Federal learning-based crowd sensing data privacy protection method and storage medium

Abstract

The invention discloses a crowd sensing data privacy protection method based on federated learning and a storage medium, and in the federated learning process of crowd sensing, multi-level privacy protection of transmission and aggregation processes is realized through a double-layer mask and an adaptive differential perturbation mechanism. A double-layer mask method is combined with a private mask of equipment and a public mask of a server, multiple encryption is carried out on model parameters, the safety of the parameters in the transmission process is ensured, a self-adaptive differential perturbation mechanism dynamically adjusts the noise according to the change condition of the model, and the model precision is kept while data privacy is protected. According to the scheme, the privacy protection problem of the crowd sensing data in federated learning can be effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of privacy data security protection of crowd intelligence perception, and in particular to a crowd intelligence perception data privacy protection method based on federated learning. Background Art

[0002] With the rapid development of the Internet of Things (IoT) and smart devices, crowd sensing technology provides important support for data collection, sharing and analysis among multiple devices. Smartphones, wearable devices, sensors and other terminals can collect data such as user behavior, health status and environmental information, forming a rich data resource, which brings huge value to the fields of health monitoring and environmental monitoring. However, these data usually contain highly sensitive personal information, such as health data and location information. Traditional methods of centralized data uploading and processing face huge challenges in privacy protection. In the application of crowd sensing, how to effectively protect user privacy data and share it securely while ensuring the value of data has become an urgent problem to be solved.

[0003] Federated Learning, as an emerging distributed machine learning method, provides a new processing framework for the protection of privacy data. Unlike traditional centralized data processing methods, federated learning allows each device to train models locally, avoiding the direct uploading of raw data, thereby greatly reducing the risk of privacy leakage. Each device generates model parameter updates through local training and sends these updates to the central server, which aggregates the updated parameters to obtain a global model and achieve the goal of collaborative learning. This model is particularly effective in crowd sensing data processing because it allows data to remain local to the device to protect user privacy. However, in practical applications, federated learning still faces some technical challenges in crowd sensing environments, especially in terms of privacy protection during model parameter transmission and aggregation.

[0004] Although federated learning avoids directly uploading raw data, local model parameters may still be intercepted by malicious attackers during transmission, posing the risk of privacy leakage. In addition, during the aggregation process, the central server may infer sensitive information of individual devices by analyzing the model parameters uploaded by the device. Therefore, in order to truly achieve data privacy protection, it is necessary to ensure security during transmission, take multi-level protection measures for model parameters, and prevent the central server from obtaining device privacy information through model updates during the aggregation stage. How to maximize the effectiveness of the model and the accuracy of collaborative learning while ensuring data privacy is a difficult problem that needs to be solved in the process of combining crowd sensing and federated learning. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method for privacy protection of crowd-sensing data based on federated learning, which can effectively solve the privacy protection problem of crowd-sensing data in federated learning. Multi-level privacy protection of the transmission and aggregation process is achieved through a double-layer mask and an adaptive differential perturbation mechanism. The double-layer mask method combines the private mask of the device and the public mask of the server to perform multiple encryption on the model parameters to ensure the security of the parameters during transmission. The adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes in the model, maintaining the model accuracy while protecting data privacy.

[0006] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a method for protecting the privacy of crowd-sensing data based on federated learning. In the process of federated learning of crowd-sensing, multi-level privacy protection of the transmission and aggregation process is realized through double-layer masking and adaptive differential perturbation mechanism. The double-layer masking method combines the private mask of the device and the public mask of the server to perform multiple encryptions on the model parameters to ensure the security of the parameters during the transmission process. The adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes in the model, and maintains the model accuracy while protecting data privacy. The method specifically includes the following steps: system initialization stage, data collection stage of edge intelligent perception device, training output protection mechanism stage based on double-layer masking, differential perturbation stage of local model, global model aggregation and differential perturbation stage; the method combines edge computing with federated learning, adopts a hierarchical federated learning architecture, reduces the transmission and centralized storage of perception data, effectively reduces the risk of user privacy leakage, and realizes the availability and invisibility of data through the distributed training model of federated learning, while solving the problem of data islands.

[0007] The system initialization phase includes:

[0008] Step 1-1: Key generation and distribution: When the system is initialized, the parameter server generates a large prime number p and an initial random number r, and uses a discrete logarithm-based algorithm to generate a symmetric key K. Each edge device u and sensor device v receives key negotiation parameters (such as random number r) from the parameter server. u and r v ), and calculate the shared key K u,v To ensure secure communications.

