A communication networking method applied to federated learning

Abstract

This application discloses a communication networking method for federated learning, aimed at improving the security of communication networks used in federated learning. The solution provided includes: broadcasting a networking request in a network to be grouped based on a zero-trust communication protocol, the networking request carrying parameters of the target federated learning program in which the network to be grouped is located; obtaining a routing list from anonymous networking endpoints in the network to be grouped in response to the networking request, the routing list including anonymous identity information of each anonymous networking endpoint participating in the target federated learning program, the anonymous identity information carrying parameters of the corresponding anonymous networking endpoint participating in the federated learning program; and joining the federated learning network corresponding to the target federated learning program based on the routing list.

Description

Technical Field

[0001] This application relates to the field of communications, and more particularly to a communication networking method for federated learning. Background Technology

[0002] Federated Learning (FL) is a machine learning setup in which multiple client entities collaborate to solve a machine learning problem under the coordination of a central server or service provider. Each client's raw data is stored locally and is not exchanged or directly transferred; instead, targeted updates designed for real-time aggregation are used to achieve the learning objective. Federated Learning is effective in protecting the data generated on each device by sharing model updates.

[0003] However, during the training process of federated learning, communication model updates may still leak sensitive information to third parties or central servers. Even with decentralized peer-to-peer data transmission, the risk of data interception and tampering still exists during data transmission.

[0004] How to improve the security of communication networks used in federated learning is the technical problem that this application aims to solve. Summary of the Invention

[0005] The purpose of this application is to provide a communication networking method for federated learning, so as to improve the security of communication networking for federated learning.

[0006] Firstly, a communication networking method for federated learning is provided, applicable to clients participating in federated learning, including:

[0007] Broadcast a networking request in a network to be grouped based on a zero-trust communication protocol. The networking request carries the parameters of the target federated learning in which it participates.

[0008] Obtain the routing list federated by the anonymous networking endpoints in the network to be grouped in response to the networking request. The routing list includes the anonymous identity information of each anonymous networking endpoint participating in the target federated learning. The anonymous identity information carries the parameters of the federated learning that the corresponding anonymous networking endpoints participate in.

[0009] Join the federated learning network corresponding to the target federated learning based on the routing list.

[0010] Secondly, a communication networking device for federated learning is provided, applicable to clients participating in federated learning, including:

[0011] The broadcast module broadcasts a networking request in the network to be grouped based on the zero-trust communication protocol. The networking request carries the parameters of the target federated learning in which it participates.

[0012] The acquisition module acquires a routing list of anonymous networking endpoints in the network to be grouped in response to the networking request. The routing list includes the anonymous identity information of each anonymous networking endpoint participating in the target federated learning. The anonymous identity information carries the parameters of the federated learning in which the corresponding anonymous networking endpoint participates.

[0013] The networking module joins the federated learning network corresponding to the target federated learning based on the routing list.

[0014] Thirdly, an electronic device is provided, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method of the first aspect.

[0015] Fourthly, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, implements the steps of the method of the first aspect.

[0016] Fifthly, a computer program product is provided, comprising a non-transitory computer-readable storage medium storing a computer program operable to cause a computer to perform some or all of the steps of the method of the first aspect.

[0017] In this embodiment, firstly, a networking request is broadcast in the network to be grouped based on a zero-trust communication protocol. The networking request carries the parameters of the target federated learning process in which the client participates. Then, a routing list is obtained from the anonymous networking endpoints in the network to be grouped in response to the networking request. The routing list includes the anonymous identity information of each anonymous networking endpoint participating in the target federated learning process, and the anonymous identity information carries the parameters of the corresponding anonymous networking endpoint's participation in the federated learning process. Next, the client joins the federated learning network corresponding to the target federated learning process based on the routing list. The scheme provided in this embodiment allows clients to join the federated learning network corresponding to the target federated learning process in the network to be grouped using anonymous identities. The anonymous identity information carries the parameters of the client's participation in the federated learning process, which can represent the characteristics of the client's participation in the federated learning process while concealing the identity information, thereby ensuring that the client joins the same network as other clients participating in the target federated learning process. This ensures that the client joins the federated learning network anonymously, concealing the client's sensitive identity while implementing federated learning, which is beneficial for improving the communication network security of federated learning and the data transmission security within the network. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a schematic diagram of a scenario of a secure computing environment isolated from an untrusted environment, as described in one embodiment of this application.

[0020] Figure 2 This is a schematic diagram of a model inversion attack and a reconstruction attack in one embodiment of this application;

[0021] Figure 3 This is one of the flowcharts illustrating a communication networking method applied to federated learning according to an embodiment of this application;

[0022] Figure 4 This is a second schematic flowchart of a communication networking method applied to federated learning, according to one embodiment of this application.

[0023] Figure 5 This is the third flowchart of an embodiment of a communication networking method applied to federated learning in this application;

[0024] Figure 6 This is the fourth flowchart of an embodiment of a communication networking method applied to federated learning in this application;

[0025] Figure 7 This is a schematic diagram illustrating an application scenario of a communication networking method for federated learning, according to one embodiment of this application.

