A GPU-accelerated ciphertext aggregation method for federated learning based on homomorphic encryption

Abstract

The present invention discloses a federated learning GPU accelerated ciphertext aggregation method based on homomorphic encryption, which relates to the field of information security technology and comprises the following steps: a server initializes the model parameters of a global model and sends them to a client; a client generates a private key and a calculation key for homomorphic encryption, trains a local model according to the received model parameters, updates the local model, encrypts the model parameters of the local model using a modular component homomorphic encryption algorithm using the private key to obtain a ciphertext, and sends the ciphertext to the server; the server loads the ciphertexts of all clients onto a GPU, performs parallel sum calculations according to the calculation key to obtain a sum value, transmits the sum value back to a CPU for weighted average aggregation, obtains an aggregated ciphertext and sends it to the client; the client decrypts the aggregated ciphertext using the private key, updates the local model with the decrypted model parameters, and repeats the above-mentioned training and encryption transmission process. The present invention can effectively improve the efficiency and accuracy of federated learning while ensuring the security of learning.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more particularly to a federated learning GPU-accelerated ciphertext aggregation method based on homomorphic encryption. Background Art

[0002] In the era of massive data, numerous devices and organizations are continuously generating vast amounts of information. Leveraging this valuable data can significantly improve problem-solving efficiency. Deep learning demonstrates powerful performance by building models and learning from the characteristics of vast amounts of sample data to help us solve practical problems.

[0003] However, in traditional centralized deep learning, users upload their personal data to a server for training. This data transfer process poses the risk of privacy leakage, so users may refuse to share their data. This can result in insufficient data diversity or insufficient data volume, which in turn reduces the accuracy and robustness of the trained model. Unlike centralized deep learning, federated learning is a distributed deep learning method that allows users to collaborate with other users on model training without uploading data. Specifically, users simply upload their locally trained model parameters to the server. The server aggregates the model parameters from each user and returns the aggregated model to the user, starting the next round of training until consensus is reached. This collaborative approach reduces the risk of data leakage and alleviates user concerns about privacy. However, the server remains vulnerable to attacks, where attackers can obtain user-uploaded model parameters and compromise the global model. Preventing model parameters from being directly exposed to attackers presents a challenge.

[0004] Homomorphic encryption allows calculations to be performed directly on ciphertext without having to decrypt it into plaintext for calculations. The result of decrypting the ciphertext obtained after the homomorphic encryption operation is consistent with the result obtained from the plaintext operation. Based on this feature, homomorphic encryption can be applied to federated learning. The client encrypts the model information and transmits it to the server. The server only performs aggregation operations and returns the new encrypted model information to the client. The client performs decryption operations locally and uses the new global model for training. This process is repeated until the end condition is met. In this way, some sensitive information is protected and users' concerns about information leakage are alleviated. However, the existing homomorphic encryption applied to federated learning has the following disadvantages: 1. The high computational overhead of homomorphic encryption leads to excessively long time: Homomorphic encryption is usually more complex than traditional encryption algorithms. Especially when calculating large-scale data, the computational complexity increases significantly, requiring a lot of computing power and time for encryption and decryption operations, resulting in overall low efficiency. 2. Precision loss and many homomorphic encryption libraries do not support floating-point operations: Some homomorphic encryption methods introduce noise during the encryption and decryption process and may approximate the data, resulting in deviations between the encrypted and decrypted values ​​and the true values. In federated learning, many parameters such as weights are floating-point numbers, but many homomorphic encryption libraries only support integer operations, hindering the development of homomorphic encryption for federated learning. 3. Technically insecure: Currently commonly used homomorphic encryption libraries such as HElib and SEAL are developed by foreign countries, significantly increasing the cost of commercial use and reducing the security of Chinese products.

