Verifiable training classification model in mobile communication system and classification method thereof

Abstract

The invention provides a verifiable training classification model in a mobile communication system and a classification method of the verifiable training classification model, relates to the technical field of cloud services, designs a cloud edge collaborative classifier training framework capable of protecting privacy, and safely outsourcing time-consuming operation to an ES (Extended Station) so as to reduce the calculation burden of SMD (Surface Mount Device) and CS (Circuit Switching). Meanwhile, the calculation efficiency of classification service can be improved, and the data volume is increased. Secondly, an algorithm library based on multi-key fully homomorphic encryption is further designed, and the algorithm library supports distance and comparison calculation operation of encrypted data. In addition, the algorithm library can also construct other privacy protection classifier training services in a modular mode. Finally, a classification method capable of verifying the training classification model in the mobile communication system is provided, and lightweight integrity verification is achieved. The SMD only needs to execute a simple online signature operation, and most of time-consuming offline operations are safely outsourced to an edge service, so that any encrypted aggregated data is ensured not to be replaced or tampered before being decrypted.

Description

Technical Field

[0001] The present invention relates to the field of cloud service technology, and in particular to a verifiable training classification model and a classification method thereof in a mobile communication system. Background Art

[0002] With the rapid development of mobile communication technology, cloud services have been well developed in the fields of smart cities, autonomous driving, cloud medical consultation, etc. Due to the limited resources and bandwidth of the communication system infrastructure, traditional cloud-based mobile communication systems are difficult to meet the needs of intelligent services, especially real-time services. By transferring some computing tasks from cloud servers to edge servers, the performance of mobile communication systems can be improved while reducing latency and saving bandwidth. For example, sensor data is collected by smart mobile devices, forwarded to edge servers for aggregation processing, and then the processing results are sent to the cloud for further analysis to provide various data services for mobile communication applications. Once enough training data is collected, the generalization ability of the classifier can be improved. The cloud-edge collaborative classifier training service is conducive to big data analysis, but it also brings data privacy risks and increases the difficulty of effective information sharing. At the same time, the properties of edge computing also increase the probability of internal and external attackers. For example, in edge servers and smart grid systems, customers often transmit sensitive data (such as electricity usage information) to the cloud to obtain centralized services, which usually contain user privacy information. Therefore, how to implement a privacy-preserving classifier training service has become an urgent need.

[0003] Traditional homomorphic encryption schemes can implement specific ciphertext calculations and protect the confidentiality of data. However, homomorphic encryption also has two disadvantages. On the one hand, existing schemes use the same public key for encryption, which poses a risk of data leakage. If a user colludes with an attacker or other users to leak their keys, the privacy of the user's data and classification model will be compromised. On the other hand, the aggregation server in edge computing may return incorrect aggregation results. For example, a malicious aggregation server may directly tamper with the aggregation results, or forge aggregation results to deceive participants in order to save computing resources. In addition, the aggregation server may be lazy to reduce computing overhead. Therefore, it is necessary to check the integrity of the aggregated data. The combination of homomorphic encryption and integrity verification provides a new method for verifiable training classification models.

[0004] In the method proposed by the Chinese patent "CN202011014135.5 An edge computing technology and cloud-edge collaboration method based on power distribution Internet of Things", the central server cannot verify the integrity of the aggregated data, and the central server may directly tamper with the aggregation results, resulting in the inability to train the correct model. In the outsourced clustering federation method proposed by the Chinese patent "CN202210609601.7 Data clustering method, device and process based on homomorphic encryption", resource-constrained users need to participate in the calculation process, such as data encryption, decryption, calculation and other operations, which reduces the performance of the system.

[0005] The classifier training service in the mobile communication system must meet the following properties: (1) Confidentiality: Different smart mobile devices need to use their own public keys to encrypt data and upload the encrypted data to the edge server to ensure the confidentiality of the data and model. (2) Lightweight: Due to the resource limitations of smart mobile devices and complex encryption operations, the computing costs of the cloud and smart mobile devices are increased, and a lightweight cloud-edge collaborative architecture is required. (3) Integrity: The encrypted aggregated data may be tampered with or forged, and the integrity of the aggregated data is very important.

[0006] There is currently no solution that can provide all of the above features at the same time. Almost all previous privacy-preserving and verifiable solutions only support computation on data provided by individual users. Summary of the invention

[0007] In view of the shortcomings of the prior art, the present invention provides a verifiable training classification model and classification method in a mobile communication system, which can protect the privacy information of the data owner and the training model, support multiple parties to jointly train the model, and verify the integrity of the aggregated results. It can reduce the computing overhead on the mobile device and meet the data privacy requirements.

[0008] On the one hand, a verifiable trainable classification model in a mobile communication system includes a trusted institution TI, a smart mobile device SMD, an edge server ES, and a cloud server CS;

[0009] The trusted institution TI generates system security parameters Psystem, assuming that the system security parameters can be transmitted to the smart mobile device SMD and the edge server ES through a secure communication channel, and then goes offline and does not participate in subsequent processes;

[0010] The smart mobile device SMD generates IoT data on the registered device, encrypts it with its own public key and uploads it to the edge server ES, only participating in the offline or online verification process;

[0011] The edge server ES receives the encrypted data, provides classifier training services for the encrypted data, generates a local model and uploads it to the cloud server CS, and then verifies the integrity of the global model during the verification process;

[0012] The cloud server CS is an aggregator for aggregating local models from the edge server ES for aggregation services and registration services. The cloud server CS generates an aggregate signature and sends it together with the global signature to the edge server ES.

