Fair federal learning method based on function encryption

Abstract

The invention provides a fair federated learning method based on function encryption, designs a privacy protection federated learning framework-QPFFL based on multi-client function encryption MCFE and a privacy protection reputation mechanism PPRM, and aims to solve challenges such as quantum resistance, privacy protection and fairness in federated learning. Wherein the privacy of client data is ensured through multi-client function encryption, and safe aggregation of the model is realized. A privacy preserving reputation mechanism identifies and mitigates malicious behavior, evaluates the contribution of each client, and adjusts model weights according to their reputation values. Through the integration of the MCFE and the PPRM, the framework can resist attacks such as convenient vehicle building and poisoning, and the fair model distribution is realized while the data privacy is not damaged.

Description

Technical Field

[0001] The present invention relates to information security technology, and in particular to privacy-preserving federated learning technology. Background Art

[0002] With the rapid development of artificial intelligence (AI), enterprises and individuals are facing challenges of data silos and data privacy. Federated learning (FL) has become a widely used distributed paradigm that can perform collaborative model training without directly sharing data. Federated learning is currently used in various fields in industry and academia, such as models for predicting heart attacks in the medical field, providing patients with more accurate medical advice based on the prediction results of federated learning algorithms. However, federated learning faces severe challenges in terms of fairness and privacy.

[0003] Fairness is a core challenge of federated learning. In the traditional FL framework, although each client contributes differently to the model update, all clients are treated equally when the model is assigned, which can cause dissatisfaction among clients with higher contributions and may lead to free-rider attacks. The fairness issue is intertwined with the resource constraints and data scarcity issues faced by some participants, so there is an urgent need for a mechanism that can fairly evaluate and reward contributions to solve these problems. Moreover, traditional FL is susceptible to interference and attacks, such as poisoning attacks, which leads to degradation of model performance or misjudgment, affecting the robustness of the model. Lyu et al. proposed a collaborative fair federated learning framework, which calculates the reputation of participants based on contribution values ​​to solve the fairness problem. However, they expose the information of clients with high contributions and may be subject to attribute reasoning and other attacks from malicious clients, increasing the privacy risk of honest clients.

[0004] On the other hand, privacy is another key issue in FL. Direct plaintext transmission of gradients can lead to attribute inference and quantum attacks, resulting in privacy leakage. Currently, privacy-preserving federated learning (PPFL) has become an important means to protect sensitive data, that is, the client hides model parameters by encryption or other methods before sending information to the cloud server. However, traditional aggregation methods in privacy-preserving federated learning, such as homomorphic encryption (HE), differential privacy (DP), multi-party secure computing (MPC), and trusted execution environment (TEE), have shown significant limitations in practical applications. Homomorphic encryption (HE) is vulnerable to collusion attacks that affect security or lead to longer training times. Differential privacy (DP) loses the performance of the federated learning model. Multi-party secure computing (MPC) leads to huge communication overhead. Trusted execution environment (TEE) is limited by limited computing resources and hardware costs. At present, many studies use functional encryption (FE) to solve privacy issues. Functional encryption is a lightweight public key encryption algorithm that can achieve effective aggregation on encrypted data and is more suitable for PPFL scenarios.

[0005] This dual challenge of fairness and privacy, coupled with the limitations of existing methods, highlights the need for a comprehensive approach that both preserves privacy and promotes fairness by rewarding different contributions. Summary of the invention

[0006] The technical problem to be solved by the present invention is to implement a method capable of ensuring the privacy and fairness of privacy-preserving federated learning by utilizing multi-client function encryption MCFE and privacy-preserving reputation mechanism PPRM.

[0007] The technical solution adopted by the present invention to solve the above technical problems is a fair federated learning method based on function encryption, comprising the steps of:

[0008] System initialization steps: Set the weight parameter α, reputation threshold β, the total number of clients n and the client set u for calculating the reputation value; the aggregation server initializes the invisible reputation value vector R, which contains the reputation value r of each client. i , client serial number i∈[n]; the trusted third party TTP generates the system public key pp and sends it to each client and aggregation server, then uses the system public key to generate the master key msk, and adds the private key sk of each client i in the master key msk i Distribute to the corresponding client i; finally generate the decryption key sk r And send to the aggregation server;

[0009] Client model training steps: The client trains the local model to obtain the local gradient w all, the public label of this round of training is l;