[0009] Step 1-2: Device registration and authentication: The parameter server assigns a unique ID to each device i , and use the hash function H to encrypt the device identity to ensure the security of identity authentication; the server generates a private mask θ for each device i and coefficient vector λ i , and is transmitted to each device after being encrypted.

[0010] Step 1-3: Model parameter initialization: When the system starts, the central server sets the initial global model parameter ω0, which can be a zero vector or a small random value to ensure the stability of the initial state of the model. The initial model parameter ω0 will be distributed to all edge nodes and sensing devices. In this way, the model parameters of the entire system in the initial state remain consistent, which is convenient for subsequent collaborative training and model updates.

[0011] The data collection phase of the edge intelligent sensing device is as follows: In this phase, we need to collect data from the edge intelligent device and send it to the border gateway. After the collection is completed, the edge intelligent device can go offline and then perform other tasks. For the border gateway, they store data for aggregation.

[0012] The training output protection mechanism stage based on double-layer mask is specifically as follows:

[0013] Step 2-1: Each sensor generates a personal random mask vector θ at the beginning of training i , which is used to protect the privacy of the local training output data of the device. i is an n-dimensional column vector with a value range between [0,1]. i After normalization, we get the coefficient vector λ i , and use symmetric encryption to θ i and λ i Encrypt them and then send them to the edge server.

[0014] Step 2-2: The edge server receives the encrypted mask vector θ from each device i and coefficient vector λ i , and construct these vectors into a common coefficient matrix P. The server verifies the linear independence of these vectors and checks the linear independence of these vectors to ensure that the constructed matrix is ​​full rank.

[0015] When the coefficient matrix reaches full rank, generate the common mask Λ and the inverse matrix P -1 , and encrypt it using a symmetric encryption algorithm. The encrypted public mask Λ is distributed to each sensor device participating in the training through a secure communication channel. The sensor device decrypts the ciphertext to obtain the public mask and coefficient matrix.

[0016] Step 2-3: In each round of training of federated learning, the sensing device i will use the local dataset D i Perform local training and generate partial model output Y i k Each sensing device i has a local dataset D i The device passes the data to the local model, and through the forward propagation of the local model, the device obtains a corresponding partial model output

[0017] In each round of training, the sensor performs the above process on multiple input samples to obtain a series of partial model outputs. Combine these partial model outputs to form a partial model output matrix Y i k .

[0018] Step 2-4: To protect data privacy, the device outputs the partial model matrix Y i k Before sending to the edge server, the matrix Y i k After receiving the public mask, each sensing device outputs Y to the local model i k Divide into blocks, and the sub-blocks after division are recorded as Y i k,j , for each sub-block Y i k,j Device application private maskθ i After the device completes the encryption processing of all sub-blocks, it will output the encrypted data Q i Sent to the edge server.

[0019] Step 2-5: Mask removal and model recovery: The edge server receives the encrypted sub-block data Q sent by the device i Then, using the inverse matrix P -1 The edge server removes the mask of each sub-block and gradually restores the model output. i k After that, continue to use the output components as input to complete the training of the neural network.

[0020] The differential perturbation stage of the local model is specifically:

[0021] Step 3-1: Local model parameter initialization: At the beginning of each round of training, the edge server initializes the local model parameters ω0 for each participating device, which will be optimized through gradient updates during the training process.

[0022] Step 3-2: Gradient calculation and clipping: After each device i completes the training output of part of the model, calculate the corresponding local gradient To prevent gradient leakage, the device first clips the calculated gradient. The purpose of clipping is to ensure that the size of the gradient does not exceed the preset threshold C, thereby limiting the impact of abnormal gradients on model updates and reducing the possibility of privacy leakage.

[0023] Step 3-3: Add adaptive differential privacy perturbation: After pruning, in order to protect gradient privacy, each device will add adaptive differential privacy perturbation to the local gradient. For each device, the standard deviation σ of the noise will be dynamically adjusted according to the update speed of the model, so that the size of the noise will be adjusted according to the rate of change of the model. When the model parameters change rapidly, the noise increases, and vice versa, it decreases, so as to improve the effect of privacy protection and avoid excessive impact on model accuracy.

[0024] Step 3-4: Local model parameter update: After adding noise, the device updates the local model parameters using the perturbed gradients.

[0025] Step 3-5: Upload local model parameters: After each round of training, the device sends the updated local model parameters to the central cloud server, and the central server aggregates the local models of each edge server.

[0026] The global model aggregation and differential perturbation phase is specifically as follows:

[0027] Step 4-1: Receive local model parameters: After each round of training, the central cloud server receives the local model parameters uploaded by all participating devices. Each device sends the differentially perturbed and updated local model parameters to the central cloud server, ready for aggregation.

