds true:

[0033]

[0034] If the condition is met, the verification passes and the user proceeds to the next round of training; if the condition is not met, the verification fails, and the user terminates training and exits.

[0035] This invention also proposes a verifiable federated learning smart healthcare privacy protection system for the aforementioned verifiable federated learning smart healthcare privacy protection method, including a certificate authority, user, edge computing node, and cloud server;

[0036] The certificate authority is responsible for issuing certificates, verifying and auditing the identity of certificate applicants, ensuring that the public key contained in the certificate and the identity information of its owner are authentic and trustworthy, and is also responsible for initializing model parameters, generating a linear homomorphic hash function, and broadcasting it to all participants.

[0037] The user is the data owner, who collects patient information and performs local training.

[0038] The edge computing nodes are located close to the end users to share the computing overhead of the cloud server;

[0039] The cloud server is responsible for aggregating the gradients uploaded by edge computing nodes and generating a label based on the aggregation result for users to verify the aggregation result.

[0040] This invention provides a verifiable federated learning-based smart healthcare privacy protection system and method. The system includes a certificate authority, users, edge computing nodes, and a cloud server, allowing users to independently verify the correctness of the aggregation results returned by the server without third-party assistance. Specifically, a secure communication channel is established using the TLS protocol, ensuring the integrity of data transmission while encrypting messages. The key used for encryption is inaccessible to any party other than the communicating parties. Gradient privacy is protected using a double-masking approach, and a linear homomorphic hash function is used to provide verifiability for the scheme, enabling users to independently verify the correctness of the aggregation results returned by the server. This invention utilizes a double aggregation verification method, which effectively reduces the computational overhead on the user end, allows users to exit during training, and does not impose additional computational burden on the cloud server. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a schematic diagram of the architecture of a verifiable federated learning smart healthcare privacy protection system according to the present invention.

[0043] Figure 2 This is a flowchart illustrating a verifiable federated learning method for protecting privacy in smart healthcare according to the present invention.

[0044] Figure 3 This is a schematic diagram of the information transmission process for identity authentication and key negotiation in a verifiable federated learning smart healthcare privacy protection method of the present invention. Detailed Implementation

[0045] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0046] This invention provides a verifiable federated learning-based smart healthcare privacy protection system, such as... Figure 1 As shown, the entities include Certificate Authority (CA), Users, Edge Network (ECN), and Cloud Server (CS). Subsequent sections will use English names to refer to the corresponding entities. Assume that in federated learning, the set of users P is U, and the users are divided into T sub-regions U based on network latency. i , Each subregion has n t There are (t=1,…,T) users, and the number of users in each sub-region is random. K edge computing nodes are randomly and uniformly deployed in each sub-region to collect the local training parameters of users in that region and to coordinate the iteration of the global model, where K≥3.

[0047] Certificate Authority (CA): A Certificate Authority is trusted, meaning it does not collude with any party. It is responsible for issuing certificates, verifying and auditing the identity of certificate applicants, and ensuring that the public key contained in the certificate and its owner's identity information are authentic and trustworthy. It is also responsible for initializing model parameters, generating a linear homomorphic hash function (LHH), and broadcasting it to all participants.

[0048] User / Healthcare Institution (User): The user is the data owner, collecting patient information and performing local training. During each iteration, each user encrypts the local gradient and calculates the gradient hash, sending it to the edge node. Finally, each user verifies the accuracy of the aggregated result returned by the cloud server.

[0049] Edge Computing Nodes (ECNs): Edge computing nodes are located close to end users to offload the computing overhead of cloud servers. They can represent local computing companies or gateways with certain computing capabilities. Edge nodes are responsible for negotiating with users within their region to generate random numbers used to mask gradients; these random numbers serve as seeds. In each iteration, edge computing nodes group participants based on whether they uploaded parameters on time, returning error reports to non-compliant participants.

[0050] Cloud Server (CS): The cloud server is responsible for aggregating the gradients uploaded by ECN and generating a label based on the aggregation result for users to verify the aggregation result.

