A function encryption-based fair federated learning method

Abstract

The application provides a fair federated learning method based on function encryption, designs a privacy protection federated learning framework QPFFL based on multi-client function encryption MCFE and privacy protection reputation mechanism PPRM, and aims to solve quantum resistance, privacy protection and fairness and other challenges in federated learning. Among them, the multi-client function encryption guarantees the privacy of the client data and realizes the safe aggregation of the model. The privacy protection reputation mechanism identifies and mitigates malicious behavior, evaluates the contribution of each client, and adjusts the model weight according to the reputation value. Through the integration of MCFE and PPRM, the framework can resist attacks such as free riding and poisoning, and ensure fair model distribution while not compromising data privacy.

Description

Technical Field

[0001] This invention relates to information security technology, and in particular to privacy-preserving federated learning technology. Background Technology

[0002] With the rapid development of Artificial Intelligence (AI), businesses and individuals face challenges related to data silos and data privacy. Federated Learning (FL) has become a widely used distributed paradigm, enabling collaborative model training without directly sharing data. Currently, Federated Learning is applied across various sectors of industry and academia, such as in the medical field, where models predicting heart attacks provide patients with more accurate medical advice based on the predictions of federated learning algorithms. However, Federated Learning faces significant challenges regarding fairness and privacy.

[0003] Fairness is a core challenge in federated learning. In traditional federated learning frameworks, although each client contributes differently to model updates, all clients are treated equally during model allocation. This can lead to dissatisfaction among clients with higher contributions and may result in free-rider attacks. The fairness issue is intertwined with resource constraints and data scarcity faced by some participants, thus necessitating a mechanism that can fairly evaluate and reward contributions to address these problems. Furthermore, traditional federated learning is vulnerable to interference and attacks, such as poisoning attacks, which can lead to degraded model performance or misjudgments, affecting the model's robustness. Lyu et al. proposed a collaborative fair federated learning framework that calculates participants' reputation scores based on their contributions to address the fairness issue. However, these frameworks expose information about high-contributing clients, making them susceptible to attribute inference and other attacks from malicious clients, increasing the privacy risks for honest clients.

[0004] On the other hand, privacy is another key issue in federated learning (FL). Directly transmitting gradients in plaintext can lead to property inference and quantum attacks, resulting in privacy breaches. Currently, Privacy-preserving Federated Learning (PPFL) has become an important means of protecting sensitive data, where clients hide model parameters through encryption or other methods before sending information to the cloud server. However, traditional aggregation methods in privacy-preserving federated learning, such as homomorphic encryption (HE), differential privacy (DP), multi-party secure computation (MPC), and trusted execution environments (TEEs), exhibit significant limitations in practical applications. Homomorphic encryption (HE) is vulnerable to collusion attacks, affecting security or leading to longer training times. Differential privacy (DP) sacrifices the performance of the federated learning model. Multi-party secure computation (MPC) incurs significant communication overhead. Trusted execution environments (TEEs) are limited by finite computing resources and hardware costs. Currently, many studies use functional encryption (FE) to address privacy issues. Functional encryption is a lightweight public-key encryption algorithm that can achieve efficient aggregation on encrypted data, making it more suitable for PPFL scenarios.

[0005] This dual challenge of fairness and privacy, coupled with the limitations of existing methods, underscores the need for a comprehensive approach that protects privacy and promotes fairness by rewarding different contributions. Summary of the Invention

[0006] The technical problem to be solved by this invention is to achieve a method that can guarantee the privacy and fairness of privacy-preserving federated learning by utilizing multi-client function encryption (MCFE) and privacy-preserving reputation mechanism (PPRM).