[0028] Step 4-2: Global model parameter aggregation: The central server receives the encrypted model parameters from each device After that, these encrypted models need to be decoded first. The decoding process is done by removing the private mask θ of each device. i After decoding, the server obtains the local model parameters of all devices ω i , and then aggregate the global model. In order to improve the efficiency of model aggregation, the server uses the weighted average method to aggregate the local models of each device.

[0029] Step 4-3: Adaptive noise addition: After the global model is aggregated, in order to protect the privacy of the global model, the server needs to add the aggregated global model parameters ω global Add adaptive noise, the adaptive differential privacy mechanism adjusts the noise standard deviation σ according to the rate of change of the global model global , to ensure that more noise is added when the model changes rapidly and less noise is added when the model tends to be stable, and then the Gaussian noise Added to the global model parameters.

[0030] Step 4-4: Global model release: After adding differential privacy noise, the central server will protect the global model Published to all devices. Each device downloads the global model and uses it as the starting model for the next round of local training until the model converges or the number of iterations is reached.

[0031] The privacy protection method includes three entities: a central cloud server, an edge server, and a sensing device;

[0032] The sensing devices are the executors of data collection and local training, usually smart phones, wearable devices or IoT terminals. They are responsible for data collection, local model training, protecting user privacy and uploading encrypted model parameters on the device side.

[0033] The edge server performs data aggregation, model management, and mask management between the sensing device and the central cloud server, provides localized processing support, reduces transmission costs, and improves privacy protection. The edge server layer is deployed close to the sensing device to reduce latency, and works in collaboration with the cloud server to jointly perform local model training for federated learning.

[0034] The central cloud server is the core coordinator of the entire system and is responsible for key tasks such as data aggregation, model aggregation, privacy protection, and global model publishing. As the central node of federated learning, it aggregates model updates from each edge server and updates the global model.

[0035] A storage medium stores at least one instruction, which is loaded and executed by a processor to implement the privacy protection method.

[0036] The advantages of the present invention are: 1. The present invention uses a hierarchical federated learning architecture. The present invention adopts a hierarchical architecture, combining sensing devices, edge nodes and central servers, so that data can be efficiently processed at different levels. The introduction of edge nodes not only reduces the computing pressure of the central server, but also can perform preliminary aggregation of model parameters of multiple sensing devices, greatly reducing the amount of data transmission. In addition, the edge nodes will perform additional encryption processing before transmitting data to the central server, further enhancing the security of the data. This hierarchical architecture design significantly improves the scalability of the system, while improving data transmission efficiency and privacy protection capabilities.

[0037] 2. The present invention uses federated learning to make data visible but unavailable. Through the federated learning framework, collaborative learning among multiple devices is achieved without uploading the original data. After each device completes model training locally, it only uploads the updated model parameters to the upper node or central server to avoid the leakage of original data. The introduction of federated learning enables each device to share the advantages of the global model, improves the accuracy of data analysis and model training, and meets the needs of efficient collaborative learning of crowd-sensing data. Under this architecture, the system can realize joint modeling of multi-source data on the basis of protecting user privacy, providing an innovative solution for the secure sharing of privacy-sensitive data.

[0038] 3. The present invention uses a multi-layer privacy protection mechanism. The present invention adopts a multi-layer privacy protection mechanism and applies technologies such as double-layer masking and multiple encryption in the process of data transmission and model aggregation. The private mask generated on the device side is combined with the public mask on the server side to ensure the double encryption of model parameters during transmission, thereby reducing the risk of privacy leakage. At the same time, adaptive differential perturbation dynamically adjusts the noise size according to the model update, ensuring privacy while maintaining model accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The following is a brief description of the contents expressed in the drawings of the present invention and the symbols in the drawings:

[0040] Figure 1 It is a schematic diagram of the principle architecture of the privacy protection method of the present invention;

[0041] Figure 2 This is a flow chart of the method for protecting privacy of crowd-sensing data based on federated learning of the present invention. DETAILED DESCRIPTION

[0042] The specific implementation of the present invention will be further explained in detail below by describing the optimal embodiment with reference to the accompanying drawings.

[0043] This embodiment is used to solve the privacy protection problem in the learning and processing process of crowd-sensing data in federated learning. It designs and provides a crowd-sensing data privacy protection method based on federated learning. It combines edge computing with federated learning, adopts a hierarchical federated learning architecture, reduces the transmission and centralized storage of perception data, and effectively reduces the risk of user privacy leakage. It adopts a multi-layer privacy protection mechanism, and realizes multiple privacy protections in the transmission and aggregation process through double-layer masking and adaptive differential perturbation. And through the distributed training model of federated learning, the data is available and invisible, and the problem of data islands is solved at the same time. In the federated learning process of crowd perception, multi-level privacy protection for the transmission and aggregation process is realized through double-layer masking and adaptive differential perturbation mechanism. The double-layer masking method combines the private mask of the device and the public mask of the server to perform multiple encryption on the model parameters to ensure the security of the parameters during transmission. The adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes in the model, while protecting data privacy and maintaining model accuracy. The specific scheme is as follows:

[0044] like Figure 1 As shown in the figure, a method for protecting privacy of crowd-sensing data based on federated learning includes three entities: a central cloud server, an edge server, and a sensing device.