[0051] The following section provides further explanation of the verifiable federated learning method for protecting privacy in smart healthcare:

[0052] Please see Figure 2 This invention provides a verifiable method for protecting privacy in smart healthcare through federated learning, comprising the following steps:

[0053] S1: The architecture includes a privacy protection system for certificate authentication centers, users, edge computing nodes, and cloud servers;

[0054] S2: Entity registration for the privacy protection system;

[0055] S3: Authentication and key negotiation based on the TLS protocol;

[0056] S4: The user performs the masking gradient;

[0057] S5: Cloud server collects and aggregates information;

[0058] S6: Each user independently verifies the aggregated results returned by the cloud server.

[0059] Steps S2 to S6 include registration, identity authentication and key exchange, gradient masking, aggregation, and verification stages.

[0060] In step S2, for convenience, EID is used to represent the private identity of the edge computing node, PID represents the private identity of the user, and Cert... E Cert represents a digital certificate issued by a CA to an edge computing node. P This refers to the digital certificate issued to the user by the CA.

[0061] ECN selects a random number r E ←{0,1} λ , calculate Where p and q are two large prime numbers. Let Hello be an example. E ={r E ,X E ,p,q,EID}. ECN sends Hello to CA E information.

[0062] CA received Hello E After the message, generate a public / private key pair (sk) for the ECN. E ,pk E ), where sk E Used to generate digital signatures, PK E Used to verify digital signatures. CA uses sk E Generate digital signature σ E =SIG.Sign(sk E ,r E ||X E ||p||q||EID) and pk E Announced. The digital certificate is designated Cert. E ={σ E ,pk E The CA (Certificate Authority) defines a cipher suite consisting of a key exchange method, signature, encryption, and MAC algorithm, and a chain of certificates. The CA assigns the digital certificate Cert... E Awarded to ECN.

[0063] Step S3, the authentication and key exchange process, includes the following steps:

[0064] Verify ECN identity:

[0065] ECN receives the digital certificate Cert issued by the CA. E Then, {Cert E Hello E} is sent to user P. P receives {Cert} E Hello E After that, verify SIG.Vfy(pk) E ,σ E ||r E ||X E Is ||p||q||EID==1 true?

[0066] User calculates shared key:

[0067] If the verification passes, user P randomly selects r. P ←{0,1} λ , calculate Remember Hello P ={r P ,X P ,PID}, user P will send Hello P Send it to the CA. Then, P calculates the pre-master key. From the pre-master key pms, further derive the master key ms = PRF(pms, r E ||r P After exporting the master key, PMS will be erased from memory. The key material is calculated after obtaining the master key MS. Then shared key Used to encrypt and verify data sent from user P to ECN. Used to decrypt and verify data received from ECN.

[0068] Generate user certificate:

[0069] User P will Hello P ={r P ,X P The message ,PID} is sent to the CA. After receiving the message, the CA generates a digital signature σ. P =SIG.Sign(sk P ,r P ||X P ||PID) and pk P Announced. Next, the CA issues a digital certificate, Cert, to P. P ={σ P ,pk P ,list,chain}.

[0070] After completing the above calculations, the shared key... The TLS record layer, now handed over to user P, is capable of encrypting and verifying any data. To signal "encryption started" to the ECN, a byte value of "1" is designated as the flag. enc And send it to the ECN in plaintext. Then the user handshake completes with the fin message. P The authentication encryption component is used to verify the integrity of the data, and its calculation formula is:

[0071] fin P =PRF(ms,H(Hello) E Hello P ||σE ||σ P ).

[0072] Where H is the hash function specified in the negotiated list.

[0073] Verify user identity:

[0074] P completes the encryption message. and {C P Cert P Hello P} is sent to the ECN. The ECN receives {C P Cert P Hello P After that, first verify the signature SIG.Vfy(pk E ,σ E ||r E ||X E Is ||p||q||EID)==1 true?

[0075] ECN calculates the shared key:

[0076] If the verification passes, calculate the pre-master key. Export master key ms = PRF(pms, r E ||rP), then erase the pre-master key pms. After obtaining the master key ms, calculate the key material. Then shared key ECN handshake completed message fin E The authentication encryption components are calculated using the following formula:

[0077] fin E =PRF(ms,H(Hello) E Hello P ||σ E ||σ P ||fin P ||flag enc )).