[0013] On the other hand, a classification method of a verifiable training classification model in a mobile communication system is implemented based on the aforementioned verifiable training classification model in a mobile communication system; specifically comprising the following steps:

[0014] Step 1: Key initialization;

[0015] Specifically, the trusted institution TI selects two random security parameters α, β and a bilinear mapping e:G×G→G T , where G and G T is the set of integers A subgroup of , g is the generator of G; three one-way hash functions H0, H1, H2 and a chameleon hash function are defined in the trusted institution TI. Where H0:{0,1} * →G,H1: H2: is an integer set, and the trusted authority TI calculates and verifies the signature e(g1,g1) α and signature public key Y = g1 x , where g i Represents the generator; assuming that the number of edge nodes is n, the number of smart devices is i, and the trusted institution TI generates the system security parameter P system , where P system ={α,β,n,g,G,G T ,e,g1,Y,e(g1,g1) α ,H0,H1,H2,H chi ,pp}, where α, β, n represent random numbers, parameter pp is a multi-key FHE security parameter, and the trusted institution TI sends pp to SMD.

[0016] Step 2: Offline-online verification;

[0017] Step 2.1: Edge server registration;

[0018] The edge server ES selects two random values ​​y, z and an integer r i ,q i To get the offline status value St =(r i ,q i ,p i ), where p i =H1(i||TS i ||k i ), TS i Indicates the ES message, k i Indicates the ES key, defining parameter g2 = g1 y ,g3=g1 z , based on the BLS signature method, construct an offline signature Σ BLS , the edge server ES calculates the DTCH function where s i ,u i Represents a random integer, BLS signature Constructed as X i Indicates an integer randomly selected by SMD, the edge server ES will sign the label offline and online verification key V on =(g1,g2.g3) is sent to the cloud server CS, where

[0019] Step 2.2: Message generation;

[0020] Cloud server CS receives offline signature tag After that, first execute the batch verification algorithm to check the offline verification and construct the online signature Then, the online signature is sent to the edge server ES;

[0021] The check is offline verification: the cloud server CS first aggregates the offline signature tags of the edge server ES and checks whether where g i represents the generator, Y i Represents the signature public key; if the batch verification algorithm outputs 1, the offline verification is passed; otherwise, it is rejected;

[0022] The online signature is constructed: the cloud server CS constructs the online signature based on the offline signature tag. To construct an online signature where u i ′=((r i -c i )+(s i -s i ′)y+u i z)z -1 ,s i ′=s i +1, c iRepresents ciphertext, then the cloud server CS builds the report And send it to the edge server ES, which reconstructs the data report

[0023] Step 2.3: message aggregation;

[0024] When the edge server ES receives the data report DR i When the edge server ES executes the online signature verification algorithm to perform online signature verification; the edge server ES constructs the aggregate signature and sends it to the cloud server CS.

[0025] The online signature verification: The edge server ES checks the timestamp TS i Then first check whether H ch (c i ,s i ′,u i ′)=H ch (r i ,s i ,u i ). If the online signature verification algorithm outputs 1, the offline verification is accepted; otherwise, it is rejected;

[0026] The message aggregation: Cloud server CS calculates the aggregated ciphertext

[0027] The constructed aggregate signature: cloud server CS based on private key X j Constructing an aggregate signature Where ID i is the identity of the edge server. Then, the edge server ES aggregates the message AP=i||μ||TS i ||Σ Agg Sent to the cloud server CS.

[0028] Step 2.4: Read the message;

[0029] After receiving the aggregation message AP, the cloud server CS checks e(g1,Σ Agg )=e(Y i ,H0(i||μ||TS t )) is established to check the aggregate signature Σ Agg ; If the algorithm Ver.on() outputs 1, the offline verification is accepted; otherwise, it is rejected.

[0030] After receiving offline validation, the classification model is trained;

[0031] Step 3: Build an algorithm library; specifically design an algorithm library based on multi-key homomorphic encryption; the algorithm library includes a secure distance calculation protocol, a secure comparison protocol, and a secure minimum value protocol.

[0032] (1) Safety distance calculation protocol:

[0033] Given a data set D = {m1,m2,...,m n Any two-dimensional n*d data object m in i =(m i1 ,m i2 ,...,m id ), m id It is n*d two-dimensional data, let C i =(c1,c2,...,c d ) represents m i In the public key pk l,i The encrypted ciphertext, c d Represents ciphertext, the corresponding decryption private key is sk l,i , O i =(o j1 ,o j2 ,...,o jd ) indicates that in the public key pk l,j Another set of ciphertext encrypted under the following, the corresponding decryption private key is sk l,j , o jd is a two-dimensional ciphertext of n*d;

[0034] Assume that the edge server ES has the ciphertext C i and O j But there is no corresponding decryption private key sk l,i and sk l,j , the Euclidean distance expression is expressed as: The value range of z is [1, d];

[0035] The squared Euclidean distance is used instead of the Euclidean distance, C i and O j The squared Euclidean distance between them is expressed as:

[0036] Before calculating the squared Euclidean distance on the ciphertext field, we discuss the following two cases:

[0037] If C i and O j The corresponding decryption private keys are different. To calculate the ciphertext distance, we first use the ciphertext extension sub-algorithm CZW.CTExt() in the CZW algorithm to expand C i and O j ;

[0038] If C i and O j The corresponding decryption private keys are The ciphertext squared Euclidean distance is expressed as:

[0039]

[0040] The decryption private key corresponding to the calculated distance is in Represents a single ciphertext private key;

[0041] If C i and O j The corresponding decryption private key is the same, and the ciphertext squared Euclidean distance is expressed as:

[0042]

[0043] The decryption private key corresponding to the calculated distance is

[0044] (2) Security Comparison Protocol

[0045] Given any two ciphertexts C i and O j , using the CZW multi-key fully homomorphic encryption algorithm, a protocol that supports encrypted ciphertext comparison under different public keys is constructed; random noise is introduced to hide the final comparison result from the smart mobile device SMD.

