A Multi-Party Data Access Authorization Method Based on Federated Learning

Abstract

This invention discloses a multi-party data access authorization method based on federated learning, belonging to the field of authorization and authentication technology. This invention sets the same initial data processing model for each data participant. Each data participant inputs its own raw data into the initial data processing model to generate computational correction parameters. A correction parameter matrix is ​​generated based on the computational correction parameters. These correction parameter matrices are then overlapped and mapped to obtain the total matching degree between them. Based on the total matching degree, permission levels are set for the data participants. When any data participant generates a data access request, multiple data participants review the request and grant the corresponding data access permissions based on the review results, effectively ensuring the data privacy of the data participants.

Description

Technical Field

[0001] This invention relates to the field of authorization and authentication technology, specifically a multi-party data access authorization method based on federated learning. Background Technology

[0002] Current research on access control mainly focuses on user identity, authorization and authentication, and access authorization federation. This poses new challenges to traditional access control, especially as the surge in user demand and data volume leads to the increasing complexity of access control management environments. In addition, federated learning and privacy computing are increasingly being used in existing access control technologies.

[0003] While federated learning and privacy-preserving computation authorization methods are innovative and promising, they still have some existing shortcomings. For example, when there are too many data participants, the different data access permissions and data control permissions of each data participant make the permission management that access control technology needs to handle increasingly complex. At the same time, as the number of participants increases, the computational resources and time required for complex technical requirements such as authorization and secure computation increase dramatically, limiting the scalability and implementation efficiency of the system. How to reduce the complexity of permission management while improving the flexibility of computing resources is a challenge of existing technologies. To address this, a multi-party data access authorization method based on federated learning is proposed. Summary of the Invention

[0004] To address the aforementioned technical problems, the present invention aims to provide a multi-party data access authorization method based on federated learning.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A multi-party data access authorization method based on federated learning includes the following steps:

[0007] Step 1: Set up a shared cloud platform and set up the same initial data processing model for each data participant. Each data participant inputs its own raw data into the initial data processing model for training to generate operation correction parameters. At the same time, the shared cloud platform generates the corresponding correction parameter matrix based on the operation correction parameters of each data participant.

[0008] Step 2: Overlap the various correction parameter matrices to obtain the total matching degree between the correction parameter matrices, and set the permission level for the data participants corresponding to each correction parameter matrix based on the total matching degree.

[0009] Step 3: Each data participant uploads their respective access key to the shared cloud platform. The shared cloud platform then aggregates all access keys to generate a public access key, divides the public access key into several public access sub-keys, and randomly sends the public access sub-keys to each data participant. At the same time, a key concatenation sequence is generated according to the sending order.

[0010] Step four: The key concatenation sequence is split into several key concatenation sub-sequences and sent to data participants with higher permission levels. When the shared cloud platform receives a data access request from any data participant, multiple data participants review the data access request and grant the corresponding data access permissions based on the review results.

[0011] Furthermore, the process of generating the operational correction parameters includes:

[0012] Set up a shared cloud platform, and then assign numbers S1, S2, ..., S to each data participant on the shared cloud platform. n n is a natural number greater than 0;

[0013] The shared cloud platform simultaneously sends a preset initial data processing model to each data participant. The initial data processing model consists of an input layer, a processing layer, and an output layer.

[0014] After receiving the initial data processing model, each data participant inputs their own raw data into the input layer of the initial data processing model. Then, the input layer uses a data standardization algorithm to transform the raw data of each data participant into the same data format and sends the transformed raw data to the processing layer.

[0015] Each data participant selects the required data processing algorithm to calculate the transformed raw data and outputs the same number of operation correction parameters in the output layer.