[0045] Perception devices are the executors of data collection and local training. They are usually smartphones, wearable devices or IoT terminals. They are responsible for data collection, local model training, protecting user privacy and uploading encrypted model parameters on the device side.

[0046] The edge server performs data aggregation, model management, and mask management between the sensing device and the central cloud server, provides localized processing support, reduces transmission costs, and improves privacy protection. The edge server layer is deployed close to the sensing device to reduce latency, and works in collaboration with the cloud server to jointly perform local model training for federated learning.

[0047] The central cloud server is the core coordinator of the entire system, responsible for key tasks such as data aggregation, model aggregation, privacy protection, and global model publishing. As the central node of federated learning, it aggregates model updates from each edge server and updates the global model.

[0048] The present invention provides a method for protecting privacy of group intelligence perception data based on federated learning, and the execution process is as follows: Figure 2 As shown, it includes the system initialization stage, the data collection stage of the edge intelligent perception device, the training output protection mechanism stage based on the double-layer mask, the differential perturbation stage of the local model, and the global model aggregation and differential perturbation stage. The five stages of this method are as follows:

[0049] 1. The system initialization phase is as follows:

[0050] Step 1-1: Key generation and distribution: When the system is initialized, the parameter server generates a large prime number p and an initial random number r, and uses an algorithm based on discrete logarithms to generate a symmetric key K:

[0051] K=g r modp

[0052] Among them, g is a primitive root, which is used as the basis for key generation, and mod is the modulus operation. The parameter server initializes the encryption protocol by generating some basic mathematical parameters (such as large prime numbers, random numbers, etc.), and generates all the parameters required for key negotiation, and then sends these parameters to each participating device through a secure channel. Each edge server u and perception device v receives the key negotiation parameters (such as random number r u and r v ) Calculate the shared key K u,v To ensure secure communication, this key negotiation ensures confidentiality during data transmission.

[0053]

[0054] Step 1-2: Device registration and authentication: The parameter server assigns a unique ID to each sensing device i , and use the hash function H to encrypt the device identification to ensure the security of identity authentication. i is the device key, ID i Is a unique identifier for the device.

[0055] H(ID i )=hash(ID i ‖K i )

[0056] The parameter server generates a private mask θ for each sensor device i and coefficient vector λ i , these masks θ i and coefficient vector λ i Used to protect the data privacy of the device. Private mask θ i and coefficient vector λ i It is transmitted to the device after encryption to ensure the safe transmission of private data.

[0057] θ i =rand(0,1) n

[0058] Where rand is a random number generator used to generate random values, and n is the size of the generated random vector.

[0059] Step 1-3: Model parameter initialization: When the system starts, the central server sets the initial global model parameter ω0, which can be a zero vector or a small random value to ensure the stability of the initial state of the model. The initial model parameter ω0 will be distributed to all edge nodes and sensing devices. In this way, the model parameters of the entire system in the initial state remain consistent, which is convenient for subsequent collaborative training and model updates.

[0060] 2. The data collection stage of edge intelligent sensing devices is as follows:

[0061] The data collection phase of the edge intelligent sensing device is as follows: In this phase, the edge intelligent sensing device is responsible for collecting environmental data and sending the data to the border gateway. After completing the data collection, the edge intelligent device can choose to go offline or switch to other tasks without having to continue online waiting for further processing. For the border gateway, they store the data after receiving it, preparing for subsequent data aggregation processing. At the same time, each edge server downloads the initial global model from the cloud so that the model can be updated after the data is aggregated, thereby realizing distributed collaborative learning.

[0062] 3. The training output protection mechanism stage based on double-layer mask is specifically as follows:

[0063] Step 2-1: Each sensor generates a personal random mask θ at the beginning of training i , which is used to protect the privacy of the local training output data of the device. i is an n-dimensional column vector with a value range between [0,1]. i After normalization, we get the coefficient vector λ i , to ensure that the generated mask has consistent strength across devices, and uses symmetric encryption to θ i and λ i Encryption. The specific normalization formula is as follows:

[0064]

[0065] Among them, ||θ i ||2 is the coefficient vector θ i The second norm of θ is used to ensure the uniformity and stability of the mask. i and coefficient vector λ i Sent to the edge server.