[0005] Therefore, how to improve the efficiency, accuracy, and security of federated learning using homomorphic encryption is an urgent problem that needs to be solved by those skilled in the art. Summary of the Invention

[0006] In view of this, the present invention provides a federated learning GPU-accelerated ciphertext aggregation method based on homomorphic encryption. This method combines a modular component homomorphic encryption library with federated learning, and uses GPUs to parallelly calculate different modular components to achieve MNIST handwriting recognition under encrypted conditions. This greatly improves the speed and security of recognition, effectively enhances the efficiency and accuracy of federated learning, and ensures the security of learning.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] A GPU-accelerated ciphertext aggregation method for federated learning based on homomorphic encryption includes the following steps:

[0009] Step 1: The server initializes the global model and sends the model parameters of the global model to the client;

[0010] Step 2: The client generates a private key and a computation key for homomorphic encryption;

[0011] Step 3: The client trains the local model based on the model parameters of the global model and updates the local model;

[0012] Step 4: The client encrypts the model parameters of the local model using the modular component homomorphic encryption algorithm based on the private key, obtains the ciphertext, and sends the ciphertext to the server;

[0013] Step 5: After receiving the ciphertext, the server loads all the client ciphertexts into the GPU and performs parallel sum calculations based on the calculation key to obtain the sum value. The sum value is then sent back to the CPU for weighted average aggregation based on the calculation key to obtain the aggregated ciphertext and send it to the client.

[0014] Step 6: The client uses the private key to decrypt the aggregated ciphertext, uses the decrypted model parameters to update the local model, and returns to step 3 until the number of iterations is reached or the objective function of the global model converges.

[0015] Preferably, in step 1, the model parameters are initialized to obtain a global model, and the global model is a neural network with a depth of 6 layers, including 2 convolutional layers, 1 maximum pooling layer and 3 fully connected layers.

[0016] Preferably, the process of generating a public-private key pair by the client in step 2 is:

[0017] Step 21: Select n module bases to form a module projection base B;

[0018] Step 21: Set the user master key U, encrypt the user master key U, and generate the location template S;

[0019] Step 23: Generate a private key and a computation key based on the model projection basis B and the position template S. The private key SK includes the model projection basis B, the position template S, the magnification a, and the scale factor Δ; the computation key EK includes the model projection basis B, the magnification a, and the scale factor Δ.

[0020] Preferably, the specific process of the client training the local model in step 3 is:

[0021] Step 31: Download the model parameters of the current global model from the server;

[0022] Step 32: Update the local model using the downloaded model parameters and load the dataset;

[0023] Step 33: Extract several data batches of size B from the dataset;

[0024] Step 34: Input a batch of data into the local model for forward propagation to obtain the prediction results;

[0025] Step 35: Calculate the loss function based on the predicted results and the true results marked in the dataset, and calculate the gradient of the loss function relative to each model parameter in the local model through the backpropagation algorithm;

[0026] Step 36: Update the model parameters of the local model using stochastic gradient descent according to the gradient, select the next set of data batches, and return to step 34 until the set number of training rounds is reached or the loss converges.

[0027] Preferably, in step 4, the specific process of the client encrypting the model parameters of the local model using the modular component homomorphic encryption algorithm according to the private key is:

[0028] Step 41: Select 3 random numbers;

[0029] Step 42: Multiply the model parameter by the scale factor Δ in the private key SK and round it to the nearest integer. Multiply the obtained integer by the magnification factor a in the private key SK and add the random noise η to obtain the distinguished plaintext.

[0030] Step 43: Multiply the three random numbers by the magnification factor a and then add the random number noise η to obtain three amplified scrambled random numbers;

[0031] Step 44: Perform a modulo operation on the model parameters with respect to the modulo projection basis B to obtain a true modulo projection set;

[0032] Step 45: Perform a modulo operation on the modulo projection basis B using the three amplified scrambled random numbers to obtain a redundant modulo projection set;

[0033] Step 46: Insert the real module projection set into the redundant module projection set according to the position of the real module component in the position template S of the private key SK to obtain the ciphertext e; the ciphertext e is actually the obfuscated redundant module projection set, the real module projection is in the real module projection set, and the position template S determines the position of each real module projection in the M-1 obfuscated redundant module projections in the obfuscated redundant module projection set.