[0016] Furthermore, the process of establishing the correction parameter matrix based on the aforementioned operational correction parameters includes:

[0017] Each data participant will integrate all computational correction parameters to generate a parameter data package, label it with the corresponding number, and send it to the shared cloud platform;

[0018] Once the shared cloud platform determines that it has received parameter data packets from all data participants, it extracts the computational correction parameters from each parameter data packet and establishes a correction parameter matrix K, which can be represented as:

[0019] Where t i，a and m i，a Indicates that the number is S iThe data participant's feature operation correction parameter and target operation correction parameter, K i Indicates that the number is S i The data participants' correction parameter matrix, where a is a natural number greater than 0, and i is less than or equal to n.

[0020] Furthermore, the process of obtaining the total matching degree between the various correction parameter matrices based on the correction parameter matrix includes:

[0021] The various correction parameter matrices are overlapped and mapped, and the matching degree between each correction parameter matrix is ​​calculated. The total matching degree is then obtained based on the matching degree between the various correction parameter matrices. The formula for calculating the total matching degree is as follows:

[0022]

[0023] Where P i Indicates that the number is K i The total matching degree of the modified parameter matrix, N = n-1, M j，i and T j，i These represent the numbers K. j K i The target matching degree and feature matching degree between the corrected parameter matrices.

[0024] Furthermore, the process of setting permission levels for data participants based on the overall matching degree includes:

[0025] A fixed number of permission level pools are set up, and the total matching degree of each correction parameter matrix is ​​summed to obtain the matching percentage p of each correction parameter matrix. The formula for calculating the matching percentage p is as follows:

[0026] The matching percentages of each correction parameter matrix are arranged in descending order. Then, starting with the correction parameter matrix with the highest matching percentage, the expected permission level G of each data participant is calculated.

[0027] Based on the expected permission level G of each data participant, the permission level pool assigns the same permission level value to the corresponding data participant in descending order. Whenever a data participant obtains a permission level from the permission level pool, the permission level pool is reduced by the corresponding level. When the remaining level in the permission level pool is less than the expected permission level G, the permission level pool will assign all remaining levels to the corresponding data participant.

[0028] Furthermore, the process of generating the public access subkey includes:

[0029] Each data participant generates its own access key and marks it with a corresponding number. When the shared cloud platform determines that it has received the access keys of all data participants, it concatenates the access keys in sequence according to the numbers on each access key to obtain the public access key.

[0030] The public access key is divided into several public access subkeys of equal size from left to right. These subkeys are then randomly assigned to each data participant. A key concatenation sequence is generated based on the order in which the public access subkeys are divided and the corresponding data participant number.

[0031] Furthermore, the process of authorizing access to the data participants includes:

[0032] Set permission level thresholds, compare the permission levels of each data participant with the permission level thresholds, and then select data participants whose permission levels are greater than or equal to the permission level thresholds and mark them as management data participants;

[0033] The key concatenation sequence is split into the same number of key concatenation sub-sequences as the number of management data participants, and then the key concatenation sub-sequences are sent to each management data participant;

[0034] When any data participant sends a data access request to the shared cloud platform, the shared cloud platform will send the data access request to other data participants, where the data access request includes the number of the data participant that it wishes to access;

[0035] If more than half of the data participants approve the data access request, the data access request is deemed approved and the corresponding data participants are granted access rights; otherwise, the data access request is rejected.

[0036] Furthermore, once the data participants have obtained access rights, each data participant uploads its publicly held access subkey to the shared cloud platform.

[0037] Based on the ID of the data participant sending the data access request and the ID of the data participant it wishes to access, the correction parameter matrices of both parties are overlapped and mapped, and the target parameter set and feature parameter set are generated based on the overlap.

[0038] The shared cloud platform sends the target parameter set and feature parameter set to the data participants who wish to access the data in the data access request, and then the participants retrieve the corresponding parts from the original data based on the target parameter set and feature parameters to generate access data;

[0039] At the same time, the shared cloud platform obtains key splicing sub-sequences from various management data participants, generates key splicing sequences based on the key splicing sub-sequences, and then splices public access sub-keys based on the key splicing sequences to obtain public access key;

[0040] Several access keys are randomly selected from the public access key, and then the access data is encrypted using the selected access keys to generate the corresponding decryption key;

[0041] The shared cloud platform sends the decryption key and access data to the corresponding data participants. After decrypting the access data using the decryption key, the data participants input the decrypted access data into their unique data processing model to obtain the data they need.

