A model parameter aggregation method and system based on flow security multi-party computation, a terminal device, and a medium

Abstract

The application discloses a model parameter aggregation method and system based on flow security multi-party computation, terminal equipment and medium, relates to the technical field of federated learning, and is applied to a server and a client which is provided with an exit stage in advance, and the method comprises the following steps: the server sets global model initialization parameters and broadcasts the global model initialization parameters to the client; the client calculates updated local parameters and constructs bit secret shares which are sent to the server; the server converts the bit secret shares into arithmetic secret shares, calculates 2 norms by using square sum tuples, checks the square sum tuples, aggregates parameters after the checking, updates a global model, and broadcasts the global model; and the application improves verification efficiency, reduces communication and calculation amount by constructing square sum tuples, and realizes safe exit of the client in multiple stages by designing a flow mechanism of dynamic exit of the client and task handover of the server, so that the flow and equipment robustness of parameter aggregation are enhanced without affecting operation of the protocol.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning, and particularly relates to a model parameter aggregation method and system based on flow security multi-party computation, a terminal device and a medium. BACKGROUND

[0002] Federated learning (FL) is a new distributed machine learning mechanism, whose core idea is "data does not move, model moves", that is, the data is not uploaded to the central server for joint training, but the updated local parameters are uploaded to the server after local training, and the global model is obtained through parameter aggregation. This mechanism not only reduces the uploading of user data, but also fully utilizes the computing power of the client and reduces the computing load of the central server. Usually, when the model parameters are aggregated, it is necessary to ensure that the server cannot obtain the real model parameters, that is, the secure aggregation of model parameters.

[0003] In the prior art, the main methods for realizing secure aggregation are differential privacy (DP), homomorphic encryption (HE) and secure multi-party computation (MPC). Among them, the secure multi-party computation method can ensure the privacy of data as long as the honest participants occupy a certain proportion. Compared with other privacy computing technologies, MPC has the characteristics of more extensive computing mode and stronger privacy protection. However, the above framework still has problems. First, malicious clients will upload incorrect model parameters or data secret shares to try to destroy the correctness of the model and affect the usability of the model. The existing related work can effectively prevent malicious model parameters through norm checking and Byzantine defense methods, but the related work has the problems of low computing efficiency and high communication overhead. Second, the client downtime is uncontrollable, and the client device performance is inconsistent. When the client cannot complete the execution of the protocol, the existing parameter aggregation protocol will be suspended, and there is a problem that it cannot flexibly cope with different performance of client devices, temporary exit of client, and waste of computing resources.

[0004] Therefore, there is an urgent need for a method to solve the above problems to fill the gap in the prior art. SUMMARY

[0005] The technical problems to be solved by the present application are that in the technical field of federated learning, malicious clients upload error parameters or secret shares to destroy the model, although there are defense methods such as norm checking, but the calculation efficiency is low and the communication overhead is high. Secondly, when the client cannot completely execute the protocol due to downtime, performance difference, etc., the existing aggregation protocol will be suspended, and it cannot flexibly cope with device performance difference and temporary exit of the client, resulting in waste of computing resources. These problems affect the efficiency and practicability of secure aggregation.

[0006] In order to solve the above technical problems, the technical scheme adopted by the present application is as follows:

[0007] In a first aspect, the present application provides a model parameter aggregation method based on flow security multi-party computation, which is applied to a server and a client interacting with the server, the client is pre-set with an exit stage, the exit stage refers to any one stage before the server converts the bit secret share into an arithmetic secret share after the client updates the parameters, the method comprises:

[0008] The server sets the initialization parameters of the global model, and broadcasts the initialization parameters to the client;

[0009] The client updates the parameters based on the local data and the initialization parameters, obtains updated local parameters, constructs the updated local parameters into a bit secret share, and sends it to the server;

[0010] The server receives the bit secret share, converts the bit secret share into an arithmetic secret share, and calculates the 2-norm of the arithmetic secret share using the square and tuple;

[0011] The server checks the 2-norm, and after the check is passed, the arithmetic secret share is aggregated to obtain an aggregated parameter, and the global model is updated using the aggregated parameter to obtain an updated global model;

[0012] The server broadcasts the updated global model to the client.

[0013] In an implementation manner, the client is multiple, and the setting of the exit stage for the client comprises:

[0014] For any client, the exit stage of the client is confirmed before the parameter update is performed;

[0015] After the exit stage execution is completed, the client exits.

[0016] In an implementation manner, the server is two, the parameter update is performed by the client based on the local data and the initialization parameter, the updated local parameter is obtained, and the updated local parameter is constructed as a bit secret share and sent to the server, including:

[0017] The local data and the initialization parameter are input into a preset model training function by the client, and the updated local parameter is calculated.

[0018] The updated local parameter is converted into a binary form by the client to obtain a bit sequence composed of a plurality of bits.

[0019] The bit sequence is split by the client to generate two corresponding bit secret shares, wherein the two bit secret shares can restore the bit sequence after combination.

[0020] The two bit secret shares are sent to the two servers by the client.

[0021] In an implementation manner, before the bit secret share is converted into an arithmetic secret share, it includes:

[0022] A group of client COT random numbers are generated by the client based on the bit sequence, and the client COT random numbers are sent to the two servers.

[0023] A group of server COT random numbers are generated by the two servers in cooperation, wherein one of the two servers generates a random seed and calculates a part of random number shares, and the other receives the random seed based on a preset protocol and generates a corresponding complementary random number share, and the part of random number shares and the complementary random number share jointly form the complete server COT random number.

[0024] The client COT random numbers sent by the client are received by the two servers, a COT random number-based security verification protocol is executed, and if the verification is successful, the complete COT random number is obtained in combination with the server COT random number.

[0025] If the verification fails, the data of the client is rejected.