[0034] Preferably, the ciphertext e is transmitted to the CPU in the server for storage. In step 5, the server is equipped with a GPU, and the process of weighted averaging and aggregation of the ciphertext by the server is as follows:

[0035] Step 51: The GPU copies the ciphertext e on the CPU in the server;

[0036] Step 52: The GPU launches a sum kernel and an extraction kernel, calling multiple thread blocks. Each thread block contains multiple threads. Each thread performs sum calculations on different data groups of the ciphertext e according to the calculation key EK, extracts the sum value and stores it in the result array. The sum value in the result array is returned to the CPU, freeing up GPU memory. Each thread processes the corresponding data group according to the global index, performs sum and extraction operations, obtains the sum value, and returns it to the CPU.

[0037] Step 53: The CPU performs a weighted average operation on the sum value according to the calculated key EK to obtain the aggregated ciphertext and sends it to the client.

[0038] Preferably, the client receives the aggregated ciphertext, decrypts it using the private key SK to obtain updated model parameters, and updates the local model using the updated model parameters.

[0039] Through the above technical solutions, it can be seen that compared with the prior art, the present invention discloses a federated learning GPU-accelerated ciphertext aggregation method based on homomorphic encryption, which ensures data security through a federated learning solution based on modular component homomorphic encryption, thereby alleviating users' concerns about data privacy leakage. The present invention uses a homomorphic encryption method based on obfuscated modular components. The calculations of different modular components are independent. The independence of the components makes it possible to calculate multiple data components at the same time, so that multi-core processors or distributed computing resources can be fully utilized to accelerate the calculation process; GPUs are used to implement parallel calculations of ciphertexts. GPUs have a large number of cores and can process large amounts of data at the same time, which is suitable for large-scale computing tasks. GPUs are fast when performing matrix operations and vector operations, and are especially suitable for the process of matrix addition. GPUs can process more data per unit time, which helps to accelerate complex computing processes. When processing specific types of computing tasks, GPUs are usually more energy efficient than CPUs and can more effectively utilize computing resources. Therefore, the characteristics of GPU parallel computing are very suitable for accelerating computing processes. The specific beneficial effects produced by the present invention include:

[0040] (1) A federated learning solution is adopted, where the server and clients can work together to train the model, combining diverse data from different clients to improve the generalization ability of the model and enable it to perform better on unknown data;

[0041] (2) The server can perform aggregation operations such as weighted averaging on the encrypted parameters from each participant to obtain an update of the global model, thereby achieving the integration and improvement of model parameters in federated learning;

[0042] (3) The modular component homomorphic encryption algorithm is implemented using a domestically developed modular component homomorphic encryption library. It is highly efficient and requires a relatively short average running time, making it suitable for scenarios with large amounts of data. The client does not need to upload data to the server when training data locally, and the modular component homomorphic encryption algorithm is used, allowing the server to directly perform aggregation operations on the ciphertext without decrypting it, thus protecting the user's privacy-sensitive data and reducing the risk of data leakage.

[0043] (4) Using GPU to accelerate the ciphertext aggregation operation effectively improves efficiency, increasing the aggregation operation speed by five times compared to ordinary CPU;

[0044] (5) By supporting floating-point operations and floating-point encoding, ciphertext calculations with 19 digits after the decimal point can be realized, providing support for the implementation of the federated learning security aggregation method based on the modular component homomorphic encryption algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0046] Figure 1 Flowchart of the modular component homomorphic federated learning secure aggregation method provided by the present invention;

[0047] Figure 2 Schematic diagram of the federated learning architecture based on the modular component homomorphic encryption algorithm provided by the present invention. DETAILED DESCRIPTION

[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0049] The embodiment of the present invention discloses a federated learning GPU accelerated ciphertext aggregation method based on homomorphic encryption, such as Figure 1 As shown, the following steps are included:

[0050] Step 1: The server initializes the global model and sends the model parameters of the global model to the client;

