A federated learning method resistant to poisoning attacks based on lightweight homomorphic encryption

Abstract

The present invention discloses a poisoning-resistant federated learning method based on lightweight homomorphic encryption, which includes an initialization stage, a gradient encryption and signature generation stage, a verification and calculation of aggregate weights stage, a gradient aggregation stage, and a gradient correctness verification stage. The present invention generates a unique mask for each client and blinds the encrypted local gradient. The adversary can only obtain the plaintext message if it knows the mask of each client, which effectively resists the chosen plaintext attack. The information sent between the various communication entities of the present invention must pass through an integrity verification algorithm based on an elliptic curve, which ensures the integrity of the transmitted information, prevents the adversary from tampering with the information, and effectively resists man-in-the-middle attacks. During the entire training process of the present invention, the homomorphic encryption algorithm is used to realize data calculation and processing in a ciphertext state, ensuring that data privacy is not leaked. At the same time, symmetric homomorphic encryption is used to reduce the computing overhead of the server and improve performance.

Description

Technical Field

[0001] The present invention relates to the field of information security communication technology, and in particular to a federated learning method based on lightweight homomorphic encryption that is resistant to poisoning attacks. Background Art

[0002] Traditional security measures are no longer sufficient to combat emerging cyberattacks. Therefore, the establishment of an intelligent threat intelligence platform is being proposed to address these complex attacks. Within this platform, threat intelligence data from multiple sources must be collected to jointly train a model. However, each participant possessing threat intelligence data is restricted to their own data. To address this situation, the federated learning framework has emerged.

[0003] Federated learning ensures that multiple participants can jointly train the same model without leaking local raw data. Each participant protects privacy by uploading local gradients instead of sharing raw data. However, uploaded local gradients may contain sensitive information that attackers can exploit to reconstruct the original data. Furthermore, attackers can tamper with uploaded local gradients or inject malicious data into local datasets, causing model training results to contradict expected outcomes. This can lead to the model producing erroneous results for specific data, rendering the trained model ineffective and ineffective.

[0004] Based on this, to protect the privacy of threat intelligence data and detect poisoned data while reducing training overhead, a poison-resistant federated learning method based on lightweight homomorphic encryption was designed. By utilizing lightweight homomorphic encryption, data remains encrypted during transmission and processing, effectively protecting user privacy and preventing data tampering and malicious attacks. Furthermore, the poisoning attack protection mechanism can identify and resist malicious data from untrusted nodes, ensuring the security and integrity of data during the federated learning process. This invented method has significant application prospects in model training for intelligent threat intelligence platforms. Summary of the Invention

[0005] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a federated learning method based on lightweight homomorphic encryption that is resistant to poisoning attacks.

[0006] The object of the present invention is achieved through the following technical solutions:

[0007] The present invention discloses a federated learning method based on lightweight homomorphic encryption to resist poisoning attacks, comprising the following steps:

[0008] S1. System initialization: The trusted center sets the system's public parameters, including the elliptic curve-based additive cyclic group and its generators, the collision-resistant hash function, the system's master public key, and the key for the symmetric encryption algorithm. The trusted center also sets the system's master private key and keeps it secret. It also registers various communication entities in the system. The trusted center generates its own signature private key for each communication entity and sends it to each communication entity through a secure channel.

[0009] S2. Gradient encryption and signature generation: Each client first trains the model locally to obtain local gradients. It then symmetrically encrypts each dimension of the local gradient data and adds a mask to blind it. It then signs the encrypted gradient and mask, and finally sends the ciphertext and digital signature to the aggregation server.

[0010] S3. Verification and calculation of aggregation weight: After receiving information from all clients, the aggregation server first uses the digital signature verification algorithm based on elliptic curves to batch verify all signatures. If the verification passes, the message is accepted as untampered; otherwise, it is rejected. In the ciphertext state, the aggregation server calculates the gradient mean and generates a random number to blind the mean and encrypted local gradient. The result is generated into a digital signature and sent to the central server. After receiving the signature, the central server first verifies it. After verification passes, it executes the anomaly detection algorithm, calculates the aggregation weight of each local gradient, and sends it to the aggregation server for aggregation processing.

[0011] S4, Gradient Aggregation: After receiving the aggregation weight, the aggregation server calculates the aggregation result and the verification value of each client in the encrypted state, and sends it to the central server for decryption. The central server decrypts the received result and sends it to each client;

[0012] S5. Gradient correctness verification: After receiving the message, the client performs integrity verification. If all passes, it indicates that the aggregation result has not been tampered with. The client receives the aggregation result and iterates to continue the next round of training.

[0013] Furthermore, the step S1 specifically includes the following steps:

[0014] S11. The trusted center TA generates the initialization model parameters W 0 and the learning rate Based on the finite field GF(p), a non-singular elliptic curve is selected as y 2 =x 3 +ax+b(mod p), where coefficients a,b∈Z p , meeting 4a 3 +27b 2(mod p)≠0, the trusted center selects the q-order additive cycle G on the elliptic curve, selects the generator as P, and in the finite field Z q Select the first non-zero random number k as the decryption private key of the elliptic curve and calculate the corresponding public key Q = k·P;

[0015] S12. The trusted center selects two secure prime numbers u and v within a preset range, and satisfies u>>v; from the finite field Z u Select the second non-zero random number s and a small integer ψ to obtain the key S of the symmetric homomorphic encryption algorithm hom =(s,v);

[0016] S13. The trusted center sets five collision-resistant hash functions: Set up another hash function in is a q-1 factorial cyclic group;

[0017] S14: The trusted center generates an identity identifier CID for each of the first clients. i (i=1, 2, ... n), the identity identifier PID of the aggregation server, the identity identifier SID of the central server;

