Consistency verification method and device

Abstract

A consistency verification method and apparatus, the consistency verification method comprising: a first apparatus generates n ciphertexts, the n ciphertexts correspond to n nodes, each node corresponds to a key, each ciphertext is determined by performing first encryption on a plaintext according to the key of the corresponding node, and n is a positive integer; the first device obtains a challenge value; the first device sends n response values to the second device, each response value is determined according to a random value, a challenge value and a plaintext, and the random value belongs to a random value set determined by the first device; and the second device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent or not according to the n response values. According to the scheme of the invention, consistency verification can be carried out on the distributed ciphertext on the premise of protecting plaintext privacy, and verification cost and potential safety hazards are reduced.

Description

Technical Field

[0001] The present application relates to the field of computers, and more specifically, to a consistency verification method and device. Background Art

[0002] With the rapid development of artificial intelligence (AI) technology and the need for privacy protection of models and data assets, federated learning technology has become a research hotspot in industry and academia. The general process of federated learning can be summarized as follows: First, the model aggregator initializes a global model. In order to protect the privacy of the model, the global model is encrypted into ciphertext and sent to each local node. Subsequently, each local node decrypts the global model and uses its own data set to train the model on the local device. After completing local training, each node calculates model updates, such as weight parameters and gradient information, and sends these updates back to the model aggregator. After that, the global model aggregator collects all model updates and then uses aggregation algorithms such as federated averaging to update the global model. The aggregator distributes the updated global model to local nodes again for the next round of training until the model converges or meets other stopping conditions.

[0003] In real-world scenarios, there are some reasons that cause inconsistencies in the global models received by each local training node. When the task publisher investigates model inconsistencies, the third-party auditing agency needs to determine whether the responsible party is the model aggregator or the transmission process, and then provide auditing and optimization for the federated learning system. However, in this process, the third-party auditing agency must know the plaintext of the global model, which undermines the requirement for confidentiality of model information. Therefore, how to make a correct judgment on the consistency of global model distribution while protecting model privacy is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a consistency verification method and device to ensure the confidentiality of the model during transmission, and to perform consistency verification on the distributed model ciphertext while protecting the privacy of the model.

[0005] In a first aspect, a consistency verification method is provided, the method comprising: a first device generates n ciphertexts, the n ciphertexts correspond to n nodes, each node corresponds to a key, each ciphertext is determined by performing a first encryption on a plaintext according to the key of the corresponding node, and n is a positive integer; the first device obtains a challenge value; the first device sends n response values ​​to a second device, each response value is determined according to a random value, a challenge value and a plaintext, and the random value belongs to a set of random values ​​determined by the first device; the second device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values.

[0006] It should be noted that each node corresponds to a key. The key of the node can be understood as the key corresponding to the node, or the key owned by the node. In the following text, the key of the ciphertext can be understood as the key corresponding to the node used to encrypt the plaintext to obtain the ciphertext. The subsequent expressions can be understood in this way and will not be repeated here.

[0007] According to the solution of the present application, through the method of zero-knowledge proof, the consistency of the distributed ciphertext can be verified while protecting the privacy of the model, thereby reducing the verification cost and security risks.

[0008] In certain implementations of the first aspect, a first device sends n commitment values ​​to a second device, the n commitment values ​​corresponding one-to-one to n ciphertexts, each commitment value being determined by performing a second encryption on a random value based on a key of the corresponding ciphertext, and the first encryption and the second encryption use the same algorithm; the second device verifies whether the i-th ciphertext is obtained from the i-th plaintext based on the i-th commitment value, the challenge value, and the i-th response value, i∈{1,2,…,n}.

[0009] According to the solution of the present application, the second device can determine whether the ciphertext of the first device is determined by the plaintext, so that the device causing the inconsistency can be screened out, thereby improving the verification efficiency.

[0010] In certain implementations of the first aspect, when the response value Res i , Commitment valueCom i , challenge value c and ciphertext C i The second device determines that the i-th ciphertext is obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the third encryption and the first encryption use the same algorithm.

[0011] In certain implementations of the first aspect, algorithms used by the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

[0012] According to the solution of the present application, an additively homomorphic asymmetric encryption algorithm is used to replace a general asymmetric encryption algorithm to meet the consistency verification equation designed subsequently and ensure the confidentiality of the plaintext during transmission.

[0013] In certain implementations of the first aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0014] According to the solution of the present application, the use of the Paillier encryption algorithm can improve the efficiency of encryption and decryption and the security of the device during the verification process.

[0015] In some implementations of the first aspect, the response value Resi , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0016] In certain implementations of the first aspect, the first device receives a challenge value sent by the second device, where the challenge value belongs to a set of random values ​​determined by the first device.

[0017] In some implementations of the first aspect, the first device determines the challenge value based on the commitment value.

[0018] According to the solution of the present application, through a non-interactive consistency proof method, the first device generates proof parameters once and sends them to the second device for verification. There is no need for the two devices to interact and wait online in real time at the same time, which reduces communication overhead and expands the applicable scenarios.

[0019] In certain implementations of the first aspect, the plain text is a global model.

[0020] In certain implementations of the first aspect, the second device sends a verification result to the third device, where the verification result is used to indicate whether the n plaintexts corresponding to the n ciphertexts are consistent, and / or whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0021] According to the solution of the present application, the consistency of the ciphertext sent can be verified and the verification result can be provided to the device, thereby ensuring the normal operation of the system and improving the system performance.

[0022] In a second aspect, a consistency verification method is provided, the method comprising: generating n ciphertexts, the n ciphertexts corresponding to n nodes, each node corresponding to a key, each ciphertext being determined by a first encryption of a plaintext according to the key of the corresponding node, and n being a positive integer; obtaining a challenge value; sending n response values, each response value being determined based on a random value, a challenge value and a plaintext, the random value belonging to a set of random values ​​determined by a first device, and the n response values ​​being used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

[0023] In certain implementations of the second aspect, n commitment values ​​are sent, corresponding one-to-one to n ciphertexts, each commitment value is determined by performing a second encryption on a random value based on the key of the corresponding ciphertext, the first encryption and the second encryption use the same algorithm, the i-th commitment value is used to verify with the challenge value and the i-th response value whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0024] In some implementations of the second aspect, the response value Res i , Commitment valueComi , challenge value c and ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the third encryption and the first encryption use the same algorithm.

[0025] In certain implementations of the second aspect, algorithms used by the first encryption, the second encryption, and the third encryption include additive homomorphic encryption algorithms.