[0010] Model parameter encryption steps: Each client uses the system public key pp and the client private key sk i , client serial number i and label l perform multi-client function encryption to encrypt the local gradient to generate FE.Enc(w all ), and use homomorphic encryption to encrypt local gradients to generate HE.Enc(w all ), the ciphertext FE.Enc(w all ) and the homomorphically encrypted ciphertext HE.Enc(w all ) is sent to the aggregation server;

[0011] Aggregation result calculation steps: The aggregation server receives the local gradients encrypted by the multi-client function and the local gradients encrypted by homomorphic encryption and the corresponding labels l sent by each client; uses the received system public key pp, reputation value list R, and decryption key sk r The local gradients encrypted by the functions of all clients are decrypted by multi-client functions with label l to obtain the global gradient w g ; The aggregation server traverses the client serial number i and takes a random number u for each client i i ,v i ; Then use the homomorphic properties of homomorphic encryption to calculate u i ×HE.Enc(∥w all ∥ 2 ),v i ×∥w g ∥ 2 and HE.Enc(w all )·w g Get the ciphertext HE.Enc(u i ×∥w all ∥ 2 )、HE.Enc(w all ·w g ) and HE.Enc(v i ×∥w g ∥ 2 ) and send these ciphertexts to TTP;

[0012] TTP cosine similarity intermediate value calculation steps: TTP homomorphic decryption to get u i ×∥w all ∥ 2 、v i ×∥w g ∥ 2 and w all ·w g ; Calculate the median cosine similarity of client i in this round of training Send the int of client i to the aggregation server;

[0013] Client reputation update step: After the aggregation server receives the int from client i, it calculates the cosine similarity Then update the reputation value of the client in this round i =αr i ′+(1-α)cos(w all ,w g ), where r i ′ is the reputation value of each client in the previous round, and then the updated reputation value r is determined i Is it greater than or equal to the reputation threshold β? If so, keep the client i, otherwise, remove the client i from the client set u; after completing the reputation value update of all clients i in the client set, update the global gradient w g Sent to the corresponding client, sparsify represents the sparse processing algorithm;

[0014] Client model update step: The client uses the received w g Update the locally trained model.

[0015] The reputation value is dynamically updated based on each participant's performance in this round of training (refer to the cosine similarity of local gradients and global gradients) and their previous reputation values, reflecting their reliability and contribution to model training. This design not only enhances fairness and robustness, but also rewards the client's active contribution and excludes malicious behavior, motivating participants in the federated learning process.

[0016] Multi-client function encryption is a distributed function encryption scheme, which is characterized by supporting input from different clients (sources). The data comes from different clients, and there may be a lack of mutual trust between these clients. The multi-client function encryption of the present invention uses labels, and each client in each round of training process, The encrypted data is bound to the corresponding label of this round, so that more fine-grained control over the data is achieved. In addition, during the multi-client function decryption process of the aggregated ciphertext, data associated with different labels cannot be decrypted, which prevents effective decryption or transmission of meaningful information through collusion attacks. Therefore, the label attribute effectively alleviates the risk of collusion between participating entities.

[0017] The beneficial effects of the present invention are:

[0018] Privacy. Semi-honest aggregation servers cannot learn additional information other than the expected output, and malicious collusion participants cannot learn the model parameters of other honest participants.

[0019] Fairness. Fairly measure each client’s contribution to the global model without accessing the client’s private data.

[0020] Robustness. Maintain stable and accurate calculation results in the presence of differences in data distribution and various attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is the overall method and operation flow chart of the present invention. DETAILED DESCRIPTION

[0022] The implementation of the method of the present invention is completed by the following parts:

[0023] 1) Trusted Third Party (TTP). This entity is responsible for setting public parameters, generating and distributing client public and private keys, generating function aggregation keys, and performing secure computations to ensure fairness. TTP is an independent agency trusted by both the client and the aggregation server and will not collude with other entities. This trusted and independent agent is a common assumption in existing cryptographic systems that use trusted third parties as the underlying infrastructure.

[0024] 2) Aggregation server. This entity is responsible for receiving ciphertexts from clients participating in training, detecting attacks such as poisoning and free-riding, completing the calculation of the global model after receiving the function aggregation key, and distributing the parameters of the global model according to the reputation values ​​of the participating clients. This entity is semi-honest, it complies with the algorithm and protocol, but may attempt to derive sensitive information about client data and model parameters.

[0025] 3) Client. Assume that there are n participating clients, denoted as u1, u2, ..., u n , each client u i Each holds a local dataset D i In the application scenario of federated learning, the client is usually an individual, organization or institution that holds sensitive information.

