Communication networking method applied to federated learning

Abstract

The invention discloses a communication networking method applied to federated learning, which is used for improving the security of communication networking applied to federated learning. The scheme provided by the invention comprises the following steps: broadcasting a networking request in a to-be-grouped network constructed based on a zero-trust communication protocol, wherein the networking request carries parameters of target federated learning in which the networking request participates; a routing list fed back by anonymous networking ends in the to-be-grouped network to the networking request is obtained, the routing list comprises anonymous identity information of all anonymous networking ends participating in the target federated learning, and the anonymous identity information carries parameters of federated learning participated by the corresponding anonymous networking ends; and adding the federated learning network corresponding to the target federated learning based on the routing list.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a communication networking method applied to federated learning. Background Art

[0002] Federated Learning (FL) is a machine learning setting where multiple entity clients participating in federated learning can collaboratively solve machine learning problems under the coordination of a central server or service provider. Each client's raw data is stored locally and is not exchanged or directly transmitted, but rather targeted update iterations designed for instant aggregation are used to achieve learning goals. Federated learning has a good effect in protecting the data generated on each device by sharing model updates.

[0003] However, in the training process of applying federated learning, the communication model update may still leak sensitive information to third parties or central servers. Even if decentralized point-to-point data transmission is adopted, there is still a risk of data being intercepted and tampered during the data transmission process.

[0004] How to improve the security of communication networks used in federated learning is a technical problem to be solved by this application. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a communication networking method applied to federated learning, so as to improve the security of the communication networking applied to federated learning.

[0006] In a first aspect, a communication networking method applied to federated learning is provided, which is applied to a client participating in federated learning, including: Broadcasting a networking request in a network to be grouped based on a zero-trust communication protocol, wherein the networking request carries parameters of a target federated learning in which the network participates; Obtaining a routing list of anonymous networking terminals in the network to be grouped in response to the networking request, wherein the routing list includes anonymous identity information of each anonymous networking terminal participating in the target federated learning, and the anonymous identity information carries parameters of the federated learning in which the corresponding anonymous networking terminal participates; Join the federated learning network corresponding to the target federated learning based on the routing list.

[0007] In a second aspect, a communication networking device applied to federated learning is provided, which is applied to a client participating in federated learning, including: A broadcast module, which broadcasts a networking request in a network to be grouped based on a zero-trust communication protocol, wherein the networking request carries parameters of the target federated learning in which the network participates; An acquisition module is provided to acquire a routing list of anonymous networking terminals in the network to be grouped in response to the networking request, wherein the routing list includes anonymous identity information of each anonymous networking terminal participating in the target federated learning, and the anonymous identity information carries parameters of the federated learning in which the corresponding anonymous networking terminal participates; A networking module joins the federated learning network corresponding to the target federated learning based on the routing list.

[0008] According to a third aspect, an electronic device is provided. The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the method according to the first aspect are implemented.

[0009] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method according to the first aspect are implemented.

[0010] In a fifth aspect, a computer program product is provided, the computer program product comprising a non-transitory computer-readable storage medium storing a computer program, the computer program being operable to cause a computer to execute part or all of the steps of the method of the first aspect.

[0011] In an embodiment of the present application, first, a networking request is broadcast in a network to be grouped that is constructed based on a zero-trust communication protocol, and the networking request carries the parameters of the target federated learning in which it participates. Then, a routing list of the anonymous networking end in the network to be grouped is obtained to feedback the networking request, and the routing list includes the anonymous identity information of each anonymous networking end participating in the target federated learning, and the anonymous identity information carries the parameters of the federated learning in which the corresponding anonymous networking end participates. Next, the federated learning network corresponding to the target federated learning is joined based on the routing list. Through the scheme provided in the embodiment of the present application, the federated learning network corresponding to the target federated learning in which it participates can be joined in the network to be grouped through an anonymous identity. Among them, the anonymous identity information carries the parameters of the federated learning in which it participates, and can express the characteristics of the federated learning in which it participates while concealing the identity information, thereby ensuring that other clients participating in the target federated learning join the same network. Thereby ensuring that the client joins the federated learning network with an anonymous identity, concealing the sensitive identity of the client while realizing federated learning, is conducive to improving the communication networking security of federated learning and improving the data transmission security in the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1It is a schematic diagram of a scenario of a secure computing environment isolated from an untrusted environment in one embodiment of the present application; Figure 2 is a schematic diagram of a model inversion attack and a reconstruction attack in one embodiment of the present application; Figure 3 This is one of the flow charts of a communication networking method applied to federated learning in one embodiment of the present application; Figure 4 This is a second flow chart of a communication networking method applied to federated learning in an embodiment of the present application; Figure 5 This is a flowchart of a communication networking method for federated learning according to an embodiment of the present application; Figure 6 This is a fourth flow chart of a communication networking method applied to federated learning in an embodiment of the present application; Figure 7 This is a schematic diagram of an application scenario of a communication networking method applied to federated learning in an embodiment of the present application; Figure 8 This is a flowchart of a communication networking method for federated learning according to an embodiment of the present application; Fig. 9 It is a schematic diagram of the interaction process between a data request end and a data response end of a communication networking method applied to federated learning in an embodiment of the present application; Fig.10 This is the sixth flow chart of a communication networking method applied to federated learning in an embodiment of the present application; Fig.11 This is the seventh flow chart of a communication networking method applied to federated learning in an embodiment of the present application; Fig.12 This is a flowchart of a communication networking method for federated learning according to an embodiment of the present application; Fig.13 This is a ninth flowchart of a communication networking method for federated learning according to an embodiment of the present application; Fig.14 It is a structural diagram of a communication networking device applied to federated learning in one embodiment of the present application. DETAILED DESCRIPTION