[0026] In an implementation manner, before the bit secret share is converted into an arithmetic secret share, it further includes:

[0027] The client generates a client square sum tuple, and splits the client square sum tuple into two client square sum tuple secret shares, and sends the two client square sum tuple secret shares to the two servers respectively, wherein the square sum tuple contains a target value and a plurality of random numbers, and the target value is equal to the sum of squares of the rest of the random numbers;

[0028] The two servers cooperate to generate a set of server square sum tuples, and each server obtains a secret share corresponding to the server square sum tuple;

[0029] The two servers receive the client square sum tuple secret shares sent by the client, execute a secure verification protocol based on the square sum tuple, and if the verification is successful, combine the server square sum tuple to obtain a complete square sum tuple;

[0030] If the verification fails, the data of the client is rejected.

[0031] In an implementation mode, the receiving, by the server, of the bit secret share, the conversion of the bit secret share into an arithmetic secret share, and the calculation of the 2-norm of the arithmetic secret share using a square sum tuple, comprise:

[0032] The two servers perform bit operations on the bit secret share respectively to obtain respective integer domain arithmetic secret shares, wherein the sum of the arithmetic secret shares held by the two servers is equal to the updated local parameter;

[0033] The two servers perform association processing on the arithmetic secret share and the square sum tuple, wherein one of the two servers calculates a square term based on the held arithmetic secret share and the partial elements of the square sum tuple, and the second server calculates a corresponding square term based on the locally held arithmetic secret share and the remaining elements of the square sum tuple;

[0034] The two servers securely interact and combine the respective square terms to obtain the square sum of the arithmetic secret share, and the square sum of the arithmetic secret share is the 2-norm of the arithmetic secret share.

[0035] In an implementation mode, the checking, by the server, of the 2-norm, comprises:

[0036] The two servers perform sign bit extraction on the 2-norm of the arithmetic secret share to obtain bit shares of the sign bit;

[0037] The two servers open the respective held bit shares of the sign bit;

[0038] If the sign bit is negative, the data of the client is rejected.

[0039] In a second aspect, the embodiments of the present application also provide a model parameter aggregation system based on secure multi-party computation of flow, which is applied to a server and a client interacting with the server, the client being pre-configured with an exit stage, the exit stage referring to any stage before the server converts bit secret shares into arithmetic secret shares after the client performs parameter update, and the system comprising:

[0040] an initialization parameter broadcasting module configured to set initialization parameters of a global model by the server and broadcast the initialization parameters to the client;

[0041] a bit secret share constructing module configured to perform parameter update by the client based on local data and the initialization parameters, obtain updated local parameters, and construct the updated local parameters into bit secret shares and send the bit secret shares to the server;

[0042] an arithmetic secret share constructing module configured to receive the bit secret shares by the server, convert the bit secret shares into arithmetic secret shares, and calculate 2-norm of the arithmetic secret shares by using square and tuple;

[0043] a parameter aggregation module configured to check the 2-norm by the server, aggregate the arithmetic secret shares to obtain aggregated parameters after the check passes, and update the global model by using the aggregated parameters to obtain an updated global model;

[0044] a global model broadcasting module configured to broadcast the updated global model to the client by the server.

[0045] In a third aspect, the embodiments of the present application also provide a terminal device, which comprises a memory, a processor, and a model parameter aggregation program based on secure multi-party computation of flow stored in the memory and executable on the processor, and the processor implements the steps of the model parameter aggregation method based on secure multi-party computation of flow when executing the model parameter aggregation program based on secure multi-party computation of flow.

[0046] In a fourth aspect, the embodiments of the present application also provide a computer readable storage medium, which stores a model parameter aggregation program based on secure multi-party computation of flow, and the processor implements the steps of the model parameter aggregation method based on secure multi-party computation of flow when executing the model parameter aggregation program based on secure multi-party computation of flow.

[0047] Beneficial effects: The application discloses a model parameter aggregation method and system based on flow security multi-party computation, a terminal device and a medium, relates to the technical field of federated learning, and is applied to a server and a client interacting with the server. The client is provided with an exit stage in advance. The exit stage refers to any stage before the server converts a bit secret share into an arithmetic secret share after the client updates parameters. The method comprises the following steps: setting an initialization parameter of a global model through the server, and broadcasting the initialization parameter to the client; updating parameters based on local data and the initialization parameter through the client, obtaining updated local parameters, constructing the updated local parameters into a bit secret share, and sending the bit secret share to the server; receiving the bit secret share through the server, converting the bit secret share into an arithmetic secret share, and calculating the 2-norm of the arithmetic secret share by using a square and tuple; checking the 2-norm through the server, obtaining aggregated parameters by aggregating the arithmetic secret share after the check is passed, and updating the global model by using the aggregated parameters to obtain an updated global model; and broadcasting the updated global model to the client through the server. Through the dual-server and multi-client architecture, the application realizes efficient verification by combining a square and tuple, reduces the communication volume and the calculation amount, improves the 2-norm calculation efficiency, resists malicious client attacks, guarantees the parameter aggregation security, balances the efficiency and robustness, effectively solves the problem of safe aggregation of model parameters in federated learning. Meanwhile, a dynamic exit mechanism of the client is designed, the multi-stage safe exit is supported, the protocol operation is not affected, and the adaptive capacity of the system to dynamic changes of devices is enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 The flowchart of the specific implementation of the model parameter aggregation method based on flow security multi-party computation provided by the embodiment of the application is provided.

[0049] Figure 2 The application provides a model parameter aggregation method based on flow security multi-party computation.

[0050] Figure 3 The application provides a model parameter aggregation method based on flow security multi-party computation.

[0051] Figure 4 The application provides a model parameter aggregation method based on flow security multi-party computation. DETAILED DESCRIPTION

[0052] For the purposes of the present invention, the technical solutions and effects are more clear and explicit, the following embodiments are further described with reference to the drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and do not limit the present invention.

[0053] The flowchart shown in the drawings is only an example and does not necessarily include all contents and operations or steps, nor does it necessarily execute in the order described. For example, some operations or steps can be further divided, combined or partially merged, so the actual execution order may be changed according to the actual situation.