[0046] Step S1: The edge server ES first considers C i and O j Whether they correspond to the same decryption private key;

[0047] If C i and O j The corresponding decryption private keys are different. The edge server ES uses the ciphertext extension sub-algorithm CZW.CTExt() in the CZW algorithm to extend C i and O j for and The corresponding decryption private key is Perform step S2;

[0048] If C i and O j The corresponding decryption private key is the same, proceed to step 1;

[0049] Step S2: The edge server ES uses the public key The plaintext random numbers p and e are encrypted as follows;

[0050] The value of the ciphertext e is updated by calling the selection protocol, that is, the size except the highest bit.

[0051] Step S3: Compare the highest bit and use the formula res = C i ·(O j +1)+(C i+O j +1)·t calculates the comparison result res. If res=1, it means C i <O j ; If res = 0, then C i ≥O j ;

[0052] (3) Safe Minimum Protocol

[0053] Given any set of data d i , represents the ciphertext data C i and O j The Euclidean distance of the edge server ES has all the distance ciphertexts d i1 ,d i2 ,...,d ik , the smart mobile device SMD has the corresponding private key All information of

[0054] Step D1: The edge server ES determines whether ciphertext expansion is required:

[0055] If there exists i,j∈k, satisfying U i ≠U j , that is, the ciphertexts do not belong to the same SMD, then proceed to step D2;

[0056] If for any i,j∈k, U i ≠U j , at this time, satisfy That is, the ciphertext comes from the same SMD, and step 1 is executed;

[0057] Step D2: Edge server ES expands ciphertext d i1 ,d i2 ,...,d ik for The private keys corresponding to the expanded ciphertexts are in

[0058] Step D3: Let the set And divide the ciphertexts in set M into groups of two in order, Group; if k is an even number, the grouping is as follows: If k is an odd number, the grouping is as follows:

[0059] Step D4: The edge server ES and the smart mobile device SMD determine the size of the plaintext corresponding to each group of ciphertexts through a security comparison protocol; the edge server ES forms a new set M with the ciphertexts corresponding to the plaintexts in the group s;

[0060] Step D5: Repeat steps D3 to D4 for the new set M until only one ciphertext remains in the set M, which is d min ;

[0061] Step 4: Classification model training;

[0062] The classification model is trained using the algorithm library. First, the smart mobile device SMD converts the data type of the generated data set from floating point numbers to integers and encrypts it. Then the edge server ES calculates the distance through the secure distance calculation protocol, obtains the minimum value in the distance array through the secure minimum value protocol, compares the values ​​in the distance array to obtain the smaller value, and assigns the larger value to 0. The arrays are compared until the distance array contains only a single element with the minimum value. The loop is repeated k times to obtain the k nearest neighboring samples. Finally, the number of categories is counted to obtain the classification result.

[0063] The following is a detailed description of the kNN classifier training process:

[0064] Step 4.1: The edge server ES inputs the data to be classified x and converts each data x into a bit-by-bit representation (x l-1 ,x l-2 ,...,x0), sent to the cloud server CS;

[0065] Step 4.2: After receiving the ciphertext, the cloud server CS expands the ciphertext

[0066] Step 4.3: The edge server ES and the cloud server CS call the secure distance calculation protocol to calculate the Euclidean distance until all data are traversed. The edge server ES obtains the encryption result and saves it in the array d;

[0067] Step 4.4: The secure minimization protocol is called in the cloud server CS. The secure minimization protocol obtains a minimum value in the array d, saves its corresponding category in the array, resets the minimum value to the maximum value, and calls the secure minimization protocol repeatedly until k nearest neighbors are obtained; the edge server ES obtains the categories of the k nearest neighbors and stores the results in the array lab;

[0068] Step 4.5: The edge server ES performs category statistics and counts the number of each category in the array lab. The category in the model with the most occurrences is ci ′;

[0069] Step 4.6: The cloud server CS executes the batch verification algorithm to check The batch verification algorithm outputs 1, indicating that offline verification is accepted; otherwise, it is rejected;

[0070] Step 4.7: Cloud server CS constructs online signature Build Report And send it to the edge server ES, ES rebuilds the data report

[0071] Step 4.8: The edge server ES first checks H ch (c i ,s i ′,u i ′)=H ch (r i ,s i ,u i ); The batch verification algorithm outputs 1, indicating that offline verification is accepted; otherwise, it is rejected;

[0072] Step 4.9: Cloud server CS calculates aggregated ciphertext

[0073] Step 4.10: Cloud server CS constructs aggregate signature Set the aggregate message AP=i||μ||TS t ||Σ Agg Send to edge server ES;

[0074] Step 4.11: After receiving the message AP, the edge server ES checks e(g1,Σ Agg )=e(Y i ,H0(i||μ||TS t )); The online signature verification algorithm outputs 1, indicating that the online verification is accepted; otherwise, it is rejected;

[0075] Step 4.12: The edge server ES continues to train the classification model.