[0026] In certain implementations of the second aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0027] In some implementations of the second aspect, the response value Res i , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0028] In certain implementations of the second aspect, the first device receives a challenge value sent by the second device, where the challenge value belongs to a set of random values ​​determined by the first device.

[0029] In some implementations of the second aspect, the first device determines the challenge value based on the commitment value.

[0030] In certain implementations of the second aspect, the plain text is a global model.

[0031] In a third aspect, a consistency verification method is provided, the method comprising: obtaining a challenge value; receiving n response values, each response value being determined based on a random value, a challenge value and a plaintext, the random value belonging to a set of random values ​​determined by a first device, the plaintext being used to perform a first encryption based on a key of each of the n nodes to determine n ciphertexts, the n ciphertexts corresponding to n nodes, each node corresponding to a key, and n being a positive integer; verifying whether the n plaintexts corresponding to the n ciphertexts are consistent based on the n response values.

[0032] In certain implementations of the third aspect, n commitment values ​​are received, each corresponding one to n ciphertexts, each commitment value being determined by performing a second encryption on a random value based on a key of the corresponding ciphertext, the second encryption and the first encryption using the same algorithm; based on the i-th commitment value, the challenge value, and the i-th response value, it is verified whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0033] In certain implementations of the third aspect, when the response value Resi , Commitment valueCom i , challenge value c and ciphertext C i The i-th ciphertext is determined to be obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the third encryption and the first encryption use the same algorithm.

[0034] In certain implementations of the third aspect, algorithms used by the first encryption, the second encryption, and the third encryption include additive homomorphic encryption algorithms.

[0035] In certain implementations of the third aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0036] In some implementations of the third aspect, the response value Res i , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0037] In certain implementations of the third aspect, the challenge value is determined based on the commitment value.

[0038] In certain implementations of the third aspect, the plain text is a global model.

[0039] In certain implementations of the third aspect, a verification result is sent to a third device, where the verification result is used to indicate whether the n plaintexts corresponding to the n ciphertexts are consistent, and / or whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0040] In a fourth aspect, a consistency verification device is provided, which can be used in the first device of the second aspect. In a possible implementation, the device may include a module or unit corresponding to the method / operation / step / action described in the second aspect, and the module or unit may be a hardware circuit, or software, or a combination of a hardware circuit and software.

[0041] In one possible implementation, the device includes: a processing unit, used to generate n ciphertexts, the n ciphertexts correspond to n nodes, each node corresponds to a key, each ciphertext is determined by first encrypting the plaintext according to the key of the corresponding node, and n is a positive integer; a transceiver unit, used to obtain a challenge value; and also used to send n response values, each response value is determined based on a random value, a challenge value and a plaintext, the random value belongs to a random value set determined by the first device, and the n response values ​​are used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

[0042] In certain implementations of the fourth aspect, the transceiver unit is also used to send n commitment values, which correspond one-to-one to n ciphertexts. Each commitment value is determined by performing a second encryption on a random value based on the key of the corresponding ciphertext. The first encryption and the second encryption use the same algorithm. The i-th commitment value is used to verify with the challenge value and the i-th response value whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0043] In certain implementations of the fourth aspect, the response value Res i , Commitment valueCom i , challenge value c and ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the third encryption and the first encryption use the same algorithm.

[0044] In certain implementations of the fourth aspect, algorithms used in the first encryption, the second encryption, and the third encryption include additive homomorphic encryption algorithms.

[0045] In certain implementations of the fourth aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0046] In certain implementations of the fourth aspect, the response value Res i , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0047] In certain implementations of the fourth aspect, the transceiver unit is further configured to receive a challenge value sent by the second device, where the challenge value belongs to a random value set determined by the first device.

[0048] In certain implementations of the fourth aspect, the processing unit is further configured to determine a challenge value based on the commitment value.

[0049] In certain implementations of the fourth aspect, the plain text is a global model.

[0050] In a fifth aspect, a consistency verification device is provided, which can be used in the second device of the third aspect. In a possible implementation, the device may include a module or unit corresponding to the method / operation / step / action described in the third aspect, and the module or unit may be a hardware circuit, or software, or a combination of a hardware circuit and software.

[0051] In one possible implementation, the device includes: a transceiver unit, used to obtain a challenge value; also used to receive n response values, each response value is determined based on a random value, a challenge value and a plaintext, the random value belongs to a set of random values ​​determined by a first device, and the plaintext is used to perform a first encryption based on a key of each of the n nodes to determine n ciphertexts, the n ciphertexts correspond to n nodes, each node corresponds to a key, and n is a positive integer; a processing unit, used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent based on the n response values.

[0052] In certain implementations of the fifth aspect, the transceiver unit is further used to receive n commitment values, where the n commitment values ​​correspond one-to-one to n ciphertexts, and each commitment value is determined by performing a second encryption on a random value based on the key of the corresponding ciphertext, and the second encryption uses the same algorithm as the first encryption; the processing unit is further used to verify whether the i-th ciphertext is obtained from the i-th plaintext based on the i-th commitment value, the challenge value, and the i-th response value, i∈{1,2,…,n}.

[0053] In certain implementations of the fifth aspect, when the response value Res i , Commitment valueCom i , challenge value c and ciphertext C i The i-th ciphertext is determined to be obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the third encryption and the first encryption use the same algorithm.

[0054] In certain implementations of the fifth aspect, algorithms used for the first encryption, the second encryption, and the third encryption include additive homomorphic encryption algorithms.

[0055] In certain implementations of the fifth aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0056] In certain implementations of the fifth aspect, the response value Res i , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0057] In certain implementations of the fifth aspect, the processing unit is further configured to determine a challenge value based on the commitment value.

[0058] In certain implementations of the fifth aspect, the plain text is a global model.

[0059] In certain implementations of the fifth aspect, the transceiver unit is also used to send a verification result to a third device, which is used to indicate whether the n plaintexts corresponding to the n ciphertexts are consistent, and / or whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0060] In a sixth aspect, a consistency verification system is provided, the communication system comprising the consistency verification device provided in the fourth aspect and the consistency verification device provided in the fifth aspect. The communication system can complete the consistency verification method provided in any possible implementation of the first to third aspects or the first to third aspects.

[0061] In the seventh aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program runs on a computer, the computer executes instructions of the method of any possible implementation method of the first to third aspects or the first to third aspects mentioned above.

[0062] In an eighth aspect, a verification device is provided, comprising: a processor, wherein the processor or the processing unit can execute instructions so that the method of any possible implementation of the first to third aspects or the first to third aspects is executed.

[0063] Among them, the processor mentioned above can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the consistency verification method of the first to third aspects mentioned above.