[0054] It should be understood that the terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present invention specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0055] It should be understood that in order to facilitate the clear description of the technical solutions of the embodiments of the present invention, in the embodiments of the present invention, the same items or similar items with basically the same function and role are distinguished by using "first", "second" and the like. For example, the first control information and the second control information are only used to distinguish different control information, and do not limit the order.

[0056] Those skilled in the art can understand that the "first", "second" and the like do not limit the quantity and execution order, and the "first", "second" and the like do not necessarily mean different.

[0057] It should also be understood that the term "and / or" used in the present invention specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0058] In the field of federated learning technology, the secure aggregation of model parameters is a core step to achieve distributed training and data privacy protection. Existing federated learning frameworks usually adopt a multi-client collaborative training mode, where clients calculate model update parameters based on local data and then aggregate the parameters to optimize the global model. However, this process faces two major technical problems. On the one hand, malicious clients may launch attacks by submitting false parameters or tampering with data, leading to a decrease in the accuracy of the aggregated global model or even its failure. To counter such attacks, existing technologies often use encryption verification mechanisms, such as homomorphic encryption, zero-knowledge proof, and other methods. However, these methods often involve high computational overhead and communication costs, making them difficult to adapt to large-scale client scenarios. On the other hand, clients often dynamically exit training due to device resource limitations, network fluctuations, or task priority adjustments. Existing aggregation protocols lack flexible exit mechanisms. If a client exits at an inappropriate time, it may result in the absence of parameter shares, compromising the integrity of secret sharing and forcing the entire training process to restart. If the exit phase is forcibly restricted, it reduces the practicality and scalability of federated learning, failing to meet the dynamic fluidity needs of clients in actual applications.

[0059] On this basis, the 2-norm, as a verification data method, is widely used and is usually implemented using multiplication triplets and square tuples for fast computation. In the malicious client model, to address the low efficiency of 2-norm calculation and the high communication volume between clients and servers in parameter secure aggregation, based on secret sharing technology, the client square sum tuple generation method, the server square sum tuple generation method, the server square sum tuple verification method, and the square sum tuple calculation method are researched, which realizes efficient verification of the 2-norm and provides possible implementations by different participants for tuple generation, laying the foundation for designing a secure aggregation method that supports fluidity.

[0060] In addition, it should be noted that the model targeted by the present invention is a general model, such as a convolutional neural network, logistic regression, etc. To address the problem of wasted computational resources due to the inability of the protocol to execute smoothly in the absence of participating parties caused by actual client downtime due to network disconnection, temporary power outages, malicious motives, etc., a secure aggregation fluidity mechanism is designed that supports client task segmentation, client exit, and server task handover mechanisms. Based on secret sharing technology, combined with COT and square sum tuple technology, a model parameter aggregation method based on fluid secure multi-party computation is designed, allowing clients to exit at multiple stages without affecting the operation of the protocol, achieving fluidity in model parameter aggregation, and thus improving the robustness of parameter aggregation to devices.

[0061] Figure 2The whole protocol flow schematic diagram of the model parameter aggregation method based on flow security multi-party computation is shown, which includes all protocols in the flow security aggregation computation. In the flow schematic diagram, the step of the server broadcasting the global model parameter to the client is omitted. The protocol process is divided into five stages, stage 1 is the task selection stage, stage 2 is the gradient calculation and share generation stage, stage 3 is the OT (Oblivious Transfer, Oblivious Transfer) random number preparation stage, stage 4 is the square sum tuple preparation stage, and stage 5 is the data checking and gradient aggregation stage. The client and the server perform corresponding tasks at different times. The client informs the server whether to participate in the COT generation stage and the square sum tuple generation stage in the task selection stage, and can quit in advance if it does not participate. Other clients quit at the end of the square sum tuple preparation stage, and stage 5 only requires the server to participate, and the server performs data checking and gradient aggregation. The specific protocol flow of each stage is described in the following embodiment.

[0062] The model parameter aggregation method based on flow security multi-party computation provided in this embodiment is applied to a server and a client interacting with the server, and the client is pre-set with an exit stage, which refers to any one stage before the server converts the bit secret share into an arithmetic secret share after the client performs parameter update, as shown in the following formula: Figure 1 The method specifically includes the following steps:

[0063] Step S100, setting the initialization parameter of the global model through the server, and broadcasting the initialization parameter to the client.

[0064] In this embodiment, a double-server layout architecture is adopted to realize secret share distributed storage, security verification and anti-malicious attack, and specifically includes two servers , a client , setting the initialization parameter of the global model through the server, and broadcasting the initialization parameter to the client, all clients have the global model parameter , which represents that the global model parameter belongs to an -dimensional space in the modulus of the integer field . Wherein, the global model can be a general model, such as convolutional neural network, logistic regression, etc.

[0065] In one implementation mode, the client is multiple, and the setting of the exit stage for the client includes:

[0066] Step S110, for any client, confirming the exit stage of the client before the parameter update is performed;

[0067] Step S120, after the execution of the exit stage is completed, the client exits.

[0068] In the embodiment, the client informs the server whether to participate in the COT generation stage and the square and tuple generation stage in the task selection stage, and can exit in advance if not participating. Other clients exit at the end of the square and tuple preparation stage. As shown in FIG. 1, stage 1 is the task selection stage. Specifically, all clients Figure 2 select whether to exit in advance, and inform . Thereafter, as shown in FIG. 1, , it is known that Figure 2 will exit in stage 2, will exit in stage 3, and the remaining clients will exit in stage 4. In the embodiment, the exit stage can be any one of stages 2, 3, and 4 preset by the protocol, stages 2, 3, and 4 being after the parameter update of the client and before the server converts the bit secret share into an arithmetic secret share. Step S200, performing parameter update by the client based on local data and the initialization parameter, obtaining updated local parameters, and constructing the updated local parameters into a bit secret share and sending to the server. Figure 2 In the embodiment, the secure aggregation uses a bit secret share and an arithmetic secret share. For input

[0069] , that is, is an integer in the modulo

[0070] sense, and the arithmetic secret share is . Let , the bit secret share of each bit satisfies . After the client calculates the local parameter update, the bit secret share of the gradient is constructed, the gradient data is , the client constructs , and satisfies . As shown in stage 2 of FIG. 1, that is, the gradient calculation and share generation stage, when the client calculates the updated local parameter based on the local data and the initialization parameter, the updated local parameter is first constructed into a bit secret share. Figure 2

[0071] ​​​​In one implementation, when there are two servers, the step of updating parameters through the client based on local data and the initialization parameters to obtain updated local parameters, constructing the updated local parameters into a bit secret share, and sending it to the server specifically includes the following steps:

[0072] Step S210: Input the local data and the initialization parameters into the preset model training function through the client to calculate the updated local parameters. The updated local parameters are used to adjust the parameters of the global model.