[0007] The technical solution adopted by this invention to solve the above-mentioned technical problems is a fair federated learning method based on function encryption, comprising the following steps:

[0008] System initialization steps: Set the weight parameter α for calculating reputation value, the reputation threshold β, the total number of clients n, and the client set u; initialize the aggregation server with an invisible reputation value vector R, which contains the reputation value r of each client. i The client sequence number i∈[n]; the trusted third party TTP generates the system public key pp and sends it to each client and the aggregation server, then uses the system public key to generate the master key msk, and adds the private key sk of each client i in the master key msk. i Distribute to the corresponding client i; finally generate the decryption key sk r And send it to the aggregation server;

[0009] Client-side model training steps: The client trains a local model to obtain the local gradient w. allThe public tag for this round of training is l;

[0010] Model parameter encryption steps: Each client uses the system public key pp and the client private key sk i The client sequence number i and label l are used for multi-client function encryption to encrypt the local gradient generation FE.Enc(w all Simultaneously, homomorphic encryption is used to encrypt the local gradient generation HE.Enc(w all ), which encrypts the ciphertext FE.Enc(w all ) and homomorphically encrypted ciphertext HE.Enc(w all Send to the aggregation server;

[0011] The aggregation result calculation steps are as follows: The aggregation server receives the local gradients of multi-client function encryption and homomorphic encryption, along with the corresponding labels l, sent by each client; it then uses the received system public key pp, reputation value list R, and decryption key sk... r The global gradient w is obtained by decrypting the local gradients of the function encrypted by label l for all clients using a multi-client function. g The aggregation server iterates through client serial numbers i and generates a random number u for each client i. i ,v i Then, using the homomorphic property of homomorphic encryption, u is calculated. i ×HE.Enc(∥w all ∥ 2 ), v i ×∥w g ∥ 2 and HE.Enc(w all )·w g Obtain the ciphertext HE.Enc(u i ×∥w all ∥ 2 HE.Enc(w all ·w g ) and HE.Enc(v i ×∥w g ∥ 2 And send these encrypted messages to TTP;

[0012] TTP cosine similarity median calculation steps: TTP homomorphic decryption obtains u i ×∥w all ∥ 2 v i ×∥w g ∥ 2 and w all ·w g Calculate the median cosine similarity of client i in this round of training. Send the int value of client i to the aggregation server;

[0013] The client's reputation value update steps are as follows: After receiving the int value of client i, the aggregation server calculates the cosine similarity. Then perform this round of client reputation value update. i =αr i ′+(1-α)cos(w all ,w g ), where r i ' represents the reputation value of each client in the previous round, and then the updated reputation value r is determined. i If the reputation value is greater than or equal to the reputation threshold β, retain client i; otherwise, remove client i from the client set u. After updating the reputation values ​​of all clients i in the client set, update the global gradient. w g Send to the corresponding client; sparsify indicates a sparse processing algorithm.

[0014] Client-side model update steps: The client uses the received w g Update the locally trained model.

[0015] The reputation score is dynamically updated based on each participant's performance in the current training round (referencing the cosine similarity of local and global gradients) and their previous reputation scores, thus reflecting their reliability and contribution to model training. This design not only enhances fairness and robustness but also rewards positive client contributions and excludes malicious behavior, incentivizing participants' engagement in the federated learning process.

[0016] Multi-client function encryption is a distributed function encryption scheme characterized by its support for input from different clients (sources). Data originates from various clients, which may lack mutual trust. This invention's multi-client function encryption utilizes tags; each client's encrypted data is bound to a corresponding tag during each training round, thus providing finer-grained control over the data. Furthermore, during the multi-client function decryption of aggregated ciphertext, data associated with different tags cannot be decrypted. This prevents effective decryption or transmission of meaningful information through collusion attacks; therefore, the tag attribute effectively mitigates the risk of collusion among participating entities.

[0017] The beneficial effects of this invention are:

[0018] • Privacy. Semi-honest aggregation servers cannot learn additional information beyond the expected output, and malicious colluding participants cannot learn the model parameters of other honest participants.

[0019] • Fairness. To fairly measure each client's contribution to the global model without accessing their private data.