[0042] Compared with the prior art, the beneficial effects of the present invention are:

[0043] 1. This invention sets the same initial data processing model for each data participant. Each data participant inputs its own raw data into the initial data processing model for training to generate computational correction parameters. At the same time, the shared cloud platform generates corresponding correction parameter matrices based on the computational correction parameters of each data participant. The shared cloud platform overlaps and maps the correction parameter matrices to obtain the total matching degree between the correction parameter matrices. Then, based on the total matching degree, permission levels are set for the data participants corresponding to each correction parameter matrix. The data correlation between each data participant is determined based on the correction parameters, and corresponding permission levels are set for each data participant based on the data correlation, thus simplifying the permission level management process.

[0044] 2. This invention involves each data participant uploading their respective access control keys to a shared cloud platform. The shared cloud platform then aggregates all access control keys to generate a public access control key, which is divided into several public access control sub-keys. These sub-keys are randomly sent to each data participant, and a key concatenation sequence is generated according to the sending order. This key concatenation sequence is then split into several key concatenation sub-sequences and sent to data participants with higher access levels. When the shared cloud platform receives a data access request from any data participant, multiple data participants review the request and grant the corresponding data access rights based on the review results. This reduces direct communication between data participants and effectively ensures their data privacy. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0046] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0048] like Figure 1 As shown, a multi-party data access authorization method based on federated learning includes the following steps:

[0049] Step 1: Set up a shared cloud platform and set up the same initial data processing model for each data participant. Each data participant inputs its own raw data into the initial data processing model for training to generate operation correction parameters. At the same time, the shared cloud platform generates the corresponding correction parameter matrix based on the operation correction parameters of each data participant.

[0050] Specifically, a shared cloud platform is set up, and then the shared cloud platform assigns numbers S1, S2, ..., S to each data participant. n , where n is a natural number greater than 0, and n represents the total number of data participants;

[0051] The shared cloud platform simultaneously sends a preset initial data processing model to each data participant. The initial data processing model consists of an input layer, a processing layer, and an output layer.

[0052] It should be noted that the input layer has multiple data standardization algorithms pre-set to integrate the raw data from various data participants into the same data format. The processing layer has multiple data processing algorithms pre-set, such as linear regression. The output layer has the same data standardization algorithm as the input layer to ensure that the data format of the raw data processing results from various data participants is the same.

[0053] After receiving the initial data processing model, each data participant inputs their own raw data into the input layer of the initial data processing model. Then, the input layer uses a data standardization algorithm to transform the raw data of each data participant into the same data format and sends the transformed raw data to the processing layer.

[0054] Each data participant selects the required data processing algorithm to calculate the transformed raw data and outputs the same number of calculation correction parameters in the output layer;

[0055] It should be noted that the operation correction parameters are divided into feature operation correction parameters and target operation correction parameters. Feature operation correction parameters are generated based on the data characteristics of the original data, while target operation correction parameters are generated based on the data target of the original data. For example, if the original data of a data participant is bank business data, then the data characteristics of the original data are loan type and deposit type, and the target characteristics are depositors or loaners.

[0056] Each data participant modifies the initial data processing model based on the computational correction parameters, thereby generating their own unique data processing model;

[0057] Each data participant will integrate all computational correction parameters to generate a parameter data package, label it with the corresponding number, and send it to the shared cloud platform;

[0058] Once the shared cloud platform determines that it has received parameter data packets from all data participants, it extracts the computational correction parameters from each parameter data packet and establishes a correction parameter matrix K, which can be represented as:

[0059] Where t i，a and m i，a Let i and a represent the feature operation correction parameter and target operation correction parameter of data participant S, where i and a are natural numbers greater than 0 and i is less than or equal to n.