[0018] S15. Trusted center in finite field Z q are the first client CID i (i=1, 2, ... n) select the third non-zero random number The aggregation server PID selects a fourth non-zero random number The central server SID selects a fifth non-zero random number And perform doubling operation on the third non-zero random number to obtain the first group element R i =t i P (i = 1, 2, ..., n); perform a doubling operation on the fourth non-zero random number to obtain a second group element R θ =t θ P; perform a doubling operation on the fifth non-zero random number to obtain the third group element The last one is the CID of the first client i (i=1, 2, ...n) Generate the first signature private key sig i =t i +k·H1(R i ||CID i )(i=1, 2, ...n); Generate a second signature private key sigθ=t for the aggregation server PID θ +k·H1(R θ ||PID); Generate a third signature private key for the central server SID

[0019] S16. The trusted center publishes parameters {G, P, H1, H2, H3, H4, H5, H6, Q, u} and sends the public parameters to the first client CID through a secure channel. i (i=1, 2, ... n) Send the first parameter set Send the second parameter set {k, PID, R θ , sig θ}; Send the third parameter set to the central server SID

[0020] Preferably, in step S2, each client encrypts the gradient, generates a mask to blind it, and generates a digital signature of the corresponding gradient; wherein the first client CID i (i=1, 2, ...n) execution includes the following steps:

[0021] S21: First client CID i (i=1, 2, ...n) Use the global model W of round t t Train on the local dataset to obtain the j-dimensional local gradient model V i =(V i，1 , V i，2 ,...,V i，j ); the first client CID i (i=1,2,...n) select two random numbers respectively, As the elliptic curve encryption parameter, r i，2 (|r i，2 |+|v|<|u|) as the symmetric homomorphic encryption parameter, and β i As a random mask; using the key S of the symmetric homomorphic encryption algorithm hcm Encrypted Gradient V t , and use β t Perform blinding and calculate the local gradient after encryption blinding where s ψ Indicates that the second non-zero random number s is used as the base small integer ψ to perform the exponential operation; use r i，1 Mask β t Encryption, double point calculation blind mask first component α i，1 =r i，1 P, and the second component of the blinding mask α i，2 =r i，1 Q; blinding mask second component α i,2 Hash and XOR the result with the mask value to calculate the blinded encrypted value Get the encrypted data set A i={α i，1 , γ i}; S22, the first client CID i (i=1,2,...n) in the finite field Z q Select the sixth non-zero random number d i , calculate the fourth group element D i =d i ·P=(ξ i ,ξ i ), where ξ i is the first component of the fourth group element, ζ i The second component of the fourth group element; the first client CID i (i=1, 2, ...n) Get the first timestamp time i , calculate η i =H2(U i ||γ i ||time i ||CID i ), and thus η is calculated i The digital signature σ i =(sig i +μ i ·d i ·η i )modq, where μ i =ξ i modq;

[0022] S23: First client CID i (i=1, 2, ...n) the message Msg i =(U i , A i , σ i , D i , time i , R i , CID i ) is sent to the aggregation server PID for further processing.

[0023] Preferably, in step S3, it is assumed that messages sent by m terminal users are received, and the first client CID i The index of each valid client in (i=1, 2, ...n) is recorded in the set Ω1 to obtain the second client CID i (i∈Ω1), and 0<|Ω1|≤n, |Ω1|=m; wherein the aggregation server PID execution includes the following steps:

[0024] S31, according to the first timestamp time of the received message i (i∈Ω1), determine whether time is satisfiedj -time i ≤Δtime, where Δtime is the time delay allowed by the system, time j is the current timestamp; if it does not meet the requirements, the integrity authentication fails; otherwise, the aggregation server PID randomly selects a coefficient set Each of the coefficients In [1,2 κ ] is randomly selected, κ is an integer within a preset range; for the second client CID i (i∈Ω1), calculate η i =H2(U i ||γ i ||time i ||CID i ), and according to the fourth group element D i Calculate the corresponding intermediate parameter μ i =ξ i modq; The integrity of the information is verified by the following equation:

[0025]

[0026] S32, using the decryption private key k based on the elliptic curve encryption algorithm sent by the trusted center TA, calculate α i，2 =α i，1 ·k, and α i，2 Hash the result H6(α i，2 ||CID i ) and the blinded encrypted value γ i Perform XOR to restore the mask value Calculate the unblinded encrypted gradient

[0027] S33, to ensure that private data is not leaked, the aggregation server PID calculates the gradient mean in the encrypted state

[0028] S34: Also to protect data privacy, the aggregation server PID is the second client CID i (i∈Ω1) Generate a random number λ i , the unblinded encrypted gradient T i And the gradient mean Δ and the corresponding random number λ i Multiply them together to get the blinded encrypted gradient λ i T i and the gradient mean λ i Δ;

[0029] S35, aggregate server PID in finite field Z q Select the seventh non-zero random number d θ , calculate the fifth group element D θ =d θ ·P=(ξ θ ,ζ θ ), where ξ θ is the first component of the fifth group element, ζ θ Is the second component of the fifth group element; and obtain the second timestamp time θ , and calculate η from this θ =H3(λ i T i ||λ l Δ||time θ ||PID); and calculate its digital signature σ θ =(sig θ +μ θ ·d θ ·η θ )mod q;

[0030] S36, the aggregation server PID sends the information Msg θ =(λ i T i ,λ l Δ,σ θ ,D θ ,time θ ,R θ ,PID) is sent to the central server SID.