[0051] Step 2: The client generates a private key and a computation key for homomorphic encryption;

[0052] Step 3: The client trains the local model based on the model parameters of the global model and updates the local model;

[0053] Step 4: The client encrypts the model parameters of the local model using the modular component homomorphic encryption algorithm based on the private key, obtains the ciphertext, and sends the ciphertext to the server;

[0054] Step 5: After receiving the ciphertext, the server loads all the client ciphertexts into the GPU and performs parallel sum calculations based on the calculation key to obtain the sum value. The sum value is then sent back to the CPU for weighted average aggregation based on the calculation key to obtain the aggregated ciphertext and send it to the client.

[0055] Step 6: The client uses the private key to decrypt the aggregated ciphertext, uses the decrypted model parameters to update the local model, and returns to step 3 until the number of iterations is reached or the objective function of the global model converges.

[0056] On the other hand, in a specific embodiment, a GPU-accelerated ciphertext aggregation method based on homomorphic encryption is provided. The structural diagram of data transmission between the server and the client is as follows: Figure 2 As shown, the specific steps include:

[0057] S1. Model parameter initialization;

[0058] The server initializes the model parameters of the global model, including weight parameters, and selects clients to participate in training at a certain ratio. The server sends the initialized global model to the clients participating in training and then starts federated learning.

[0059] S2. Key Generation: The client generates key information used for encryption, decryption, and homomorphic computation, including private keys and computation keys.

[0060] S3. Client-side local model training;

[0061] The client receives the global model sent by the server and trains local data based on it. When the client's model reaches the end condition, it uses the modular component homomorphic encryption algorithm to encrypt the model parameters with the private key and transmits the encrypted model parameters back to the server.

[0062] S4. Server aggregation;

[0063] After receiving the encrypted model parameters from each client, the server performs a weighted average calculation based on the calculation key. This process involves a large number of blind calculation operations such as ciphertext addition and a large number of independent modulus components that require the same calculation. Therefore, this blind calculation process is parallelized on the GPU to speed up the calculation. After the calculation is completed, the newly encrypted model parameters are resent to each client.

[0064] S5. Iterative training;

[0065] After receiving the newly encrypted model parameters, the client uses the private key to decrypt them, then uses the decrypted model parameters to update the local model and restart local data training, repeating S3-S5 until the end condition is met, which includes reaching the training round or model convergence.

[0066] On the other hand, in a specific embodiment, a federated learning GPU-accelerated ciphertext aggregation method based on homomorphic encryption specifically includes the following steps:

[0067] S1. The server initializes the model parameters of the global model, specifically including the following steps:

[0068] S11. The server initializes the global model and sets it to a 6-layer neural network with 2 convolutional layers, 1 maximum pooling layer, and 3 fully connected layers.

[0069] S12. The server sends the model parameters of the global model to the clients participating in the training;

[0070] S2. The client generates the private key and computation key required for homomorphic encryption, which specifically includes the following steps:

[0071] S21, selecting n standard modular bases to form a modular projection base B; performing modular operations on the modular bases to obtain modular projections of the data, and constructing a modular projection base;

[0072] S22. The client sets its own user master key U and encrypts the user master key U to generate a location template S;

[0073] S23. Generate a private key SK, including the module projection basis B, the position template S, the magnification a, and the scaling factor Δ; generate a computation key EK, including the module projection basis B, the magnification a, and the scaling factor Δ. The magnification a is used to eliminate the noise added during the homomorphic encryption process to ensure the accuracy of the result. The scaling factor Δ is determined based on the sufficient precision required to represent floating-point numbers, ensuring that the range and accuracy of the encryption calculation are consistent with the expected accuracy of the result. The position template S determines the M-1 positions used to obfuscate each true module projection in the redundant module projections. It is also the most critical parameter in our private key. To ensure security, N log M > 128 is required to ensure that the position template S cannot be obtained by brute force by an attacker.