[0073] Step S220: The updated local parameters are converted into binary form by the client to obtain a bit sequence consisting of several bits;

[0074] Step S230: The client splits each bit of the bit sequence to generate two corresponding bit secret shares, wherein the bit sequence can be restored by combining the two bit secret shares.

[0075] Step S240: The client sends the two portions of the bit secret to the two servers respectively.

[0076] In this embodiment, for in Each of them , Based on the client's local data and global model parameters Calculate the local gradient vector And calculate the bit secret share vector of the gradient. That is, the gradient secret share of the client-side split is of length . A binary vector. Then, for... All of them , Send gradient bit secret shares respectively Give And withdraw from the agreement.

[0077] In one implementation, before converting the bit secret share into an arithmetic secret share, the following steps are specifically included:

[0078] Step S251: The client generates a set of client COT random numbers based on the bit sequence and sends the client COT random numbers to the two servers;

[0079] Step S252, generating a set of server COT random numbers through cooperation of two servers, wherein one of the two servers generates a random seed and calculates a partial random number share, and the other receives the random seed based on a preset protocol and generates a corresponding complementary random number share, and the partial random number share and the complementary random number share jointly form a complete server COT random number;

[0080] Step S253, receiving the client COT random number sent by the client through the two servers, performing a security verification protocol based on the COT random number, and if the verification is successful, combining the server COT random number to obtain a complete COT random number;

[0081] Step S254, if the verification fails, rejecting the data of the client.

[0082] In the embodiment, first, for two servers, Figure 2 in the phase 2 gradient calculation and share generation stage, entering a preprocessing stage, inputting initialization parameters and extension parameters to a COT generation function , simultaneously inputting initialization parameters and extension parameters to , obtaining a vector , obtaining a vector combination . Specifically, the used COT generation function is represented as:

[0083] Function: COT generation function

[0084] Initialization: sender input , wherein , receiver input , function save , ignore the subsequent command.

[0085] Extension: input

[0086] generate a random vector

[0087] generate a random vector , calculate .

[0088] Output: Get output , Get output .

[0089] in, This indicates that the generated domain belongs to a finite field. random numbers, This represents a binary finite field, containing only the two elements 0 and 1. Represents the finite field A dimensional vector space, that is, a vector space of length n. A set of binary vectors, Indicates containing A finite field of n elements.

[0090] Subsequently, a total of Group COT random numbers, represented in set form as Each corresponding element in the set satisfies Used for converting bit shares to arithmetic shares, where It is a random vector symbol for a single round of COT. It is the first in a multi-round batch scenario The random vector symbol for the wheel. In Figure 2 In the OT random number preparation phase of phase 3, Client aggregation can still be performed at this stage. COT random numbers The generation process involves using COT random numbers, which are generated based on Related Unintentional Transmissions (COT) and have a specific correlation. These random numbers are used for security verification before the bit secret share is converted into an arithmetic secret share.

[0091] Specifically, the server requires a COT (Content on the Origin) when converting bit secret sharing to arithmetic secret sharing, which can be generated by either the client or the server. implement Obtain COT. First Generate global random numbers ,in Indicates containing A finite field of elements, server Set expansion amount , pass get , denoted as set , pass get and denoted as set The elements in the set satisfy .

[0092] The process of constructing COT by the client, i.e., the local OT generation function, is denoted as:

[0093] Function: Local OT generation method

[0094] Input: selected bits , an offset .

[0095] Output: set and , , satisfy .

[0096] For the client, for all clients in , generate random numbers , where is the boundary of the 2-norm check , and are the calculation security parameter and the statistical security parameter, respectively, is the bit number of the square sum tuple element, and is called twice:

[0097]

[0098]

[0099] Then, the COT random number is generated.

[0100] For all clients in , , send the bit secret share of the gradient and the COT random number to the corresponding server , respectively, and exit the protocol.

[0101] For the two servers, , verify the OT random number provided by , , let , call the verification protocol , input . If the verification is successful, the verified ​If the verification fails, the data of the client is rejected. , verification in OT random numbers provided, let , call the verification protocol , input If the verification is successful, the verified ; if the verification fails, the data of the client is rejected. Wherein, the OT random number is a random number generated based on oblivious transfer (OT), and is used in the security calculation of the process of converting bit secret shares into arithmetic secret shares.

[0102] Then the server verifies each client data, and if the verification is successful, discards the last OT random number. The remaining OT random numbers can be used. The OT verification function protocol is represented as:

[0103] Function: OT verification ( server executes)

[0104] Input: Input , Input , wherein , , , , .

[0105] Output: OT verification result, if it is 0, it means that the verification is passed, and if it is not 0, it means that the verification fails.

[0106] In an implementation mode, before the bit secret share is converted into an arithmetic secret share, the method further includes the following steps:

[0107] Step S261, a client square sum tuple is generated by the client, and the client square sum tuple is split into two client square sum tuple secret shares, which are sent to two servers respectively, wherein the square sum tuple contains a target value and a plurality of random numbers, and the target value is equal to the sum of squares of all the random numbers;

[0108] Step S262, a group of server square sum tuples are generated by the two servers in cooperation, and each server obtains a secret share corresponding to the server square sum tuple;

[0109] Step S263, receiving the client square sum tuple and the secret share of the client square sum tuple sent by the client through the two servers, performing a secure verification protocol based on the square sum tuple, and if the verification is successful, combining the server square sum tuple to obtain a complete square sum tuple;

[0110] Step S264, if the verification fails, rejecting the data of the client.