[0076] The beneficial effects of adopting the above technical solution are:

[0077] The present invention provides a verifiable training classification model and classification method in a mobile communication system, which significantly transfers the processing of the cloud to the edge and safely trains the model between multiple parties. Furthermore, the integrity verification of aggregated data is realized, and most of the time-consuming operations are outsourced from the cloud to the edge server, while maintaining the confidentiality and integrity of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 This is the overall architecture diagram of the verifiable training classification model of the present invention; DETAILED DESCRIPTION

[0079] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0080] On the one hand, a verifiable training classification model in a mobile communication system combines multi-key homomorphic encryption to protect the privacy of data and models, and uses an online / offline signature mechanism to support the integrity verification of aggregated data. Figure 1 It is a structural diagram of the present invention, which is divided into four entities, including a trusted institution TI (Trusted Institution), a smart mobile device SMD (Smart Mobile Devices), an edge server ES (Edge Server) and a cloud server CS (Cloud Server).

[0081] The trusted institution TI generates system security parameters Psystem, including parameters pp, hash functions, random elements, etc. It is assumed that the system security parameters can be secretly transmitted to the smart mobile device SMD and the edge server ES through a secure communication channel, and then offline and do not participate in subsequent processes;

[0082] The smart mobile device SMD generates IoT data on the registered device, encrypts it with its own public key and uploads it to the edge server ES, only participating in the offline or online verification process;

[0083] The edge server ES receives the encrypted data, provides classifier training services for the encrypted data, generates a local model and uploads it to the cloud server CS, and then verifies the integrity of the global model during the verification process;

[0084] The cloud server CS is an aggregator for aggregating local models from the edge server ES for aggregation services and registration services. The cloud server CS generates an aggregate signature and sends it together with the global signature to the edge server ES.

[0085] In this embodiment, TI transmits the private key to ES and SMD through a secure channel. Smart mobile devices (such as sensors, mobile phones, and vehicles) collect a large amount of user data, use edge and cloud computing to train models, and provide classifier training services. ES and SMD jointly complete the offline / online verification process. Each ES sends its local model to CS, CS aggregates the local model to obtain a global model, and ES verifies the integrity of the aggregated data. Through the analysis of the calculation process, the basic operations are extracted, and the algorithm library corresponding to the basic operations is designed. CS and ES interact through the algorithm library. The training process is mainly carried out in ES, and CS assists in the calculation, which reduces the computing cost of CS.

[0086] On the other hand, a classification method of a verifiable trainable classification model in a mobile communication system is implemented based on the aforementioned verifiable trainable classification model in a mobile communication system. In this embodiment, it is described by the following 13 polynomial time algorithm groups Setup, CZW.KeyGen, CZW.SKeyGen, CZW.SKey, Classifier.Train, Classifier.Agg, Sign.off, Ver.off, Sign.on, Ver.on, Agg, Sign.Agg and Ver.Agg:

[0087] Setup(α,β)→(pp,P system ):TI inputs two safety parameters α, β to obtain the system safety parameters pp, P system Then, TI sends pp to SMD, and P system Send to ES.

[0088] CZW.KeyGen(pp,i)→(pk l,i ,sk l,i ): Each SMD independently generates a public-private key pair pk l,i ,sk l,i .

[0089] CS generates a computation key Used to refresh the ciphertext.

[0090] ES runs the key exchange sub-algorithm to convert [x i ] is converted to [[x i ]].

[0091] Classifier.Train([[x i ]],[[y i ]])→c i : ES and CS jointly train the classifier to obtain the local parameter c i .

[0092] Classifier.Agg(c i )→C: CS aggregates local parameters c i Used to obtain the global parameter C and send C to ES.

[0093] ES inputs two random numbers y, z and two integers r i ,q i , output state value S t , DTCH function Offline Signature and the online verification key Von .

[0094] CS input V pk , Output the verification result b1∈{0,1}, where b1=1 indicates that the aggregation verification is passed, and b1=0 indicates that it is rejected.

[0095] CS input c i ,S t ,s i ′, where s i ′ is a random number. Output online signature

[0096] ES input V on , Output the verification result b2∈{0,1}, where b2=1 indicates that the aggregation verification is passed, and b2=0 indicates that it is rejected.

[0097] Agg(μ i )→μ: CS input local aggregation result μ i , output the global aggregation result μ.

[0098] Sign.Agg(X j ,μ)→(Y j ,∑ Agg ):CS inputs the aggregation result and random number X j , output the public key Y j and aggregate signature∑ Agg .

[0099] Ver.Agg(Y j ,∑ Agg )→b3:ES input Y j ,∑ Agg , and output a result b3∈{0,1}, where b3=1 means the aggregation verification is passed, and b3=0 means it is rejected.

[0100] The specific steps include:

[0101] Step 1: Key initialization;

[0102] Specifically, the trusted institution TI selects two random security parameters α, β and a bilinear mapping e:G×G→G T , where G and G T is the set of integers A subgroup of , g is the generator of G; three one-way hash functions H0, H1, H2 and a chameleon hash function are defined in the trusted institution TI. Where H0:{0,1}* →G,H1: H2: is an integer set, and the trusted authority TI calculates and verifies the signature e(g1,g1) α and signature public key Y = g1 x , where g i Represents the generator; assuming that the number of edge nodes is n, the number of smart devices is i, and the trusted institution TI generates the system security parameter P system ,in Among them, α, β, n represent random numbers, the parameter pp is the multi-key FHE security parameter, and the trusted institution TI sends pp to the SMD.