[0013] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. The numbering of the drawings in this application is only used to distinguish the various steps in the scheme, and is not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0014] To address the risks of privacy leakage and data abuse involving data sharing technologies, security can be improved by using trusted computing based on hardware trusted execution environment (TEE) technology or homomorphic encryption (HE) based on cryptography.

[0015] Among them, TEE can specifically provide a secure computing environment isolated from an untrusted environment. This isolation and trusted verification mechanism provides a basis for implementing trusted computing, such as Figure 1 As shown. The TEE can be implemented based on hardware, such as IntelSGX, AMD SEV, ARM TrustZone, and RISC-V Keystone. TEE can also be constructed based on virtualization technology, such as Microsoft's VSM, Intel's Trusty for iKGT&ACRN, but they cannot yet match the security of hardware TEE. Specifically, TEE requires a specific processor chip that supports the hardware trusted execution environment, which limits the popularity and application scope of TEE technology. In addition, the development and deployment of TEE is relatively complex, requiring professional knowledge and skills, and the development and implementation costs are high. In addition, the encryption and isolation mechanisms of TEE may cause performance overhead, which has a negative impact on computing and response time.

[0016] HE is a special encryption technology that allows computing operations to be performed in an encrypted state without decrypting the data. This means that operations can be performed on encrypted data and the results are still encrypted, and the correct results can only be obtained after decryption.

[0017] If the above HE or Secure Multi-Party Computation (SMPC) technology is used, in actual applications, multiple participants will be allowed to calculate on encrypted data without mutual trust. Each participant can obtain the calculation results without obtaining the private input of other participants, and can perform more complex function calculations on the encrypted result set data. With the help of the above technology, the risk of privacy data leakage in the field of machine learning can be reduced to a certain extent, but it still cannot completely solve privacy leakage attacks such as reconstruction attacks and model inversion attacks. The schematic diagram of model inversion attack and reconstruction attack is shown in the figure. Figure 2 As shown in the figure, the original data of privacy may be obtained through model inversion attack and reconstruction attack. Therefore, there is still a risk of data leakage.

[0018] The above-mentioned TEE and HE are both designed to protect the security of the data itself, ensuring that the data will not be accessed or tampered with without authorization during use and processing. However, these two solutions do not involve protection in the data transmission stage and cannot prevent data leakage during the transmission stage.

[0019] In order to solve the problems existing in the related technology, the embodiment of the present application provides a communication networking method applied to federated learning, which can be applied to clients participating in federated learning, realize anonymous communication among federated learning participants, effectively improve the security of data communication during the federated learning process, and facilitate the security and reliability of the federated learning data exchange process.

[0020] The solution provided in the embodiment of the present application can be applied to application scenarios involving federated learning in various fields. The solution can realize federated learning networking, which can be used for federated learning modeling data exchange and calculation, and can support both horizontal federation and vertical federation. The solution provided in the embodiment of the present application can provide a more reliable and secure data transmission solution for the development of federated learning, which is conducive to promoting the promotion and application of federated learning technology in practical applications.

[0021] The present application embodiment provides a communication networking method applied to federated learning, such as Figure 3 As shown, it is applied to clients participating in federated learning, including: S31: Broadcasting a networking request in the network to be grouped that is built based on the zero-trust communication protocol, where the networking request carries parameters of the target federated learning in which the network participates.

[0022] The above zero-trust communication protocol is a dedicated network communication protocol based on the Zero Trust Architecture (ZTA). It can be effectively applied to federated learning scenarios as a dedicated channel for machine learning data interaction across vertical fields. The protocol takes protecting data privacy and ensuring security as its core principles, and aims to solve the security and privacy protection challenges faced by traditional communication protocols in cross-domain data interaction.

[0023] The zero-trust communication protocol should adopt a zero-trust security model to ensure that both parties in communication are safe and reliable. During the interaction process, verification and authorization must be performed at every stage of data interaction. Any data transmission needs to undergo strict identity authentication and access control to ensure that only authorized users or devices can access and transmit data. This zero-trust model effectively prevents the risk of unauthorized access and data leakage.

[0024] The network protocol follows the following basic principles: From a spatial perspective, all users who use this protocol to communicate are untrustworthy (hereinafter referred to as the security boundary principle); from a temporal perspective, the security of each user also changes dynamically (hereinafter referred to as the risk adaptation principle); any access subject must undergo identity authentication and authorization before access is allowed (hereinafter referred to as the least privilege principle).