[0064] In a possible implementation, the verification device further includes a memory for storing the above executable instructions. Optionally, the memory and the processor are integrated together.

[0065] In a possible implementation, the verification device further includes a communication interface for inputting and / or outputting signaling or data.

[0066] In a possible implementation, the verification device is a chip.

[0067] In a ninth aspect, a computer program product is provided, the product comprising a computer program code, which, when executed, is used to execute instructions for the method of any possible implementation of the first to third aspects or the first to third aspects.

[0068] In the tenth aspect, a chip system is provided, including a memory and a processor, wherein the memory is used to store instructions, and the processor is used to call and execute the instructions from the memory, so that the methods in the above-mentioned first to third aspects and possible implementation methods are executed.

[0069] Among them, the chip system may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0070] Specifically, the beneficial effects of other aspects can refer to the beneficial effects described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 This is a schematic diagram of a federated learning architecture provided in an embodiment of the present application;

[0072] Figure 2 This is a schematic diagram of an applicable scenario provided by an embodiment of the present application;

[0073] Figure 3 It is a schematic diagram of a consistency verification method provided by an embodiment of the present application;

[0074] Figure 4 is a schematic diagram of another consistency verification method provided in an embodiment of the present application;

[0075] Figure 5 is a schematic block diagram of a consistency verification device provided in an embodiment of the present application;

[0076] Figure 6 It is a schematic block diagram of another consistency verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0078] It should be understood that in the present application, "sending information to...(the second device)" can be understood as the destination of the information being the second device. It can include sending information to the second device directly or indirectly. "Receiving information from...(the first device)" can be understood as the source of the information being the first device, which can include receiving information from the first device directly or indirectly. The information may be processed as necessary between the source and destination of the information transmission, such as format changes, etc., but the destination can understand the valid information from the source. Similar expressions in the present application can be understood similarly and will not be repeated here.

[0079] In order to facilitate understanding of the embodiments of the present application, first, a brief introduction is given to the concepts and technologies involved in the embodiments of the application.

[0080] It should be understood that the related terms and explanations in the following text are common to all embodiments throughout the text, and different embodiments can be used independently or in combination based on certain internal or external connections, and different implementation methods in the embodiments can be used independently or in combination.

[0081] 1. Federated Learning

[0082] The federated learning architecture is Figure 1 As shown in the figure, the general process can be summarized into the following stages: First, the model aggregator initializes a global model. In order to protect the privacy of the model, the global model is encrypted into ciphertext and sent to each local node. Subsequently, each local node decrypts the global model and uses its own data set to train the model on the local device. After completing the local training, each node calculates the model updates, such as weight parameters and gradient information, and sends these updates back to the model aggregator. After that, the global model aggregator collects all model updates and then uses aggregation algorithms such as federated averaging to update the global model. The aggregator distributes the updated global model to the local nodes again for the next round of training until the model converges or other stopping conditions are met.

[0083] However, in real-world scenarios, there are some reasons that cause inconsistencies in the global models received by each local training node. From the perspective of the global model aggregator: First, the model aggregator mistakenly creates different global model versions due to system failures and sends them to different local nodes; second, the model aggregator is at risk of being hijacked and deliberately distributes inconsistent models to local training nodes. From the perspective of the model ciphertext transmission process: during the transmission of the encrypted model, the global model ciphertext received by each node may be inconsistent due to network delays, packet loss, and other issues; second, if the information is intercepted and modified by an unauthorized third party during the transmission process, the models received by each local node will also be inconsistent.

[0084] When the global model received by the local node is inconsistent, two major problems will occur: First, the model update trained by each node based on the local data set will not be able to improve the performance of the global model, resulting in the global model failing to converge normally, the overall learning performance declining, and the failure to achieve the expected learning goals. Second, the consistency of the global model on each node is the basis of distributed learning. If the global model is inconsistent, more iterations and more complex calculation processes are required to achieve convergence, which will greatly increase the calculation and communication overhead of the node.

[0085] 2. Network intelligence based on federated learning

[0086] Network intelligence based on federated learning requires the close integration of federated learning technology with mobile communication networks, so that all participants in the network can carry out network intelligence in a federated learning manner under the premise of protecting data privacy, so as to meet the joint modeling needs of users, operators and industries. The network intelligence architecture based on federated learning includes three layers: intra-domain federation, cross-domain federation, and global federation, involving AI modeling demand parties such as users, operators and industries. In the global federation layer, operators can act as central coordinators and become the link between users and industries, providing cross-border interoperability, task coordination, resource scheduling, security authentication and other functions, solving cross-domain privacy issues between users and industries, and breaking down data silos between industries. In the cross-domain federation layer, the operator side mainly includes network nodes such as operation administration and maintenance (OAM) and core network (CN), which can assume the dual roles of Client and Coordinator. When acting as a Coordinator, it coordinates the federated learning between nodes within or between domains; when acting as a Client, it participates in the federated learning within or between domains as a participant. For example, the network data analytics function (NWDAF) in the core network can coordinate the intra-domain network function (NF) / other domain federated learning. The UE on the user side and the AF on the industry side can both act as Coordinator / Client to implement intra-domain or inter-domain federated learning.

[0087] The Coordinator of the core AI unit is used as the central node to assist the core network, terminal, wireless, network management, application and other fields in intra-domain or inter-domain federated learning. The central node sends the initial model to the distributed nodes. The distributed nodes use their own local data sets to train the model and send the model weight update information to the central node. The data does not leave the local area, ensuring user privacy and data security. The central node aggregates the model updates received from each distributed node and sends the aggregated model to each distributed node. The distributed nodes accept the aggregated model, start updating the local model, apply new data instances, and perform localized reasoning. For example, in the mobile communication network architecture, the core network element NWDAF can serve as a central node to assist intra-domain or inter-domain federated learning, which is used to monitor abnormal conditions of nodes in the domain or provide end-to-end overall service quality services.

[0088] NWDAF is a data-aware analysis network element that automatically senses and analyzes the network based on network data, and participates in the entire life cycle of network planning, construction, operation and maintenance, network optimization, and operation, making the network easy to maintain and control, improving the efficiency of network resource utilization, and enhancing user service experience. NWDAF network element is responsible for data collection, model training, reasoning judgment and intelligent prediction, and outputs analysis results for network, network management and application execution strategy decision-making.

[0089] For example, Figure 2 As shown in the figure, Server NWDAF can act as a model aggregator to deliver the global model to multiple nodes such as Client NWDAF1 and Client NWDAF2. OAM can act as a verification agency to verify the consistency of the delivery of the global model.