[0031] Preferably, in step S3, the central server SID executes the following steps:

[0032] S3a, when the central server SID receives the message Msg sent by the aggregation server PID θ , according to the second timestamp time received θ , determine whether time is met j -time θ ≤Δtime, if it does not meet the requirements, the integrity authentication is determined to be unsuccessful; otherwise, the central server SID calculates η θ =H3(λ l T i ||λ l Δ||time θ ||PID), and then according to the received D θ =(ξ θ ,ζ θ ), calculate μ θ =ξ θ modq; through the equation σθ P = μ θ ·η θ ·D θ +R θ +H1(R θ ||PID)·Q to verify the integrity of the information;

[0033] S3b, the central server SID uses the symmetric key S hom CID of the second client i λ of (i∈Ω1) i T i and λ i Δ is decrypted to obtain the blinded local model gradient λ i T′ i =(λ i V i，1 ,λ i V i，2 , ..., λ i V i，j ) and the mean gradient

[0034] S3c, the central server SID performs anomaly detection, first calculating the local model gradient λ for each blind i T′ i and the gradient mean λ i The L2 norm distance l of Δ′ i =||λ i T′ i -λ i Δ′|| 2 ; Calculate l i The ratio between the gradient mean Δ′ Represents the degree of deviation between the gradient uploaded by each client and the mean; define a benchmark δ, if e i ≤δ, then it corresponds to the second client CID i The aggregation weight of (i∈Ω1) is not affected; on the contrary, if e i >δ, it indicates the corresponding second client CID i (i∈Ω1) has the possibility of data poisoning, and the aggregation weight needs to be reduced; thus, each second client CID is calculated i The aggregation weight of (i∈Ω1) is τ i =1-max(0,e i -δ);

[0035] S3d, central server SID in finite field Z q Pick the eighth non-zero random number Calculate the sixth group element in is the first component of the sixth group element, Is the second component of the sixth group element; get the third timestamp Calculated from this And calculate its corresponding digital signature in

[0036] S3e, central server SID broadcast information

[0037] Preferably, in step S4, the aggregation server PID calculates the first aggregation result ω and the first verification value Auth encrypted by each client in the encrypted state. i , and sent to the central server SID; the central server SID decrypts it and sends it to each client. The aggregation server PID executes the following specific steps:

[0038] S41, when the aggregation server PID receives the information sent by the central server SID According to the third timestamp received Determine whether it is satisfied If the requirements are not met, the integrity authentication is judged to be unsuccessful; otherwise, the calculation Based on calculate Through the equation To verify the integrity of the information;

[0039] S42: Perform gradient aggregation in an encrypted state to protect privacy, and obtain an encrypted first aggregation result. and the second client CID i The first verification value of (i∈Ω1) where i∈Ω1;

[0040] S43, the aggregation server PID randomly selects the ninth non-zero random number Calculate the seventh group element D θ ′=d θ ′·P=(ξ′ θ ,ζ′ θ ), where ξ′ θ The first component of the seventh group element, ξ′ θ The second component of the seventh group element; get the fourth timestamp time' θ , and calculate η from this θ ′=H5(ω||Auth i ||time′ θ ||PID); and calculate its digital signature σ′ θ =(sig θ +μ′θ ·d′ θ ·η′ θ )modq, where μ′ θ =ξ′ θ modq;

[0041] S44, the aggregation server PID sends the information Msg' θ =(ω,Authi,σ′ θ ,D′ θ ,time′ θ ,R θ ,PID) is sent to the central server SID.

[0042] Preferably, in step S4, the central server SID executes the following steps:

[0043] S4a, when the central server SID receives the message Msg' sent by the aggregation server PID θ , according to the fourth timestamp time′ received θ , determine the fifth timestamp time′ j , whether it satisfies time′ j -time′ θ ≤Δtime, if it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, calculate η′ θ =H5(ω||Auth i ||time′ θ ||PID), and then according to D′ θ =(ξ′ θ ,ζ′ θ ), calculate μ′ θ =ξ′ θ mod q; through the equation σ′ θ P = μ′ θ ·η′ θ ·D′ θ +R θ +H1(R θ ||PID)·Q to verify the integrity of the information;

[0044] S4b, decrypt the first aggregation result ω and the first verification value Auth i , the second aggregation result obtained after decryption is The second verification value obtained after decryption is

[0045] S4c: The central server SID broadcasts the second aggregation result ω′ and the second verification value

[0046] Preferably, step S5 specifically includes the following steps:

[0047] S51: Second client CID i (i∈Ω1) After receiving all verification information, three verifications are performed to determine the integrity of the aggregation results;

[0048] First, verify the aggregation weight τ i The correctness of the second client CID i (i∈Ω1) receives information sent by the central server SID According to the third timestamp received Determine whether it is satisfied If the requirements are not met, the integrity authentication is judged to be unsuccessful; otherwise, the calculation Based on calculate Through the equation To verify the integrity of the information;

[0049] Secondly, determine the second verification value The correctness of the second client CID i (i∈Ω1) according to its own local gradient V i and the generated mask value β i Calculate V i ·τ i +β i and verify the value with the second received Compare and accept if they are equal, otherwise consider the second verification value received It was forged, ending this round of training;

[0050] Finally, verify the correctness of the aggregation result; the second client CID i (i∈Ω1) calculation Is it equal to the second aggregation result ω′? If not, the result is considered to be forged and the current round of training ends;

[0051] S52: Second client CID i (i∈Ω1) calculates the global model parameters of round t+1 Perform update iterations and conduct the next round of training based on the updated model parameters until the model converges.

[0052] The beneficial effects of the present invention are:

[0053] 1) Each client generates its own unique mask and blinds the encrypted local gradient. The adversary can only obtain the plaintext message by knowing the mask of each client, effectively resisting the chosen plaintext attack.

[0054] 2) All information sent between communication entities must pass the integrity verification algorithm based on elliptic curves, which ensures the integrity of the transmitted information, prevents the adversary from tampering with the information, and effectively resists man-in-the-middle attacks.

[0055] 3) After the client sends the encrypted local gradient to the server, the aggregation server and the central server execute the anomaly detection algorithm to detect abnormal data and reduce its aggregation weight, effectively resisting data poisoning attacks.

[0056] 4) During the entire training process, homomorphic encryption algorithms are used to enable data calculation and processing in ciphertext, ensuring that data privacy is not leaked. At the same time, symmetric homomorphic encryption is used to reduce the server's computing overhead and improve performance.