[0025] In a network based on a zero-trust communication protocol, it may be difficult for the two parties that need to communicate to quickly locate each other. Based on this, while ensuring security through a zero-trust communication protocol, it is also necessary to adapt feasible fast addressing technology. In practical applications, Internet Protocol (IP) technology can be used to provide addressing, routing, data segmentation and reassembly functions to ensure that data packets can be forwarded from one network to another.

[0026] The above-mentioned IP technology specifically performs MAC address mapping through IP subnet division and ARP protocol. It does not check or send back confirmation regardless of whether the transmitted datagram is correct or not, and does not have flow control and error control functions. This characteristic of IP protocol provides the main framework of transmission function at the network layer, and users can add necessary functions to a given application at the transport layer as needed, so the maximum transmission efficiency can be achieved. However, this transmission mode has certain security risks. For example, the forgery of IP address is a common problem. An attacker can cheat or tamper with IP address to implement cheating, denial of service or other malicious activities. In addition, the IP protocol itself lacks encryption and identity authentication mechanisms, which easily leads to the risk of information leakage and eavesdropping. It can be seen that how to ensure that both parties of network layer communication can quickly locate each other while also ensuring that the communication process is safe, reliable and cannot be replayed is a technical problem to be solved in the embodiment of the present application.

[0027] In this step, the client participating in the federated learning broadcasts a networking request in the to-be-grouped network built based on the zero-trust communication protocol, and the networking request carries the parameters of the target federated learning that the client participates in. The parameters of the target federated learning may include general parameter information of the target federated learning, for example, at least one of the following information: the industry to which the user belongs, the model structure, the type of optimization algorithm used, the type of loss function, etc.

[0028] Among them, since the parameters of the federated learning in the embodiment of the present application are common industry parameters and federated learning model parameters, the user's unique privacy attributes will not be exposed when the parameters are used to classify users. An anonymous user in the network to be grouped sends a networking request in the form of network broadcast, thereby seeking responses from other clients with the same parameters in the network to be grouped.

[0029] S32: Obtain a routing list of anonymous networking terminals in the network to be grouped in response to the networking request, wherein the routing list includes anonymous identity information of each anonymous networking terminal participating in the target federated learning, and the anonymous identity information carries parameters of the federated learning in which the corresponding anonymous networking terminal participates.

[0030] Other clients participating in the above target federated learning respond to the networking request in the above step and provide a routing list. In this step, the routing list is obtained and stored and updated locally. In a network, the routing lists obtained by all users with the same federated parameters can be guaranteed to be updated in real time and consistent with each other through broadcasting and local updates.

[0031] For example, if the network of the target federated learning has not yet been established, then based on the above networking request, at least one client participating in the target federated learning can feedback a routing list with its own anonymous identity information to the client executing the main body of this instance. Then, through broadcasting and updating, the routing list includes at least the client executing the main body of this instance and the client that feedbacks the routing list. On this basis, if information is received from other clients based on the above networking request, the routing list is further broadcast and updated to ensure that the routing lists of each client in the network are updated in real time and the content is consistent.

[0032] S33: Join the federated learning network corresponding to the target federated learning based on the routing list.

[0033] In this step, each client that is based on the above routing list and the parameters of the target federated learning can jointly achieve networking. This solution can use the parameters of the target federated learning as anonymous identities for networking. On the one hand, it can hide its own sensitive information and ensure identity security, and on the other hand, it can characterize the characteristics of the target federated learning. By broadcasting requests and updating routing lists, it can achieve joint networking with other clients participating in the target federated learning.

[0034] Through the solution provided by the embodiment of the present application, it is possible to join the federated learning network corresponding to the target federated learning in which one participates through an anonymous identity in the network to be grouped. Among them, the anonymous identity information carries the parameters of the federated learning in which one participates, and can express the characteristics of the federated learning in which one participates while concealing the identity information, thereby ensuring that other clients participating in the target federated learning join the same network. This ensures that the client joins the federated learning network with an anonymous identity, conceals the sensitive identity of the client while implementing federated learning, and is conducive to improving the communication network security of federated learning and improving the data transmission security in the network.

[0035] The federated learning network constructed by the embodiment of the present application is a confusion network. In the confusion network, the universal federated learning parameters contained in the user's temporary identity information are public, which can realize the federated learning common networking while protecting the privacy of the client's real sensitive information. Optionally, the division of parameter levels in the network also needs to avoid too large a user volume in the same autonomous network and too high a routing matching delay, so as to achieve the effect of ensuring the efficiency of routing matching.

[0036] In terms of routing list updates, an efficient routing update mechanism is needed to ensure the real-time and consistency of routing lists. In actual application scenarios, users of federated learning business scenarios are often enterprise users with data modeling needs. These enterprises may be physically dispersed, but routing updates are usually not very frequent. Therefore, in terms of routing protocols, internal gateway protocols and external gateway protocols can be combined to dynamically adjust routing addressing rules according to different user states.