[0103] Step 2: Offline-online verification;

[0104] Step 2.1: Edge server registration;

[0105] The edge server ES selects two random values ​​y, z and an integer r i ,q i To get the offline status value S t =(r i ,q i ,p i ), where p i =H1(i||TS i ||k i ), TS i Indicates the ES message, k i Indicates the ES key, defining parameter g2 = g1 y ,g3=g1 z , based on the BLS signature method, construct an offline signature Σ BLS , the edge server ES calculates the DTCH function where s i ,u i Represents a random integer, BLS signature Constructed as X i Indicates an integer randomly selected by SMD, the edge server ES will sign the label offline and online verification key V on =(g1,g2.g3) is sent to the cloud server CS, where

[0106] Step 2.2: Message generation;

[0107] Cloud server CS receives offline signature tag After that, first execute the batch verification algorithm to check the offline verification and construct the online signature Then, the online signature is sent to the edge server ES;

[0108] The check is offline verification: the cloud server CS first aggregates the offline signature tags of the edge server ES and checks whether where g i represents the generator, Y i Represents the signature public key; if the batch verification algorithm outputs 1, the offline verification is passed; otherwise, it is rejected;

[0109] The online signature is constructed: the cloud server CS constructs the online signature based on the offline signature tag. To construct an online signature where u i ′=((r i -c i )+(s i -s i ′)y+u i z)z -1 ,s i ′=s i +1, c i Represents ciphertext, then the cloud server CS builds the report And send it to the edge server ES, which reconstructs the data report

[0110] Step 2.3: message aggregation;

[0111] When the edge server ES receives the data report DR i When the edge server ES executes the online signature verification algorithm to perform online signature verification; the edge server ES constructs the aggregate signature and sends it to the cloud server CS.

[0112] The online signature verification: The edge server ES checks the timestamp TS i Then first check whether H ch (c i ,s i ′,u i ′)=H ch (r i ,s i ,u i ). If the online signature verification algorithm outputs 1, the offline verification is accepted; otherwise, it is rejected;

[0113] The message aggregation: Cloud server CS calculates the aggregated ciphertext

[0114] The constructed aggregate signature: cloud server CS based on private key X j Constructing an aggregate signature Where IDi is the identity of the edge server. Then, the edge server ES aggregates the message AP=i||μ||TS i ||Σ Agg Sent to the cloud server CS.

[0115] Step 2.4: Read the message;

[0116] After receiving the aggregation message AP, the cloud server CS checks e(g1,Σ Agg )=e(Y i ,H0(i||μ||TS t )) is established to check the aggregate signature Σ Agg ; If the algorithm Ver.on() outputs 1, the offline verification is accepted; otherwise, it is rejected.

[0117] After receiving offline validation, the classification model is trained;

[0118] Step 3: Build an algorithm library; specifically design an algorithm library based on multi-key homomorphic encryption for the classifier; the algorithm library includes a secure distance calculation protocol, a secure comparison protocol, and a secure minimum value protocol.

[0119] (4) Safety distance calculation protocol:

[0120] Given a data set D = {m1,m2,...,m n Any two-dimensional n*d data object m in i =(m i1 ,m i2 ,...,m id ), m id It is n*d two-dimensional data, let C i =(c1,c2,...,c d ) represents m i In the public key pk l,i The encrypted ciphertext, c d Represents ciphertext, the corresponding decryption private key is sk l,i , O i =(o j1 ,o j2 ,...,o jd ) indicates that in the public key pk l,j Another set of ciphertext encrypted under the following, the corresponding decryption private key is sk l,j , o jd is a two-dimensional ciphertext of n*d; the secure distance calculation protocol is designed not to disclose m i , calculate the distance between them.

[0121] Assume that the edge server ES has the ciphertext C i and Oj But there is no corresponding decryption private key sk l,i and sk l,j , the Euclidean distance expression is expressed as: The value range of z is [1, d];

[0122] Since the CZW algorithm does not support the square root operation on the ciphertext domain, the squared Euclidean distance is used instead of the Euclidean distance. Since the norm is non-negative, using the squared Euclidean distance to measure similarity does not harm the accuracy of the clustering results. i and O j The squared Euclidean distance between them is expressed as:

[0123] Considering C i and O j It may be encrypted by different public keys. Before calculating the squared Euclidean distance on the ciphertext field, it is divided into the following two cases for discussion:

[0124] If C i and O j The corresponding decryption private keys are different. To calculate the ciphertext distance, we first use the ciphertext extension sub-algorithm CZW.CTExt() in the CZW algorithm to expand C i and O j , the ciphertext expansion process is as follows:

[0125]

[0126] If C i and O j The corresponding decryption private keys are The ciphertext squared Euclidean distance is expressed as:

[0127]

[0128] The decryption private key corresponding to the calculated distance is in Represents a single ciphertext private key;

[0129] If C i and O j The corresponding decryption private key is the same, and the ciphertext squared Euclidean distance is expressed as:

[0130]

[0131] The decryption private key corresponding to the calculated distance is

[0132] (5) Security Comparison Protocol

[0133] Given any two ciphertexts C i and O j, the security comparison protocol aims to determine the numerical value of two ciphertexts without leaking the plaintext. ES has ciphertext C i and O j , SMD has the information of the corresponding decryption private key of the ciphertext. The protocol construction uses the CZW multi-key fully homomorphic encryption algorithm to construct a protocol that supports the comparison of encrypted ciphertexts under different public keys; in addition, for overall security considerations, random noise is introduced to hide the final comparison results from the smart mobile device SMD.