[0020] • Robustness. Maintains stable and accurate computational results even with varying data distributions and the presence of various attacks. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating the overall method and operation of the present invention. Detailed Implementation

[0022] The implementation of the method of this invention is accomplished by the following parts:

[0023] 1) Trusted Third Party (TTP). This entity is responsible for setting public parameters, generating and distributing client public and private keys, generating function aggregation keys, and performing secure computations to ensure fairness. The TTP is an independent entity trusted by both clients and aggregation servers and does not collude with other entities. In existing cryptographic systems that use trusted third parties as the underlying infrastructure, this trustworthy and independent proxy is a common assumption.

[0024] 2) Aggregation Server. This entity is responsible for receiving ciphertext from participating clients, detecting attacks such as poisoning and free-riding, completing the calculation of the global model after receiving the function aggregation key, and distributing the global model parameters according to the reputation values ​​of participating clients. This entity is semi-honest; it adheres to the algorithm and protocol, but may attempt to deduce sensitive information about client data and model parameters.

[0025] 3) Clients. Assume there are n participating clients, denoted as u1, u2, ..., u... n Each client u i They all hold a local dataset D i In federated learning applications, clients are typically individuals, organizations, or institutions that hold sensitive information.

[0026] The threats that federated learning frameworks may encounter can be categorized into two threat models. The first is the semi-honest aggregation server. We assume the aggregation server correctly follows the algorithm and protocol, but may attempt to infer sensitive information such as training data and model updates. This adversarial setup is a common assumption in privacy-preserving federated learning schemes. The second is the malicious client. These clients can perform various attacks, such as free-riding on the federated learning system without contributing fair resources, poisoning the model training process by injecting adversarial data, or performing quantum attacks.

[0027] For the aforementioned threat model, our technical solution, based on the federated learning aggregation algorithm of this invention, includes the following steps:

[0028] 1) A trusted third party initializes the keys required for the entire training process and distributes the keys to the clients participating in the training.

[0029] 2) The client trains the model locally using its own dataset, encrypts the trained model parameters using a function encryption key and a homomorphic encryption key, and uploads the two encryption results to the aggregation server in the cloud.

[0030] 3) After receiving the encrypted information from the client, the aggregation server uses a function to encrypt and obtain the global gradient. It then calculates the reputation value of each client based on their different contributions to the global gradient, and compares the reputation value with a predefined reputation threshold. Clients with reputation values ​​below the threshold will be identified as malicious and removed.

[0031] 4) Finally, the aggregation server assigns the corresponding global model based on each client's reputation value.

[0032] This invention proposes a novel Multi-Client Function Encryption (MCFE) and a Privacy-Preserving Reputation Mechanism (PPRM). MCFE and PPRM are used to form a privacy-preserving federated learning framework, QPPFL, that guarantees both privacy and fairness. MCFE ensures the privacy of client data and enables secure model aggregation. PPRM identifies and mitigates malicious behavior, evaluates individual contributions, and adjusts model weights based on personalized reputation values. Through the integration of MCFE and PPRM, we can resist free-rider and poisoning attacks, ensuring fair model allocation without compromising data privacy. Below, we will first describe MCFE and PPRM, and then further introduce the QPPFL framework.

[0033] Multi-client function encryption (MCFE) is a distributed function encryption scheme where data originates from different clients that may lack mutual trust. Combined with tags, MCFE provides finer-grained control over the data. Furthermore, during the decryption of aggregated ciphertext, data associated with different tags cannot be decrypted, preventing effective decryption or transmission of meaningful information through collusion attacks. Therefore, tag attributes effectively mitigate the risk of collusion among participating parties. The MCFE algorithm used in this invention comprises five probabilistic multinomial-time algorithms:

[0034] 1) Initialize FE.Setup: Input security parameter λ and number of clients n, initialize and generate public key pp, FE.Setup(1 λ ,1 n→pp. The specific process is as follows: Set P to the maximum value of the plaintext space, V to the maximum value of the ciphertext space, select system parameters m0, q, K, ε, where m0 is any integer, q is a prime number, K = nPV, and the scaling factor ε ∈ (0,1); global hash function. Let l be a finite field of order q with length n+m0, and let l denote the tag; the generated system public key is

[0035] 2) Key generation FE.KeyGen: Input the system public key pp, generate the master private key msk, FE.KeyGen(pp) → msk. The specific process is as follows: For all client sequence numbers i∈[n], Z i By from random sampling Get random number s i and t i :

[0036]

[0037] Where D represents a discrete Gaussian distribution, and εq is the offset of the discrete Gaussian distribution. This represents a matrix of size 1×m0. Representation matrix It follows a discrete Gaussian distribution with an offset of εq;

[0038] Then, n client private keys sk i =Z i Combine to generate the master private key msk = {sk i} i∈[n] ={Z i} i∈[n] ;

[0039] 3) Encryption algorithm FE.Enc: FE.Enc(pp, sk i ,x i ,i,l)→ct i,l Input the system public key pp and the private key sk of the i-th client. i The plaintext x of the i-th client i Client sequence number i and tag l, output ciphertext ct i,l The specific process is as follows: For x i ∈{0,...,P-1}, compute the ciphertext ct of the i-th client. i,l :

[0040]

[0041] in, Indicates rounding down;

[0042] 4) Key derivation FE.KeyDer: FE.KeyDer(pp,msk,R)→sk r Enter the public key pp, and all client private keys sk. i The composed msk and reputation value vector R = {r i} i∈[n] Generate the decryption key sk r The specific process is as follows: For n client reputation values ​​r i ∈V, calculate the decryption key sk r :

[0043]

[0044] 5) Decryption algorithm FE.Enc: Input public key pp, reputation value vector R, client ciphertext {ct} i,l} i∈[n] , function decryption key sk r Given label l, output the aggregation result μ. The specific process is as follows:

[0045] First calculate the intermediate value μ′ of the aggregation result.

[0046]

[0047] Then, based on μ′, output μ∈{-K+1,...,K-1}, where μ makes... Minimum.

[0048] In our PPFL scheme, the aggregation server maintains an invisible reputation value vector R = {r1, r2, ..., r...} n},and r i = 1000, where n represents the number of clients participating in the current training process. These reputation values ​​are dynamically updated based on each participant's performance in this round of training and their previous reputation values, thus reflecting their reliability and contribution to model training. This design not only enhances fairness and robustness but also rewards positive contributions from clients and excludes malicious behavior, incentivizing participants' engagement in the federated learning process.

[0049] Based on the client's previous contributions, the aggregation server uses reputation values ​​to weight the local model parameters w in the current training round. all Thus, the global model parameters w are obtained. g : This process uses a function-based encryption decryption algorithm to form a global model. Furthermore, a configurable reputation threshold β sets the minimum expected contribution threshold in the FL environment, helping to establish a baseline for determining whether to allow clients to participate in training, identification, and reduction of malicious clients.

[0050] Reputation updates for privacy protection. In each round of interaction, the client's reputation value r... i First, compare the score with a threshold β. Clients with scores less than β will be excluded from subsequent training rounds. The formula for calculating the reputation score of each participant i is:

[0051] r i =αr i ′+(1-α)cos(w all ,w g )

[0052] Where, r i ′ represents the reputation score from previous rounds, α is the weighting parameter for calculating the reputation score, and cos(w) all ,w g ) is a measure of local gradient w all With global gradient w g The cosine similarity between them, cos(w all ,w g The calculation formula is:

[0053]