[0037] Optionally, when the client first accesses the network, the Exterior Gateway Protocol (EGP) is used to obtain a routing list of all users with the same zero-trust protocol parameters as the client. Thus, grouping and networking are completed between users based on this routing list.

[0038] Optionally, after the networking is completed, in the subsequent data communication process, in order to avoid too many users in the same autonomous system (Autonomous System, AS) divided by matching parameters, the Open Shortest Path First (OSPF) protocol with better internal gateway addressing can be switched to routing addressing.

[0039] In terms of security, for clients in the network, the host security can be further improved by converging the communication ports. Optionally, to prevent malicious users from using anonymous identities to launch denial of service attacks, the zero-trust protocol only reserves a random port for receiving address knock broadcast messages from other hosts in the autonomous system (i.e., the communication requests sent by the data request end in the following text).

[0040] In addition, in terms of performance, considering that the business scenario of federated learning multi-party data modeling has high requirements for data transmission speed and can tolerate small deviations in data integrity and data sorting, it is optional to use the lightweight User Datagram Protocol (UDP) for data transmission.

[0041] Through the solution provided by the above embodiment of the present application, the requirements of federated learning networking can be realized on the basis of concealing the real privacy identity information of the client. In order to further improve the security of federated learning networking, prevent malicious users from using the anonymous characteristics of confusing network user identities to carry out worm attacks or DDoS attacks, and ensure that both parties in communication can achieve data transmission, in the solution provided by the embodiment of the present application, the data request end and the data response end are authenticated and confirmed, and then a communication connection for realizing federated learning data transmission is established.

[0042] Based on the solution provided in the above embodiment, optionally, the client is a data requesting end. Figure 4 As shown, after the above step S33, that is, after joining the federated learning network corresponding to the target federated learning based on the routing list, it also includes: S41: Sending a communication request to each anonymous networking end in the federated learning network, wherein the communication request carries first identity verification information associated with the data response end and a temporary communication address of the data request end.

[0043] In this step, the data requesting end may send a communication request to each anonymous networking end in the federated learning network in which it is located in the form of broadcast, or may send a communication request to each anonymous networking end based on the routing list of the federated learning network.

[0044] Among them, the communication request carries the first identity verification information associated with the known data response end, and the first identity verification information can be obtained in advance by the data request end from the data response end. For example, the above identity verification information can be obtained by offline information exchange, online encrypted interaction, etc.

[0045] The temporary communication address may specifically be the address of the communication port of the data requesting end, which is used to perform identity verification interaction with the data responding end that needs to perform data interaction and to perform data transmission after the identity verification is passed.

[0046] By sending a communication request carrying the first identity verification information and the temporary communication address, the data response end can be requested to perform identity verification on the above-mentioned first identity verification information, and then communicate with the data request end through the above-mentioned temporary communication address after the identity verification passes.

[0047] S42: If response information carrying second identity verification information fed back to the temporary communication address is received, verify the second identity verification information.

[0048] If response information carrying the second identity verification information is received and fed back to the temporary communication address, it indicates that the data responding end has verified the first identity information and fed back the second identity verification information so that the data requesting end can verify the identity of the data responding end.

[0049] In this step, receiving the response information from the temporary communication address can ensure that the client sending the response information is a client in the federated learning network, that is, participating in the target federated learning together with the data requesting end. Moreover, based on the second identity verification information, the identity of the data responding end can be further verified to ensure that the other end performing the communication is the data responding end that the data requesting end intends to perform the communication with.

[0050] The second identity verification information may be information provided in advance by the data request end to the data response end to characterize the identity of the data response end. Optionally, the second identity information and the first identity information may be information exchanged in advance between the data request end and the data response end.

[0051] S43: If the verification passes, a temporary communication connection is established with the port that sends the response information, and the temporary communication connection is used to transmit the federated learning data associated with the data response end.

[0052] If the verification passes, a temporary communication connection is established with the port that sends the above-mentioned response information to realize the communication connection between the data request end and the data response end, and then the federated learning data is transmitted through the temporary communication connection, thereby effectively improving the security of the federated learning data during the transmission process.

[0053] Through the solution provided in the embodiment of the present application, the first identity verification information sent by the data request end can facilitate the data response end to perform identity verification on the data request end, and the second identity verification information sent by the data response end can facilitate the data request end to perform identity verification on the data response end, thereby realizing point-to-point identity verification in the anonymous identity federated learning network, and then establishing a temporary communication connection with high security, thereby improving the security during data transmission.

[0054] Based on the solution provided in the above embodiment, optionally, Figure 5 As shown, before the above step S41, that is, before sending a communication request to each anonymous networking end in the federated learning network, it also includes: S51: Use a known data response end public key to encrypt a known data response end service password to obtain the first identity verification information.

[0055] S52: Generate the communication request based on the first identity verification information and the temporary communication address of the data requesting end.

[0056] In the solution provided in the embodiment of the present application, identity encryption verification is performed based on a key pair, wherein the data request end and the data response end can provide their own service password and public key to the other party in advance so that the other party can generate identity verification information.