[0066] Step 2-2: The edge server receives the encrypted mask vector θ from each device i and coefficient vector λ i, and construct these vectors into a common coefficient matrix P to ensure that the data blocks of each device are independently protected. The edge server uses the coefficient vectors λ1, λ2, 2λ uploaded by all devices k Construct the public coefficient matrix P. The specific steps are as follows:

[0067] (1) The coefficient vector λ of each device i as the row vector of the matrix P;

[0068] (2) The coefficient vectors of all devices are combined to form a matrix P, where each row corresponds to the coefficient vector of a device and the number of columns of the matrix is ​​consistent with the dimension of each coefficient vector.

[0069] For example, suppose there are k devices and the coefficient vector λ for each device is i =[λ i1 ,λ i2 ,2λ in ], then the common coefficient matrix P will be a k×n matrix:

[0070]

[0071] Among them, each row λ i are all coefficient vectors of device i. The edge server verifies the linear independence of these vectors and checks the linear independence of these vectors to ensure that the constructed matrix is ​​full rank. The coefficient matrix P constructed by these vectors satisfies a specific rank condition, ensuring that the data can be restored by matrix inversion when the mask is removed later.

[0072] The edge server first checks whether the received coefficient vector is linearly independent of the vectors in the existing coefficient matrix P, where the coefficient matrix P is a matrix that stores the coefficient vectors of all devices. Whenever a new device uploads its coefficient vector λ i , the edge server compares it with the existing coefficient vector. If the new coefficient vector λ i Linearly independent of the vector in the current coefficient matrix P, the edge server gradually accumulates the vector into the existing coefficient matrix P to expand the rank of the matrix. And gradually accumulate the private mask θ i , generate the public mask Λ. When the coefficient matrix reaches full rank, generate the public mask Λ and the inverse matrix P -1 , and encrypt it using a symmetric encryption algorithm. The encrypted public mask Λ is distributed to each sensor device participating in the training through a secure communication channel to ensure security during transmission. The public mask Λ is defined as:

[0073]

[0074] This process ensures that the generation of the public mask Λ fully considers the personal private masks of all devices, making it have a global protection effect. The sensing device decrypts the ciphertext to obtain the public mask and coefficient matrix.

[0075] Step 2-3: In each round of training of federated learning, the sensing device i will use the local dataset D i Perform local training and generate partial model output Y i k Each sensing device i has a local dataset D i , which contains multiple data samples {x1, x2, x3, …, x n}. These data samples are used to train the local model and generate intermediate outputs. The device takes the input sample x n Passed to the local model, through the forward propagation of the local model, the device obtains a corresponding partial model output It represents the local model for the input sample x n The intermediate result or feature representation is usually the activation result of an intermediate layer in the model.

[0076] In each round of training, the device performs the above process on multiple input samples to obtain a series of partial model outputs. Combine these partial model outputs to form a partial model output matrix Y i k ,Right now:

[0077]

[0078] Step 2-4: To protect data privacy, the perception device converts the partial model output matrix Y i k Before sending to the edge server, the matrix Y i k After each sensing device receives the public mask Λ, it outputs Y to the local model i k Divide the model into blocks and output the matrix Y according to the number of data samples i k Evenly split the output into j sub-blocks by row to reduce the risk of single data point exposure. The sub-blocks after block division are recorded as Y i k,j , for each sub-block Y i k,j Device application private maskθ i And the public mask Λ is double encrypted, the specific formula is:

[0079]

[0080] Among them, P is the public coefficient matrix. After completing the encryption processing of all sub-blocks, the sensing device will output the encrypted data Sent to the edge server.

[0081] Step 2-5: Mask removal and model recovery: The edge server receives the encrypted sub-block data Q sent by the sensing device i Then, using the inverse matrix P -1 And the common mask Λ removes the mask of each sub-block and gradually restores the model output. The decoding formula is as follows:

[0082]

[0083] Among them, Y i k,j is the model output, P -1 is the inverse matrix of the common coefficient matrix, is the encrypted output data of the sensing device, Λ is the public mask, θ i is the private mask. The edge server first removes the private mask of the device θ i , then through the inverse matrix P -1 Decrypt and remove the public mask Λ, thus recovering the original model output Q of the device i Finally, all sub-blocks are reassembled into the complete output Y i k , which is used for subsequent model aggregation. The edge server obtains the output Y of the model i k After that, continue to use the output components as input to complete the training of the neural network.