[0054] For privacy and security reasons, the aggregation server cannot directly calculate this cosine value; therefore, the lightweight computational task is delegated to TTP. In the threat model of this invention, the client does not have access to the global gradient, and the aggregation server is unaware of the client's model parameters. Therefore, homomorphic encryption (HE) is used to encrypt this information before sending the client's encrypted information and global model parameters to TTP. Specifically, the aggregation server... Generate a random number u for each client i and v i And using the homomorphic property of homomorphic encryption, respectively with ∥w all ∥ 2 and ∥w g ∥ 2 Multiply to generate HE.Enc(u i ×∥w all ∥ 2 HE.Enc(w all ·w g ) and HE.Enc(v i ×∥w g ∥ 2 They are sent to TTP. TTP decrypts them and calculates w. all and w g The median cosine similarity between them And return it to the aggregation server. The aggregation server ultimately returns the int and... Multiply to calculate cos(w)all ,w g The aggregation server is the only one who knows u and v, thus ensuring data privacy during the process.

[0055] After model gradient aggregation, the aggregation server distributes the global gradients to the participants. Each participant is limited to downloading only one gradient, sparsified based on the maximum value and its reputation value.

[0056]

[0057] Here, sparsify represents a sparse processing algorithm.

[0058] Based on the above algorithm, this invention proposes QPFFL, a novel PPFL scheme integrating MCFE and PPRM. QPFFL achieves privacy protection, collaborative fairness, and robust performance. Figure 1 As shown below, the complete process of the aggregation protocol training phase in federated learning is outlined:

[0059] 1. System initialization:

[0060] Set the weight parameter α for calculating the reputation value, the reputation threshold β, the total number of clients n, the security parameter λ, and the set of clients participating in the current training round.

[0061] The aggregation server initializes an invisible reputation value vector R = {r1, r2, ..., r...} i ,...,r n}, r i =1000 / n, i∈[n];

[0062] The trusted third party, TTP, inputs the security parameter λ and the number of clients n into FE.Setup to initialize the system, generates a system public key pp and sends it to each client and the aggregation server. Then, it uses FE.KeyGen(pp) to obtain the master key msk and extracts the private key sk of each client i from the master key msk. i Distribute the key to the corresponding client i, and finally generate the decryption key sk based on FE.KeyDer(pp,msk,r). r And send it to the aggregation server;

[0063] 2. Client i performs model training:

[0064] Local gradient w is obtained through local training all That is, plaintext x i =w all Furthermore, the publicly displayed label for this training is l;

[0065] 3. Client i encrypts model parameters:

[0066] Client i uses function encryption based on client number i and label l to encrypt model parameter ct. i,l ←FE.Enc(pp,sk i ,x i ,i,l), while using homomorphic encryption to encrypt local gradients to obtain HE.Enc(w all ), ct i,l and HE.Enc(w all Send to the aggregation server;

[0067] 4. The aggregation server performs the following calculations to determine the aggregation results:

[0068] Receive the system public key pp and collect the encrypted local gradient ct from each client. i,l and HE.Enc(w all And the corresponding tag l, using the system public key pp, tag l, and decryption key sk r and R to {ct i,l} i∈[n] Decryption yields the aggregated result μ←FE.Dec(pp,R,{ct i,l} i∈[n] ,sk r ,l), the aggregation result μ is used as the global gradient w g =μ;

[0069] The aggregation server iterates through the client sequence number i and generates a random number u for each client i. i , Then, using the homomorphic property of homomorphic encryption, we can calculate u. i ×HE.Enc(∥w all ∥ 2 ), v i ×∥w g ∥ 2 and HE.Enc(w all )·w g Obtain the ciphertext HE.Enc(u i ×∥w all ∥ 2 HE.Enc(w all ·w g ) and HE.Enc(v i ×∥w g ∥ 2 And send these encrypted messages to TTP;

[0070] 5. TTP performs cosine similarity calculation:

[0071] TTP for HE.Enc(u i ×∥w all ∥2 HE.Enc(v) i ×∥w g ∥ 2 ) and HE.Enc(w all ·w g Homomorphic decryption yields u i ×∥w all ∥ 2 v i ×∥w g ∥ 2 and w all ·w g ;