[0074] S3. The client participating in training receives the model parameters of the global model from the server. The client sets the hyperparameters used for training, such as the learning rate, batch size, and number of training rounds, so as to perform forward and backward propagation on its own local data. The training process of the received global model based on the set hyperparameters specifically includes the following steps:

[0075] S31, the client downloads the model parameters of the current global model from the server. These parameters are usually aggregated in the previous training rounds;

[0076] S32, the client uses the model parameters to update its local model;

[0077] S33. The client prepares data locally, loads the dataset, and performs some preprocessing operations on the local data.

[0078] S34. The client extracts a data batch of size B from the loaded data set, where B defines the number of samples contained in each data batch.

[0079] Use the current local model to perform forward propagation calculations on the extracted data batches, input the data batches into the local model's neural network for forward propagation, and calculate the prediction results of the local model through each layer of the network;

[0080] S36. Calculate the loss function using the predicted results and the true values ​​marked in the local dataset;

[0081] S37. Calculate the gradient of the loss function with respect to each model parameter of the local model through the backpropagation algorithm. This process involves the chain rule, calculating the gradient of each model parameter backward layer by layer.

[0082] S38. Use the stochastic gradient descent (SGD) algorithm to update the model parameters based on the calculated gradients. The update process involves dynamically adjusting parameters such as the learning rate to ensure stability in parameter updates and reduce the risk of problems such as overfitting.

[0083] S39, repeat the forward propagation and back propagation process, i.e. S34-S38, until the set training rounds are reached or the loss converges;

[0084] S4. After the client participating in the training completes the training of the local model, it uses the private key to encrypt the model parameters using the modular component homomorphic encryption algorithm. The client performing the training transmits the encrypted model parameters to the server. Assuming that the modular projection basis B includes 64 modular bases and the number of obfuscated redundant data is 3, the specific steps are as follows:

[0085] S41, generating three random data (i.e., confusing redundant data) for confusing the real model projection component;

[0086] S42. Multiply the model parameter by the scaling factor Δ in the private key SK and round it to the nearest integer. The resulting integer is first multiplied by the magnification factor a in the private key SK and then added to the first random number η to obtain a distinguishing plaintext. The first random number η is mainly used to prevent the same plaintext under the same modulus from generating the same ciphertext, where η << a, so as to eliminate the noise generated by the superposition of the first random number η and obtain the correct result.

[0087] S43. Multiply the three random numbers by the amplification factor a in the private key SK to amplify them by a factor of a, and add random number noise η to obtain three amplified and scrambled data, namely, the amplified scrambled random numbers;

[0088] S44, performing a modulo operation on the model parameters on the modulo projection basis B (which has 64 modulo bases) to obtain a modulo projection, and constructing a true modulo projection set;

[0089] S45, performing a modulo operation on the modulo projection basis B (which has 64 modulo bases) using the three amplified scrambled random numbers to obtain a modulo projection, and constructing a redundant modulo projection set;

[0090] S46. Insert the true modulus projection set into the redundant modulus projection set according to the position of the true modulus component in the position template S of the private key SK for obfuscation. Each true modulus projection has four optional positions, and obtain a ciphertext e of size 64×4.

[0091] S47. The participant sends the encrypted client model parameters, i.e., ciphertext e, to the server.

[0092] S5. The server receives the ciphertext e from each client and does not decrypt it. Instead, it directly uses the properties of homomorphic encryption to perform a weighted average of the ciphertexts to obtain the aggregated ciphertext. The ciphertext e is then transmitted to the server's CPU.

[0093] The server loads the weighted average calculation process of the ciphertext to the GPU for parallel summation. The calculated summation result is returned to the CPU, which performs weighted average aggregation on the summation result and then sends it to the clients participating in the training. The specific steps include:

[0094] S51, GPU is ready to receive and process data, and copies the ciphertext e on the CPU to the GPU so that the GPU can access the data;

[0095] S52: The GPU starts a sum kernel, calling multiple thread blocks. Each thread block contains multiple threads, responsible for summing different data groups. It also starts an extract kernel, responsible for extracting the first array from each group and storing it in the result array.