[0026] Figure 8 This is the fifth flowchart of an embodiment of a communication networking method applied to federated learning in this application;

[0027] Figure 9 This is a schematic diagram of the interaction process between the data request end and the data response end in a communication networking method applied to federated learning according to an embodiment of this application;

[0028] Figure 10 This is the sixth flowchart of an embodiment of a communication networking method applied to federated learning in this application;

[0029] Figure 11 This is the seventh flowchart of a communication networking method applied to federated learning, according to one embodiment of this application;

[0030] Figure 12 This is the eighth flowchart of an embodiment of a communication networking method applied to federated learning in this application;

[0031] Figure 13This is the ninth flowchart of a communication networking method applied to federated learning, according to one embodiment of this application;

[0032] Figure 14 This is a schematic diagram of a communication networking device applied to federated learning, according to one embodiment of this application. Detailed Implementation

[0033] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. The drawing numbers in this application are only used to distinguish the various steps in the solution and are not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0034] To address the risks of privacy breaches and data misuse involving data sharing technologies, security can be enhanced by employing trusted computing based on hardware trusted execution environment (TEE) technology or homomorphic encryption (HE) based on cryptography.

[0035] Specifically, a TEE can provide a secure computing environment isolated from untrusted environments. This isolation and trusted verification mechanism provides the foundation for achieving trusted computing, such as... Figure 1 As shown, this TEE can be hardware-based, such as Intel SGX, AMD SEV, ARM TrustZone, and RISC-V Keystone. TEEs can also be constructed using virtualization technologies, such as Microsoft's VSM and Intel's Trusty for iKGT & ACRN, but these cannot match the security of hardware TEEs. Specifically, TEEs require specific processor chips that support a trusted hardware execution environment, which limits the widespread adoption and application of TEE technology. Furthermore, TEE development and deployment are relatively complex, requiring specialized knowledge and skills, resulting in high development and implementation costs. Additionally, the encryption and isolation mechanisms of TEEs can lead to performance overhead, negatively impacting computation and response time.

[0036] HE is a special encryption technique that allows computational operations to be performed in an encrypted state without decrypting the data. This means that operations can be performed on encrypted data, and the result will still be encrypted; only after decryption can the correct result be obtained.

[0037] If HE (Heterologous Encryption) or Secure Multi-Party Computation (SMPC) techniques are used, multiple participants can perform computations on encrypted data without trusting each other in practical applications. Each participant can obtain the computation result without accessing the private inputs of other participants, and can perform more complex function calculations on the encrypted result set. These techniques can reduce the risk of privacy data leakage in the field of machine learning to some extent, but they cannot completely eliminate privacy-leaking attacks such as reconstruction attacks and model inversion attacks. A diagram illustrating model inversion attacks and reconstruction attacks is shown below. Figure 2 As shown, model inversion attacks and reconstruction attacks can potentially obtain raw, private data. Therefore, the risk of data leakage remains.

[0038] Both TEE and HE are designed to protect the security of the data itself, ensuring that the data is not accessed or tampered with without authorization during use and processing. However, neither of these solutions addresses the protection of the data transmission phase, and therefore cannot prevent data leakage during the transmission phase.

[0039] To address the problems existing in related technologies, this application provides a communication networking method for federated learning, which can be applied to clients participating in federated learning, enabling anonymous communication among federated learning participants, effectively improving the security of data communication during federated learning, and facilitating the safe and reliable exchange of data during federated learning.

[0040] The solution provided in this application is applicable to various application scenarios involving federated learning. By implementing a federated learning network, it can be used for data exchange and computation in federated learning modeling, supporting both horizontal and vertical federation. The solution provided in this application offers a more reliable and secure data transmission solution for the development of federated learning, which is conducive to promoting the application and dissemination of federated learning technology in practice.

[0041] This application provides a communication networking method for federated learning, such as... Figure 3 As shown, the clients used in federated learning include:

[0042] S31: Broadcast a networking request in the network to be grouped based on the zero-trust communication protocol, the networking request carrying the parameters of the target federated learning in which it participates.

[0043] The aforementioned zero-trust communication protocol is a dedicated network communication protocol based on the Zero Trust Architecture (ZTA). It can be effectively applied in federated learning scenarios as a dedicated channel for cross-vertical machine learning data interaction. With data privacy and security as its core principles, this protocol aims to address the security and privacy challenges faced by traditional communication protocols in cross-domain data interaction.

[0044] This zero-trust communication protocol should adopt a zero-trust security model to ensure that both communicating parties are secure and trustworthy. During the interaction, verification and authorization must be performed at every stage of data exchange. Any data transmission requires strict authentication and access control to ensure that only authorized users or devices can access and transmit data. This zero-trust model effectively prevents the risks of unauthorized access and data leakage.

[0045] This network protocol follows the following basic principles:

[0046] Spatially, all users communicating using this protocol are untrusted (hereinafter referred to as the security boundary principle); temporally, the security of each user is also dynamically changing (hereinafter referred to as the risk adaptive principle); any access subject must undergo identity authentication and authorization before access is permitted (hereinafter referred to as the least privilege principle).