[0090] 3. Hash Function

[0091] Hash function, also known as hash algorithm or hash function, is a method of creating a small digital "fingerprint" from any kind of data. Hash function compresses a message or data into a summary, making the data smaller and fixing the format of the data. The function shuffles and mixes the data to recreate a fingerprint called a hash value or hash value. Hash values ​​are usually represented by a short string of random letters and numbers.

[0092] In one possible implementation, the global model distribution consistency can be verified through a hash algorithm. The model aggregator uses a hash function to hash the global model, and then sends the hash value together with the encrypted global model ciphertext to the local training node. After the local node decrypts the global model, it uses a hash function to process the model and compares the result with the received hash value. If they are consistent, it indicates that the model has not been tampered with during transmission, thus ensuring the integrity of the global model.

[0093] It should be understood that in the above implementation, if a hash algorithm is used to verify the consistency of the model ciphertext sent by the model aggregator to each local node, the third-party auditing agency needs to obtain the plaintext information of the global model, calculate the correct hash value, and then compare the calculated hash value with the hash value sent by the aggregator to each node. If all hash values ​​are equal, it means that the model sent by the aggregator is consistent. However, in this process, the third-party auditing agency must know the plaintext of the global model, which undermines the requirement for confidentiality of model information. In addition, although the hash algorithm is simple to calculate, it is vulnerable to attacks such as rainbow table attacks and exhaustive attacks, and suffers from the risk of model privacy leakage.

[0094] In another possible implementation, the third-party auditing agency may not calculate the correct hash value based on the model plain text, but instead directly determine the consistency of the model distribution based on whether the hash values ​​sent by the global model aggregator to each local node are the same.

[0095] It should be understood that in the above implementation, there is a situation where the model aggregator deliberately sends the same hash value to confuse the auditing agency, but in fact the hash value may not match the global model sent. Therefore, it is impossible to correctly determine the consistency of the global model sent while protecting the privacy of the model based on the hash algorithm.

[0096] In view of the above problems, the present application provides a consistency verification method based on additive homomorphic encryption technology and zero-knowledge proof ideas to ensure the confidentiality of plaintext during transmission and to achieve consistency verification of distributed ciphertext under the premise of protecting the privacy of plaintext.

[0097] In a possible implementation, the method of the present application can be applied to network equipment and terminal equipment.

[0098] A network device may be a node in a radio access network (RAN), which may also be referred to as an access network device, or a RAN node (or device). A network device is used to help a terminal achieve wireless access. Multiple network devices in a communication system may be nodes of the same type or nodes of different types. In some scenarios, the roles of a network device and a terminal are relative. Network devices and terminals are sometimes referred to as communication devices.

[0099] In one possible scenario, the network device may be a base station, an evolved NodeB (eNodeB), a transmitting and receiving point (TRP), a transmitting point (TP), a next generation NodeB (gNB), a next generation base station in a 6th generation (6G) mobile communication system, a base station in a future mobile communication system, a satellite, or an access point (AP) in a WiFi system, an integrated access and backhaul (IAB) node, a network device in a mobile switching center non-terrestrial network (NTN) communication system, that is, it can be deployed on a high altitude platform or satellite, etc. The network device may be a macro base station, a micro base station or an indoor station, a relay node or a donor node, or a wireless controller in a CRAN scenario. The network device may also be a device that functions as a base station in device to device (D2D) communication, Internet of Vehicles communication, drone communication, and machine communication. Optionally, the network device may also be a server, a wearable device, a vehicle or a vehicle-mounted device, etc. For example, the access network device in vehicle to everything (V2X) technology may be a road side unit (RSU).

[0100] In another possible scenario, multiple network devices collaborate to assist the terminal in achieving wireless access, and different network devices respectively implement part of the functions of the base station. For example, the network device may be a centralized unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU may be set separately, or may be included in the same network element, such as a baseband unit (BBU). The RU may be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH). It is understandable that the network device may be a CU node, a DU node, or a device including a CU node and a DU node. In addition, the CU may be divided into a network device in the access network RAN, or the CU may be divided into a network device in the core network CN, without limitation here.

[0101] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, CU, CU-CP, CU-UP, DU and RU are described as examples in this application. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application may be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0102] In the embodiments of the present application, the form of the network device is not limited. The device for realizing the function of the network device can be the network device; or it can be a device that can support the network device to realize the function, such as a chip system. The device can be installed in the network device or used in combination with the network device.

[0103] Terminal equipment, also known as user equipment (UE), mobile station (MS), mobile terminal (MT), etc., is a device used to provide voice or data connectivity to users, or an IoT device. For example, terminal equipment includes handheld devices with wireless connection functions, vehicle-mounted devices, etc. At present, terminal devices can be: mobile phones, tablet computers, laptops, PDAs, mobile internet devices (MID), wearable devices (such as smart watches, smart bracelets, pedometers, etc.), vehicle-mounted devices (such as cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed trains, etc.), satellite terminals, virtual reality (VR) devices, augmented reality (AR) devices, smart point of sale (POS) machines, customer-premises equipment (CPE), wireless terminals in industrial control, smart home devices (such as refrigerators, TVs, air conditioners, electric meters, etc.), smart robots, robotic arms, workshop equipment, wireless terminals in unmanned driving, wireless terminals in telemedicine, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, or wireless terminals in smart homes, flight equipment (such as smart robots, hot air balloons, drones, airplanes), etc. The terminal device can also be other devices with terminal functions, for example, the terminal device can also be a device that serves as a terminal function in D2D communication.

[0104] The embodiments of the present application do not limit the device form of the terminal. The device for realizing the function of the terminal device can be a terminal device; it can also be a device that can support the terminal device to realize the function, such as a chip system. The device can be installed in the terminal device or used in combination with the terminal device. In the embodiments of the present application, the chip system can be composed of chips, or it can include chips and other discrete devices.

[0105] In an embodiment of the present application, in a possible implementation, the first device may be a network device, the local node may be a terminal device, the second device may be a network device or a terminal device, and the second device may be used to verify the consistency of the ciphertext sent by the first device to the local node. In another possible implementation, the first device and the second device may also be core network elements, specifically, the first device may be a NWDAF network element, the second device may be an OAM network element, and the number of core network elements may be one or more, which is not limited in the present application.

[0106] In a possible implementation, the first device may be a model aggregator; the second device may be a third-party auditing agency (Verifier). It is assumed that the Aggregator has the risk of system failure or hijacking by an attacker, thereby destroying the consistency of the global model; it is assumed that the Verifier will honestly follow the protocol to perform operations, but will try to reveal the privacy information of the model based on the data obtained, so it cannot leak any useful information related to the global model during the proof process.