[0057] 5) On the basis of ensuring data confidentiality, integrity and non-repudiation, through this method, the server can receive multiple ciphertexts from different clients and can achieve decryption through batch verification, further improving the performance of communication between entities. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 The figure is a flowchart of the steps of the anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions of the present invention in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work shall fall within the scope of protection of the present invention.

[0060] The present invention discloses a federated learning method based on lightweight homomorphic encryption to resist poisoning attacks, in order to achieve privacy protection of threat intelligence data and detection of poisoned data, while reducing the cost of the training process. The flowchart of the steps is as follows: Figure 1 As shown, the specific steps include:

[0061] S1. System initialization: The trusted center sets the system's public parameters, including the elliptic curve-based additive cyclic group and its generators, the collision-resistant hash function, the system's master public key, and the key for the symmetric encryption algorithm. The trusted center also sets the system's master private key and keeps it secret. It also registers various communication entities in the system. The trusted center generates its own signature private key for each communication entity and sends it to each communication entity through a secure channel.

[0062] S2. Gradient encryption and signature generation: Each client first trains the model locally to obtain local gradients. It then symmetrically encrypts each dimension of the local gradient data and adds a mask to blind it. It then signs the encrypted gradient and mask, and finally sends the ciphertext and digital signature to the aggregation server.

[0063] S3. Verification and calculation of aggregation weight: After receiving information from all clients, the aggregation server first uses the digital signature verification algorithm based on elliptic curves to batch verify all signatures. If the verification passes, the message is accepted as untampered; otherwise, it is rejected. In the ciphertext state, the aggregation server calculates the gradient mean and generates a random number to blind the mean and encrypted local gradient. The result is generated into a digital signature and sent to the central server. After receiving the signature, the central server first verifies it. After verification passes, it executes the anomaly detection algorithm, calculates the aggregation weight of each local gradient, and sends it to the aggregation server for aggregation processing.

[0064] S4, Gradient Aggregation: After receiving the aggregation weight, the aggregation server calculates the aggregation result and the verification value of each client in the encrypted state, and sends it to the central server for decryption. The central server decrypts the received result and sends it to each client;

[0065] S5. Gradient correctness verification: After receiving the message, the client performs integrity verification. If all passes, it indicates that the aggregation result has not been tampered with. The client receives the aggregation result and iterates to continue the next round of training.

[0066] Specifically, step S1 includes the following steps:

[0067] S11. The trusted center TA generates the initialization model parameters W 0 and the learning rate Based on the finite field GF(p), a non-singular elliptic curve is selected as y 2 =x 3 +ax+b(mod p), where coefficients a,b∈Z p , meeting 4a 3 +27b 2 (mod p)≠0, the trusted center selects the q-order additive cycle G on the elliptic curve, selects the generator as P, and in the finite field Z q Select the first non-zero random number k as the decryption private key of the elliptic curve and calculate the corresponding public key Q = k·P;

[0068] S12, the trusted center selects two secure prime numbers u and v within a preset range, where the preset range is a range pre-set according to the working environment and is not limited to a specific range, and satisfies u>>v; from the finite field Z uSelect the second non-zero random number S and a small integer ψ to obtain the key S of the symmetric homomorphic encryption algorithm hom =(s, v);

[0069] S13. The trusted center sets five collision-resistant hash functions: Set up another hash function in is a q-1 factorial cyclic group;

[0070] S14: The trusted center generates an identity identifier CID for each of the first clients. i (i=1, 2, ...n), the identity identifier PID of the aggregation server, and the identity identifier SID of the central server;

[0071] S15. Trusted center in finite field Z q are the first client CID i (i=1, 2, ... n) select the third non-zero random number The aggregation server PID selects a fourth non-zero random number The central server SID selects a fifth non-zero random number And perform doubling operation on the third non-zero random number to obtain the first group element R i =t i P(i=1, 2, ..., n); perform doubling operation on the fourth non-zero random number to obtain the second group element R θ =T θ P; perform a doubling operation on the fifth non-zero random number to obtain the third group element The last one is the CID of the first client i (i=1, 2, ...n) Generate the first signature private key sig i =t i +k·H1(R i ||CID i )(i=1, 2, ..., n); Generate a second signature private key sig for the aggregation server PID θ =t θ +k·H1(R θ ||PID); Generate a third signature private key for the central server SID

[0072] S16: The trusted center publishes the parameters {G, P, H1, H2, H3, H4, H5, H6, Q, u} and sends the public parameters {G, P, H1, H2, H3, H4, H5, H6, Q, u} to the first client CID through a secure channel. i (i=1, 2, ... n) Send the first parameter set Send the second parameter set {k, PID, Rθ , sig θ}; Send the third parameter set to the central server SID

[0073] Specifically, in step S2, each client encrypts the gradient, generates a mask to blind it, and generates a digital signature of the corresponding gradient; wherein the first client CID i (i=1, 2, ...n) execution includes the following steps:

[0074] S21: First client CID i (i=1, 2, ...n) Use the global model W of round t t Train on the local dataset to obtain the j-dimensional local gradient model V i =(V i，1 , V i，2 ,...,V i，j ); the first client CID i (i=1,2,...n) select two random numbers respectively, As the elliptic curve encryption parameter, r i，2 (|r i，2 |+|v|<|u|) as the symmetric homomorphic encryption parameter, and β i As a random mask; using the key S of the symmetric homomorphic encryption algorithm hom Encrypted Gradient V i , and use β i Perform blinding and calculate the local gradient after encryption blinding where s ψ Indicates that the second non-zero random number s is used as the base small integer ψ to perform the exponential operation, using r i,1 Mask β i Encryption, double point calculation blind mask first component a i，1 =r i，1 P, and the second component of the blinding mask α i，2 =r i，1 Q; blinding mask second component a i，2 Hash and XOR the result with the mask value to calculate the blinded encrypted value Get the encrypted data set A i ={α i，1 , γ i};

[0075] S22: First client CID i (i=1,2,...n) in the finite field Z q Select the sixth non-zero random number d i , calculate the fourth group element Di =d i ·P=(ξ i ,ζ i ), where ξ i is the first component of the fourth group element, ζ i The second component of the fourth group element; the first client CID i (i=1,2,...n) Get the first timestamp time i , calculate η i =H2(U i ||γ i ||time i ||CID i ), and thus η is calculated i The digital signature σ i =(sig i +μ i ·d i ·η i )modq, where μ i =ξ i modq;

[0076] S23: First client CID i (i=1, 2, ...n) the message Msg i =(U i , A i , σ i , D i , time i , R i , CID i ) is sent to the aggregation server PID for further processing.