[0047] In networks based on zero-trust communication protocols, the two parties needing to communicate may find it difficult to quickly locate each other. Therefore, while ensuring security through zero-trust communication protocols, it is also necessary to adapt to feasible fast addressing technologies. In practical applications, Internet Protocol (IP) technology can be used to achieve this, aiming to provide functions such as addressing, routing, data segmentation and reassembly, ensuring that data packets can be forwarded from one network to another.

[0048] The aforementioned IP technology specifically uses IP subnetting and ARP protocol for MAC address mapping. It doesn't check or send acknowledgments regardless of the correctness of transmitted datagrams, and it lacks flow control and error control functions. This characteristic of the IP protocol provides the main framework for transmission functions at the network layer. Users can add necessary functions to a given application at the transport layer as needed, thus achieving maximum transmission efficiency. However, this transmission method has certain security vulnerabilities. For example, IP address spoofing is a common problem. Attackers can use deception or tampering with IP addresses to carry out spoofing, denial-of-service attacks, or other malicious activities. Furthermore, the IP protocol itself lacks encryption and authentication mechanisms, making it susceptible to information leakage and eavesdropping risks. Therefore, how to ensure that both parties in network layer communication can quickly locate each other while also ensuring that the communication process is secure, reliable, and non-replayable is the technical problem that this application aims to solve.

[0049] In this step, the clients participating in federated learning broadcast a networking request in the grouping network built based on a zero-trust communication protocol. This networking request carries the parameters of the target federated learning process in which the client is participating. The parameters of the target federated learning process may include general parameter information of the target federated learning process, such as at least one of the following: the user's industry, model structure, type of optimization algorithm used, and type of loss function.

[0050] Since the parameters used in the federated learning in this embodiment are general industry parameters and federated learning model parameters, classifying users using these parameters does not expose users' unique privacy attributes. Anonymous users in the network to be grouped send network requests via network broadcast to seek responses from other clients with the same parameters in the network to be grouped.

[0051] S32: Obtain the routing list of anonymous networking terminals in the network to be grouped in response to the networking request. The routing list includes the anonymous identity information of each anonymous networking terminal participating in the target federated learning. The anonymous identity information carries the parameters of the federated learning participated in by the corresponding anonymous networking terminal.

[0052] Other clients participating in the aforementioned federated learning respond to the networking request in the previous steps by providing a routing list. In this step, this routing list is retrieved, stored locally, and updated. Within a network, broadcasting and local updates can ensure that the routing lists obtained by all users with the same federation parameters are updated in real time and are consistent with each other.

[0053] For example, if the target federated learning network has not yet been established, based on the aforementioned network request, at least one client participating in the target federated learning can send a routing list containing its own anonymous identity information to the execution entity client of this instance. Then, through broadcasting and updating, the routing list includes at least the execution entity client of this instance and the client that sent the routing list. Furthermore, if information from other clients based on the aforementioned network request is received, the routing list is further broadcast and updated to ensure that the routing lists of all clients within the network are updated in real time and have consistent content.

[0054] S33: Join the federated learning network corresponding to the target federated learning based on the routing list.

[0055] In this step, clients based on the aforementioned routing list and the parameters of the target federated learning jointly form a network. This scheme can use the parameters of the target federated learning as anonymous identities for networking, which on the one hand conceals sensitive information and ensures identity security, and on the other hand represents the characteristics of the target federated learning. Networking with other clients participating in the target federated learning can be achieved through broadcast requests and routing list updates.

[0056] The solution provided in this application allows clients to anonymously join a federated learning network corresponding to a target federated learning session within a network to be grouped. The anonymous identity information carries parameters of the client's participation in the federated learning session, representing the characteristics of the federated learning session while concealing the client's identity. This ensures that the client joins the same network as other clients participating in the target federated learning session. This ensures that the client joins the federated learning network anonymously, concealing the client's sensitive identity while implementing federated learning, which improves the communication network security of federated learning and enhances the security of data transmission within the network.

[0057] The federated learning network constructed in this embodiment is a scrambled network. In a scrambled network, the general federated learning parameters contained in the user's temporary identity information are public, enabling federated learning network formation while protecting the privacy of the client's real and sensitive information. Optionally, the hierarchical division of parameters in the network should also avoid an excessively large number of users within the same autonomous network to prevent excessively high routing matching latency, thereby ensuring routing matching efficiency.

[0058] Regarding route list updates, an efficient route update mechanism is needed to ensure the real-time nature and consistency of the route list. In practical application scenarios, users of federated learning are often enterprise users with data modeling needs. These enterprises may be physically geographically dispersed, but route updates are usually not very frequent. Therefore, in terms of routing protocols, internal gateway protocols and external gateway protocols can be combined to dynamically adjust routing rules based on different user states.

[0059] Optionally, when a client first connects to the network, the Exterior Gateway Protocol (EGP) is used to obtain a list of routes for all users who have the same zero-trust protocol parameters as the client. This list is then used to group and network the users.