[0107] The present application provides a consistency verification method 100, which involves a first device and a second device. The first device may be a certification device, and the second device may be a verification device. For example, the first device may be a model aggregator, and the second device may be a third-party auditing agency. Figure 3 As shown, the method 100 includes at least the following steps:

[0108] S110, the first device generates n ciphertexts.

[0109] The first device generates n ciphertexts, the n ciphertexts correspond to n nodes, each node corresponds to a key, each ciphertext is determined by performing a first encryption on the plaintext according to the key of the corresponding node, and n is a positive integer.

[0110] In a possible implementation, when the first device is a model aggregator and the second device is a third-party auditing agency, the plain text is a global model.

[0111] In a possible implementation, performing the first encryption includes performing encryption using an additively homomorphic encryption algorithm, which may be an asymmetric encryption algorithm.

[0112] Additively homomorphic asymmetric encryption algorithms include the Paillier encryption algorithm.

[0113] The Paillier encryption algorithm is widely used due to its high encryption and decryption efficiency and complete security proof. It is one of the commonly used encryption algorithm schemes in computing scenarios. The use of the Paillier encryption algorithm can improve the security and efficiency of the verification process.

[0114] Additively homomorphic asymmetric encryption algorithms also include Gentry's algorithm, BGV / BFV scheme, GSW scheme and CKKS algorithm, etc. The asymmetric encryption algorithm only needs to satisfy additively homomorphic, and this application does not limit the specific algorithm used.

[0115] For example, in the model federated learning system, there are n local nodes, each of which has a pair of public and private keys {PK i ,SK i}, i∈{1,2,…,n}, where PK i Indicates the private key owned by the local node, SK i Represents the public key owned by the local node; the model aggregator uses an additively homomorphic asymmetric encryption system, such as the Paillier encryption algorithm, to encrypt the global model (i.e., plaintext) to be distributed using the public key of each local node, expressed as Where M represents the global model, Indicates the use of encryption algorithm and public key PK i Encryption, C i Indicates the use of node i's public key PK i The encrypted model ciphertext (i.e., ciphertext).

[0116] After the first device generates n ciphertexts, the n ciphertexts can be sent to the n nodes. The sending can be sending the n ciphertexts directly to each node, or sending the n ciphertexts to other devices, which then send them to the n nodes.

[0117] In a possible implementation, the first device may i , i∈{1,2,…,n} is stored in an open, transparent, and tamper-proof database. For example, it can be stored in the Ethereum blockchain network for local training nodes and second devices to query and download.

[0118] According to the solution of the present application, the efficiency and security of ciphertext distribution can be effectively improved.

[0119] Public key PK of each local node i , i∈{1,2,…,n} is also public in the system, for example, it is also stored in the blockchain network. The model aggregator also publishes a hash function G is a group, which represents an algebraic structure with binary operations that satisfy closure, associativity, identity, and inverse elements, including Abelian groups, homomorphisms, and conjugation classes. represents a set of non-zero integers modulo q. G can be obtained by hashing

[0120] S120, the second device determines a challenge value.

[0121] S121, the second device sends a challenge value, and correspondingly, the first device receives the challenge value.

[0122] In this implementation, the first device obtains a challenge value, which is determined by the second device, and the challenge value belongs to the set of random values ​​determined by the first device. In a possible implementation, the first device will make the determined set of random values ​​public in a system such as the Ethereum blockchain network, and the second device can obtain the set of random values ​​from the public system, or directly receive the set of random values ​​sent by the first device.

[0123] Exemplarily, the second device randomly selects a challenge value and sends it to the first device.

[0124] S130, the first device determines n response values.

[0125] S131, the first device sends n response values, and correspondingly, the second device receives the response values.

[0126] Each of the n response values ​​is determined based on the random value, the challenge value and the plain text.

[0127] In one possible implementation, the second device selects a random number Response value Res i , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}. The second device sends all responses (ie, n response values) to the first device.

[0128] S150: The second device performs verification.

[0129] The second device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values.

[0130] Exemplarily, the second device checks whether the n response values ​​satisfy Res 1 =Res 2 =…=Res n ; If the equation holds, then r+c·M 1 =r+c·M 2 =…=r+c·M n , since the random value r and the challenge value c are consistent, we can get M 1 =M 2 =…=M n That is, when the above equation is satisfied, it means that the plaintexts contained in the n responses received by the second device are the same.

[0131] When the second device verifies that the n plaintexts corresponding to the n ciphertexts are inconsistent according to the n response values, the second device may not continue the following verification and inspection. When the second device verifies that the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values, further verification may be continued, and the following steps may be performed.

[0132] In a possible implementation, method 100 may further include the following steps:

[0133] S140: The first device determines n commitment values.

[0134] S141, the first device sends n commitment values, and correspondingly, the second device receives n commitment values.

[0135] The n commitment values ​​correspond one-to-one to the n ciphertexts. Each commitment value is determined by performing a second encryption on a random value according to the key of the corresponding ciphertext. The first encryption and the second encryption use the same algorithm.

[0136] In one possible implementation, the second encryption includes an additively homomorphic encryption algorithm.

[0137] The second encryption uses the same algorithm as the first encryption. For the description of the second encryption, refer to the description of the first encryption.

[0138] Exemplarily, the first device selects a random number And calculate n commitment values

[0139] In a possible implementation, when the second device verifies that the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values, S150, the second device performs verification, further comprising:

[0140] The second device verifies whether the i-th ciphertext is obtained from the i-th plaintext according to the i-th commitment value, the challenge value and the i-th response value, i∈{1,2,…,n}.

[0141] In one possible implementation, when the response value Res i , Commitment valueCom i , challenge value c and ciphertext C i The second device confirms that the i-th ciphertext is obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the random value according to the key of the ciphertext corresponding to the commitment value, and the third encryption and the first encryption use the same algorithm.

[0142] If the mth equation does not hold, that is, Then it can be determined that the mth ciphertext is inconsistent with the plaintext, thereby verifying which node caused the inconsistency.

[0143] Specifically, the second device receives the entire response Res i , i∈{1,2,…,n}, obtain C from the public database i , i∈{1,2,…,n}, for example, query from the blockchain, and then perform the following two steps:

[0144] (1) Whether Res is satisfied 1 =Res 2 =…=Res n , if the equation holds true, it means that the global models contained in the n responses received by the second device are the same.

[0145] (2) Whether

[0146] It should be understood that the derivation process of step (2) is

[0147] If both conditions (1) and (2) above are met, it means that the global model sent by the first device to the n local nodes is consistent, otherwise it means that it is inconsistent.