[0077] Specifically, in step S3, it is assumed that messages sent by m terminal users are received, and the first client CID i The index of each valid client in (i=1,2,...n) is recorded in the set Ω1 to obtain the second client CID i (i∈Ω1), and 0<|Ω1|≤n, |Ω1|=m; wherein the aggregation server PID execution includes the following steps:

[0078] S31, according to the first timestamp time of the received message i (i∈Ω1), determine whether time is satisfied j -time i ≤Δtime, where Δtime is the time delay allowed by the system, time j is the current timestamp; if it does not meet the requirements, the integrity authentication fails; otherwise, the aggregation server PID randomly selects a coefficient set Each of the coefficients In [1,2 κ ] is randomly selected, κ is an integer within a preset range, the preset range is a range pre-set according to the working environment, and is not limited to a specific range; for the second client CID i (i∈1), calculate η i =H2(U i ‖γ i ‖time i ‖CID i ), and according to the fourth group element D i Calculate the corresponding intermediate parameter μ i =ξ i modq; The integrity of the information is verified by the following equation:

[0079]

[0080] S32, using the decryption private key k based on the elliptic curve encryption algorithm sent by the trusted center TA, calculate α i，2 =α i，1 ·k, and α i，2 Hash the result H6(α i，2 ‖CID i ) and the blinded encrypted value γ i Perform XOR to restore the mask value Calculate the unblinded encrypted gradient

[0081] S33, to ensure that private data is not leaked, the aggregation server PID calculates the gradient mean in the encrypted state

[0082] S34: Also to protect data privacy, the aggregation server PID is the second client CID i (i∈Ω1) Generate a random number λ i , the unblinded encrypted gradient T i And the gradient mean Δ and the corresponding random number λ i Multiply them together to get the blinded encrypted gradient λ i T i and the gradient mean λ i Δ;

[0083] S35, aggregate server PID in finite field Z q Select the seventh non-zero random number d θ , calculate the fifth group element D θ =d θ ·P=(ξ θ,ζ θ ), where ξ θ is the first component of the fifth group element, ξ θ Is the second component of the fifth group element; and obtain the second timestamp time θ , and calculate η from this θ =H3(λ i T i ||λ i Δ||time θ ||PID); and calculate its digital signature σ θ =(sig θ +μ θ ·d θ ·η θ )modq;

[0084] S36, the aggregation server PID sends the information Msg θ =(λ i T i ,λ i Δ, σ θ , D θ , time θ , R θ , PID) is sent to the central server SID.

[0085] Specifically, in step S3, the central server SID executes the following steps:

[0086] S3a, when the central server SID receives the message Msg sent by the aggregation server PID θ , according to the second timestamp time received θ , determine whether time is met j -time θ ≤Δtime, if it does not meet the requirements, the integrity authentication is determined to be unsuccessful; otherwise, the central server SID calculates η θ =H3(λ i T i ||λ i Δ||time θ ||PID), and then according to the received D θ =(ξ θ ,ζ θ ), calculate μ θ =ξ θ modq; through the equation σ θ P = μ θ ·η θ ·D θ +R θ +H1(R θ ||PID)·Q to verify the integrity of the information;

[0087] S3b, the central server SID uses the symmetric key S hom CID of the second client i λ of (i∈Ω1) i T i and λ i Δ is decrypted to obtain the blinded local model gradient λ i T′ i =(λ i V i，1 ,λ i V i，2 , ..., λ i V i，j ) and the mean gradient

[0088] S3c, the central server SID performs anomaly detection, first calculating the local model gradient λ for each blind i T′ i and the gradient mean λ i The L2 norm distance l of Δ′ i =||λ i T′ i -λ i Δ′|| 2 ; Calculate l i The ratio between the gradient mean Δ′ Represents the degree of deviation between the gradient uploaded by each client and the mean; define a benchmark δ, if e i ≤δ, then it corresponds to the second client CID i The aggregation weight of (i∈Ω1) is not affected; on the contrary, if e i >δ, it indicates the corresponding second client CID i (i∈Ω1) has the possibility of data poisoning, and the aggregation weight needs to be reduced; thus, each second client CID is calculated i The aggregation weight of (i∈Ω1) is τ i =1-max(0,e i -δ);

[0089] S3d, central server SID in finite field Z q Pick the eighth non-zero random number Calculate the sixth group element in is the first component of the sixth group element, Is the second component of the sixth group element; get the third timestamp Calculated from this And calculate its corresponding digital signature in

[0090] S3e, central server SID broadcast information

[0091] Specifically, in step S4, the aggregation server PID calculates the first aggregation result ω and the first verification value Auth encrypted by each client in the encrypted state. i , and sent to the central server SID; the central server SID decrypts it and sends it to each client. The aggregation server PID executes the following specific steps:

[0092] S41, when the aggregation server PID receives the information sent by the central server SID According to the third timestamp received Determine whether it is satisfied If the requirements are not met, the integrity authentication is judged to be unsuccessful; otherwise, the calculation Based on calculate Through the equation To verify the integrity of the information;

[0093] S42: Perform gradient aggregation in an encrypted state to protect privacy, and obtain an encrypted first aggregation result. and the second client CID i The first verification value of (i∈Ω1) where i∈Ω1;

[0094] S43, the aggregation server PID randomly selects the ninth non-zero random number Calculate the seventh group element D θ ′=d θ ′·P=(ξ′ θ ,ζ′ θ ), where ξ′ θ The first component of the seventh group element, ζ′ θ The second component of the seventh group element; get the fourth timestamp time' θ , and calculate η′ θ =H5(ω||Auth i ||time′ θ ||PID); and calculate its digital signature σ′ θ =(sig θ +μ′ θ ·d′ θ ·η′ θ ) mod q, where μ′ θ =ξ′ θ mod q;

[0095] S44, the aggregation server PID sends the information Msg'θ =(ω,Aut i ,σ′ θ ,D′ θ ,time′ θ ,R θ ,PID) is sent to the central server SID.