[0060] Optionally, after the network is established, in order to avoid an excessive number of users within the same Autonomous System (AS) with hierarchical matching parameters during subsequent data communication, the routing can be switched to the Open Shortest Path First (OSPF) protocol, which has better internal gateway addressing.

[0061] In terms of security, for clients within the network, host security can be further improved by converging communication ports. Optionally, to prevent malicious users from launching denial-of-service attacks using anonymous identities, the zero-trust protocol can reserve only one random port for receiving address-knock broadcast messages from other hosts within the autonomous system (i.e., communication requests sent by the data requesting end in the following text).

[0062] In addition, in terms of performance, considering that the business scenario of federated learning multi-party data modeling has high requirements for data transmission speed and can tolerate a small amount of deviation in data integrity and data sorting, the lightweight User Datagram Protocol (UDP) can be selected for data transmission.

[0063] The solution provided by the above embodiments of this application can achieve the requirements of federated learning networking while concealing the client's real privacy and identity information. To further improve the security of federated learning networking, prevent malicious users from using the anonymity of network user identities to launch worm attacks or DDoS attacks, and ensure that both communicating parties can achieve data transmission, the solution provided by the embodiments of this application performs authentication and confirmation on the data requesting end and the data responding end, thereby establishing a communication connection for realizing federated learning data transmission.

[0064] Based on the solution provided in the above embodiments, optionally, the client is a data requesting end. Wherein, as... Figure 4 As shown, after step S33 above, that is, after adding the federated learning network corresponding to the target federated learning based on the routing list, the method further includes:

[0065] S41: Send a communication request to each anonymous network endpoint in the federated learning network. The communication request carries the first identity verification information associated with the data response endpoint and the temporary communication address of the data request endpoint.

[0066] In this step, the data requester can send communication requests to each anonymous network endpoint in its own federated learning network via broadcast, or it can send communication requests to each anonymous network endpoint based on the routing list of the federated learning network.

[0067] The communication request carries known first identity verification information associated with the data response end. This first identity verification information can be obtained by the data request end from the data response end in advance, for example, by offline information exchange or online encrypted interaction.

[0068] The aforementioned temporary communication address can specifically be the address of the communication port of the data requesting end, used to perform identity verification interaction with the data response end that needs to perform data interaction, and to perform data transmission after the identity verification is successful.

[0069] By sending a communication request carrying first identity verification information and a temporary communication address, the data response end can be requested to perform identity verification on the first identity verification information, and then communicate with the data request end through the temporary communication address after the identity verification is successful.

[0070] S42: If a response message carrying second identity verification information is received and sent to the temporary communication address, then the second identity verification information is verified.

[0071] If a response message carrying second identity verification information is received and sent to the temporary communication address, it indicates that the data response end has successfully verified the first identity information and has sent back the second identity verification information so that the data request end can verify the identity of the data response end.

[0072] In this step, receiving the response information from the temporary communication address ensures that the client sending the response information is a client within the federated learning network, meaning it participates in the target federated learning together with the data requester. Furthermore, the second identity verification information further verifies the identity of the data response client, ensuring that the end executing the communication is indeed the data response client intended by the data requester to perform the communication.

[0073] The second identity verification information may be information provided in advance by the data requester to the data responseer to characterize the identity of the data responseer. Optionally, this second identity information and the aforementioned first identity information may be information exchanged in advance between the data requester and the data responseer.

[0074] S43: If the verification passes, a temporary communication connection is established with the port that sent the response information. The temporary communication connection is used to transmit federated learning data associated with the data response end.

[0075] If the verification passes, a temporary communication connection is established with the port that sent the above response information to realize the communication connection between the data requester and the data responder. Then, federated learning data is transmitted through this temporary communication connection, which effectively improves the security of federated learning data during transmission.

[0076] The solution provided in this application embodiment enables the data requester to perform identity verification on the data requester by sending the first identity verification information, and the data response end to perform identity verification on the data response end by sending the second identity verification information, thereby enabling point-to-point identity verification in anonymous federated learning networks, and establishing a temporary, highly secure communication connection to improve the security of data transmission.

[0077] Based on the solutions provided in the above embodiments, optionally, such as Figure 5 As shown, before step S41 above, that is, before sending communication requests to each anonymous network endpoint in the federated learning network, the following is also included:

[0078] S51: Encrypt the known data response server service password using the known public key of the data response server to obtain the first identity verification information.

[0079] S52: Generate the communication request based on the first identity verification information and the temporary communication address of the data requesting end.

[0080] The scheme provided in this application embodiment uses key pairs for identity encryption verification. Specifically, the data requesting end and the data responding end can pre-provide each other with their service passwords and public keys so that the other party can generate identity verification information.

[0081] In this application example, the data requesting end uses the public key pre-provided by the data responding end to encrypt the service password of the data responding end, obtaining the first identity verification information. Then, a communication request containing the first identity verification information and a temporary communication address is generated, so that the data responding end can use its own private key to decrypt and verify the first identity verification information. Specifically, the public key provided by the data responding end to the data requesting end that needs to perform communication and its own private key for decryption form a key pair. Therefore, after receiving the first identity verification information, the data responding end can use its stored private key to perform decryption and verification to verify the identity of the data requesting end.