[0134] Step S1: Before comparison, the edge server ES first considers C i and O j Whether they correspond to the same decryption private key;

[0135] If C i and O j The corresponding decryption private keys are different. The edge server ES uses the ciphertext extension sub-algorithm CZW.CTExt() in the CZW algorithm to extend C i and O j for and The corresponding decryption private key is Perform step S2;

[0136] If C i and O j The corresponding decryption private key is the same, proceed to step 1;

[0137] Step S2: The edge server ES uses the public key The plaintext random numbers p and e are encrypted as follows;

[0138]

[0139] The value of the ciphertext e is updated by calling the selection protocol, that is, the size except the highest bit.

[0140] Step S3: Compare the highest bit and use the formula res = C i ·(O j +1)+(C i +O j +1)·t calculates the comparison result res. If res=1, it means C i <O j ; If res = 0, then C i ≥O j ;

[0141] (6) Safe Minimum Protocol

[0142] Given any set of data d i , represents the ciphertext data C i and Oj The Euclidean distance of the secure minimum value protocol is designed to determine the minimum value d without leaking the plaintext. min . The edge server ES has all the distance ciphertexts d i1 ,d i2 ,...,d ik , the smart mobile device SMD has the corresponding private key All information of the protocol; The main idea of ​​the security comparison protocol proposed before is as follows.

[0143] Step D1: The edge server ES determines whether ciphertext expansion is required:

[0144] If there exists i,j∈k, satisfying U i ≠U j , that is, the ciphertexts do not belong to the same SMD, then proceed to step D2;

[0145] If for any i,j∈k, U i ≠U j , at this time, satisfy That is, the ciphertext comes from the same SMD, and step 1 is executed;

[0146] Step D2: Edge server ES expands ciphertext d i1 ,d i2 ,...,d ik for The private keys corresponding to the expanded ciphertexts are in

[0147] Step D3: Let the set And divide the ciphertexts in set M into groups of two in order, Group; if k is an even number, the grouping is as follows: If k is an odd number, the grouping is as follows:

[0148] Step D4: The edge server ES and the smart mobile device SMD determine the size of the plaintext corresponding to each group of ciphertexts through a security comparison protocol; the edge server ES forms a new set M with the ciphertexts corresponding to the plaintexts in the group s;

[0149] Step D5: Repeat steps D3 to D4 for the new set M until only one ciphertext remains in the set M, which is d min .

[0150] Step 4: Classification model training;

[0151] The classification model is trained using the algorithm library. First, the smart mobile device SMD converts the data type of the generated data set from floating point numbers to integers and encrypts it. Then the edge server ES calculates the distance through the secure distance calculation protocol, obtains the minimum value in the distance array through the secure minimum value protocol, compares the values ​​in the distance array to obtain the smaller value, and assigns the larger value to 0. The arrays are continued to be compared until the distance array contains only a single element with the minimum value. The loop is repeated k times to obtain the k nearest neighboring samples. Finally, the number of categories is counted to obtain the classification result.

[0152] The following is a detailed description of the kNN classifier training process:

[0153] Step 4.1: The edge server ES inputs the data to be classified x and converts each data x into a bit-by-bit representation (x l-1 ,x l-2 ,...,x0), sent to the cloud server CS;

[0154] Step 4.2: After receiving the ciphertext, the cloud server CS expands the ciphertext

[0155] Step 4.3: The edge server ES and the cloud server CS call the secure distance calculation protocol to calculate the Euclidean distance until all data are traversed. The edge server ES obtains the encryption result and saves it in the array d;

[0156] Step 4.4: The secure minimization protocol is called in the cloud server CS. The secure minimization protocol obtains a minimum value in the array d, saves its corresponding category in the array, resets the minimum value to the maximum value, and calls the secure minimization protocol repeatedly until k nearest neighbors are obtained; the edge server ES obtains the categories of the k nearest neighbors and stores the results in the array lab;

[0157] Step 4.5: The edge server ES performs category statistics and counts the number of each category in the array lab. The category in the model with the most occurrences is ci ′;

[0158] Step 4.6: The cloud server CS executes the batch verification algorithm to check The batch verification algorithm outputs 1, indicating that offline verification is accepted; otherwise, it is rejected;

[0159] Step 4.7: Cloud server CS constructs online signature Build Report And send it to the edge server ES, ES rebuilds the data report

[0160] Step 4.8: The edge server ES first checks Hch (c i ,s i ′,u i ′)=H ch (r i ,s i ,u i ); The batch verification algorithm outputs 1, indicating that offline verification is accepted; otherwise, it is rejected;

[0161] Step 4.9: Cloud server CS calculates aggregated ciphertext

[0162] Step 4.10: Cloud server CS constructs aggregate signature Set the aggregate message AP=i||μ||TS t ||Σ Agg Send to edge server ES;

[0163] Step 4.11: After receiving the message AP, the edge server ES checks e(g1,Σ Agg )=e(Y i ,H0(i||μ||TS t )); The online signature verification algorithm outputs 1, indicating that the online verification is accepted; otherwise, it is rejected;

[0164] Step 4.12: The edge server ES continues to train the classification model.

[0165] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) to form a technical solution.

Claims

1. A verifiable trainable classification model in a mobile communication system, characterized in that: Including trusted institutions TI, smart mobile devices SMD, edge servers ES and cloud servers CS; The trusted institution TI generates system security parameters Psystem, assuming that the system security parameters can be transmitted to the smart mobile device SMD and the edge server ES through a secure communication channel, and then goes offline and does not participate in subsequent processes; The smart mobile device SMD generates IoT data on the registered device, encrypts it with its own public key and uploads it to the edge server ES, only participating in the offline or online verification process; The edge server ES receives the encrypted data, provides classifier training services for the encrypted data, generates a local model and uploads it to the cloud server CS, and then verifies the integrity of the global model during the verification process; The cloud server CS is an aggregator for aggregating local models from the edge server ES for aggregation services and providing registration services. The cloud server CS generates an aggregate signature and sends it together with the global signature to the edge server ES.