[0084] After the perception device receives the information sent by the edge server, it updates the local neural network parameters using the following formula:

[0085]

[0086] Among them, ω k is the local model parameter of the current sensing device in the kth iteration, η is the learning rate, which is used to control the step size of parameter update, is the gradient calculated by the perception device at the tth step of the current iteration. After receiving the system initialization parameters, the perception device performs model training based on local training data. During the training process, the perception device calculates the gradient To reflect the change trend of the loss function to the parameters. The local model parameter ω of the current device k According to the stochastic gradient descent method, the gradient value regulated by the learning rate is subtracted to update the model to minimize the loss function and gradually optimize the model performance. When the model converges, the perception device inputs data and sends the results to the edge server, which feeds the results back to the perception device.

[0087] 4. The differential perturbation stage of the local model is specifically as follows:

[0088] Step 3-1: Local model parameter initialization: At the beginning of each round of training, the edge server initializes the local model parameters ω0 for each participating sensing device. These parameters will be optimized through gradient updates during the training process.

[0089] Step 3-2: Gradient calculation and clipping: After each sensor device i completes the training output of part of the model, calculate the corresponding local gradient This gradient is used to update local model parameters. To prevent gradient leakage, the perception device first clips the calculated gradient. The clipping formula is:

[0090]

[0091] in, is the gradient calculated by the sensing device at the tth step of the current iteration, and C is the threshold for gradient clipping (clipping threshold, Is a regulation factor. If the magnitude of the gradient exceeds the threshold C, the gradient is limited to the range of C by scaling; if the gradient is less than C, it remains unchanged. The purpose of clipping is to ensure that the magnitude of the gradient does not exceed the preset threshold C, thereby limiting the impact of abnormal gradients on model updates and reducing the possibility of privacy leakage;

[0092] Step 3-3: Add adaptive differential privacy perturbation: After pruning, in order to protect gradient privacy, each perceptual device will add adaptive differential privacy perturbation to the local gradient. Different from the traditional fixed noise, an adaptive noise mechanism based on the model update rate is introduced here. Specifically, for each device, the standard deviation σ of the noise will be dynamically adjusted according to the update speed of the model:

[0093]

[0094] Among them, σ i is the standard deviation of the noise added by sensing device i in the current training round, σ base is the basic noise standard deviation, △ω i represents the change in model parameters of sensing device i between the previous round and the current round, △t is the time interval, and η is the adjustment coefficient. In this way, the size of the noise will be adjusted according to the rate of change of the model. When the model parameters change rapidly, the noise increases, and vice versa, it decreases, so as to improve the effect of privacy protection and avoid excessive impact on model accuracy.

[0095] Step 3-4: Local model parameter update: After adding noise, the perception device uses the perturbed gradient to update the local model parameters. The update formula is:

[0096]

[0097] Here represents Gaussian noise, with a mean of 0 and a variance of η is the adjustment coefficient, is the gradient calculated by the perception device at the current iteration step t, represents the local model parameters of device i after the update in round t+1, represents the local model parameters of sensing device i at round t.

[0098] Step 3-5: Upload local model parameters: After each round of training, the perception device sends the updated local model parameters to the central cloud server, and the central server aggregates the local models of each edge server.

[0099] 5. The global model aggregation and differential perturbation stage is specifically as follows:

[0100] Step 4-1: Receive local model parameters: After each round of training, the central cloud server receives the local model parameters uploaded by all participating devices. Each sensing device sends the differentially perturbed and updated local model parameters to the central cloud server, ready for aggregation.

[0101] Step 4-2: Global model parameter aggregation: The central server receives the encrypted model parameters from each device After that, these encrypted models need to be decoded first. The decoding process is done by removing the private mask θ of each device. i Finish:

[0102]

[0103] After decoding, the server obtains the local model parameters ω of all devices i , and then aggregate the global model. In order to improve the efficiency of model aggregation, the server uses the weighted average method to aggregate the local models of each device. The aggregation formula is:

[0104]

[0105] Among them, α i Indicates device D i The weight can be determined based on the amount of training data, model performance or other factors of each device. n is the number of devices involved in the training. ω global are the decoded local model parameters of device Di.

[0106] Step 4-3: Adaptive noise addition: After the global model is aggregated, in order to protect the privacy of the global model, the central server needs to adjust the aggregated global model parameters ω global Add noise. Here, an adaptive differential privacy mechanism is used, that is, the size of the noise is dynamically adjusted according to the changes in the model update. The adaptive differential privacy dynamic mechanism adjusts the noise standard deviation σ according to the rate of change of the global model. global , to ensure that more noise is added when the model changes rapidly, and less noise is added when the model tends to be stable. The specific formula is:

[0107] σ global =σ0×exp(-η·Δω)

[0108] Among them, △ω represents the difference between the global model of the current round and the global model of the previous round, η is the adjustment parameter, and σ0 is the standard deviation of the basic noise. The added Gaussian noise Perturb the global model parameters to protect privacy while minimizing the impact on model performance;

[0109]

[0110] Among them, ω global are the local model parameters of the decoded device Di, is the added Gaussian noise, are the global model parameters after adding noise.