[0060] Step 2: The shared cloud platform performs overlapping mapping on the various correction parameter matrices to obtain the total matching degree between the various correction parameter matrices, and then sets the permission level for the data participants corresponding to each correction parameter matrix based on the total matching degree.

[0061] Specifically, the shared cloud platform will sequentially overlap and map the correction parameter matrix numbered K1 with other correction parameter matrices, and calculate the matching degree between the correction parameter matrix numbered K1 and other correction parameter matrices.

[0062] It should be noted that during the overlapping mapping of the various correction parameter matrices, the feature operation correction parameters and the target operation correction parameters are overlapped separately.

[0063] The total matching degree is obtained based on the matching degree between the correction parameter matrix numbered K1 and other correction parameter matrices;

[0064] The process of obtaining the total matching degree of the corresponding correction parameter matrix based on the matching degree includes:

[0065] The total matching degree is calculated based on the matching degree between the modified parameter matrix and other modified parameter matrices, where the formula for calculating the total matching degree is:

[0066]

[0067] Where P i Indicates that the number is K i The total matching degree of the modified parameter matrix, N = n-1, M j，i and T j，i These represent the numbers K. j K i The target matching degree and feature matching degree between the corrected parameter matrices;

[0068] The same method is used to obtain the total matching degree of all correction parameter matrices, and then the permission level of the corresponding data participants is set according to the total matching degree of each correction parameter matrix;

[0069] The process of setting permission levels for data participants based on the overall matching degree includes:

[0070] A permission level pool of 100 levels is set up, and the total matching degree of each correction parameter matrix is ​​added together to obtain the matching percentage p of each correction parameter matrix. The formula for calculating the matching percentage p is as follows:

[0071] The matching percentages of each correction parameter matrix are arranged in descending order. Then, starting with the correction parameter matrix with the highest matching percentage, the expected permission level G of each data participant is calculated.

[0072] Based on the expected permission level G of each data participant, the permission level pool assigns the same permission level value to the corresponding data participant in descending order. Whenever a data participant obtains a permission level from the permission level pool, the permission level pool is reduced by the corresponding level. When the remaining level in the permission level pool is less than the expected permission level G, the permission level pool will assign all remaining levels to the corresponding data participant.

[0073] Step 3: Each data participant uploads their respective access key to the shared cloud platform. The shared cloud platform then aggregates all access keys to generate a public access key, divides the public access key into several public access sub-keys, and randomly sends the public access sub-keys to each data participant. At the same time, a key concatenation sequence is generated according to the sending order.

[0074] Specifically, each data participant generates its own access key and labels it with a corresponding number, and then sends the access key to the shared cloud computing platform;

[0075] The shared cloud platform counts the number of each access key to determine whether it has received access keys from all data participants.

[0076] Once the shared cloud platform determines that it has received the access control keys from all data participants, it concatenates the access control keys sequentially according to the number attached to each access control key to obtain the public access control key.

[0077] The public access key is divided into 100 equal-sized public access subkeys from left to right. These subkeys are then randomly assigned to each data participant. A key concatenation sequence is generated based on the order in which the public access subkeys are divided and the corresponding data participant number.

[0078] Step 4: The key concatenation sequence is split into several key concatenation sub-sequences and sent to data participants with higher permission levels. When the shared cloud platform receives a data access request from any data participant, multiple data participants review the data access request and grant the corresponding data access permissions based on the review results.

[0079] Specifically, a permission level threshold is set, and the permission level of each data participant is compared with the permission level threshold. Then, data participants with permission levels greater than or equal to the permission level threshold are selected and marked as management data participants.

[0080] The key concatenation sequence is split into the same number of key concatenation sub-sequences as the number of management data participants, and then the key concatenation sub-sequences are sent to each management data participant;

[0081] It should be noted that after the shared cloud platform sends the key concatenation subsequence to each management data participant, the shared cloud platform automatically deletes the public access permission subkey and the key concatenation subsequence generation record.