[0082] Based on the solutions provided in the above embodiments, optionally, such as Figure 6 As shown, in step S42 above, the verification of the second identity verification information includes:

[0083] S61: Use your own private key to perform decryption and verification on the second identity verification information.

[0084] In the scheme provided in this application embodiment, the data requesting end provides its own public key and its own service password to the data responding end in advance, so that the data responding end can use the public key of the data requesting end to encrypt the service password of the data requesting end to obtain the second identity verification information.

[0085] In this step, the requesting data terminal uses its own private key to decrypt and verify the second identity verification information. Since the public key provided by the requesting data terminal to the responding data terminal and the private key used to decrypt the second identity verification information are a key pair, the second identity verification information can be effectively verified.

[0086] In step S43 above, if the verification passes, a temporary communication connection is established with the port that sent the response information, including:

[0087] S62: If the service password obtained by decrypting the second identity verification information matches its own service password, then a temporary communication connection is established with the port that sent the response information.

[0088] In this step, the data requesting end uses its own private key to decrypt the second identity verification information, and performs a matching verification between the decrypted service password and its own service password. If they match, it can be determined that the end that sent the second identity verification information is the data response end that has exchanged identity verification information in advance. Then, a temporary communication connection is established with the port that sent the response information to transmit the data associated with the data response end.

[0089] The following example will further illustrate this solution.

[0090] The solution provided in this application can be used to implement one-way addressing in anonymous identity networking, thereby establishing a temporary and secure communication connection.

[0091] Figure 7 The illustration shows an application scenario of the method provided in this application, assuming that participant A, participant B, and users on the same network segment are all in the same federated learning network. This solution is implemented through the following steps:

[0092] Step 1: Participant A (e.g., the data requester) and participant B (e.g., the data responder) exchange communication keys offline. These communication keys include their own service password and their own public key, so that the other party can generate identity verification information.

[0093] Step 2: The data requester and data response ends each generate anonymous identities using obfuscated network technology, as provided in any of the above embodiments, thereby participating in the federated learning network anonymously. Once in the federated learning network, no anonymous participant needs to open a communication port, reducing the risk of malicious attacks on the anonymous end.

[0094] Step 3: The requesting end uses the pre-obtained public key of the responding end to encrypt the service password of the responding end, obtaining the first identity verification information. This generates a communication request carrying the first identity verification information and a temporary communication address, and initiates a one-way addressing broadcast in the federated learning network, ensuring that all anonymous users within the network can receive the communication request.

[0095] Step 4: The data response end can receive the above communication request using any random port, decrypt and verify the first identity verification information using its own private key, and match and verify the service password contained therein. After successful verification, it generates second identity verification information based on the public key and service password pre-provided by the data request end, opens its own communication port, and sends a response message carrying the second identity verification information to the temporary communication address carried in the communication request, thereby responding to the above address broadcast.

[0096] Step 5: After receiving the above response information, the requesting end uses its own private key to decrypt and verify the second identity verification information, and matches and verifies the service password within it. After successful verification, data communication is conducted through an open temporary port using a temporary address.

[0097] The solution provided in this application effectively improves data communication security based on obfuscated network technology and one-way addressing technology. Specifically, obfuscated network technology enables anonymous networking between communicating parties, while one-way addressing technology is used to locate legitimate target users after anonymous networking is completed, allowing the communicating parties to complete on-demand communication.

[0098] Based on the solution provided in the above embodiments, optionally, in step S41 above, sending communication requests to each anonymous network endpoint in the federated learning network includes:

[0099] Based on the routing list, the communication request is sent via multicast to each anonymous network endpoint in the federated learning network; or, the communication request is broadcast in the federated learning network.

[0100] In the solution provided in this application embodiment, when all anonymous users within the network have a complete routing list, sending multicast messages no longer requires pointing to a specific port to achieve multicast transmission. Alternatively, broadcasting within the network can also be used to perform transmission. Through multicast or broadcasting, communication requests can be sent to various anonymous terminals within the network to unidirectionally search for data response terminals.

[0101] Based on the solutions provided in the above embodiments, optionally, such as Figure 8 As shown, the method further includes:

[0102] S81: After the federated learning data is transmitted through the temporary communication connection, an end communication identifier is sent through the temporary communication connection.

[0103] In the solution provided in this application, after the federated learning data transmission is completed, the data requesting end and the data responding end terminate the communication by exchanging identifiers. This ensures that temporary communication is only used to transmit trusted data between the two verified ends, reducing the risk of malicious attacks and data leakage.

[0104] In this step, an end-of-communication flag is sent through the temporary communication connection for transmitting federated learning data. This end-of-communication flag indicates that the data requesting end has completed the data transmission required for this temporary communication connection, thereby allowing the data responding end to confirm whether to end this temporary communication connection.

[0105] S82: If an acknowledgment callback flag based on the communication termination flag is received, then the temporary communication connection is terminated.