[0111] Step 4-4: Global model release: After adding differential privacy noise, the central server will protect the global model Published to all devices. Each device downloads the global model and uses it as the starting model for the next round of local training until the model converges or the number of iterations is reached.

[0112] The above scheme protects private data in the federated learning process of crowd-sensing data processing, which can effectively solve the privacy protection problem of crowd-sensing data in federated learning. Multi-level privacy protection for transmission and aggregation processes is achieved through double-layer masking and adaptive differential perturbation mechanism. The double-layer masking method combines the private mask of the device and the public mask of the server to multiple-encrypt the model parameters to ensure the security of the parameters during transmission. The adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes in the model, while maintaining the model accuracy while protecting data privacy. This method uses double-layer masking technology and adaptive differential privacy mechanism to ensure the security and privacy of data transmission and aggregation processes. The layered architecture performs preliminary data processing on the edge server, reduces the pressure on the central server, and effectively improves the efficiency of data transmission. The federated learning mode trains the model locally to avoid uploading the original data, ensures that the data is available but not visible, and solves the problem of data islands to achieve efficient collaboration and privacy protection.

[0113] Obviously, the specific implementation of the present invention is not limited to the above-mentioned methods. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, they are all within the protection scope of the present invention.

Claims

1. A method for protecting privacy of crowd-sensing data based on federated learning, characterized by: In the federated learning process of crowd perception, multi-level privacy protection for the transmission and aggregation processes is achieved through double-layer masking and adaptive differential perturbation mechanism. The double-layer masking method combines the private mask of the device and the public mask of the server to perform multiple encryptions on the model parameters to ensure the security of the parameters during transmission. The adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes in the model, maintaining the model accuracy while protecting data privacy.

2. The method for protecting privacy of crowd-sensing data based on federated learning according to claim 1, characterized in that: The method includes five stages: system initialization stage, data collection stage of edge intelligent sensing device, training output protection mechanism stage based on double-layer mask, differential perturbation stage of local model, and global model aggregation and differential perturbation stage.

3. The method for protecting privacy of crowd-sensing data based on federated learning according to claim 2, characterized in that: The system initialization phase includes: Step 1-1: Key generation and distribution: When the system is initialized, the parameter server generates a large prime number p and an initial random number r, and uses an algorithm based on discrete logarithms to generate a symmetric key K. Each edge device u and perception device v receives key negotiation parameters through the parameter server and calculates the shared key K. u,v To ensure secure communications; Step 1-2: Device registration and authentication: The parameter server assigns a unique ID to each device i , and use the hash function H to encrypt the device identity to ensure the security of identity authentication; the server generates a private mask θ for each device i and coefficient vector λ i , and transmitted to each device after encryption; Step 1-3: Model parameter initialization: When the system starts, the central server sets the initial global model parameter ω0, which will be distributed to all edge nodes and sensing devices.

4. A method for protecting privacy of crowd-sensing data based on federated learning as claimed in claim 2 or 3, characterized in that: The data collection phase of the edge intelligent sensing device includes: collecting data from the edge intelligent device and sending it to the border gateway. After the collection is completed, the edge intelligent device goes offline. For the border gateway, they store data for aggregation.