2. A classification method for a verifiable training classification model in a mobile communication system, based on the verifiable training classification model in a mobile communication system according to claim 1, characterized in that: The following steps are involved: Step 1: Key initialization; Step 2: Perform offline-online verification; Step 3: Build an algorithm library; specifically design an algorithm library based on multi-key homomorphic encryption; the algorithm library includes a secure distance calculation protocol, a secure comparison protocol, and a secure minimum value protocol; Step 4: Classification model training; Use the algorithm library to train the classification model; First, the smart mobile device SMD converts the data type of the generated data set from floating point numbers to integers and encrypts it; then the edge server ES calculates the distance through the secure distance calculation protocol, obtains the minimum value in the distance array through the secure minimum value protocol, compares the values ​​in the distance array to obtain the smaller value, and assigns the larger value to 0; continues to compare the arrays until the distance array contains only a single element with the minimum value; loops k times to obtain the k nearest neighboring samples, and finally counts the number of categories to obtain the classification result.

3. The classification method of a verifiable training classification model in a mobile communication system according to claim 2, characterized in that: The step 1 is specifically as follows: the trusted institution TI selects two random security parameters α, β and a bilinear mapping e:G×G→G T , where G and G T is the set of integers A subgroup of G, g is the generator of G; three one-way hash functions H0, H1, H2 and a chameleon hash function H are defined in the trusted institution TI. chi : Where H0:{0,1} * →G,H1: H2: is an integer set, and the trusted authority TI calculates and verifies the signature e(g1,g1) α and signature public key Y = g1 x , where g i represents the generator; assuming that the number of edge nodes is n, the number of smart devices is i, and the trusted institution TI generates the system security parameter P system ,in Where α, β, and n represent random numbers, the parameter pp is a multi-key FHE security parameter, and the trusted institution TI sends pp to the SMD.

4. The classification method of a verifiable training classification model in a mobile communication system according to claim 2, characterized in that: The step 2 specifically includes the following steps: Step 2.1: Edge server registration; The edge server ES selects two random values ​​y, z and an integer r i ,q i To get the offline status value S t =(r i ,q i ,p i ), where p i =H1(i||TS i ||k i ), TS i Indicates the ES message, k i Indicates the ES key, defining parameter g2 = g1 y ,g3=g1 z , based on the BLS signature method, construct an offline signature Σ BLS , the edge server ES calculates the DTCH function where s i ,u i Represents a random integer, BLS signature Constructed as X i Indicates an integer randomly selected by SMD, the edge server ES will sign the label offline and online verification key V on =(g1,g2.g3) is sent to the cloud server CS, where Step 2.2: Message generation; Cloud server CS receives offline signature tag After that, first execute the batch verification algorithm to check the offline verification and construct the online signature Then, the online signature is sent to the edge server ES; The check is offline verification: the cloud server CS first aggregates the offline signature tags of the edge server ES and checks whether where g i represents the generator, Y i Represents the signature public key; if the batch verification algorithm outputs 1, the offline verification is passed; otherwise, it is rejected; The online signature is constructed: the cloud server CS constructs the online signature based on the offline signature tag. To construct an online signature where u i ′=((r i -c i )+(s i -s i ′)y+u i z)z -1 ,s i ′=s i +1, c i Represents ciphertext, then the cloud server CS builds the report And send it to the edge server ES, which reconstructs the data report Step 2.3: message aggregation; When the edge server ES receives the data report DR i When the edge server ES executes the online signature verification algorithm to perform online signature verification; the edge server ES constructs the aggregate signature and sends it to the cloud server CS; The online signature verification: The edge server ES checks the timestamp TS i Then first check whether H ch (c i ,s i ′,u i ′)=H ch (r i ,s i ,u i ); if the online signature verification algorithm outputs 1, the offline verification is accepted; otherwise, it is rejected; The message aggregation: Cloud server CS calculates the aggregated ciphertext The constructed aggregate signature: cloud server CS based on private key X j Constructing an aggregate signature Where ID i is the identity of the edge server; then, the edge server ES aggregates the message AP=i||μ||TS i ||Σ Agg Send to cloud server CS; Step 2.4: Read the message; After receiving the aggregation message AP, the cloud server CS checks e(g1,Σ Agg )=e(Y i ,H0(i||μ||TS t )) is established to check the aggregate signature Σ Agg ; If the algorithm Ver.on() outputs 1, the offline verification is accepted; otherwise, it is rejected; After undergoing offline validation, the classification model is trained.