[0106] If an acknowledgment callback is received from the data responder, it indicates that the data responder has also completed the data transmission required for this temporary communication connection. After receiving the acknowledgment callback, the data requester can terminate this temporary communication connection.

[0107] See Figure 9 The interaction flow between the data requester and the data response provider is as follows:

[0108] ① The two communicating parties exchange service passwords and public keys in advance;

[0109] ② The two communicating parties generate anonymous identities and complete the network formation by using network obfuscation technology. At this time, it is not necessary to open any communication ports;

[0110] ③ The requesting party uses the public key to encrypt the service password and generate a temporary communication address to construct a communication request.

[0111] ④ In a confused network, multicast is performed based on the routing list. Since all users have a complete routing list, it is no longer necessary to send multicast packets to a specific port.

[0112] ⑤ After receiving the multicast message (the responder can use any random port to receive multicast information), it uses its private key to decrypt and verify the service password;

[0113] ⑥ After successful verification, the responder opens the communication port and returns the requester's service password, encrypted with the public key, to a temporary address for the requester to confirm. After successful verification, the requester opens the port for data communication.

[0114] ⑦ After the data transmission is completed, the requesting party sends a communication end marker. Upon receiving the confirmation callback, both parties close the port, and the data communication ends.

[0115] The solution provided in this application enables unidirectional addressing in anonymized, obfuscated networks, thereby establishing end-to-end temporary communication connections and effectively improving the security of federated learning data transmission. After data transmission is complete, the temporary communication connection is terminated by exchanging identifiers, reducing the risk of attacks during network deployment and enhancing the overall security of data interaction.

[0116] The following describes the solution provided by the embodiments of this application from the perspective of the data response end.

[0117] Based on the solution provided in the above embodiments, optionally, the client is a data response terminal;

[0118] like Figure 10 As shown, after step S33 above, that is, after adding the federated learning network corresponding to the target federated learning based on the routing list, the method further includes:

[0119] S101: If a communication request carrying first identity verification information and a temporary communication address is received in the federated learning network, then the first identity verification information is verified.

[0120] The first identity verification information can be information that the data response end provides to the data request end in advance. For example, the identity verification information can be obtained by means of offline information exchange or online encrypted interaction.

[0121] S102: If the verification passes, a response message carrying the second identity verification information is sent back to the temporary communication address. The response message is used to establish a temporary communication connection with the port that sent the communication request. The temporary communication connection is used to transmit federated learning data associated with the data response terminal.

[0122] The first identity verification information sent by the data requesting end facilitates the data responding end to perform identity verification on the data requesting end, and the second identity verification information sent by the data responding end facilitates the data requesting end to perform identity verification on the data responding end. This enables point-to-point identity verification in an anonymous federated learning network, thereby establishing a temporary, highly secure communication connection and improving the security of data transmission.

[0123] Based on the solutions provided in the above embodiments, optionally, such as Figure 11 As shown, in step S101 above, verifying the first identity verification information includes:

[0124] S111: Decrypt the first identity verification information using your own private key.

[0125] The scheme provided in this application embodiment uses key pairs for identity encryption verification. Specifically, the data requesting end and the data responding end can pre-provide each other with their service passwords and public keys so that the other party can generate identity verification information.

[0126] In this application example, the data response end uses the public key pre-provided by the data request end to decrypt and verify the service password of the data request end. Specifically, the public key provided by the data response end to the data request end that needs to perform communication, and its own private key for decryption, form a key pair. Therefore, after receiving the first identity verification information, the data response end can use its stored private key to perform decryption and verification to verify the identity of the data request end.

[0127] In step S102 above, if the verification passes, a response message carrying the second identity verification information is sent back to the temporary communication address, including:

[0128] S112: If the service password obtained by decrypting the first identity verification information matches the service password of its own data request end, then the response information carrying the second identity verification information is sent back to the temporary communication address.

[0129] In this step, the data response end uses its own private key to decrypt the first identity verification information, and performs a matching verification between the decrypted service password and its own service password. If they match, it can be determined that the end that sent the first identity verification information is the data request end that has exchanged identity verification information in advance, and then a temporary communication connection is established to transmit the data required for federated data.

[0130] Based on the solutions provided in the above embodiments, optionally, such as Figure 12 As shown, in step S112 above, if the service password obtained by decrypting the first identity verification information matches the service password of its own data request end, then a response message carrying the second identity verification information is sent back to the temporary communication address, including:

[0131] S121: If the service password obtained by decrypting the first identity verification information matches its own service password, then the known data requester's public key is used to encrypt the known data requester's service password to obtain the second identity verification information, and a response information carrying the second identity verification information is sent back to the temporary communication address.

[0132] In this step, the data response end uses its own private key to decrypt the first identity verification information, and performs a matching verification between the decrypted service password and its own service password. If they match, it can be determined that the end that sent the first identity verification information is the data request end that has exchanged identity verification information in advance. Then, the known data request end's public key is used to encrypt the known data request end's service password to obtain the second identity verification information.