[0057] In the present application example, the data request end uses the public key provided in advance by the data response end to encrypt the service password of the data response end to obtain the first identity verification information. Then, a communication request containing the first identity verification information and the temporary communication address is generated so that the data response end can use its own private key to perform decryption verification on the first identity verification information. Among them, the public key provided by the data response end to the data request end that needs to perform communication and the private key used by itself to perform decryption are a pair of key pairs, so that the data response end can use its own stored private key to perform decryption verification after receiving the first identity verification information to verify the identity of the data request end.

[0058] Based on the solution provided in the above embodiment, optionally, Figure 6 As shown, in the above step S42, performing verification on the second identity verification information includes: S61: Use its own private key to perform decryption verification on the second identity verification information.

[0059] In the solution provided in the embodiment of the present application, the data requesting end provides its own public key and its own service password to the data responding end in advance, so that the data responding end can use the public key of the data requesting end to encrypt the service password of the data requesting end to obtain the second identity verification information.

[0060] In this step, the data request end uses its own private key to perform decryption verification on the second identity verification information. Since the public key provided in advance by the data request end to the data response end and the private key used to decrypt the second identity verification information are a key pair, the second identity verification information can be effectively verified.

[0061] Wherein, in the above step S43, if the verification is passed, a temporary communication connection is established with the port that sends the response information, including: S62: If the service password obtained by decrypting the second identity verification information matches the own service password, a temporary communication connection is established with the port that sends the response information.

[0062] In this step, the data requesting end uses its own private key to decrypt the second identity verification information, and performs a matching verification on the decrypted service password and its own service password. If they match, it can be determined that the other end sending the second identity verification information is the data responding end that has exchanged identity verification information in advance, and then a temporary communication connection is established with the port sending the response information to transmit data associated with the data responding end.

[0063] The present invention is further described below with reference to an example.

[0064] The solution provided in the embodiment of the present application can be used to implement one-way addressing in anonymous identity networking, thereby establishing a temporary and secure communication connection.

[0065] Figure 7 The following is a schematic diagram of an application scenario of the method provided in the embodiment of the present application, assuming that participants A, B and users in the same network segment are all in the same federated learning network. This solution is implemented by the following steps: Step 1: Participant A (e.g., data requester) and participant B (e.g., data responder) who need to communicate data exchange communication keys offline. The communication keys specifically include their own service password and their own public key so that the other party can generate identity verification information.

[0066] Step 2: The data request end and the data response end respectively generate anonymous identities through the scheme provided by any of the above embodiments, using the obfuscated network technology, so as to participate in the federated learning network with anonymous identities. After entering the federated learning network, any anonymous participant does not need to open the communication port, reducing the risk of malicious attacks faced by the anonymous end.

[0067] Step 3: The data request end uses the pre-acquired public key of the data response end to encrypt the service password of the data response end to obtain the first identity verification information. Thus, a communication request carrying the first identity verification information and a temporary communication address is generated, and a one-way addressing broadcast is initiated in the federated learning network, so that each anonymous user in the network can receive the above communication request.

[0068] Step 4: The data responder can use any random port to receive the above communication request, use its own private key to perform decryption verification on the first identity verification information, and match and verify the service password therein. After the verification is passed, the second identity verification information is generated based on the public key and service password pre-provided by the data requester, and its own communication port is opened to send a response message carrying the second identity verification information to the temporary communication address carried in the communication request, thereby responding to the above addressing broadcast.

[0069] Step 5: After receiving the above response information, the data request end uses its own private key to perform decryption verification on the second identity verification information, and matches and verifies the service password therein. After the verification is passed, data communication is performed using a temporary address through an open temporary port.

[0070] Through the solution provided by the embodiment of the present application, the security of data communication is effectively improved based on the obfuscated network technology and the one-way addressing technology. Among them, the obfuscated network technology is used to realize the anonymous networking of the two communicating parties, and the one-way addressing technology can be used to locate the legitimate target user after the anonymous networking is completed, so that the two communicating parties can complete on-demand communication.

[0071] Based on the solution provided in the above embodiment, optionally, in the above step S41, sending a communication request to each anonymous networking terminal in the federated learning network includes: The communication request is sent to each anonymous networking end in the federated learning network through multicast based on the routing list; or the communication request is broadcast in the federated learning network.

[0072] In the solution provided by the embodiment of the present application, when all anonymous users in the network have a complete routing list, multicast transmission can be achieved without pointing to a specific port. Alternatively, the transmission can be performed by broadcasting in the network. By multicasting or broadcasting, the mailbox 163 can be logged in to send a communication request to each anonymous end in the network, so as to find the data response end in a one-way manner.

[0073] Based on the solution provided in the above embodiment, optionally, Figure 8 As shown, the method also includes: S81: After the transmission of the federated learning data through the temporary communication connection is completed, an end communication identifier is sent through the temporary communication connection.

[0074] In the solution provided by the embodiment of the present application, after the federated learning data transmission is completed, the data request end and the data response end end the communication by exchanging identifiers. This ensures that temporary communication is only used to transmit trusted data between two ends with verified identities, reduces the risk of malicious attacks, and reduces the risk of data leakage.