[0026] The threats that the federated learning framework may encounter are summarized into two threat models. The first is a semi-honest aggregation server. We assume that the aggregation server follows the algorithm and protocol correctly, but may try to infer sensitive information about training data and model updates. This adversarial setting is a common assumption in privacy-preserving federated learning schemes. The second is malicious clients. These clients can perform various attacks, such as free-riding by exploiting the federated learning system without contributing fair resources, poisoning the model training process by injecting adversarial data, or conducting quantum attacks.

[0027] In view of the above threat model, under the federated learning aggregation algorithm of the present invention, our technical solution includes the following steps:

[0028] 1) The trusted third party initializes the key required for the entire training process and distributes the key to the clients participating in the training.

[0029] 2) The client uses its own data set to train the model locally, encrypts the trained model parameters using the function encryption key and the homomorphic encryption key respectively, and uploads the two encryption results to the aggregation server in the cloud.

[0030] 3) After the aggregation server receives the encrypted information from the client, it uses function encryption to obtain the global gradient, and calculates the reputation value of each client based on its different contribution to the global gradient, and then compares its reputation value with the predefined reputation threshold. Clients below the reputation threshold will be identified as malicious and removed.

[0031] 4) Finally, the aggregation server assigns the corresponding global model according to the reputation value of each client.

[0032] This paper proposes a new multi-client function encryption (Multi-Client FE) MCFE and a privacy-preserving reputation mechanism PPRM. MCFE and PPRM are used to form a privacy-preserving federated learning (QPPFL) framework that guarantees privacy and fairness. MCFE ensures the privacy of client data and achieves secure aggregation of models. PPRM identifies and mitigates malicious behavior, evaluates individual contributions, and adjusts model weights based on personalized reputation values. Through the integration of MCFE and PPRM, we can resist attacks such as free riding and poisoning, and ensure fair model distribution without compromising data privacy. Below, we will first describe MCFE and PPRM. Then we will further introduce the QPPFL framework.

[0033] Multi-client function encryption is a distributed function encryption scheme in which data comes from different clients that may lack mutual trust. Combined with tags, MCFE has more fine-grained control over data. In addition, during the decryption of aggregated ciphertext, data associated with different tags cannot be decrypted, which prevents effective decryption or transmission of meaningful information through collusion attacks. Therefore, the tag attribute effectively mitigates the risk of collusion between participating entities. The MCFE algorithm used in the present invention includes five probabilistic polynomial time algorithms:

[0034] 1) Initialize FE.Setup: Input security parameter λ and number of clients n, initialize and generate public key pp, FE.Setup(1 λ ,1 n)→pp. The specific process is: set P to the maximum value of the plaintext space, V to the maximum value of the ciphertext space, select system parameters m0, q, K, ε, m0 is an arbitrary integer, q is a prime number, K = nPV, scaling factor ε∈(0,1); global hash function is a finite field of order q with length n+m0, l represents the label; the generated system public key is

[0035] 2) Key generation FE.KeyGen: Input the system public key pp to generate the master private key msk, FE.KeyGen(pp)→msk. The specific process is: for all client serial numbers i∈[n], Z i By Random sampling Get random number s i and t i :

[0036]

[0037] Where D represents discrete Gaussian distribution, εq is the offset of discrete Gaussian distribution, represents a matrix of size 1×m0, Representation Matrix It is distributed according to a discrete Gaussian with an offset of εq;

[0038] Then n client private keys sk i =Z i Combined to generate the master private key msk = {sk i} i∈[n] = {Z i} i∈[n] ;

[0039] 3) Encryption algorithm FE.Enc: FE.Enc(pp,sk i ,x i ,i,l)→ct i,l , input the system public key pp and the private key sk of the i-th client i , the plaintext x of the i-th client i , client serial number i and label l, output ciphertext ct i,l The specific process is: for x i ∈{0,...,P-1}, calculate the ciphertext ct of the i-th client i,l :

[0040]

[0041] in, Indicates rounding down;

[0042] 4) Key derivation FE.KeyDer: FE.KeyDer(pp,msk,R)→sk r , enter the public key pp, all client private keys sk i The msk and reputation value vector R = {r i} i∈[n] , generate function decryption key sk r The specific process is as follows: for n client reputation values ​​r i ∈V, calculate the decryption key sk r :

[0043]

[0044] 5) Decryption algorithm FE.Enc: Input public key pp, reputation value vector R, client ciphertext {ct i,l} i∈[n] , function decryption key sk r and label l, and output the aggregation result μ. The specific process is:

[0045] First calculate the intermediate value μ′ of the aggregation result

[0046]

[0047] Then output μ∈{-K+1,...,K-1} according to μ′, so that Minimum.