[0096] Specifically, in step S4, the central server SID executes the following steps:

[0097] S4a, when the central server SID receives the message Msg' sent by the aggregation server PID θ , according to the fourth timestamp time′ received θ , determine the fifth timestamp time′ j , whether it satisfies time′ j -time′ θ ≤Δtime, if it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, calculate η′ θ =H5(ω||Auth i ||time′ θ ||PID), and then according to D′ θ =(ξ′ θ ,ζ′ θ ), calculate μ′ θ =ξ′ θ = mod q; through the equation σ′ θ P = μ′ θ ·η′ θ ·D′ θ +R θ +H1(R θ ||PID)·Q to verify the integrity of the information;

[0098] S4b, decrypt the first aggregation result ω and the first verification value Auth i , the second aggregation result obtained after decryption is The second verification value obtained after decryption is

[0099] S4c: The central server SID broadcasts the second aggregation result ω′ and the second verification value

[0100] Specifically, step S5 includes the following steps:

[0101] S51: Second client CID i (i∈Ω1) After receiving all verification information, three verifications are performed to determine the integrity of the aggregation results;

[0102] First, verify the aggregation weight τi The correctness of the second client CID i (i∈Ω1) receives information sent by the central server SID According to the third timestamp received Determine whether it is satisfied If the requirements are not met, the integrity authentication is judged to be unsuccessful; otherwise, the calculation Based on calculate Through the equation To verify the integrity of the information;

[0103] Secondly, determine the second verification value The correctness of the second client CID i (i∈Ω1) according to its own local gradient V i and the generated mask value β i Calculate V i ·τ i +β i and verify the value with the second received Compare and accept if they are equal, otherwise consider the second verification value received It was forged, ending this round of training;

[0104] Finally, verify the correctness of the aggregation result; the second client CID i (i∈Ω1) calculation Is it equal to the second aggregation result ω? If not, the result is considered to be forged and the current round of training ends;

[0105] S52: Second client CID i (i∈Ω1) calculates the global model parameters of round t+1 Perform update iterations and conduct the next round of training based on the updated model parameters until the model converges.

[0106] For example, the correctness analysis of the anti-poisoning attack federated learning method based on lightweight homomorphic encryption includes:

[0107] Correctness of batch signature verification: During the malicious verification and aggregation weight calculation phase, the aggregation server PID will receive messages and signatures from clients. Assuming that messages are received from m clients, each first client CID i The subscripts of the valid clients in (i=1, 2, ...n) are recorded in the set Ω1 to obtain the second client CID i(i∈Ω1). Before the server processes the data, it must first verify the integrity of the data. In order to efficiently verify the integrity of all confidential data, the aggregation server PID can use a batch verification signature algorithm based on elliptic curves. Let each second client CID i The message sent by (i∈Ω1) is Msg i =(M i , U i , v i , time i , R i ), calculate η i and u i , randomly selected The specific process is as follows:

[0108] Correctness of the anomaly detection algorithm: In the tth round of training, after the central server SID receives m messages, it performs integrity verification. If it passes, the terminal server m uses the symmetric key S hom Decrypt the ciphertext and get λ i T′ i and λ i Δ′. During the anomaly detection process, the deviation between the local gradient of each client and the standard value can still be obtained by using the masked parameters for calculation Assuming that the local gradient is a g-dimensional vector, we have:

[0109]

[0110] The foregoing description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein and should not be construed as excluding other embodiments. Rather, the present invention can be used in various other combinations, modifications, and environments and can be modified within the scope of the concept described herein through the above teachings or techniques or knowledge in the relevant field. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention are intended to be protected by the appended claims.

Claims

1. A federated learning method based on lightweight homomorphic encryption to resist poisoning attacks, characterized by: The following steps are involved: S1. System initialization: The trusted center sets the system's public parameters, including the elliptic curve-based additive cyclic group and its generators, the collision-resistant hash function, the system's master public key, and the key for the symmetric encryption algorithm. The trusted center also sets the system's master private key and keeps it secret. It also registers various communication entities in the system. The trusted center generates its own signature private key for each communication entity and sends it to each communication entity through a secure channel. S2. Gradient encryption and signature generation: Each client first trains the model locally to obtain local gradients. It then symmetrically encrypts each dimension of the local gradient data and adds a mask to blind it. It then signs the encrypted gradient and mask, and finally sends the ciphertext and digital signature to the aggregation server. S3. Verification and calculation of aggregation weight: After receiving information from all clients, the aggregation server first uses the elliptic curve-based digital signature verification algorithm to batch verify all signatures; If the verification is successful, the message is accepted and has not been tampered with. Otherwise, it is rejected. In the ciphertext state, the aggregation server calculates the gradient mean and generates a random number to blind the mean and the encrypted local gradient. The result generates a digital signature and sends the blinded ciphertext and signature to the central server. After receiving the signature, the central server first verifies it. After the verification is successful, it executes the anomaly detection algorithm, calculates the aggregation weight of each local gradient, and sends it to the aggregation server for aggregation processing. S4, Gradient Aggregation: After receiving the aggregation weight, the aggregation server calculates the aggregation result and the verification value of each client in the encrypted state, and sends it to the central server for decryption. The central server decrypts the received result and sends it to each client; S5. Gradient correctness verification: After receiving the message, the client performs integrity verification. If all passes, it indicates that the aggregation result has not been tampered with. The client receives the aggregation result and iterates to continue the next round of training.

2. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 1 is characterized in that: The step S1 specifically includes the following steps: S11. The trusted center TA generates the initialization model parameters W 0 and the learning rate Based on the finite field GF(p), a non-singular elliptic curve is selected as y 2 =x 3 +ax+b(mod p), where coefficients a, b∈Z p , meeting 4a 3 +27b 2 (mod p)≠0, the trusted center selects the q-order additive cycle G on the elliptic curve, selects the generator as P, and in the finite field Z q Select the first non-zero random number k as the decryption private key of the elliptic curve and calculate the corresponding public key Q = k·P; S12, the trusted center selects two secure prime numbers u and v within a preset range, and satisfies u>>v; from the finite field Z u Select the second non-zero random number s and a small integer ψ to obtain the key S of the symmetric homomorphic encryption algorithm hom =(s, v); S13. The trusted center sets five collision-resistant hash functions: Set up another hash function in is a q-1 factorial cyclic group; S14: The trusted center generates an identity identifier CID for each of the first clients. i (i=1, 2, ...n), the identity identifier PID of the aggregation server, and the identity identifier SID of the central server; S15. Trusted center in finite field Z q are the first client CID i (i=1, 2, ... n) select the third non-zero random number The aggregation server PID selects a fourth non-zero random number The central server SID selects a fifth non-zero random number And perform doubling operation on the third non-zero random number to obtain the first group element R i =t i P (i = 1, 2, ..., n); perform a doubling operation on the fourth non-zero random number to obtain a second group element R θ =t θ P; perform a doubling operation on the fifth non-zero random number to obtain the third group element The last one is the CID of the first client i (i=1, 2, ...n) Generate the first signature private key sig i =t i +k·H1(R i ||CID i )(I=1, 2, ..., n); Generate a second signature private key for the aggregation server PID Generate a third signature private key for the central server SID S16. The trusted center publishes parameters {G, P, H1, H2, H3, H4, H5, H6, Q, u} and sends the public parameters to the first client CID through a secure channel. i (i=1, 2, ... n) Send the first parameter set Send the second parameter set [k, PID, R θ , sig θ }; Send the third parameter set to the central server SID 3. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 2 is characterized in that: In step S2, each client encrypts the gradient, generates a mask to blind it, and generates a digital signature of the corresponding gradient; wherein the first client CID i (i=1, 2, ...n) execution includes the following steps: S 21 , the first client CID i (i=1, 2, ...n) using the global model W of round t t Train on the local dataset to obtain the j-dimensional local gradient model V i =(V i，1 , V i，2 ,...,V i，j ); the first client CID i (i=1,2,...n) select two random numbers respectively, As the elliptic curve encryption parameter, r i，2 (|r i,2 |+|v|<|u|) as the symmetric homomorphic encryption parameter, and β i As a random mask; using the key S of the symmetric homomorphic encryption algorithm hom Encrypted Gradient V i , and use β i Perform blinding and calculate the local gradient after encryption blinding Among them S ψ Indicates that the second non-zero random number s is used as the base small integer ψ to perform the exponential operation; use r i，1 Mask β i Encryption, double point calculation blind mask first component α i，1 =r i，1 P, and the second component of the blinding mask α i，2 =r i,1 Q; blinding mask second component α i，2 Hash and XOR the result with the mask value to calculate the blinded encrypted value Get the encrypted data set A i ={α i，1 , γ i }; S22: First client CID i (i=1,2,…n) in the finite field Z q Select the sixth non-zero random number d i , calculate the fourth group element D i =d i ·P=(ξ i ,ζ i ), where ξ i is the first component of the fourth group element, ζ i The second component of the fourth group element; the first client CID i (i=1, 2, ...n) Get the first timestamp time i , calculate η i =H2(U i ||γ i ||time i ||CID i ), and thus η is calculated i The digital signature σ i =(sig i +μ i ·d i ·η i ) mod q, where μ i =ξ i mod q; S23: First client CID i (i=1, 2, ...n) the message Msg i =(U i , A i , σ i , D i , time i , R i , CID i ) is sent to the aggregation server PID for further processing.

4. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 3 is characterized in that: In step S3, it is assumed that m messages sent by terminal users are received and the first client CID i The subscript of each valid client in (i=1, 2, ... n) is recorded in the set Ω1 to obtain the second client CID i (i∈Ω1), and 0<|Ω1|≤n, |Ω1|=m; wherein the aggregation server PID execution includes the following steps: S31, according to the first timestamp time of the received message i (i∈Ω1), determine whether time is satisfied j -time i ≤Δtime, where Δtime is the time delay allowed by the system, time j is the current timestamp; if it does not meet the requirements, the integrity authentication fails; otherwise, the aggregation server PID randomly selects a coefficient set Each of the coefficients In [1, 2 κ ] is randomly selected, κ is an integer within a preset range; for the second client CID i (i∈Ω1), calculate η i =H2(U i ||γ i ||time i ||CID i ), and according to the fourth group element D i Calculate the corresponding intermediate parameter μ i =ξ i mod q; the integrity of the information is verified by the following equation: S32, using the decryption private key k based on the elliptic curve encryption algorithm sent by the trusted center TA, calculate α i，2 =α i，1 ·k, and α i，2 Hash the result H6(α i，2 ||CID i ) and the blinded encrypted value γ i Perform XOR to restore the mask value Calculate the unblinded encrypted gradient S33, to ensure that private data is not leaked, the aggregation server PID calculates the gradient mean in the encrypted state S34: Also to protect data privacy, the aggregation server PID is the second client CID i (i∈Ω1) Generate a random number λ i , the unblinded encrypted gradient T i And the gradient mean △ and the corresponding random number λ i Multiply them together to get the blinded encrypted gradient λ i T i and the gradient mean λ i Δ; S35, aggregate server PID in finite field Z q Select the seventh non-zero random number d θ , calculate the fifth group element D θ =d θ ·P=(ξ θ ,ζ θ ), where ξ θ is the first component of the fifth group element, ζ θ Is the second component of the fifth group element; and obtain the second timestamp time θ , and calculate η from this θ =H3(λ i T i ||λ i Δ||time θ ||PID); and calculate its digital signature σ θ =(sig θ +μ θ ·d θ ·η θ )mod q; S36, the aggregation server PID sends the information Msg θ =(λ i T i ,λ i Δ, σ θ , D θ , time θ , R θ , PID) is sent to the central server SID.

5. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 4 is characterized in that: In the step S3; The central server SID execution specifically includes the following steps: S3a, when the central server SID receives the message Msg sent by the aggregation server PID θ , according to the second timestamp time received θ , determine whether time is met j -time θ ≤Δtime, if it does not meet the requirements, the integrity authentication is determined to be unsuccessful; otherwise, the central server SID calculates η θ =H3(λ i T i ||λ i Δ||time θ ||PID), and then according to the received D θ =(ξ θ ,ζ θ ), calculate μ θ =ξ θ mod q; through the equation σ θ P = μ θ ·η θ ·D θ +R θ +H1(R θ ||PID)·Q to verify the integrity of the information; S3b, the central server SID uses the symmetric key S hom CID of the second client i λ of (i∈Ω1) i T i and λ i △ is decrypted to obtain the blinded local model gradient λ i T′ i =(λ i V i，1 ,λ i V i，2 , ..., λ i V i，j ) and the mean gradient S3c, the central server SID performs anomaly detection, first calculating the local model gradient λ for each blind i T′ i and the gradient mean λ i The L2 norm distance l of Δ′ i =||λ i T′ i -λ i Δ|| 2 ; Calculate l i The ratio between the gradient mean Δ′ e i Represents the degree of deviation between the gradient uploaded by each client and the mean; define a benchmark δ, if e i ≤δ, then it corresponds to the second client CID i The aggregation weight of (i∈Ω1) is not affected; on the contrary, if e i >δ, it indicates the corresponding second client CID i (i∈Ω1) has the possibility of data poisoning, and the aggregation weight needs to be reduced; thus, each second client CID is calculated i The aggregation weight of (i∈Ω1) is τ i =1-max(0,e i -δ); S3d, central server SID in finite field Z q Pick the eighth non-zero random number Calculate the sixth group element in is the first component of the sixth group element, Is the second component of the sixth group element; get the third timestamp Calculated from this And calculate its corresponding digital signature in S3e, central server SID broadcast information 6. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 5 is characterized in that: In step S4, the aggregation server PID calculates the first aggregation result ω and the first verification value Auth encrypted by each client in the encrypted state. i , and sent to the central server SID; the central server SID decrypts it and sends it to each client. The aggregation server PID executes the following specific steps: S41, when the aggregation server PID receives the information sent by the central server SID According to the third timestamp received Determine whether it is satisfied If the requirements are not met, the integrity authentication is judged to be unsuccessful; otherwise, the calculation Based on calculate Through the equation To verify the integrity of the information; S42: Perform gradient aggregation in an encrypted state to protect privacy, and obtain an encrypted first aggregation result. and the second client CID i The first verification value of (i∈Ω1) where i∈Ω1; S43, the aggregation server PID randomly selects the ninth non-zero random number Calculate the seventh group element D θ ′=d θ ′·P=(ξ′ θ ,ξ′ θ ), where ξ′ θ The first component of the seventh group element, ζ′ θ The second component of the seventh group element; get the fourth timestamp time' θ , and calculate η′ θ =H5(ω||Auth i ||time′ θ ||PID); and calculate its digital signature σ′ θ =(sig θ +μ′ θ ·d′ θ ·η′ θ ) mod q, where μ θ ′=ξ θ ′modq; S44, the aggregation server PID sends the information Msg' θ =(ω,Auth i ,σ′ θ , D′ θ , time′ θ , R θ , PID) is sent to the central server SID.

7. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 6 is characterized in that: In step S4, the central server SID executes the following steps: S4a, when the central server SID receives the message Msg sent by the aggregation server PID θ , according to the received fourth timestamp time′θ, determine the fifth timestamp time′ j , whether it meets the time j -time θ ≤Δtime, if it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, calculate η′ θ =H5(ω||Auth i ||time′ θ ||PID), and then according to D′ θ =(ξ′ θ ,ζ′ θ ), calculate μ′ θ =ξ θ mod q; through the equation σ′ θ P = μ′ θ ·η′ θ ·D′ θ +R θ +H1(R θ ||PID)·Q to verify the integrity of the information; S4b, decrypt the first aggregation result ω and the first verification value Auth i , the second aggregation result obtained after decryption is The second verification value obtained after decryption is S4c: The central server SID broadcasts the second aggregation result ω′ and the second verification value 8. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 7 is characterized in that: The step S5 specifically includes the following steps: S51: Second client CID i (i∈Ω1) After receiving all verification information, three verifications are performed to determine the integrity of the aggregation results; First, verify the aggregation weight τ i The correctness of the second client CID i (i∈Ω1) receives information sent by the central server SID According to the third timestamp received Determine whether it is satisfied If the requirements are not met, the integrity authentication is judged to be unsuccessful; otherwise, the calculation Based on calculate Through the equation To verify the integrity of the information; Secondly, determine the second verification value The correctness of the second client CID i (i∈Ω1) according to its own local gradient V i and the generated mask value β i Calculate V i ·τ i +β i and verify the value with the second received Compare and accept if they are equal, otherwise consider the second verification value received It was forged, ending this round of training; Finally, verify the correctness of the aggregation result; the second client CID i (i∈Ω1) calculation Is it equal to the second aggregation result ω′? If not, the result is considered to be forged and the current round of training ends; S52: Second client CID i (i∈Ω1) calculates the global model parameters of round t+1 Perform update iterations and conduct the next round of training based on the updated model parameters until the model converges.

Images