[0133] In this application example, after the data response end verifies the first identity verification information, it uses the public key pre-provided by the data request end to encrypt the service password of the data request end to obtain the second identity verification information. Then, it sends a response message carrying the aforementioned second identity verification information to the data request end, so that the data request end can use its own private key to decrypt and verify the second identity verification information. After both ends have successfully verified their identities, a temporary communication connection is established to transmit the data required for federated learning through a secure connection.

[0134] Based on the solutions provided in the above embodiments, optionally, such as Figure 13 As shown, it also includes:

[0135] S131: If an end communication identifier is received based on the temporary communication connection, then check whether the federated learning data has been transmitted successfully.

[0136] S132: If the transmission is completed, a confirmation callback flag is fed back based on the end communication flag, and the temporary communication connection is terminated.

[0137] In the solution provided in this application, after the federated learning data transmission is completed, the data requesting end and the data responding end terminate the communication by exchanging identifiers. This ensures that temporary communication is only used to transmit trusted data between the two verified ends, reducing the risk of malicious attacks and data leakage.

[0138] In this step, the data requester receives an end-of-communication flag via a temporary communication connection. This flag indicates that the data requester has completed the data transmission required for this temporary communication connection, allowing the data responseer to confirm whether to terminate the temporary communication connection.

[0139] If the data response end has also completed the required data transmission, it will send a confirmation callback and terminate the temporary communication connection of its own end.

[0140] The solution provided in this application embodiment terminates the temporary communication connection by exchanging identifiers after data transmission is completed, reducing the risk of attacks in the network and improving the overall security of data interaction.

[0141] The solution provided by the above embodiments of this application adopts obfuscated network technology, no longer relies on IP protocol addressing, but uses anonymous identity networking, and establishes communication connections temporarily based on authentication, which effectively improves the identity security of networking clients and the security of data transmission.

[0142] Among them, generating anonymous identities based on federated learning parameters can represent the characteristics of participating in federated learning while protecting identity privacy information. This enables multiple clients participating in the same federated learning to join the same federated learning network and maintain their private identities within the network, thereby improving identity privacy security on the basis of achieving the network required for federated learning.

[0143] This solution employs unidirectional addressing for identity verification and temporary communication connections in federated learning networks, effectively enhancing data transmission security. This unidirectional addressing technology ensures the legitimacy of both parties in each data communication, preventing the leakage of sensitive user information, reducing information exposure, and protecting users from additional network attacks. Furthermore, after federated learning data transmission is complete, the temporary communication connection is disconnected by exchanging identifiers, preventing malicious attacks on established connections and effectively improving the overall security of communication within the network.

[0144] The solution provided in this application embodiment uses a zero-trust protocol for data exchange in machine learning data modeling. Combined with homomorphic encryption and secure multi-party computation technology, it can effectively prevent privacy-leaking attacks such as reconstruction attacks, model inversion attacks, and member reasoning attacks.

[0145] Furthermore, the one-way addressing technology based on zero-trust protocols provided in the embodiments of this application has significant commercial value in network communication. Firstly, this technology offers high levels of data security and privacy protection, enabling enterprises to maintain a high degree of trust in data interactions across vertical industries. By using anonymous address pairs for data communication, enterprises can establish connections without exposing their real identities and communication parameters, effectively preventing unauthorized access and data leakage.

[0146] Secondly, unidirectional addressing technology based on zero-trust protocols offers flexibility and scalability, adapting to the data interaction needs of different vertical industries. Whether in the financial, healthcare, or industrial control sectors, enterprises can leverage this technology to achieve secure data transmission and sharing. This enables enterprises to conduct business and data collaboration more efficiently, improving work efficiency and business innovation capabilities.

[0147] Furthermore, one-way addressing technology based on zero-trust protocols can reduce enterprises' network security and privacy protection costs. Traditional network communication protocols require significant manpower and resources to ensure data security and privacy protection, while one-way addressing technology based on zero-trust protocols can achieve secure data transmission and privacy protection in a simplified and automated manner, reducing enterprises' security management costs and risks.

[0148] This application also provides a communication networking device 140 for federated learning, which is applied to clients participating in federated learning, such as... Figure 14 As shown, it includes:

[0149] Broadcast module 141 broadcasts a networking request in a network to be grouped based on a zero-trust communication protocol, the networking request carrying parameters of the target federated learning in which it participates;

[0150] The acquisition module 142 acquires the routing list fed back by the anonymous networking end in the network to be grouped to the networking request. The routing list includes the anonymous identity information of each anonymous networking end participating in the target federated learning. The anonymous identity information carries the parameters of the federated learning participated in by the corresponding anonymous networking end.

[0151] The networking module 143 joins the federated learning network corresponding to the target federated learning based on the routing list.

[0152] The apparatus provided in this application embodiment allows a client to anonymously join a federated learning network corresponding to a target federated learning activity within a network to be grouped. The anonymous identity information carries parameters of the client's participation in the federated learning activity, representing the characteristics of the federated learning activity while concealing the client's identity. This ensures that the client joins the same network as other clients participating in the target federated learning activity. This ensures that the client joins the federated learning network anonymously, concealing the client's sensitive identity while implementing federated learning, which is beneficial for improving the communication network security of federated learning and the security of data transmission within the network.