[0048] In our PPFL scheme, the aggregation server maintains an invisible reputation value vector R = {r1,r2,...,r n},and r i =1000, where n represents the number of clients participating in the current training process. These reputation values ​​are dynamically updated based on each participant's performance in this round of training and their previous reputation values, reflecting their reliability and contribution to model training. This design not only enhances fairness and robustness, but also rewards the client's active contribution and excludes malicious behavior, motivating participants in the federated learning process.

[0049] Based on the client’s previous contributions, the aggregation server uses the reputation value to weight the local model parameters w of the current training round. all So as to obtain the global model parameter w g : This process uses a decryption algorithm encrypted with a function to form a global model. In addition, a configurable reputation threshold β sets the minimum expected contribution threshold in the FL environment, which helps to establish a baseline for judging whether to allow a client to participate in training, and identifying and mitigating malicious clients.

[0050] Privacy-preserving reputation update. In each round of interaction, the client’s reputation value r i First compare with the threshold β. Clients with a value less than β will be excluded from subsequent training rounds. The reputation value calculation formula for each participant i is:

[0051] r i =αr i ′+(1-α)cos(w all ,w g )

[0052] Among them, r i ′ is the reputation value of the previous round, α is the weight parameter for calculating the reputation value, cos(w all ,w g ) is a measure of the local gradient w all With the global gradient w g The cosine similarity between all ,w g ) is calculated as:

[0053]

[0054] For privacy and security reasons, the aggregation server cannot directly calculate this cosine value, so it delegates the lightweight calculation task to the TTP. In the threat model of the present invention, the client does not have access to the global gradient, and the aggregation server does not know the client's model parameters. Therefore, before sending the client's encrypted information and global model parameters to the TTP, homomorphic encryption HE is used to encrypt this information. Specifically, the aggregation server obtains Generate a random number u for each client i and v i , and use the homomorphic property of homomorphic encryption to respectively all ∥ 2 and ∥w g ∥ 2 Multiply to generate HE.Enc(u i ×∥w all ∥ 2 )、HE.Enc(w all ·w g ) and HE.Enc(v i ×∥w g ∥ 2 ), and sends them to TTP. TTP decrypts and calculates w all and w g The median cosine similarity between And returns it to the aggregation server. The aggregation server finally connects the int with Multiply and calculate cos(wall ,w g ). The aggregation server is the only one that knows u and v, so this process ensures the privacy of the data.

[0055] After the model gradients are aggregated, the aggregation server distributes the global gradients to the participants. Each participant is limited to downloading a gradient that is sparse based on the maximum value and its reputation value:

[0056]

[0057] Among them, sparsify represents the sparse processing algorithm.

[0058] Based on the above algorithm, this paper proposes QPFFL, a new PPFL scheme that integrates MCFE and PPRM. QPFFL achieves privacy protection, collaborative fairness and robust performance. Figure 1 As shown, the complete process of the aggregation protocol training phase of federated learning is outlined below:

[0059] 1. System initialization:

[0060] Set the weight parameter α, reputation threshold β, the total number of clients n, the security parameter λ, and the client set participating in the current training round.

[0061] The aggregation server initializes the invisible reputation value vector R = {r1, r2, ..., r i ,...,r n}, r i =1000 / n, i∈[n];

[0062] The trusted third party TTP inputs the security parameter λ and the number of clients n into FE.Setup to initialize the system, generates the system public key pp and sends it to each client and aggregation server, and then uses FE.KeyGen(pp) to obtain the master key msk, and adds the private key sk of each client i in the master key msk. i Distribute to the corresponding client i, and finally generate the decryption key sk according to FE.KeyDer(pp,msk,r) r And send to the aggregation server;

[0063] 2. Client i performs model training:

[0064] Local training obtains the local gradient w all , that is, the plaintext x i =w all , and the public label of this training is l;

[0065] 3. Client i encrypts model parameters:

[0066] Client i uses function encryption to encrypt model parameter ct based on client serial number i and label l i,l ←FE.Enc(pp,sk i ,x i ,i,l), and use homomorphic encryption to encrypt local gradients to obtain HE.Enc(w all ), ct i,l and HE.Enc(w all ) is sent to the aggregation server;