[0148] S160, the second device sends a verification result.

[0149] The second device can send a verification result to the third device, where the verification result is used to indicate whether the n plaintexts corresponding to the n ciphertexts are consistent, and / or whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0150] The verification result includes the result obtained by verification in step S150, and the result can be sent to the device that needs to use the result. The third device can be an application user, or a model verification device, etc. The third device can continue to perform operations based on the result, or stop the operation and eliminate the problem that causes the inconsistency. The third device can also perform other operations based on the verification result, which is not limited in this application.

[0151] According to the solution of the present application, an additively homomorphic asymmetric encryption algorithm is used to replace a general asymmetric encryption algorithm to meet the consistency verification equation designed subsequently and ensure the confidentiality of the model during transmission. The zero-knowledge proof idea is used to replace the current consistency verification scheme based on the hash algorithm, thereby achieving consistency verification of the distributed model ciphertext while protecting the privacy of the model, reducing verification costs and security risks.

[0152] The present application provides another consistency verification method 200, which involves a first device and a second device. The first device may be a certification device, and the second device may be a verification device. For example, the first device may be a model aggregator, and the second device may be a third-party auditing organization. Figure 4 As shown, the method 200 includes the following steps:

[0153] S210, the first device generates n ciphertexts.

[0154] S210 is consistent with step S110 in method 100 , and for a detailed description, please refer to the relevant description of S110 in method 100 .

[0155] S220: The first device determines n commitment values.

[0156] The n commitment values ​​correspond one-to-one to the n ciphertexts. Each commitment value is determined by performing a second encryption on a random value according to the key of the corresponding ciphertext. The first encryption and the second encryption use the same algorithm.

[0157] The description of the first encryption and the second encryption can refer to the relevant description above. And calculate n commitment values

[0158] S221, the first device sends n commitment values, and correspondingly, the second device receives n commitment values.

[0159] S230: The first device obtains a challenge value.

[0160] S231, the second device obtains a challenge value.

[0161] In this implementation, the commitment value is information that both the first device and the second device will obtain, and the challenge value can be determined based on the commitment value.

[0162] For example, the challenge value c=Hash(Com 1 ,Com 2 ,…,Com n ), that is, the challenge value can be determined based on n commitment values.

[0163] As another example, the challenge value c=Hash(Com 1 ,Com 2 ,…,Com n-1 ), that is, the challenge value can be determined based on the partial commitment value.

[0164] An idealized hash function can convert an input into a result with true randomness (satisfying a consistent distribution), so during the verification process, a hash function can be used on the context information contained in the device to obtain a challenge value. For example, by using a hash function on the commitment value, the commitment value can be converted into a random challenge value.

[0165] In a possible implementation, the challenge value may be determined using a commonly used cryptographic hash algorithm, such as a SHA-256 algorithm, a Keccak algorithm, and an SM3 algorithm, etc. This application does not limit this.

[0166] Since the challenge value is calculated by a hash function from the values ​​generated in some initial steps of the protocol, and the input values ​​of these generated hashes can be customized, in some implementations, the challenge value can be determined based on other customized values.

[0167] S240, the first device determines n response values.

[0168] Each response value is determined based on the random value, challenge value and plaintext.

[0169] In one possible implementation, the first device selects a random number According to the random value r, challenge value c and plaintext M i Determine the response value Res i ,Res i Meet the following conditions: Res i =r+c·M i , i∈{1,2,…,n}. The first device sends all response values ​​(ie, n response values) to the second device.

[0170] S241, the first device sends n response values, and correspondingly, the second device receives n response values.

[0171] S250: The second device performs verification.

[0172] The second device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values.

[0173] Exemplarily, the second device checks whether the n response values ​​satisfy Res 1 =Res 2 =…=Res n ; If the equation holds, then r+c·M 1 =r+c·M 2 =…=r+c·M n , since the random value r and the challenge value c are consistent, we can get M 1 =M 2 =…=Mn That is, when the above equation is satisfied, it means that the plaintexts contained in the n responses received by the second device are the same.

[0174] When the second device verifies that the n plaintexts corresponding to the n ciphertexts are inconsistent according to the n response values, the second device may not continue the following verification and inspection. When the second device verifies that the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values, further verification may be continued, and the following steps may be performed.

[0175] In a possible implementation, when the second device verifies that the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values, S250, the second device performs verification, further comprising:

[0176] The second device verifies whether the i-th ciphertext is obtained from the i-th plaintext according to the i-th commitment value, the challenge value and the i-th response value, i∈{1,2,…,n}.

[0177] In one possible implementation, when the response value Res i , Commitment valueCom i , challenge value c and ciphertext C i The second device determines that the i-th ciphertext is obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the random value according to the key of the ciphertext corresponding to the commitment value, and the third encryption and the first encryption use the same algorithm.

[0178] Specifically, the second device receives the entire response Res i , i∈{1,2,…,n}, obtain C from the public database i , i∈{1,2,…,n}, for example, query from the blockchain, and then perform the following two steps:

[0179] (1) Whether Res is satisfied 1 =Res 2 =…=Res n , if the equation holds true, it means that the global models contained in the n responses received by the second device are the same.

[0180] (2) Whether

[0181] If both conditions (1) and (2) above are met, it means that the global model sent by the first device to the n local nodes is consistent, otherwise it means that it is inconsistent.

[0182] S260: The second device sends a verification result.

[0183] The second device can send a verification result to the third device, where the verification result is used to indicate whether the n plaintexts corresponding to the n ciphertexts are consistent, and / or whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0184] The verification result includes the result obtained by verification in step S250, and the result can be sent to the device that needs to use the result. The third device can be an application user, or a model verification device, etc. The third device can continue to perform operations based on the result, or stop the operation and eliminate the problem that causes the inconsistency. The third device can also perform other operations based on the verification result, which is not limited in this application.

[0185] This application provides a non-interactive consistency proof method for scenarios where the global model aggregator and the auditing agency are not online at the same time. It supports the model aggregator to generate a proof once and send it to the auditing agency for verification without the need for real-time interaction and waiting, thereby reducing communication overhead and complexity and expanding applicable scenarios.

[0186] It should be understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. For example, S221, sending n commitment values, can be executed at the same time as S241, sending n response values, or at different times, and the present application does not limit this. For another example, for S130, determining n response values, and S140, determining n commitment values, their execution order can be exchanged, and the present application does not limit this. Any sequential arrangement that can realize the function of each step should be within the scope of protection of the present application.

[0187] According to the above method, Figure 5 A schematic diagram of a consistency verification device 300 provided in an embodiment of the present application.