[0111] In this embodiment, as shown in the phase 4 square sum tuple preparation phase in the above table, for all clients in the table Figure 2 , , , generate a random number , and calculate a square sum tuple and , satisfying , and generate a secret share of the square sum tuple . Wherein . And send the bit secret share of the gradient , the COT random number and the square sum tuple to the corresponding server, and exit the protocol.

[0112] And for the server, perform the square sum tuple generation protocol multiple times to obtain square sum tuples .

[0113] In addition, for the server, , verify the square sum provided by the client in the table . call the secure verification protocol , input . If the verification is successful, obtain the verified tuple ; if the verification fails, reject the data of the client.

[0114] Specifically, arithmetic secret sharing is a basic primitive used in secure multi-party computation. When there are two participants, the secret share of the plaintext is represented as , satisfying . In this paper, two servers hold secret shares and perform operations. hold data generate secret shares, first generate a random number , and send to ,make , . When the secret share is opened, Shareholding , Shareholding Send the share to the other party and calculate. You can then obtain plaintext data.

[0115] Additions to the secret share can be performed locally, i.e. Multiplication operations are often performed using triples to reduce the complexity of multiplication. A multiplication triple contains three elements. ,satisfy Each participant holds One share. Calculate and open Then calculate locally As shown in the formula:

[0116]

[0117] When a calculation includes a fixed-length sum of squares, such as calculating the 2-norm of a vector, constructing a fixed-length tuple of sums of squares to assist in the calculation can effectively reduce the computational load. The sum of squares tuple contains... element ,satisfy Each participant holds a secret share of these elements. .

[0118] The generation of sum-of-squares tuples typically involves a preprocessing stage and an online stage. The preprocessing stage generates sum-of-squares tuples independent of the input, while the online stage uses these tuples for computation. This project employs a malicious client model. During the tuple generation stage, if the client exits the protocol, two semi-honest servers utilize a COT random number generator to implement the server-side sum-of-squares tuple generation protocol. If the client does not exit the protocol, it generates COT random numbers that satisfy the relation using a secret sharing protocol. Then, the two servers execute a sum-of-squares tuple verification protocol to verify whether the client-generated random number combination satisfies the sum-of-squares tuple relation.

[0119] For the server square sum tuple generation protocol, the aforementioned COT assistance is used, specifically the aforementioned COT generation function.

[0120] server yes sender ,server yes The recipient , When generating the square tuple, first generate the secret share respectively , . It can be expressed as = , where can be calculated by respectively, the difficulty is to calculate . Convert the multiplication operation into bit operation, that is, decompose into bits, expressed as . Using random oblivious transfer (ROT) can realize 1-bit multiplication obtain , , where , is the selection parameter pair in the random oblivious transfer protocol obtain the selection bit , . Let and send to , Let , when , , here , so you can add an equation to be true; when , . So , Let the secret share be , and the sum of the two can obtain the single bit of and the product of . Calculate . For each bit of , calculate and bitwise combination, that is, obtain . The calculation process of bitwise combination is as follows:

[0121]

[0122]

[0123]

[0124]

[0125] Through the above method, the square tuple can be generated, and the square tuple generation protocol is expressed as:

[0126] Protocol 1: Square tuple generation protocol

[0127] Input: Server No input data. Common hash function .

[0128] Output: Get secret share , satisfying where .

[0129] Protocol:

[0130] 1. Generate random number , randomly generate

[0131] 2. Input and to in turn, and input and to

[0132] 3. Get , let

[0133] 4. Get , let

[0134] 5. for do

[0135] 6. Let and send to

[0136] 7. Let

[0137] 8. end for

[0138] 9. Calculate

[0139] 10. Calculate

[0140] 11. Let .

[0141] The protocol generates square tuples through COT, and is repeatedly executed Protocol and the resulting accumulation, i.e., the sum-of-squares tuple generation protocol is represented as:

[0142] Protocol 2: Sum-of-squares tuple generation protocol

[0143] Input: Server No input data.

[0144] Output: Obtain the sum-of-squares tuple , where . The following conditions are met:

[0145]

[0146] Protocol: Server execution

[0147] 1. Initialization , Initialization

[0148] 2. for do

[0149] 3. Perform Obtain , let , i.e., the first share of the tuple

[0150] 4. Perform Obtain , let , i.e., the second share of the tuple

[0151] 5. end for

[0152] 6. Obtain .

[0153] In this embodiment, the malicious client model is used specifically, and the server sum-of-squares tuple generation method has been implemented as described above. The client can generate the sum-of-squares tuple generation method in plaintext, but the data needs to be verified by the server, consuming a sum-of-squares tuple to verify the correctness of another tuple. The sum-of-squares tuple satisfies , which is equivalent to . The server negotiates to generate a random prime number . Then open ​​, if the result is 0, then the tuple is correct. Let Simplifying, we get the derived formula:

[0154]

[0155] =

[0156] =

[0157] =

[0158] where The secret sharing of , can be opened, so let The secret sharing is and . By opening and recombining the secret shares, the correctness of the tuple can be verified. Step S300, receiving the bit secret share through the server, converting the bit secret share into an arithmetic secret share, and calculating the 2-norm of the arithmetic secret share using the square and tuple.

[0159] In this embodiment, for the server, The bit conversion protocol is performed on the bit secret share of the client, The input bit secret share , OT random number or , respectively get the arithmetic secret share .

[0160] In one implementation, the bit secret share is received through the server, the bit secret share is converted into an arithmetic secret share, and the 2-norm of the arithmetic secret share is calculated using the square and tuple, specifically including the following steps:

[0161] Step S310, performing bit operation on the bit secret share through two servers respectively, to get the respective integer domain arithmetic secret share, wherein the sum of the arithmetic secret shares held by the two servers is equal to the updated local parameter;

[0162] Step S320, associating the arithmetic secret share with the square sum tuple through two servers, wherein one of the two servers calculates a square term based on the held arithmetic secret share and square sum tuple partial element, and the second server calculates a corresponding square term based on the locally held arithmetic secret share and square sum tuple remaining element;

[0163] Step S330, securely interacting and merging the respective square terms through the two servers to obtain a square sum of the arithmetic secret share, the square sum of the arithmetic secret share being a 2-norm of the arithmetic secret share.