[0153] In this application, the modules in the apparatus provided can also implement the method steps provided in the method embodiments. Alternatively, the apparatus provided in this application may include other modules besides those described above to implement the method steps provided in the method embodiments. Furthermore, the apparatus provided in this application can achieve the technical effects achievable by the method embodiments.

[0154] Preferably, this application embodiment also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described embodiment of a communication networking method for federated learning and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0155] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described embodiment of a communication networking method for federated learning, achieving the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0156] This application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program is operable to cause a computer to perform some or all of the steps of the above-described embodiment of a communication networking method for federated learning, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0157] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0159] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0160] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0161] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0162] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0163] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0164] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0165] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0166] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A communication networking method applied to federated learning, characterized in that, Clients used in federated learning include: Broadcast a networking request in a network to be grouped based on a zero-trust communication protocol. The networking request carries the parameters of the target federated learning in which it participates. Obtain the routing list of anonymous networking terminals in the network to be grouped in response to the networking request. The routing list includes the anonymous identity information of each anonymous networking terminal participating in the target federated learning. The anonymous identity information carries the parameters of the federated learning in which the corresponding anonymous networking terminal participates. Join the federated learning network corresponding to the target federated learning based on the routing list.

2. The method as described in claim 1, characterized in that, The client is the data requester; After adding the target federated learning network to the federated learning network based on the routing list, the process also includes: A communication request is sent to each anonymous network endpoint in the federated learning network. The communication request carries the first identity verification information associated with the data response endpoint and the temporary communication address of the data request endpoint. If a response message carrying second identity verification information is received and sent to the temporary communication address, then the second identity verification information is verified. If the verification passes, a temporary communication connection is established with the port that sent the response information. This temporary communication connection is used to transmit federated learning data associated with the data response end.

3. The method as described in claim 2, characterized in that, Before sending communication requests to each anonymous network endpoint in the federated learning network, the process also includes: The first identity verification information is obtained by encrypting the known data response server service password with the known public key of the data response server. The communication request is generated based on the first identity verification information and the temporary communication address of the data requesting end.

4. The method as described in claim 2, characterized in that, Performing verification on the second identity verification information includes: The second identity verification information is decrypted and verified using the user's private key. If the verification passes, a temporary communication connection is established with the port that sent the response information, including: If the service password obtained by decrypting the second identity verification information matches its own service password, a temporary communication connection is established with the port that sent the response information.

5. The method according to any one of claims 2 to 4, characterized in that, Sending communication requests to each anonymous network endpoint in the federated learning network, including: Based on the routing list, the communication request is sent via multicast to each anonymous network endpoint in the federated learning network; or... The communication request is broadcast in the federated learning network.

6. The method according to any one of claims 2 to 4, characterized in that, Also includes: After the federated learning data is transmitted via the temporary communication connection, an end-of-communication flag is sent via the temporary communication connection. If a confirmation callback flag based on the communication termination flag is received, the temporary communication connection is terminated.

7. The method as described in claim 2, characterized in that, The client is the data response end; After adding the target federated learning network to the federated learning network based on the routing list, the process also includes: If a communication request carrying first identity verification information and a temporary communication address is received in the federated learning network, then the first identity verification information is verified. If the verification passes, a response message carrying the second identity verification information is sent back to the temporary communication address. The response message is used to establish a temporary communication connection with the port that sent the communication request. The temporary communication connection is used to transmit federated learning data associated with the data response terminal.

8. The method as described in claim 7, characterized in that, Performing verification on the first identity verification information includes: The first identity verification information is decrypted using its own private key; If the verification passes, a response message carrying the second identity verification information is sent back to the temporary communication address, including: If the service password obtained by decrypting the first identity verification information matches its own service password, then a response message carrying the second identity verification information is sent back to the temporary communication address.

9. The method as described in claim 8, characterized in that, If the service password obtained by decrypting the first identity verification information matches its own service password, then a response message carrying the second identity verification information is sent back to the temporary communication address, including: If the service password obtained by decrypting the first identity verification information matches its own service password, the known data requester's public key is used to encrypt the known data requester's service password to obtain the second identity verification information, and a response information carrying the second identity verification information is sent back to the temporary communication address.

10. The method as described in claim 7, characterized in that, Also includes: If an end-of-communication flag is received based on the temporary communication connection, then check whether the federated learning data has been successfully transmitted. If the transmission is complete, a confirmation callback flag is fed back based on the communication termination flag, and the temporary communication connection is terminated.

11. A communication networking device for federated learning, characterized in that, Clients used in federated learning include: The broadcast module broadcasts a networking request in the network to be grouped based on the zero-trust communication protocol. The networking request carries the parameters of the target federated learning in which it participates. The acquisition module acquires a routing list of anonymous networking endpoints in the network to be grouped in response to the networking request. The routing list includes the anonymous identity information of each anonymous networking endpoint participating in the target federated learning. The anonymous identity information carries the parameters of the federated learning in which the corresponding anonymous networking endpoint participates. The networking module joins the federated learning network corresponding to the target federated learning based on the routing list.

12. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 10.

Images