[0188] like Figure 5 As shown, the device 300 may include a module or unit corresponding to the method / operation / step / action described in the method 100 or the method 200, and the module or unit may be a hardware circuit, or software, or a combination of a hardware circuit and software. In a possible implementation, the device may include a transceiver unit 310 and a processing unit 320.

[0189] In a possible design, the device 300 may correspond to the first device in the above method 100 and method 200 embodiments.

[0190] The processing unit 320 in the communication device 300 is used to generate n ciphertexts, where the n ciphertexts correspond to n nodes, each node corresponds to a key, and each ciphertext is determined by first encrypting a plaintext according to the key of the corresponding node, where n is a positive integer;

[0191] The transceiver unit 310 in the device 300 is used to obtain a challenge value; it is also used to send n response values, each response value is determined based on a random value, a challenge value and a plaintext, the random value belongs to a random value set determined by the first device, and the n response values ​​are used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

[0192] In one possible implementation, the transceiver unit 310 is also used to send n commitment values, which correspond one-to-one to n ciphertexts. Each commitment value is determined by performing a second encryption on a random value based on the key of the corresponding ciphertext. The first encryption and the second encryption use the same algorithm. The i-th commitment value is used to verify with the challenge value and the i-th response value whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

[0193] In a possible implementation, the response value Res i , Commitment valueCom i , challenge value c and ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the third encryption and the first encryption use the same algorithm.

[0194] In a possible implementation, algorithms used in the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

[0195] In one possible implementation, the additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

[0196] In a possible implementation, the response value Res i , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0197] In a possible implementation, the transceiver unit 310 is further configured to receive a challenge value sent by the second device, where the challenge value belongs to a random value set determined by the first device.

[0198] In a possible implementation manner, the processing unit 320 is further configured to determine a challenge value according to the commitment value.

[0199] The transceiver unit 310 in the communication device 300 performs the receiving and sending operations performed by the first device in the above-mentioned method embodiments, and the processing unit 320 performs operations other than the receiving and sending operations.

[0200] Exemplarily, the communication device 300 may correspond to the second device in the method 100 or the method 200 according to the embodiment of the present application, and the transceiver unit 310 in the communication device 300 is used to obtain a challenge value; and is also used to receive n response values, each response value is determined according to a random value, a challenge value and a plaintext, the random value belongs to a random value set determined by the first device, and the plaintext is used to perform a first encryption according to a key of each node in the n nodes to determine n ciphertexts, the n ciphertexts correspond to n nodes, each node corresponds to a key, and n is a positive integer;

[0201] The processing unit 320 in the communication device 300 is used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values.

[0202] In a possible implementation, the transceiver unit 310 is further configured to receive n commitment values, where the n commitment values ​​correspond one-to-one to the n ciphertexts, and each commitment value is determined by performing a second encryption on a random value according to a key of the corresponding ciphertext, and the second encryption and the first encryption use the same algorithm;

[0203] The processing unit 320 is further used to verify whether the i-th ciphertext is obtained from the i-th plaintext according to the i-th commitment value, the challenge value and the i-th response value, i∈{1,2,…,n}.

[0204] In a possible implementation, when the response value Res i , Commitment valueCom i , challenge value c and ciphertext C i The i-th ciphertext is determined to be obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the third encryption and the first encryption use the same algorithm.

[0205] In a possible implementation, algorithms used in the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

[0206] In a possible implementation, the response value Res i , random value r, challenge value c and plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0207] In a possible implementation, the processing unit 320 is configured to determine a challenge value according to the commitment value.

[0208] The transceiver unit 310 in the communication device 300 performs the receiving and sending operations performed by the second device in the above-mentioned method embodiments, and the processing unit 320 performs operations other than the receiving and sending operations.

[0209] According to the above method, Figure 6 Schematic diagram of a verification device 400 provided in an embodiment of the present application. Figure 6 As shown, the device 400 may be a first device or a second device.

[0210] The device 400 may include a processor 410 (i.e., an example of a processing unit). In a possible implementation, the device 400 also includes a memory 420. The memory 420 is used to store instructions, and the processor 410 is used to execute the instructions stored in the memory 420, so that the device 400 implements the steps performed by the first device or the second device in the method 100 or the method 200.

[0211] In a possible implementation, the device 400 may further include an interface 430 (i.e., an example of a transceiver unit module). Furthermore, the processor 410, the memory 420, and the interface 430 may communicate with each other through an internal connection path to transmit control and / or data signals. The memory 420 is used to store a computer program, and the processor 410 may be used to call and run the computer program from the memory 420 to control the interface 430 to receive a signal or send a signal to complete the steps of the first device or the second device in the above method. The memory 420 may be integrated in the processor 410, or may be provided separately from the processor 410.

[0212] In a possible implementation, if the verification device 400 is a communication device, the interface 430 is a receiver or a transmitter. The receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they may be collectively referred to as a transceiver.

[0213] In a possible implementation manner, if the verification device 400 is a chip or a circuit, the interface 430 is an input interface or the interface 430 is an output interface.

[0214] As an implementation, the function of the interface 430 may be implemented by a transceiver circuit or a dedicated transceiver chip. The processor 410 may be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.

[0215] As another implementation, it is possible to use a general-purpose computer to implement the verification device provided in the embodiment of the present application. That is, the program code that implements the functions of the processor 410 and the interface 430 is stored in the memory 420, and the general-purpose processor implements the functions of the processor 410 and the interface 430 by executing the code in the memory 420.

[0216] For the concepts, explanations, detailed descriptions and other steps involved in the device 400 and related to the technical solution provided in the embodiment of the present application, please refer to the description of these contents in the aforementioned method or other embodiments, which will not be repeated here.

[0217] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the method executed by the first device or the second device in the above method embodiment are stored.

[0218] For example, when the computer program is executed by a computer, the computer can implement the method performed by the first device or the second device in the above method embodiment.

[0219] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiment.

[0220] An embodiment of the present application also provides a consistency verification system, which communication system includes the first device and the second device in the above embodiment.

[0221] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0222] It should be understood that in the embodiments of the present application, the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0223] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0224] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital versatile disc (digital versatiledisc, DVD)), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0225] It should be understood that the term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0226] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0227] It will be appreciated by those skilled in the art that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or in combination with computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. It will be clearly understood by those skilled in the art that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. In several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, which may be electrical, mechanical or other forms.

[0228] The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, the functional units in each embodiment of the present application may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions for a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory, a random access memory, a disk or an optical disk.