[0075] In this step, an end communication identifier is sent through the temporary communication connection for transmitting federated learning data. The end communication identifier is used to indicate that the data requesting end has completed the data transmission required for this temporary communication connection, so that the data responding end can confirm whether to end this temporary communication connection.

[0076] S82: If a confirmation callback identifier fed back based on the communication end identifier is received, the temporary communication connection is ended.

[0077] If the confirmation callback identifier of the data response end is received, it indicates that the data response end has also completed the data transmission required for this temporary communication connection. After receiving the confirmation callback identifier, the data request end can end this temporary communication connection.

[0078] See also Fig. 9 , the interaction process between the data request end and the data response end is as follows: ① The two communicating parties exchange service passwords and public keys in advance; ② The two communicating parties generate anonymous identities and complete the networking through obfuscation network technology. At this time, no communication ports need to be opened; ③The requester uses the public key to encrypt the service password and generate a temporary communication address to construct a communication request.

[0079] ④ Perform multicast according to the routing list in the obfuscated network. Since all users have a complete routing list, sending multicast messages no longer needs to point to a specific port; ⑤After receiving the multicast message (any random port can be used to receive multicast information), the responder uses the private key to decrypt and verify the service password; ⑥ After the verification is passed, the responder opens the communication port and returns the requester's service password encrypted with the public key through the temporary address for the requester to confirm. After the requester passes the verification, the port is opened for data communication; ⑦ After the data transmission is completed, the requester sends a communication end mark. After receiving the confirmation callback, both parties close the port and the data communication ends.

[0080] Through the solution provided by the embodiment of the present application, one-way addressing can be achieved in a confused network with anonymous identities, thereby building an end-to-end temporary communication connection, effectively improving the security of federated learning data transmission. After the data transmission is completed, the temporary communication connection is ended by exchanging identifiers, reducing the risk of attacks in the network and improving the overall security of data interaction.

[0081] Next, the solution provided by the embodiment of the present application is introduced from the data response end.

[0082] Based on the solution provided in the above embodiment, optionally, the client is a data responder; like Fig.10 As shown, after the above step S33, that is, after joining the federated learning network corresponding to the target federated learning based on the routing list, it also includes: S101: If a communication request carrying first identity verification information and a temporary communication address is received in the federated learning network, the first identity verification information is verified.

[0083] The first identity verification information may be information provided in advance by the data responding end to the data requesting end. For example, the identity verification information may be obtained by exchanging information offline, or by encrypted online interaction.

[0084] S102: If the verification passes, a response message carrying the second identity verification information is fed back to the temporary communication address, and the response message is used to establish a temporary communication connection with the port that sends the communication request, and the temporary communication connection is used to transmit the federated learning data associated with the data response end.

[0085] The first identity verification information sent by the data request end can facilitate the data response end to perform identity verification on the data request end, and the second identity verification information sent by the data response end can facilitate the data request end to perform identity verification on the data response end, thereby realizing point-to-point identity verification in the anonymous identity federated learning network, and then establishing a temporary communication connection with high security, thereby improving the security during data transmission.

[0086] Based on the solution provided in the above embodiment, optionally, Fig.11 As shown, in the above step S101, the first identity verification information is verified, including: S111: Use its own private key to decrypt the first identity verification information.

[0087] In the solution provided in the embodiment of the present application, identity encryption verification is performed based on a key pair, wherein the data request end and the data response end can provide their own service password and public key to the other party in advance so that the other party can generate identity verification information.

[0088] In the example of the present application, the data response end uses the public key provided in advance by the data request end to perform decryption verification on the service password of the data request end. Among them, the public key provided in advance by the data response end to the data request end that needs to perform communication and the private key used by itself to perform decryption are a pair of key pairs, so that the data response end can perform decryption verification using its own stored private key after receiving the first identity verification information to verify the identity of the data request end.

[0089] Wherein, in the above step S102, if the verification is passed, a response message carrying the second identity verification information is fed back to the temporary communication address, including: S112: If the service password obtained by decrypting the first identity verification information matches the data request end service password of the data request end, a response message carrying the second identity verification information is fed back to the temporary communication address.

[0090] In this step, the data responding end uses its own private key to decrypt the first identity verification information, and performs matching verification on the decrypted service password and its own service password. If they match, it can be determined that the other party sending the first identity verification information is the data requesting end that has exchanged identity verification information in advance, and then a temporary communication connection is established to transmit the data required for the federal data.

[0091] Based on the solution provided in the above embodiment, optionally, Fig.12 As shown, in the above step S112, if the service password obtained by decrypting the first identity verification information matches the data request end service password of the data request end, then feedback of response information carrying the second identity verification information to the temporary communication address includes: S121: If the service password obtained by decrypting the first identity verification information matches its own service password, the known data request end service password is encrypted using a known data request end public key to obtain second identity verification information, and a response message carrying the second identity verification information is fed back to the temporary communication address.

[0092] In this step, the data responding end uses its own private key to decrypt the first identity verification information, and performs matching verification on the decrypted service password and its own service password. If they match, it can be determined that the other end sending the first identity verification information is the data requesting end that has previously exchanged identity verification information, and then the known data requesting end service password is encrypted using the known data requesting end public key to obtain the second identity verification information.