[0164] In the embodiment, the conversion between the bit secret sharing and the arithmetic secret sharing is completed. Because the bit sharing limits the maximum value of each bit of the gradient, the check of the infinite norm is indirectly realized, i.e., the bit number of the bit sharing is limited to the limit of the infinite norm, and the bit number of the arithmetic secret sharing is larger. In order to perform the 2-norm check and the secret sharing aggregation, the bit secret sharing needs to be converted into the arithmetic secret sharing protocol. When each bit of the bit is calculated, the bit-to-arithmetic protocol needs to be constructed, which can be realized by 1-bit logical AND, i.e., According to the selection of the bit and the gradient secret sharing related to , the bit multiplication protocol is divided into non-aligned and aligned bit multiplication protocols. When the server generates the COT, the generated COT is irrelevant to the input, and the non-aligned bit multiplication protocol is represented as:

[0165] Function: non-aligned bit multiplication function

[0166] Input: let the bit secret sharing . The sending server provides the input , and the receiving server provides the input , satisfying .

[0167] Output: , satisfying , wherein is used to limit the modulus of the operation.

[0168] When the client generates the COT, the gradient share has been generated, the selected bit is set to , and the selected bit is set to . The non-aligned bit multiplication protocol is less one communication, and only needs to be sent once. The aligned bit multiplication protocol is represented as:

[0169] Function: aligned bit multiplication function

[0170] Input: Bit Secret Share . The sending server provides input , the receiving server provides input , let H be a hash function H： .

[0171] Output: , satisfying .

[0172] The server selects the corresponding bit multiplication protocol according to the COT data source when calculating the bit share to arithmetic share. Perform bit multiplication protocol for each bit, and the arithmetic secret share of bit can be obtained by offset accumulation. The bit secret share to arithmetic secret share protocol is represented as:

[0173] Protocol 5: Bit secret share to arithmetic secret share protocol .

[0174] Input: Bit Secret Share , . The sending server provides input , the receiving server provides input .

[0175] Output: , satisfying:

[0176]

[0177] Protocol: The server executes is the OT sender)

[0178] 1. Calculate , here

[0179] 2. for do

[0180] 3. Let

[0181] 4. Calculate

[0182] 5. Calculate

[0183] 6. The server calculates

[0184] 7. end for.

[0185] In this embodiment, specifically, the server uses sum-of-squares tuples. Calculate vectors Let the 2-norm be... , and With the help of It can be calculated .first and Open , calculate , calculate .Open The derivation is obtained as follows:

[0186]

[0187]

[0188]

[0189]

[0190]

[0191]

[0192]

[0193] This is The sum of squares, calculate the square for each data point, and then... By performing addition during initialization, the square sum tuple calculation protocol can be obtained. The 2-norm calculation protocol based on the square sum tuple is expressed as follows:

[0194] Protocol 3: 2-norm computation protocol based on sum of squares tuples

[0195] enter: Input sum of squares tuples Arithmetic secret share of a sum vector ,in .

[0196] Output: get 2-norm secret share ,

[0197] protocol:

[0198] 1. make

[0199] 2.for do

[0200] 3. and compute and open

[0201] 4. compute

[0202] 5. compute

[0203] 6. end for.

[0204] By the above protocol, each client and 2 servers will perform the total protocol, which constructs the total protocol representation of the square and tuple as:

[0205] Protocol 4: Square and tuple protocol

[0206] Input: 2 servers and a client , have vector secret shares that need to compute the square sum , where .

[0207] Output: servers get square sum secret shares of vector data .

[0208] Phase 1 - Square and tuple generation and verification phase

[0209] 1. if only the client participates, generate the square and tuple verification:

[0210] 2. generate random numbers , compute

[0211] 3. generate secret shares of , and send to and

[0212] 4. generate a random prime number , set the initial value

[0213] 5. for do

[0214] 6. compute and open

[0215] 7. compute

[0216] 8. compute

[0217] 9. end for

[0218] 10. server opens check if 0. If 0, get verified sum-of-squares tuple , else reject the tuple

[0219] 11. else only server participates, no need to verify the sum-of-squares tuple:

[0220] 12. , execute protocol, get

[0221] Phase 2 - sum-of-squares tuple computation phase

[0222] 13. , execute 2-norm computation protocol , get secret share of sum-of-squares .

[0223] Step S400, check the 2-norm by the server, and after the check is passed, aggregate the arithmetic secret shares to get an aggregated parameter, and update the global model using the aggregated parameter to get an updated global model.

[0224] In this embodiment, for the server, the arithmetic secret shares of the clients in execute the 2-norm computation protocol , input and tuple , get the 2-norm secret share . Check the 2-norm secret share, and after the check is passed, aggregate the arithmetic secret shares to get an aggregated parameter, and update the global model using the aggregated parameter to get an updated global model.

[0225] for the data of the clients in , let , Generating ot random numbers for bit addition computation . Performing a sign bit extraction function , inputting and , respectively, outputs a bit share of the sign bit and open. If negative, it means that the bound has not been exceeded, perform aggregation of the gradient data secret shares , otherwise reject the client's data. Thereafter, obtain a new global vector by secret share addition aggregation.

[0226] In an implementation, the checking, by the servers, of the 2-norm, specifically includes the following steps:

[0227] Step S410, performing sign bit extraction on the 2-norm of the arithmetic secret share by the two servers, to obtain a bit share of the sign bit;

[0228] Step S420, opening the bit share of the sign bit held by each of the two servers;

[0229] Step S430, if the sign bit is negative, rejecting the client's data.