[0082] When any data participant sends a data access request to the shared cloud platform, the shared cloud platform will send the data access request to other data participants, where the data access request includes the number of the data participant that it wishes to access;

[0083] If more than half of the data participants approve the data access request, the data access request is deemed approved and the corresponding data participants are granted access rights. Otherwise, the data access request is rejected, and each data participant uploads its public access subkey to the shared cloud platform.

[0084] Based on the ID of the data participant sending the data access request and the ID of the data participant it wishes to access, the shared cloud platform retrieves the corresponding correction parameter matrix, overlaps and maps the correction parameter matrices of both parties, and generates the target parameter set and feature parameter set based on the overlapping part of the two.

[0085] The shared cloud platform sends the target parameter set and feature parameter set to the data participant who wants to access the data in the data access request. Then, the participant retrieves the corresponding part from the original data according to the target parameter set and feature parameters, generates access data, and uploads it to the shared cloud platform.

[0086] At the same time, the shared cloud platform obtains key splicing sub-sequences from various management data participants, generates key splicing sequences based on the key splicing sub-sequences, and then splices public access sub-keys based on the key splicing sequences to obtain public access key;

[0087] Several access keys are randomly selected from the public access key, and then the access data is encrypted using the selected access keys to generate the corresponding decryption key;

[0088] The shared cloud platform sends the decryption key and access data to the corresponding data participants. After decrypting the access data using the decryption key, the data participants input the decrypted access data into their unique data processing model to obtain the data they need.

[0089] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A multi-party data access authorization method based on federated learning, characterized in that, Includes the following steps: Step 1: Set up a shared cloud platform and set up the same initial data processing model for each data participant. Each data participant inputs its own raw data into the initial data processing model for training to generate operation correction parameters. At the same time, the shared cloud platform generates the corresponding correction parameter matrix based on the operation correction parameters of each data participant. Step 2: Overlap the various correction parameter matrices to obtain the total matching degree between the correction parameter matrices, and set the permission level for the data participants corresponding to each correction parameter matrix based on the total matching degree. Step 3: Each data participant uploads their respective access key to the shared cloud platform. The shared cloud platform then aggregates all access keys to generate a public access key, divides the public access key into several public access sub-keys, and randomly sends the public access sub-keys to each data participant. At the same time, a key concatenation sequence is generated according to the sending order. Step four: The key concatenation sequence is split into several key concatenation sub-sequences and sent to data participants with higher permission levels. When the shared cloud platform receives a data access request from any data participant, multiple data participants review the data access request and grant the corresponding data participants data access permissions based on the review results.

2. The multi-party data access authorization method based on federated learning according to claim 1, characterized in that, The process of generating the operation correction parameters includes: Set up a shared cloud platform, and then assign numbers S1, S2, ..., S to each data participant on the shared cloud platform. n n is a natural number greater than 0; The shared cloud platform simultaneously sends a preset initial data processing model to each data participant. The initial data processing model consists of an input layer, a processing layer, and an output layer. After receiving the initial data processing model, each data participant inputs their own raw data into the input layer of the initial data processing model. Then, the input layer uses a data standardization algorithm to transform the raw data of each data participant into the same data format and sends the transformed raw data to the processing layer. Each data participant selects the required data processing algorithm to calculate the transformed raw data and outputs the same number of operation correction parameters in the output layer.

3. The multi-party data access authorization method based on federated learning according to claim 2, characterized in that, The process of establishing the correction parameter matrix based on the operational correction parameters includes: Each data participant will integrate all computational correction parameters to generate a parameter data package, label it with the corresponding number, and send it to the shared cloud platform; Once the shared cloud platform determines that it has received parameter data packets from all data participants, it extracts the computational correction parameters from each parameter data packet and establishes a correction parameter matrix K, which is represented as: Where t i，a and m i，a Indicates that the number is S i The data participant's feature operation correction parameter and target operation correction parameter, K i Indicates that the number is S i The data participants' correction parameter matrix, where a is a natural number greater than 0, and i is less than or equal to n.