[0096] S53. Each thread processes the corresponding group according to its global index, and performs addition or extraction operations according to the calculation key EK to obtain the calculation result. For example, when the ciphertext e is a 64×4 ciphertext matrix, the operation performed by the GPU is to add the corresponding positions of a large number of 64×4 ciphertext two-dimensional arrays, and then extract the ciphertext addition results and put them into the result array as the calculation result. Since this process is performed in parallel, the speed of the process is greatly accelerated. Each thread performs a blind addition operation on the ciphertexts of the model parameters corresponding to the two clients. In this process, the two groups of ciphertexts are first aligned according to the magnification a and the scale factor Δ in the calculation key EK, and then the two groups of aligned ciphertexts are added using the modular projection basis B to obtain a new ciphertext. Finally, the magnification factor and the scale factor of the new ciphertext are updated according to the magnification factors and the scale factor orders of the two groups of ciphertexts.

[0097] S54, transferring the calculation result from the result data of the GPU back to the CPU, and releasing the GPU memory;

[0098] S55. After receiving the calculation result, the CPU performs a weighted average operation based on the calculation key EK to obtain the aggregated ciphertext. Since there is no division operation in homomorphic encryption, the operation of multiplying by the inverse is used instead.

[0099] After the server aggregation operation in S56 and S55 is completed, the updated model parameters in the ciphertext state (i.e., the aggregated ciphertext) are sent to the clients participating in the training;

[0100] S6. Each client participating in the training receives the aggregated ciphertext sent by the server and decrypts it using its own private key SK and updates the local model.

[0101] S7. Repeat S3-S6 to continuously optimize the global model until the specified number of iterations is reached or the loss function converges.

[0102] In the present invention, the client is mainly responsible for receiving and decrypting the global model sent by the server, and performing gradient descent (SGD) training on local data based on the global model. The server is mainly responsible for distributing the global model to the client and performing aggregation operations on the encrypted client model parameters. In this process, the greatest effect of using the homomorphic encryption algorithm is that the server can directly perform aggregation operations without having access to the plaintext data. When performing aggregation operations, the server uses the GPU to implement parallel computing. The core architecture of the GPU is based on SIMD, i.e. "single instruction, multiple data", which means that each core will execute the same instruction at the same time, but operate on different data. This architecture is particularly suitable for processing data-intensive tasks that can be parallelized, such as image and matrix calculations; and in the GPU, the computing task is usually decomposed into a large number of threads, each thread processing part of the task. The GPU can run thousands to millions of threads at the same time, greatly improving computing efficiency. Therefore, the greatest effect of using the GPU is to accelerate the blind calculation process of the aggregation operation, add the corresponding position ciphertexts in parallel, and then transmit the result back to the CPU.

[0103] This invention completes the training of the entire data through collaborative training between the client and server, and ensures that intermediate data is not leaked, thereby enhancing the privacy and security of the client's local data. Most importantly, it uses GPUs to accelerate the parallel computing process of blind calculations, thus compensating for the inefficiency of homomorphic encryption. Federated learning allows multiple participants to train models locally without sharing the original data; through homomorphic encryption, the data remains encrypted even during the model training process, which can effectively protect personal privacy, especially in sensitive fields such as medicine and finance. It alleviates users' concerns about privacy leaks to a certain extent and can attract more users to participate.