5. The classification method of a verifiable training classification model in a mobile communication system according to claim 2, characterized in that: The safety distance calculation protocol described in step 3 is specifically as follows: Given a data set D = {m1,m2,...,m n Any two-dimensional n*d data object m in i =(m i1 ,m i2 ,...,m id ), m id It is n*d two-dimensional data, let C i =(c1,c2,...,c d ) represents m i In the public key pk l,i The encrypted ciphertext, c d Represents ciphertext, the corresponding decryption private key is sk l,i , O i =(o j1 ,o j2 ,...,o jd ) indicates that in the public key pk l,j Another set of ciphertext encrypted under the following, the corresponding decryption private key is sk l,j , o jd is a two-dimensional ciphertext of n*d; Assume that the edge server ES has the ciphertext C i and O j But there is no corresponding decryption private key sk l,i and sk l,j , the Euclidean distance expression is expressed as: The value range of z is [1, d]; The squared Euclidean distance is used instead of the Euclidean distance, C i and O j The squared Euclidean distance between them is expressed as: Before calculating the squared Euclidean distance on the ciphertext field, we discuss the following two cases: If C i and O j The corresponding decryption private keys are different. To calculate the ciphertext distance, we first use the ciphertext extension sub-algorithm CZW.CTExt() in the CZW algorithm to expand C i and O j ; If C i and O j The corresponding decryption private keys are The ciphertext squared Euclidean distance is expressed as: The decryption private key corresponding to the calculated distance is in Represents a single ciphertext private key; If C i and O j The corresponding decryption private key is the same, and the ciphertext squared Euclidean distance is expressed as: The decryption private key corresponding to the calculated distance is 6. The classification method of a verifiable training classification model in a mobile communication system according to claim 2, characterized in that: The security comparison protocol described in step 3 is specifically: Given any two ciphertexts C i and O j , using the CZW multi-key fully homomorphic encryption algorithm, a protocol that supports encrypted ciphertext comparison under different public keys is constructed; random noise is introduced to hide the final comparison result from the smart mobile device SMD; Step S1: The edge server ES first considers C i and O j Whether they correspond to the same decryption private key; If C i and O j The corresponding decryption private keys are different. The edge server ES uses the ciphertext extension sub-algorithm CZW.CTExt() in the CZW algorithm to extend C i and O j for and The corresponding decryption private key is Perform step S2; If C i and O j The corresponding decryption private key is the same, proceed to step 1; Step S2: The edge server ES uses the public key The plaintext random numbers p and e are encrypted as follows; Update the value of the ciphertext e by calling the selection protocol Selection, that is, the size except the highest bit; Step S3: Compare the highest bit and use the formula res = C i ·(O j +1)+(C i +O j +1)·t calculates the comparison result res; if res=1, it means C i <O j ; If res = 0, then C i ≥O j .

7. The classification method of a verifiable training classification model in a mobile communication system according to claim 2, characterized in that: The specific safe minimum value protocol described in step 3 is: Given any set of data d i , represents the ciphertext data C i and O j The Euclidean distance of the edge server ES has all the distance ciphertexts d i1 ,d i2 ,...,d ik , the smart mobile device SMD has the corresponding private key All information of Step D1: The edge server ES determines whether ciphertext expansion is required: If there exists i,j∈k, satisfying U i ≠U j , that is, the ciphertexts do not belong to the same SMD, then proceed to step D2; If for any i,j∈k, U i ≠U j , at this time, satisfy That is, the ciphertext comes from the same SMD, and step 1 is executed; Step D2: Edge server ES expands ciphertext d i1 ,d i2 ,...,d ik for The private keys corresponding to the expanded ciphertexts are in Step D3: Let the set And divide the ciphertexts in set M into groups of two in order, Group; if k is an even number, the grouping is as follows: If k is an odd number, the grouping is as follows: Step D4: The edge server ES and the smart mobile device SMD determine the size of the plaintext corresponding to each group of ciphertexts through a security comparison protocol; the edge server ES forms a new set M with the ciphertexts corresponding to the plaintexts in the group s; Step D5: Repeat steps D3 to D4 for the new set M until only one ciphertext remains in the set M, which is d min .

8. The classification method of a verifiable training classification model in a mobile communication system according to claim 2, characterized in that: The step 4 specifically comprises the following steps: Step 4.1: The edge server ES inputs the data to be classified x and converts each data x into a bit-by-bit representation (x l-1 ,x l-2 ,...,x0), sent to the cloud server CS; Step 4.2: After receiving the ciphertext, the cloud server CS expands the ciphertext Step 4.3: The edge server ES and the cloud server CS call the secure distance calculation protocol to calculate the Euclidean distance until all data are traversed; the edge server ES obtains the encryption result and saves it in the array d; Step 4.4: The secure minimization protocol is called in the cloud server CS. The secure minimization protocol obtains a minimum value in the array d, saves its corresponding category in the array, resets the minimum value to the maximum value, and calls the secure minimization protocol repeatedly until k nearest neighbors are obtained; the edge server ES obtains the categories of the k nearest neighbors and stores the results in the array lab; Step 4.5: The edge server ES performs category statistics and counts the number of each category in the array lab. The category in the model with the most occurrences is ci ′; Step 4.6: The cloud server CS executes the batch verification algorithm to check The batch verification algorithm outputs 1, indicating that offline verification is accepted; otherwise, it is rejected; Step 4.7: Cloud server CS constructs online signature Build Report And send it to the edge server ES, ES rebuilds the data report Step 4.8: The edge server ES first checks H ch (c i ,s i ′,u i ′)=H ch (r i ,s i ,u i ); The batch verification algorithm outputs 1, indicating that offline verification is accepted; otherwise, it is rejected; Step 4.9: Cloud server CS calculates aggregated ciphertext Step 4.10: Cloud server CS constructs aggregate signature Set the aggregate message AP=i||μ||TS t ||Σ Agg Send to edge server ES; Step 4.11: After receiving the message AP, the edge server ES checks e(g1,Σ Agg )=e(Y i ,H0(i||μ||TS t )); The online signature verification algorithm outputs 1, indicating that the online verification is accepted; otherwise, it is rejected; Step 4.12: The edge server ES continues to train the classification model.

Images