[0078] Encrypted messages ECN Decrypts C P ,get

[0079] examine Is it valid? If so, receive the shared key. Encrypt message C E Send to the user.

[0080] Key negotiation complete:

[0081] User Decryption C E ,get if If established, the shared key will be accepted.

[0082] Notice: Similarly, ECN and CS can also generate a shared key: the key held by ECN is represented as... The key held by CS is represented as in Shared key The key used for symmetric encryption during information transmission between the user and the ECN is held only by the user and the ECN, and cannot be obtained even by the Certificate Authority. Similarly, the ECN and the CS can negotiate and generate a shared key. In this way, the use of symmetric encryption between the user and the ECN, as well as between the ECN and the CS, establishes a secure information transmission channel.

[0083] The information transmission process of identity authentication and key negotiation is as follows Figure 3 As shown.

[0084] Step S4: Masking the gradient

[0085] Suppose there are n in a certain region t There are L users in each region, and N online users participating in this training round. After authentication, each user P∈U and each edge node has a unique ID address known to the other. In each training round, user P... n (n = 1, ..., N) hold the local gradient g n And it needs to be hidden from other participants. Edge Computing Node (ECN) l Generate two random numbers s (l∈1,…,L) nl Encryption obtained And sent to user P n Users can decrypt to obtain the edge node ECN. l With user P n Agreed-upon random number Therefore, each user can encrypt their local gradients as follows.

[0086]

[0087] After that, user P n Local masking gradient Divided into And satisfy encryption get User P n The encrypted and segmented gradient Send to the l-th edge node ECN l .

[0088] To implement the verification function, in the t-th region, each user P n The hash value of the local gradient will be calculated. It will also be announced to the participants in the region (including other users and edge nodes in the region).

[0089] Step S5: Aggregation

[0090] In the t-th region, each edge node ECN l Decryption yields the segmentation gradient from the user. And sum them up Similarly, each edge node can sum the random numbers it negotiates with the user. After that, ECN l Noise removal results And Encryption obtained Send to CS.

[0091] CS receives information from T regions. Decryption The aggregation result g is calculated as follows: * .

[0092]

[0093] In the t-th region, the first verification aggregation is performed: a random edge node is selected, and the hash values ​​published by users in this region are aggregated to obtain the result. And publish it to all users in the area.

[0094] Step S6: Verification

[0095] Within the t-th region, the user in that region receives the hash value aggregated by the edge nodes and verifies SLHH(g). t If the verification passes, then SLHH(g) will be used. t This information will be released to all participants in all regions.

[0096] CS obtains the aggregation result g * And calculate its hash value LHH(g) * Return the result to all users. Users then perform a second validation aggregation: verifying whether the following expression holds true.

[0097]

[0098] If the above formula is true, the verification is successful, and the user proceeds to the next round of training; if the above formula is false, the verification fails, and the user terminates training and exits.

[0099] Based on the present invention, a verifiable federated learning-based smart healthcare privacy protection system and method can address the following threat models:

[0100] Malicious cloud server attacks: A malicious cloud server means that it attempts to infer users' private information from encrypted data, or may deliberately return incorrect aggregation results.

[0101] Semi-honest user or ECN attack: Semi-honest users or ECNs are curious about users' private data and will try to infer the private data of other users through the parameters and other information they collect.

[0102] Collusion attack: There may be collusion attacks between ECN, CS and a small number of users, who infer the privacy data of other users by sharing information such as model parameters.

[0103] External malicious attack: A malicious adversary exists. They will try to obtain useful information from users by any means necessary. For example, It can launch eavesdropping attacks to obtain intermediate parameters of the model and infer users' private data.

[0104] In summary, the present invention has the following advantages:

[0105] (1) A high-efficiency, verifiable privacy-preserving federated learning scheme was designed for malicious cloud servers, which allows users to independently verify the correctness of the aggregated results returned by the server without third-party assistance.

[0106] (2) Data security is protected using a dual masking method of data segmentation and noise addition. Simultaneously, to avoid external attacks such as man-in-the-middle attacks and eavesdropping attacks that may occur during data transmission, this invention utilizes the TLS protocol to establish a secure transmission channel, effectively ensuring data security during transmission. Furthermore, it can resist collusion attacks between the server and some users or edge nodes.