5. A method for protecting privacy of crowd-sensing data based on federated learning as claimed in claim 2 or 3, characterized in that: The training output protection mechanism stage based on double-layer mask includes: Step 2-1: Each sensor generates a personal random mask vector θ at the beginning of training i , which is used to protect the privacy of the local training output data of the device, θ i is an n-dimensional column vector with a value range between [0,1]. The device will i After normalization, we get the coefficient vector λ i , and use symmetric encryption to θ i and λ i Encrypt them and then send them to the edge server; Step 2-2: The edge server receives the encrypted mask vector θ from each device i and coefficient vector λ i , and construct these vectors into a common coefficient matrix P. The server verifies the linear independence of the vectors and checks the linear independence of the vectors to ensure that the constructed matrix is ​​full rank; When the coefficient matrix reaches full rank, generate the common mask Λ and the inverse matrix P -1 , and encrypt it using a symmetric encryption algorithm. The encrypted public mask Λ is distributed to each sensor device participating in the training through a secure communication channel. The sensor device decrypts the ciphertext to obtain the public mask and coefficient matrix. Step 2-3: In each round of training of federated learning, the sensing device i uses the local dataset D i Perform local training and generate partial model output Y i k ; Each sensing device i has a local data set D i ; The device passes the data to the local model, and through the forward propagation of the local model, the device obtains a corresponding partial model output In each round of training, the perception device performs the training process on multiple input samples to obtain a series of partial model outputs; the partial model outputs are combined to form a partial model output matrix Y i k ; Step 2-4: The device outputs the partial model matrix Y i k Before sending to the edge server, the matrix Y i k After receiving the public mask, each sensing device outputs Y to the local model i k Divide into blocks, and the sub-blocks after division are recorded as Y i k,j , for each sub-block Y i k,j Device application private maskθ i and the public mask Λ for double encryption; after the device completes the encryption processing of all sub-blocks, it will output the encrypted data Q i Send to edge server; Step 2-5: Mask removal and model recovery: The edge server receives the encrypted sub-block data Q sent by the device i Then, using the inverse matrix P -1 and the common mask Λ to remove the mask of each sub-block and gradually restore the model output; the edge server obtains the output Y of the model i k After that, continue to use the output components as input to complete the training of the neural network.

6. A method for protecting privacy of crowd-sensing data based on federated learning as claimed in claim 2 or 3, characterized in that: The differential perturbation stage of the local model includes: Step 3-1: Local model parameter initialization: At the beginning of each round of training, the edge server initializes the local model parameters ω0 for each participating device. The local model parameters will be optimized through gradient updates during the training process; Step 3-2: Gradient calculation and clipping: After each device i completes the training output of part of the model, calculate the corresponding local gradient The device first clips the calculated gradient so that the gradient does not exceed the preset threshold C; Step 3-3: Add adaptive differential privacy perturbation: After cropping, each device will add adaptive differential privacy perturbation to the local gradient; for each device, the standard deviation σ of the noise will be dynamically adjusted according to the update speed of the model, and the size of the noise will be adjusted according to the rate of change of the model. When the model parameters change rapidly, the noise increases, and vice versa. Step 3-4: Local model parameter update: After adding noise, the device uses the perturbed gradient to update the local model parameters; Step 3-5: Upload local model parameters: After each round of training, the device sends the updated local model parameters to the central cloud server, and the central server aggregates the local models of each edge server.

7. A method for protecting privacy of crowd-sensing data based on federated learning as claimed in claim 2 or 3, characterized in that: The global model aggregation and differential perturbation phase includes: Step 4-1: Receive local model parameters: After each round of training, the central cloud server receives the local model parameters uploaded by all participating devices. Each device sends the differentially perturbed and updated local model parameters to the central cloud server, ready for aggregation; Step 4-2: Global model parameter aggregation: The central server receives the encrypted model parameters from each device After that, these encrypted models need to be decoded first; the decoding process is to remove the private mask θ of each device i After decoding, the server obtains the local model parameters of all devices ω i , and then aggregate the global model; Step 4-3: Adaptive noise addition: After the global model is aggregated, the server adjusts the aggregated global model parameters ω global Add adaptive noise, the adaptive differential privacy mechanism adjusts the noise standard deviation σ according to the rate of change of the global model global , to ensure that more noise is added when the model changes rapidly and less noise is added when the model tends to be stable, and then the Gaussian noise Added to the global model parameters; Step 4-4: Global model release: After adding differential privacy noise, the central server will protect the global model Published to all devices; each device downloads the global model and uses it as the starting model for the next round of local training until the model converges or the number of iterations is reached.

8. The method for protecting privacy of crowd-sensing data based on federated learning according to claim 7, characterized in that: In step 4-2, the server aggregates the local models of each device using a weighted average method.

9. A method for protecting privacy of crowd-sensing data based on federated learning as claimed in claim 2 or 3, characterized in that: The data privacy protection method of crowd-sensing based on federated learning includes three entities: the central cloud server, the edge server, and the sensing device. The sensing device is the executor of data collection and local training. It is responsible for data collection, local model training, protecting user privacy, and uploading encrypted model parameters on the device side. The edge server performs data aggregation, model management and mask management between the sensing device and the central cloud server, and provides localized processing support. The edge server layer is deployed close to the sensing device and works in collaboration with the cloud server to perform local model training of federated learning. The central cloud server is the core coordinator of the entire system, responsible for data aggregation, model aggregation, privacy protection and global model publishing. As the central node of federated learning, it aggregates model updates from each edge server and updates the global model.

10. A storage medium, characterized in that: The storage medium stores at least one instruction, and the instruction is loaded and executed by the processor to implement the method according to any one of claims 1 to 9.

Images