[0067] 4. Aggregation server performs aggregation result calculation steps:

[0068] Receive the system public key pp and collect the encrypted local gradient ct of each customer i,l and HE.Enc(w all ) and the corresponding label l, using the system public key pp, label l, decryption key sk r and R i,l} i∈[n] Decryption results in the aggregation μ←FE.Dec(pp,R,{ct i,l} i∈[n] ,sk r ,l), take the aggregation result μ as the global gradient w g =μ;

[0069] The aggregation server traverses the client serial number i and takes a random number u for each client i i , Then use the homomorphic property of homomorphic encryption to calculate u i ×HE.Enc(∥w all ∥ 2 ),v i ×∥w g ∥ 2 and HE.Enc(w all )·w g Get the ciphertext HE.Enc(u i ×∥w all ∥ 2 )、HE.Enc(w all ·w g ) and HE.Enc(v i ×∥w g ∥ 2 ) and send these ciphertexts to TTP;

[0070] 5.TTP performs cosine similarity calculation:

[0071] TTP for HE.Enc(u i ×∥w all ∥2 )、HE.Enc(v i ×∥w g ∥ 2 ) and HE.Enc(w all ·w g ) performs homomorphic decryption to obtain u i ×∥w all ∥ 2 、v i ×∥w g ∥ 2 and w all ·w g ;

[0072] Then calculate the median cosine similarity value of client i in this round of training Send the int of client i to the aggregation server;

[0073] 6. The aggregation server updates the reputation value of each client:

[0074] Receive the int from client i from TTP, and then calculate Update the reputation value of the client in this round i =αr i ′+(1-α)cos(w all ,w g ), where r i ′ is the reputation value of client i in the previous round, and the updated reputation value r is determined i Is it greater than or equal to the reputation threshold β? If so, keep the client i; otherwise, remove it from the client set After completing the reputation update of all clients i in the client set, update the global gradient according to the client's contribution level to the model update Each client's corresponding w g Send to each client;

[0075] 8. Client updates the model:

[0076] Each client uses the received w g Update the locally trained model.

[0077] From the above process, it can be seen that the training phase of the present invention is divided into four parts:

[0078] 1) Initialization phase. The aggregation server generates system parameters u and v for protecting the global gradient, as well as α and β for calculating the reputation value. TTP is responsible for the key management of the system. It will generate a series of keys, including the master key msk for function encryption and the private key sk for function encryption of each client. i , aggregate key skr , homomorphic encryption public key HE pk and private key HE sk Then, TTP will encrypt the private key sk i Distributed to each client participating in the training. In addition, before training, the gradient value needs to be converted from a floating point number to an integer to align with the function value calculation on the encryption side of the function. If a new training party joins during the training process, they first need to ask the TTP for a key through a secure channel. In order to serve more clients who want to join during the training process, the TTP needs to set a larger value n so that it can provide enough keys for new participants.

[0079] 2) Training phase: Each client uses its own data set to train the model locally, encrypts the trained model parameters using functional encryption and homomorphic encryption, and uploads them to the aggregation server.

[0080] 3) Aggregation phase. After receiving the encrypted model parameters of all clients, the aggregation server uses the decryption step of the function encryption to perform aggregation calculation to obtain the global gradient. Based on the steps of the privacy-preserving reputation mechanism described above, the aggregation server will calculate the reputation value of each client based on the different contributions of each client to the training process, and use the reputation threshold to identify malicious clients and detect various attacks. Specifically, if the reputation value of a client is lower than the predefined threshold β, the aggregation server classifies it as a malicious client or a free rider, and then removes it from the candidate client set for subsequent training iterations.

[0081] 4) Model distribution. The contribution level of each client to the global model is determined based on PPRM. The weight assigned to the client by the model will be consistent with the client's contribution level. Clients with more contributions will be rewarded with better models. This process ensures fair distribution of models.