[0229] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A consistency verification method, characterized in that: include: The first device generates n ciphertexts, the n ciphertexts correspond to n nodes, each node corresponds to a key, each ciphertext is determined by first encrypting a plaintext according to the key of the corresponding node, and n is a positive integer; The first device obtains a challenge value; The first device sends n response values ​​to the second device, each of the response values ​​is determined according to a random value, the challenge value and the plaintext, and the random value belongs to a set of random values ​​determined by the first device; The second device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values.

2. The method according to claim 1, characterized in that The method further comprises: The first device sends n commitment values ​​to the second device, the n commitment values ​​correspond one-to-one to the n ciphertexts, each commitment value is determined by performing a second encryption on the random value according to a key of the corresponding ciphertext, and the first encryption and the second encryption use the same algorithm; The second device verifies whether the i-th ciphertext is obtained from the i-th plaintext according to the i-th commitment value, the challenge value and the i-th response value, i∈{1,2,…,n}.

3. The method according to claim 2, characterized in that When the response value Res i , the commitment value Com i , the challenge value c and the ciphertext C i The second device determines that the i-th ciphertext is obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the algorithm used for the third encryption is the same as that used for the first encryption.

4. The method according to claim 3, characterized in that Algorithms used by the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

5. The method according to claim 4, characterized in that The additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

6. The method according to any one of claims 2 to 5, characterized in that The method further comprises: The second device sends a verification result to the third device, where the verification result is used to indicate whether the n plaintexts corresponding to the n ciphertexts are consistent, and / or whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

7. The method according to any one of claims 1 to 6, characterized in that The first device obtains a challenge value, including: the first device receives a challenge value sent by the second device, and the challenge value belongs to a random value set determined by the first device.

8. The method according to any one of claims 2 to 6, characterized in that: The first device acquires the challenge value, including: the first device determines the challenge value according to the commitment value.

9. The method according to any one of claims 1 to 8, characterized in that The response value Res i , the random value r, the challenge value c and the plaintext M i , the following conditions are met: Res i =r+c·M i ,i∈{1,2,…,n}。 10. The method according to any one of claims 1 to 9, characterized in that The plain text is a global model.

11. A consistency verification method, characterized in that: include: Generate n ciphertexts, where the n ciphertexts correspond to n nodes, each node corresponds to a key, each ciphertext is determined by first encrypting a plaintext according to the key of the corresponding node, and n is a positive integer; Get the challenge value; Send n response values, each of which is determined based on a random value, the challenge value and the plaintext, the random value belongs to a random value set determined by the first device, and the n response values ​​are used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

12. The method according to claim 11, characterized in that The method further comprises: Sending n commitment values, the n commitment values ​​corresponding one to the n ciphertexts, each commitment value being determined by performing a second encryption on the random value according to a key of the corresponding ciphertext, the first encryption and the second encryption using the same algorithm, The i-th commitment value is used to verify, together with the challenge value and the i-th response value, whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

13. The method according to claim 12, characterized in that When the response value Res i , the commitment value Com i , the challenge value c and the ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the algorithm used for the third encryption is the same as that used for the first encryption.

14. The method according to claim 13, characterized in that Algorithms used by the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

15. The method according to claim 14, characterized in that The additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

16. The method according to any one of claims 11 to 15, characterized in that Obtaining a challenge value includes: receiving a challenge value, where the challenge value belongs to a set of random values ​​determined by the first device.

17. The method according to any one of claims 12 to 15, characterized in that: Acquiring a challenge value includes: determining the challenge value according to the commitment value.

18. The method according to any one of claims 11 to 17, characterized in that The response value Res i , the random value r, the challenge value c and the plaintext M i , the following conditions are met: Res i =r+c·M i ,i∈{1,2,…,n}。 19. The method according to any one of claims 11 to 18, characterized in that The plain text is a global model.

20. A consistency verification method, characterized in that: include: Get the challenge value; Receive n response values, each of which is determined according to a random value, the challenge value, and a plaintext, the random value belonging to a set of random values ​​determined by a first device, the plaintext being used to perform a first encryption according to a key of each of the n nodes to determine n ciphertexts, the n ciphertexts corresponding to the n nodes, each node corresponding to a key, and n being a positive integer; Verify whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n response values.

21. The method according to claim 20, characterized in that The method further comprises: receiving n commitment values, the n commitment values ​​corresponding one to the n ciphertexts, each commitment value being determined by performing a second encryption on the random value according to a key of the corresponding ciphertext, the second encryption using the same algorithm as the first encryption; Verify whether the i-th ciphertext is obtained from the i-th plaintext according to the i-th commitment value, the challenge value and the i-th response value, i∈{1,2,…,n}.

22. The method according to claim 21, characterized in that When the response value Res i , the commitment value Com i , the challenge value c and the ciphertext C i When the following conditions are met, it is determined that the i-th ciphertext is obtained from the i-th plaintext: in, It represents a value determined by performing a third encryption on the i-th response value according to the key of the i-th ciphertext corresponding to the i-th response value, and the algorithm used for the third encryption is the same as that used for the first encryption.

23. The method according to claim 22, characterized in that Algorithms used by the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

24. The method according to claim 23, characterized in that The additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

25. The method according to any one of claims 21 to 24, characterized in that The method further comprises: A verification result is sent to a third device, where the verification result is used to indicate whether the n plaintexts corresponding to the n ciphertexts are consistent, and / or whether the i-th ciphertext is obtained from the i-th plaintext, i∈{1,2,…,n}.

26. The method according to any one of claims 21 to 25, characterized in that: Acquiring a challenge value includes: determining the challenge value according to the commitment value.

27. The method according to any one of claims 20 to 26, characterized in that The response value Res i , the random value r, the challenge value c and the plaintext M i , the following conditions are met: Res i =r+c·M i ,i∈{1,2,…,n}。 28. The method according to any one of claims 20 to 27, characterized in that The plain text is a global model.

29. A verification device, characterized in that: include: A module or device for implementing the method of any one of claims 11 to 19, or a module or device for implementing the method of any one of claims 20 to 28.

30. A verification device, characterized in that: include: A processor, wherein the processor is configured to execute a program or an instruction so that the apparatus executes the method according to any one of claims 11 to 19, or the apparatus executes the method according to any one of claims 20 to 28.

31. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the method according to any one of claims 1 to 10 to be executed, or enables the method according to any one of claims 11 to 19 to be executed, or enables the method according to any one of claims 20 to 28 to be executed.

32. A computer program product comprising instructions which, when executed on a computer, cause the method of any one of claims 1 to 10 to be performed, or the method of any one of claims 11 to 19 to be performed, or the method of any one of claims 20 to 28 to be performed.

Images