[0072] Next, calculate the median cosine similarity of client i in this round of training. Send the int value of client i to the aggregation server;

[0073] 6. The aggregation server updates the reputation values ​​of each client:

[0074] Receive the int value i from client i via TTP, and then calculate... Perform this round of client reputation value update. i =αr i ′+(1-α)cos(w all ,w g ), where r i Let ' be the reputation value of client i in the previous round, and determine the updated reputation value r. i If the client i is greater than or equal to the reputation threshold β, retain the client i; otherwise, remove it from the client set. Remove client i from the set; after updating the reputation values ​​of all clients i in the client set, update the global gradient based on the client's contribution level to the model update. The corresponding w for each client g Send to each client;

[0075] 8. The client updates the model:

[0076] Each client uses the received w g Update the locally trained model.

[0077] As can be seen from the above process, the training phase of this invention is divided into four parts:

[0078] 1) Initialization Phase. The aggregation server generates system parameters u and v to protect the global gradient, and α and β to calculate the reputation value. TTP is responsible for the system's key management; it generates a series of keys, including a function encryption master key msk and a function encryption private key sk for each client. i Aggregate key skr The public key for homomorphic encryption, HE pk and private key HE sk Then, TTP encrypts the private key sk using the function. i The gradient values ​​are distributed to each client participating in training. Furthermore, before training, the gradient values ​​need to be converted from floating-point numbers to integers to align with the function value calculations at the function encryption end. If a new training participant joins during training, they first need to request a key from the TTP via a secure channel. To serve more clients wanting to join during training, the TTP needs to set a large value n so that it can provide enough keys for new participants.

[0079] 2) Training phase. Each client trains its model locally using its own dataset, encrypts the trained model parameters using function encryption and homomorphic encryption respectively, and then uploads them to the aggregation server.

[0080] 3) Aggregation Phase. After receiving the encrypted model parameters from all clients, the aggregation server uses the decryption step of the function encryption to perform aggregation calculations to obtain the global gradient. Based on the privacy-preserving reputation mechanism steps described above, the aggregation server calculates the reputation value of each client according to their different contributions to the training process, and uses a reputation threshold to identify malicious clients and detect various attacks. Specifically, if a client's reputation value is lower than a predefined threshold β, the aggregation server classifies it as a malicious client or a free rider, and then removes it from the candidate client set for subsequent training iterations.

[0081] 4) Model Allocation. Each client's contribution level to the global model is determined based on PPRM. The weights assigned to clients will be consistent with their contribution levels. Clients contributing more will receive better model rewards; this process ensures fair model allocation.