[0093] In the present application example, after the data responding end verifies the first identity verification information, it uses the public key provided in advance by the data requesting end to encrypt the service password of the data requesting end to obtain the second identity verification information. Then, it sends a response message carrying the second identity verification information to the data requesting end so that the data requesting end can use its own private key to perform decryption verification on the second identity verification information, and then establishes a temporary communication connection after the identity verification on both ends passes, so as to transmit the data required for federated learning through a secure connection.

[0094] Based on the solution provided in the above embodiment, optionally, Fig.13 As shown, it also includes: S131: If an end communication identifier sent based on the temporary communication connection is received, check whether the federated learning data has been transmitted.

[0095] S132: If the transmission is completed, a confirmation callback identifier is fed back based on the communication end identifier, and the temporary communication connection is ended.

[0096] In the solution provided by the embodiment of the present application, after the federated learning data transmission is completed, the data request end and the data response end end the communication by exchanging identifiers. This ensures that temporary communication is only used to transmit trusted data between two ends with verified identities, reduces the risk of malicious attacks, and reduces the risk of data leakage.

[0097] In this step, the data request end terminal receives the communication end identifier sent by the temporary communication connection, and the communication end identifier is used to indicate that the data request end has completed the data transmission required for this temporary communication connection, so that the data response end can confirm whether to end this temporary communication connection.

[0098] If the data response end has also completed the data transmission required this time, it will feedback a confirmation callback identifier and end the temporary communication connection at its end.

[0099] Through the solution provided in the embodiment of the present application, after the data transmission is completed, the temporary communication connection is ended by exchanging identifiers, thereby reducing the risk of attacks in the network and improving the overall security of data interaction.

[0100] Through the solution provided by the above-mentioned embodiments of the present application, obfuscated network technology is adopted, and IP protocol addressing is no longer relied on. Instead, anonymous identity networking is used to temporarily establish a communication connection based on identity authentication, thereby effectively improving the identity security of the networking client and the security of data transmission.

[0101] Among them, anonymous identities are generated based on federated learning parameters, which can represent the characteristics of the participating federated learning while protecting the identity privacy information, so that multiple clients participating in the same federated learning can join the same federated learning network and maintain their privacy identities within the network, thereby improving identity privacy security on the basis of realizing the networking required for federated learning.

[0102] Among them, this solution uses one-way addressing to verify identities and establish temporary communication connections in the federated learning network, effectively improving the security of data transmission. This one-way addressing technology ensures that the identities of both parties in each data communication are legal and valid, and avoids the leakage of user sensitive information, reduces the exposure of information, and ensures that users will not be subject to additional network attacks. In addition, after the federated learning data transmission is completed, the temporary communication connection is disconnected by exchanging identifiers to prevent the established connection from being maliciously attacked, effectively improving the overall security of communication within the network.

[0103] In the solution provided in the embodiment of the present application, data exchange for machine learning data modeling is performed based on a zero-trust protocol, combined with homomorphic encryption and secure multi-party computing technology, which can effectively prevent privacy leakage attacks such as reconstruction attacks, model inversion attacks, and member reasoning attacks.

[0104] In addition, in the solution provided by the embodiment of the present application, the one-way addressing technology based on the zero-trust protocol has important commercial value in network communication. First, the technology provides a high degree of data security and privacy protection, enabling enterprises to maintain a high degree of trust in data interactions across vertical fields. By using anonymous address pairs for data communication, enterprises can establish connections without exposing their true identities and communication parameters, effectively preventing unauthorized access and data leakage.

[0105] Secondly, the one-way addressing technology based on the zero-trust protocol is flexible and scalable, and can adapt to the data interaction needs of different vertical fields. Whether in the financial field, medical field or industrial control field, enterprises can use this technology to achieve secure data transmission and sharing. This enables enterprises to carry out business cooperation and data cooperation more efficiently, and improve work efficiency and business innovation capabilities.

[0106] In addition, one-way addressing technology based on zero-trust protocols can also reduce the network security and privacy protection costs of enterprises. Traditional network communication protocols require a lot of manpower and resources to ensure data security and privacy protection, while one-way addressing technology based on zero-trust protocols can achieve secure data transmission and privacy protection in a simplified and automated manner, reducing the security management costs and risks of enterprises.

[0107] The embodiment of the present application also provides a communication networking device 140 for federated learning, which is applied to a client participating in federated learning, such as Fig.14 As shown, including: A broadcast module 141 broadcasts a networking request in a network to be grouped based on a zero-trust communication protocol, wherein the networking request carries parameters of a target federated learning in which the network participates; An acquisition module 142 is configured to acquire a routing list of anonymous networking terminals in the network to be grouped in response to the networking request, wherein the routing list includes anonymous identity information of each anonymous networking terminal participating in the target federated learning, and the anonymous identity information carries parameters of the federated learning in which the corresponding anonymous networking terminal participates; The networking module 143 joins the federated learning network corresponding to the target federated learning based on the routing list.