4. The multi-party data access authorization method based on federated learning according to claim 3, characterized in that, The process of obtaining the total matching degree between the various correction parameter matrices based on the correction parameter matrix includes: The various correction parameter matrices are overlapped and mapped, and the matching degree between each correction parameter matrix is ​​calculated. The total matching degree is then obtained based on the matching degree between the various correction parameter matrices. The formula for calculating the total matching degree is as follows: Where P i Indicates that the number is K i The total matching degree of the modified parameter matrix, N = n-1, M j，i and T j，i These represent the numbers K. j K i The target matching degree and feature matching degree between the corrected parameter matrices.

5. The multi-party data access authorization method based on federated learning according to claim 4, characterized in that, The process of setting permission levels for data participants based on the overall matching degree includes: A fixed number of permission level pools are set up, and the total matching degree of each correction parameter matrix is ​​summed to obtain the matching percentage p of each correction parameter matrix. The formula for calculating the matching percentage p is as follows: The matching percentages of each correction parameter matrix are arranged in descending order. Then, starting with the correction parameter matrix with the highest matching percentage, the expected permission level G of each data participant is calculated. Based on the expected permission level G of each data participant, the permission level pool assigns the same permission level value to the corresponding data participant in descending order. Whenever a data participant obtains a permission level from the permission level pool, the permission level pool is reduced by the corresponding level. When the remaining level in the permission level pool is less than the expected permission level G, the permission level pool will assign all remaining levels to the corresponding data participant.

6. The multi-party data access authorization method based on federated learning according to claim 5, characterized in that, The process of generating the public access permission subkey includes: Each data participant generates its own access key and marks it with a corresponding number. When the shared cloud platform determines that it has received the access keys of all data participants, it concatenates the access keys in sequence according to the numbers on each access key to obtain the public access key. The public access key is divided into several public access subkeys of equal size, and the public access subkeys are randomly assigned to each data participant. A key concatenation sequence is generated according to the order of the public access subkeys and the corresponding data participant number.

7. The multi-party data access authorization method based on federated learning according to claim 6, characterized in that, The process of authorizing access to the data participants includes: Set permission level thresholds, compare the permission levels of each data participant with the permission level thresholds, select data participants whose permission levels are greater than or equal to the permission level thresholds, and mark them as management data participants; The key concatenation sequence is split into the same number of key concatenation sub-sequences as the number of management data participants, and then the key concatenation sub-sequences are sent to each management data participant; When any data participant sends a data access request to the shared cloud platform, the shared cloud platform will send the data access request to other data participants, where the data access request includes the number of the data participant that it wishes to access; If more than half of the data participants approve the data access request, the data access request is deemed approved and the corresponding data participants are granted access rights; otherwise, the data access request is rejected.

8. The multi-party data access authorization method based on federated learning according to claim 7, characterized in that, Once the data participants have obtained access rights, each data participant uploads its public access subkey to the shared cloud platform. Based on the ID of the data participant sending the data access request and the ID of the data participant it wishes to access, the correction parameter matrices of both parties are overlapped and mapped, and the target parameter set and feature parameter set are generated based on the overlap. The shared cloud platform sends the target parameter set and feature parameter set to the data participants who wish to access the data in the data access request, and then the participants retrieve the corresponding parts from the original data based on the target parameter set and feature parameters to generate the access data. At the same time, the shared cloud platform obtains key splicing sub-sequences from various management data participants, generates key splicing sequences based on the key splicing sub-sequences, and then splices public access sub-keys based on the key splicing sequences to obtain public access key; Several access keys are randomly selected from the public access key, and then the access data is encrypted using the selected access keys to generate the corresponding decryption key; The shared cloud platform sends the decryption key and access data to the corresponding data participants. After decrypting the access data according to the decryption key, the data participants input the decrypted access data into their unique data processing model to obtain the data they need.

Images