Claims

1. A fair federated learning method based on function encryption, characterized in that: Includes steps: System initialization steps: Set the weight parameter α, reputation threshold β, the total number of clients n and the client set The aggregation server initializes the invisible reputation value vector R, which contains the reputation value r of each client. i , client serial number i∈[n]; the trusted third party TTP generates the system public key pp and sends it to each client and aggregation server, then uses the system public key to generate the master key msk, and adds the private key sk of each client i in the master key msk i Distribute to the corresponding client i; finally generate the decryption key sk r And send to the aggregation server; Client model training steps: The client trains the local model to obtain the local gradient w all , the public label of this round of training is l; Model parameter encryption steps: Each client uses the system public key pp and the client private key sk i , client serial number i and label l perform multi-client function encryption to encrypt the local gradient to obtain FE.Enc(w all ), and use homomorphic encryption to encrypt the local gradient to obtain HE.Enc(w all ), the encryption result of the function encryption FE.Enc(w all ) and the homomorphic encryption result HE.Enc(w all ) is sent to the aggregation server; Aggregation result calculation steps: The aggregation server receives the local gradients encrypted by the multi-client function and the local gradients encrypted by homomorphic encryption and the corresponding labels l sent by each client; uses the received system public key pp, reputation value list R, and decryption key sk r The local gradients encrypted by the functions of all clients are decrypted by multi-client functions with label l to obtain the global gradient w g ; The aggregation server traverses the client serial number i and takes a random number u for each client i i , v i ; Then use the homomorphic properties of homomorphic encryption to calculate u i ×HE.Enc(||w all || 2 ),v i ×||w g || 2 and HE.Enc(w all )·w g Get the ciphertext HE.Enc(u i ×||w all || 2 )、HE.Enc(w all ·w g ) and HE.Enc(v i ×||w g || 2 ) and send these ciphertexts to TTP; TTP cosine similarity intermediate value calculation steps: TTP homomorphic decryption to get u i ×||w all || 2 、v i ×||w g || 2 and w all ·w g ; Calculate the median cosine similarity of client i in this round of training Send the int of client i to the aggregation server; Client reputation update step: After the aggregation server receives the int from client i, it calculates the cosine similarity Then update the reputation value of the client in this round i =αr′ i +(1-α)cos(w all , w g ), where r′ i is the reputation value of each client in the previous round, and then the updated reputation value r is determined i Is it greater than or equal to the reputation threshold β? If so, keep the client i; otherwise, remove it from the client set Remove the client i from the client set; after completing the reputation update of all clients in the client set, update the global gradient w g Sent to the corresponding client, sparsify represents the sparse processing algorithm; Client model update step: The client uses the received w g Update the locally trained model.

2. The method according to claim 1, characterized in that: Initialize the reputation value r of each client i Make total is the preset total credit value.

3. The method according to claim 2, characterized in that: r i =total / n。 4. The method according to claim 1, characterized in that: The system initialization step also includes setting safety parameters; The trusted third-party TTP uses the security parameter and the number of clients n to input (1 λ , 1 n ) to the initialization function FE.Setup to generate the system public key P is the maximum value of the plaintext space, V is the maximum value of the ciphertext space, m0, q, K, ε are the selected system parameters, m0 is an arbitrary integer, q is a prime number, K = nPV, ε∈(0,1); global hash function is a finite field of order q with dimension n+m0.

5. The method according to claim 4, characterized in that: The trusted third party TTP inputs the system public key pp into the key generation function FE.KeyGen to generate the master key msk: For all client sequence numbers i∈[n], Z i By Random sampling Get random number s i and t i : Where D represents discrete Gaussian distribution, εq is the offset of discrete Gaussian distribution, represents a matrix of size 1×m0, Representation Matrix It is distributed according to a discrete Gaussian with an offset of εq; Then n client private keys sk i =Z i Combined to generate the master private key msk = {sk i } i∈[n] = {Z i } i∈[n] .

6. The method according to claim 5, characterized in that The trusted third party TTP inputs the system public key pp, the master private key msk and the reputation value vector R into the key derivation function FE.KeyDer to generate the decryption key sk r :

7. The method according to claim 6, characterized in that The multi-client function encryption function FE.Enc is: FE.Enc(pp, sk i , x i , i, l)→ct i，l ; Among them, the parameters input to the multi-client function encryption function include the system public key pp, the private key sk of the i-th client i , the plaintext x of the i-th client i , client serial number i and label l, ct i，l The ciphertext obtained by encrypting the label l function in this round is the output of the i-th client; Indicates rounding down.

8. The method according to claim 6, characterized in that: The multi-client function decryption function FE.Dec is: The parameters of the multi-client function decryption function include the system public key pp, the reputation value vector R, the local gradient {ct i，l } i∈[n] , decryption key sk r and label l, μ is the output aggregation result; First calculate the intermediate value μ′ of the aggregation result Then output μ∈{-K+1,...,K-1} according to μ′, so that Minimum.

Images