Claims

1. A fair federated learning method based on function encryption, characterized in that, Including the following steps: System initialization steps: Set the weight parameter α for calculating reputation value, the reputation threshold β, the total number of clients n, and the client set. The aggregation server initializes an invisible reputation vector R, which contains the reputation values ​​r of each client. i The client sequence number i∈[n]; the trusted third party TTP generates the system public key pp and sends it to each client and the aggregation server, then uses the system public key to generate the master key msk, and adds the private key sk of each client i in the master key msk. i Distribute to the corresponding client i; finally generate the decryption key sk r And send it to the aggregation server; Client-side model training steps: The client trains a local model to obtain the local gradient w. all The public tag for this round of training is l; Model parameter encryption steps: Each client uses the system public key pp and the client private key sk i The client sequence number i and label l are used to perform multi-client function encryption to encrypt the local gradient and obtain FE.Enc(w all Meanwhile, homomorphic encryption is used to encrypt the local gradient to obtain HE.Enc(w all ), which will encrypt the result of the function FE.Enc(w all The encryption result of homomorphic encryption is HE.Enc(w) all Send to the aggregation server; The aggregation result calculation steps are as follows: The aggregation server receives the local gradients of multi-client function encryption and homomorphic encryption, along with the corresponding labels l, sent by each client; it then uses the received system public key pp, reputation value list R, and decryption key sk... r The global gradient w is obtained by decrypting the local gradients of the function encrypted by label l for all clients using a multi-client function. g The aggregation server iterates through client serial numbers i and generates a random number u for each client i. i v i Then, using the homomorphic property of homomorphic encryption, u is calculated. i ×HE.Enc(||w all || 2 ), v i ×||w g || 2 and HE.Enc(w all )·w g Obtain the ciphertext HE.Enc(u i ×||w all || 2 HE.Enc(w all ·w g ) and HE.Enc(v i ×||w g || 2 And send these encrypted messages to TTP; TTP cosine similarity median calculation steps: TTP homomorphic decryption obtains u i ×||w all || 2 v i ×||w g || 2 and w all ·w g Calculate the median cosine similarity of client i in this round of training. Send the int value of client i to the aggregation server; The client's reputation value update steps are as follows: After receiving the int value of client i, the aggregation server calculates the cosine similarity. Then perform this round of client reputation value update. i =αr′ i +(1-α)cos(w all w g ), where r′ i The previous reputation score for each client is used as the basis for determining the updated reputation score r. i If the client i is greater than or equal to the reputation threshold β, retain the client i; otherwise, remove it from the client set. Remove client i from the set; after updating the reputation values ​​of all clients in the client set, update the global gradient. w g Send to the corresponding client; sparsify indicates a sparse processing algorithm. Client-side model update steps: The client uses the received w g Update the locally trained model.

2. The method as described in claim 1, characterized in that, Initialize the reputation value r of each client. i Make `total` is the preset total reputation value.

3. The method as described in claim 2, characterized in that, r i =total / n。 4. The method as described in claim 1, characterized in that, The system initialization process also includes setting security parameters. Trusted third-party TTP utilizes security parameters and the number of clients n as input (1 λ 1 n Generate the system public key in the initialization function FE.Setup. P is the maximum value in the plaintext space, V is the maximum value in the ciphertext space, m0, q, K, and ε are selected system parameters, where m0 is any integer, q is a prime number, K = nPV, and ε ∈ (0, 1); global hash function Let q be a finite field of order q with dimension n+m0.

5. The method as described in claim 4, characterized in that, A trusted third-party TTP inputs the system public key pp into the key generation function FE.KeyGen to generate the master key msk. For all client indices i∈[n], Z i By from random sampling Get random number s i and t i : Where D represents a discrete Gaussian distribution, and εq is the offset of the discrete Gaussian distribution. This represents a matrix of size 1×m0. Representation matrix It follows a discrete Gaussian distribution with an offset of εq; Then, n client private keys sk i =Z i Combine to generate the master private key msk = {sk i } i∈[n] ={Z i } i∈[n] .

6. The method as described in claim 5, characterized in that, The trusted third party (TTP) inputs the system public key pp, master private key msk, and reputation value vector R into the key derivation function FE.KeyDer to generate the decryption key sk. r :

7. The method as described in claim 6, characterized in that, The multi-client encryption function FE.Enc is: FE.Enc(pp, sk i x i ,i,l)→ct i，l The parameters of the multi-client encryption function include the system public key pp and the private key sk of the i-th client. i The plaintext x of the i-th client i Client serial number i and tag l, ct i，l The ciphertext obtained by encrypting the label l function in this round for the i-th client; This indicates rounding down to the nearest integer.

8. The method as described in claim 6, characterized in that, The multi-client function decryption function FE.Dec is: The parameters input to the multi-client function decryption function include the system public key pp, the reputation value vector R, and the local gradients {ct} of the function encryption for all clients. i，l } i∈[n] Decryption key sk r The labels l and μ represent the aggregated output. First calculate the intermediate value μ′ of the aggregation result. Then, based on μ′, output μ∈{-K+1, ...,K-1}, μ makes Minimum.

Images