[0104] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0105] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A GPU-accelerated ciphertext aggregation method for federated learning based on homomorphic encryption, characterized in that: The following steps are involved: Step 1: The server initializes the global model and sends the model parameters of the global model to the client; Step 2: The client generates a private key and computation key for homomorphic encryption; specifically: Step 21: Select n module bases to form a module projection base B; Step 21: Set the user master key U, encrypt the user master key U, and generate the location template S; Step 23: Generate a private key and a computation key based on the model projection basis B and the position template S. The private key SK includes the model projection basis B, the position template S, the magnification a, and the scale factor Δ; the computation key EK includes the model projection basis B, the magnification a, and the scale factor Δ. Step 3: The client trains the local model based on the model parameters of the global model and updates the local model; Step 4: The client encrypts the model parameters of the local model using the modular component homomorphic encryption algorithm based on the private key, obtains the ciphertext, and sends the ciphertext to the server. The specific operations include: Step 41: Select 3 random numbers; Step 42: Multiply the model parameter by the scale factor Δ in the private key SK and round it to the nearest integer. Multiply the obtained integer by the magnification factor a in the private key SK and add the random noise η to obtain the distinguished plaintext. Step 43: Multiply the three random numbers by the magnification factor a and then add the random number noise η to obtain three amplified scrambled random numbers; Step 44: Perform a modulo operation on the model parameters with respect to the modulo projection basis B to obtain a true modulo projection set; Step 45: Perform a modulo operation on the modulo projection basis B using the three amplified scrambled random numbers to obtain a redundant modulo projection set; Step 46: Insert the true modulus projection set into the redundant modulus projection set according to the position of the true modulus component in the position template S of the private key SK to obtain the ciphertext e; Step 5: After receiving the ciphertext, the server loads all the client ciphertexts into the GPU and performs parallel sum calculations based on the calculation key to obtain the sum value. The sum value is then sent back to the CPU for weighted average aggregation based on the calculation key to obtain the aggregated ciphertext and send it to the client. The server performs weighted average and aggregation on the ciphertext as follows: Step 51: The GPU copies the ciphertext on the CPU in the server; Step 52: The GPU launches a sum kernel and an extraction kernel, calling multiple thread blocks. Each thread block contains multiple threads. Each thread performs sum calculations on different data groups of the ciphertext according to the calculation key EK, extracts the sum value and stores it in the result array. The sum value in the result array is returned to the CPU, freeing up GPU memory. Each thread processes the corresponding data group according to the global index and performs sum and extraction operations. Each thread performs a blind addition operation on the ciphertexts of the model parameters corresponding to the two clients. In this process, the two sets of ciphertexts are first aligned according to the magnification factor a and the scaling factor Δ in the calculation key EK. Then, the two sets of aligned ciphertexts are added using the modular projection basis B to obtain the new ciphertext. Finally, the magnification factor and the scaling factor of the new ciphertext are updated according to the magnification factor and the scaling factor of the two sets of ciphertexts. Step 53: The CPU performs a weighted average operation on the sum value according to the calculated key EK to obtain the aggregated ciphertext and sends it to the client; Step 6: The client uses the private key to decrypt the aggregated ciphertext, uses the decrypted model parameters to update the local model, and returns to step 3 until the number of iterations is reached or the objective function of the global model converges.

2. The method for GPU-accelerated ciphertext aggregation based on homomorphic encryption for federated learning according to claim 1, characterized in that: In step 1, the model parameters are initialized to obtain the global model. The global model is a neural network with a depth of 6 layers, including 2 convolutional layers, 1 maximum pooling layer and 3 fully connected layers.

3. The method for GPU-accelerated ciphertext aggregation based on homomorphic encryption for federated learning according to claim 1, characterized in that: The specific process of the client training the local model in step 3 is as follows: Step 31: Download the model parameters of the current global model from the server; Step 32: Update the local model using the downloaded model parameters and load the dataset; Step 33: Extract several data batches of size B from the dataset; Step 34: Input a batch of data into the local model for forward propagation to obtain the prediction results; Step 35: Calculate the loss function based on the predicted results and the true results marked in the dataset, and calculate the gradient of the loss function relative to each model parameter in the local model through the backpropagation algorithm; Step 36: Update the model parameters of the local model using stochastic gradient descent according to the gradient, select the next set of data batches, and return to step 34 until the set number of training rounds is reached or the loss converges.

4. The method for GPU-accelerated ciphertext aggregation based on homomorphic encryption for federated learning according to claim 1, characterized in that: The client receives the aggregated ciphertext and decrypts it using the private key SK to obtain the updated model parameters, and then updates the local model using the updated model parameters.

Images