[0230] The data checking method used is the 2-norm check, whose expression is as follows:

[0231]

[0232] The expression can be calculated equivalently without the square root. In the secret share state, the two servers perform a square sum calculation protocol to obtain a 2-norm share of the client data , satisfying . Then, it is calculated whether the 2-norm exceeds the limit range .

[0233] Calculate , performing a sign bit extraction function , the sign bit extraction function is shown in Table 11. If the sign bit extracted is negative, it means that the range is exceeded, and the client data is rejected. If it is positive, the data is aggregated. The expression of the sign bit extraction function is:

[0234] Function: sign bit extraction function

[0235] Initialization: inputting the arithmetic secret share , A COT random number .

[0236] Output: Obtain bit shares of the secret .

[0237] Step S500, broadcast the updated global model to the client through the server.

[0238] In this embodiment, after completing the secure aggregation and verification process of the model parameters, similarly to step S100, the two servers broadcast the updated global model to all clients in normal operation based on the pre-established communication channel, ensuring that the clients can receive and carry out the next round of local training based on the new model in a timely manner, maintaining the iterative continuity of federated learning.

[0239] Summarize the above steps to obtain the complete protocol of liquidity secure aggregation calculation, and the secure aggregation method supporting liquidity is as follows:

[0240] Algorithm: secure aggregation method supporting liquidity

[0241] Input: 2 servers , clients , all clients have global model parameters , local one batch of data , is the boundary of 2-norm check . are the calculation of security parameters and statistical security parameters respectively, is the bit number of multiplication and tuple.

[0242] Output: using infinity norm, 2-norm check client data, server obtain a new global vector .

[0243] Phase 1-task selection phase

[0244] 1. All clients select whether to exit early and inform

[0245] 2. know will exit in phase 2, will exit in phase 3, and the remaining clients will exit in phase 4

[0246] Phase 2-gradient calculation and share generation phase

[0247] 3.for in do

[0248] 4. According to the data and the global model parameters , the local gradient vector is calculated , and the bit secret share vector of the gradient is calculated

[0249] 5.end for

[0250] 6.for in do

[0251] 7. Respectively send the gradient bit secret share to , and exit the protocol

[0252] 8.end for

[0253] 9. Enter the preprocessing stage, input and , to in turn, input and , get vector , get vector combination . A total of COT random numbers are generated, represented in set form as , where each pair in the set satisfies , which is used for bit share to arithmetic share

[0254] Phase 3-OT random number preparation stage

[0255] 10.for in do

[0256] 11. Generate random number , call twice:

[0257]

[0258]

[0259] 12. Generate COT random number

[0260] 13. end for

[0261] 14. for in do

[0262] 15. Send the bit secret share of gradient , COT random number to the corresponding server , and exit the protocol

[0263] 16. end for

[0264] 17. The COT random number of the client set can still be generated at this stage

[0265] Phase 4 - square and tuple preparation phase

[0266] 18. for in do

[0267] 19. Generate a random number , and calculate the square and tuple and , which satisfies , generate the secret share of the square and tuple . Among them

[0268] 20. Send the bit secret share of gradient , COT random number and square and tuple to the corresponding server, and exit the protocol

[0269] 21. end for

[0270] 22. Execute the square and tuple generation protocol multiple times to get square and tuples

[0271] Phase 5 - data checking and gradient aggregation phase

[0272] 23. , verify in provide the OT random number, let , call the verification protocol , input . If the verification is successful, get the verified ; if the verification fails, reject the data

[0273] 24. , verify the square provided by the client in . call the verification protocol , input . If the verification is successful, get the verified tuple ; if the verification fails, reject the data

[0274] 25. perform the bit conversion protocol on the bit secret share of the client in , input the bit secret share , the OT random number or , get the arithmetic secret share

[0275] 26. perform the 2-norm calculation protocol on the arithmetic secret share of the client in , input and the tuple , get the 2-norm secret share

[0276] 27. on the data of the client in , let , generate the OT random number for calculating the bit addition. perform the sign bit extraction function , input and respectively, output the bit share of the sign bit and open. If it is not negative, it means that the boundary has not been exceeded, perform the aggregation of the gradient data secret share , otherwise reject the data of the client

[0277] 28. A new global vector is obtained by secret sharing addition aggregation .

[0278] After that, the performance of the above protocol is evaluated using experiments. The experimental equipment uses a laboratory server CPU 16 cores, memory 64 GB.

[0279] First, test the square and tuple, the ELSA method disclosed in the literature Secure Aggregation for Federated Learning with Malicious Actors uses square tuples to calculate the 2-norm, ELSA-SH is the ELSA server semi-honest, client malicious version. The tuple verification and 2-norm calculation steps in the protocol about the calculation of 2-norm are compared, and the running time is shown in Table 1. The tuple verification time is significantly reduced. When the parameter is 100k, and the client is 100, 200, and 300, the tuple verification time is reduced by 20%, 32%, and 35% respectively. With the increase of the number of clients, the verification time reduction rate stabilizes at 35%.

[0280] Table 1

[0281]

[0282] Assuming that the clients in the entire protocol all exit the protocol after stage 4, the overall protocol running time results are shown in Table 2. When the parameter is 100k, and the number of clients is 100, 200, and 300, the server overall running time is reduced by 0.29s, 0.55s, and 1.52s respectively. The overall running time of the client is increased by 0.02s, 0.08s, and 0.06s respectively. The time added by the client in this work is much smaller than the time reduced by the server, and the overall running efficiency is improved.

[0283] Table 2

[0284]

[0285] The communication volume of the overall protocol is shown in Table 3. There is no communication between clients, client communication refers to the communication between clients and servers, server communication refers to the communication volume of the MPC protocol executed between servers, client communication volume is reduced by 5.8%, mainly because the square and tuple reduces about 50% data volume, server communication volume is reduced by 9.4%, mainly because the number of tuples opened at the end of tuple verification is reduced from to .