[0107] (3) This invention utilizes a dual aggregation verification method, which can effectively reduce the computational overhead on the user side. In addition, it supports users to exit during the training process without causing additional computational burden on the cloud server.

[0108] The above description discloses only one preferred embodiment of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art will understand that all or part of the processes of the above embodiments can be implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A verifiable federated learning method for protecting privacy in smart healthcare, characterized in that, Includes the following steps: Step 1: The architecture includes a privacy protection system for certificate authentication centers, users, edge computing nodes, and cloud servers; Step 2: Entity registration for the privacy protection system; During the execution of step 2, use This indicates the private identity of the edge computing node. Indicates the user's private identity. This refers to the digital certificate issued by the Certificate Authority to the edge computing node. This refers to the digital certificate issued to the user by the Certificate Authority. Edge computing nodes select random numbers , ,calculate ,in and They are two large prime numbers, denoted as Edge computing nodes send to the certificate authentication center information; Certificate Authentication Center received After the message, a public-private key pair is generated for the edge computing node. ,in Used to generate digital signatures Used to verify digital signatures; Certificate Authorities use Generate digital signature And Announced; digital certificate recorded as ,in This refers to a cryptographic suite consisting of a key exchange method, signature, encryption, and MAC algorithm. Represents a certificate chain; Certificate Authorization Centers will use digital certificates Awarded to Digital certificates are used to prove identity; Step 3: Perform identity authentication and key negotiation based on the TLS protocol; Step 4: The user performs masking gradient; The expression for user-masked local gradients in step 4 is as follows: Where n is the number of online users in this round of training. For the user's local gradient, The number of edge nodes in the region. Random numbers generated for edge computing nodes; encryption ,get[ The user will encrypt and segment the gradient. Send to the edge nodes ; Step 5: Cloud server collects and aggregates information; Step 6: Each user independently verifies the aggregated results returned by the cloud server.

2. The verifiable federated learning smart healthcare privacy protection method as described in claim 1, characterized in that, The execution process of step 3 includes the following steps: Step 3.1: Verify the identity of the edge computing node; Step 3.2: The user calculates the shared key; Step 3.3: Generate user certificate; Step 3.4: Verify user identity; Step 3.5: Edge computing nodes calculate the shared key; Step 3.6: Key negotiation complete.

3. The verifiable federated learning smart healthcare privacy protection method as described in claim 2, characterized in that, During the generation of the user certificate, the shared key is transferred to the user's TLS record layer; the user handshake completes with a message. The calculation formula is: in, It is negotiated. The hash function specified in , , , For digital signatures.

4. The verifiable federated learning smart healthcare privacy protection method as described in claim 3, characterized in that, The aggregation result in step 5 is calculated as follows: in, Receive from cloud server Information within each region After decryption, it is obtained.

5. The verifiable federated learning smart healthcare privacy protection method as described in claim 4, characterized in that, In step 6, the cloud server obtains the aggregation result. And calculate its hash value. The results are returned to all users, who then perform a second verification aggregation to check if the following expression holds true: If the condition is met, the verification passes and the user proceeds to the next round of training; if the condition is not met, the verification fails, and the user terminates training and exits.

6. A verifiable federated learning smart healthcare privacy protection system, used in accordance with the verifiable federated learning smart healthcare privacy protection method as described in any one of claims 1 to 5, characterized in that, This includes certificate authentication centers, users, edge computing nodes, and cloud servers; The certificate authority is responsible for issuing certificates, verifying and auditing the identity of certificate applicants, ensuring that the public key contained in the certificate and the identity information of its owner are authentic and trustworthy, and is also responsible for initializing model parameters, generating a linear homomorphic hash function, and broadcasting it to all participants. The user is the data owner, who collects patient information and performs local training. The edge computing nodes are located close to the end users to share the computing overhead of the cloud server; The cloud server is responsible for aggregating the gradients uploaded by edge computing nodes and generating a label based on the aggregation result for users to verify the aggregation result.

Images