[0108] Through the device provided by the embodiment of the present application, it is possible to join the federated learning network corresponding to the target federated learning in which the client participates through an anonymous identity in the network to be grouped. Among them, the anonymous identity information carries the parameters of the federated learning in which the client participates, and can express the characteristics of the federated learning in which the client participates while concealing the identity information, thereby ensuring that the client joins the same network as other clients participating in the target federated learning. This ensures that the client joins the federated learning network with an anonymous identity, conceals the sensitive identity of the client while implementing federated learning, and is conducive to improving the communication network security of federated learning and improving the data transmission security in the network.

[0109] Among them, the above modules in the device provided by the embodiment of the present application can also implement the method steps provided by the above method embodiment. Alternatively, the device provided by the embodiment of the present application can also include other modules in addition to the above modules to implement the method steps provided by the above method embodiment. And the device provided by the embodiment of the present application can achieve the technical effects that can be achieved by the above method embodiment.

[0110] Preferably, an embodiment of the present application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned communication networking method embodiment for federated learning are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0111] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned communication networking method embodiment for federated learning is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0112] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to execute part or all of the steps of the above-mentioned communication networking method embodiment applied to federated learning, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0113] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0114] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0115] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0116] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0117] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0118] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0119] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0120] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0121] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0122] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A communication networking method for federated learning, characterized in that: Applicable to clients participating in federated learning, including: Broadcasting a networking request in a network to be grouped based on a zero-trust communication protocol, wherein the networking request carries parameters of a target federated learning in which the network participates; Obtaining a routing list of anonymous networking terminals in the network to be grouped in response to the networking request, wherein the routing list includes anonymous identity information of each anonymous networking terminal participating in the target federated learning, and the anonymous identity information carries parameters of the federated learning in which the corresponding anonymous networking terminal participates; Join the federated learning network corresponding to the target federated learning based on the routing list.

2. The method according to claim 1, characterized in that The client is a data requesting end; After joining the federated learning network corresponding to the target federated learning based on the routing list, the method further includes: Sending a communication request to each anonymous networking end in the federated learning network, wherein the communication request carries the first identity verification information associated with the data responding end and the temporary communication address of the data requesting end; If a response message carrying the second identity verification information fed back to the temporary communication address is received, verifying the second identity verification information; If the verification passes, a temporary communication connection is established with the port that sends the response information, and the temporary communication connection is used to transmit the federated learning data associated with the data response end.

3. The method according to claim 2, characterized in that Before sending a communication request to each anonymous networking end in the federated learning network, the method further includes: Using a known data response end public key to encrypt a known data response end service password to obtain the first identity verification information; The communication request is generated based on the first identity verification information and a temporary communication address of the data requesting end.

4. The method according to claim 2, characterized in that Performing verification on the second identity verification information includes: Using its own private key to perform decryption verification on the second identity verification information; If the verification is passed, a temporary communication connection is established with the port that sends the response information, including: If the service password obtained by decrypting the second identity verification information matches its own service password, a temporary communication connection is established with the port that sends the response information.

5. The method according to any one of claims 2 to 4, characterized in that: Sending a communication request to each anonymous networking end in the federated learning network includes: Sending the communication request to each anonymous networking end in the federated learning network by multicast based on the routing list; or, The communication request is broadcasted in the federated learning network.

6. The method according to any one of claims 2 to 4, characterized in that: Also includes: After the transmission of the federated learning data through the temporary communication connection is completed, sending an end communication identifier through the temporary communication connection; If a confirmation callback identifier fed back based on the communication termination identifier is received, the temporary communication connection is terminated.

7. The method according to claim 2, characterized in that The client is a data response end; After joining the federated learning network corresponding to the target federated learning based on the routing list, the method further includes: If a communication request carrying first identity verification information and a temporary communication address is received in the federated learning network, verifying the first identity verification information; If the verification passes, a response message carrying the second identity verification information is fed back to the temporary communication address, and the response message is used to establish a temporary communication connection with the port that sends the communication request, and the temporary communication connection is used to transmit the federated learning data associated with the data response end.

8. The method according to claim 7, characterized in that Performing verification on the first identity verification information includes: Decrypting the first identity verification information using its own private key; If the verification is successful, a response message carrying the second identity verification information is fed back to the temporary communication address, including: If the service password obtained by decrypting the first identity verification information matches the own service password, response information carrying the second identity verification information is fed back to the temporary communication address.

9. The method according to claim 8, characterized in that If the service password obtained by decrypting the first identity verification information matches its own service password, feeding back response information carrying the second identity verification information to the temporary communication address, including: If the service password obtained by decrypting the first identity verification information matches its own service password, the known data request end service password is encrypted using the known data request end public key to obtain the second identity verification information, and a response message carrying the second identity verification information is fed back to the temporary communication address.

10. The method according to claim 7, characterized in that Also includes: If an end communication identifier sent based on the temporary communication connection is received, checking whether the federated learning data has been transmitted; If the transmission is completed, a confirmation callback identifier is fed back based on the communication end identifier, and the temporary communication connection is ended.

Images