[0286] Table 3

[0287]

[0288] Then, the model parameter aggregation theory based on flow security multi-party computation is analyzed. On the basis of the square sum tuple, the client can exit early in the protocol process. For the early-exiting client, the server needs to prepare random numbers in the preprocessing stage, and the random numbers generated by the server do not need to be checked. The theoretical analysis of different early-exiting client cases is shown in Table 4. " / " on the left represents the communication complexity, and " / " after represents the calculation complexity. Parameters is the number of clients, is the length of the gradient vector, is the bit secret sharing length of each gradient component, is the boundary of the 2-norm check , which is also the range of the arithmetic secret sharing. are the calculation security parameter and the statistical security parameter respectively, is the bit number of multiplication and tuple. COT generation function is the LPN parameter in the COT function, which is a fixed parameter, and COT initialization needs COTs, which can be extended to generate COTs, with a communication amount of and a calculation amount of .

[0289] Table 4

[0290]

[0291] The method considers the communication complexity and the calculation complexity. In terms of communication complexity, the earlier the client exits, the lower the communication complexity of the client. After exiting in stage 4, stage 3, and stage 2, the communication complexity is , , respectively, and the communication complexity of the server is , and respectively. The reduction of the communication amount of the client is intuitive, because the client exits early, and the task to be executed is less. The communication amount of the server only considers the communication between the servers, and the communication amount gradually increases, although the servers do not need to verify the random numbers, but the conversion of the unaligned bit secret share to the arithmetic secret share needs an additional communication, and the servers need to communicate when generating random numbers.

[0292] In terms of calculation complexity, when the client exits in stage 4, stage 3, and stage 2 in turn, the calculation complexity of the client decreases from to , and the calculation complexity of the server increases from to , which shows that the scheme can realize the transfer of the calculation load between the client and the server.

[0293] The overall communication complexity of different early exit client cases is shown in Table 5.

[0294] Table 5

[0295]

[0296] The overall communication complexity includes the communication between the client and the server and the communication between the servers during the protocol execution. The earlier the client exits, the lower the overall communication complexity. When the client exits after stage 4, stage 3, and stage 2, the overall communication complexity is , , .

[0297] In summary, under the technical scheme of the above embodiment, by constructing square and tuple, an efficient tuple verification method is realized, which can reduce the data communication between the client and the server, reduce the calculation amount of the server, and provide a method for tuple generation implemented by different participants, laying a foundation for subsequent research on security aggregation method supporting liquidity. At the same time, the MPC technology is used to ensure the security of the training model and the client data in the parameter security aggregation, on the one hand, the aggregation server supplier cannot know the model parameter information of the user, on the other hand, the user cannot cause the model to be unable to converge and the model to be wrong by uploading wrong data. The whole scheme includes two servers and multiple clients, first, the server sets the model initialization parameters and broadcasts them to each client, then the client calculates the parameter update of the local data, and constructs a bit secret share to send two servers. After receiving the data, the server executes the secure two-party computation protocol, first converts the bit secret share to an arithmetic secret share, calculates the 2 norm of the secret share, checks it, and then aggregates the parameters and updates the global model, finally broadcasts the global model to the client. The application designs a secure aggregation flow mechanism of client task segmentation, client exit and server task handover mechanism, realizes the liquidity of the random number generation stage, so that the client can exit at multiple stages without affecting the operation of the protocol, realizes the liquidity of the model parameter aggregation, and further improves the robustness of the parameter aggregation to the equipment.

[0298] As Figure 3As shown in the above embodiment, the present application further provides a model parameter aggregation system based on flow security multi-party computation. The system is applied to a server and a client interacting with the server. The client is pre-configured with an exit stage. The exit stage refers to any stage after the client performs parameter update and before the server converts bit secret shares into arithmetic secret shares. The system comprises an initialization parameter broadcast module 10, a bit secret share construction module 20, an arithmetic secret share construction module 30, a parameter aggregation module 40, and a global model broadcast module 50.

[0299] Specifically, the initialization parameter broadcast module 10 is configured to set an initialization parameter of a global model by the server and broadcast the initialization parameter to the client. The bit secret share construction module 20 is configured to perform parameter update by the client based on local data and the initialization parameter, obtain updated local parameters, and construct the updated local parameters into bit secret shares and send the bit secret shares to the server. The arithmetic secret share construction module 30 is configured to receive the bit secret shares by the server, convert the bit secret shares into arithmetic secret shares, and calculate a 2-norm of the arithmetic secret shares by using square and tuple. The parameter aggregation module 40 is configured to check the 2-norm by the server, aggregate the arithmetic secret shares to obtain aggregation parameters after the check passes, and update the global model by using the aggregation parameters to obtain an updated global model. The global model broadcast module 50 is configured to broadcast the updated global model to the client by the server.

[0300] Based on the above embodiment, the present application further provides a terminal device. A principle block diagram of the terminal device can be as shown in the above embodiment. Figure 4 The terminal device comprises a processor, a memory, a network interface, a display screen, and a temperature sensor connected by a system bus. The processor of the terminal device is configured to provide computing and control capabilities. The memory of the terminal device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The network interface of the terminal device is configured to communicate with external terminals through network connection. The computer program is executed by the processor to implement a model parameter aggregation method based on flow security multi-party computation. The display screen of the terminal device can be a liquid crystal display screen or an electronic ink display screen. The temperature sensor of the terminal device is pre-configured in the terminal device to detect the running temperature of the internal device.

[0301] Those skilled in the art can understand that, Figure 4The principle block diagram shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the terminal device to which the scheme of the present application is applied. The specific terminal device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0302] In one embodiment, a terminal device is provided, comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, the one or more programs comprising instructions for:

[0303] setting, by the server, an initialization parameter of a global model, and broadcasting the initialization parameter to the client;

[0304] updating, by the client, a parameter based on local data and the initialization parameter, obtaining an updated local parameter, and constructing the updated local parameter into a bit secret share and sending the bit secret share to the server;

[0305] receiving, by the server, the bit secret share, converting the bit secret share into an arithmetic secret share, and calculating a 2-norm of the arithmetic secret share using a square and tuple;

[0306] checking, by the server, the 2-norm, and after the check passes, aggregating the arithmetic secret share to obtain an aggregated parameter, and updating the global model using the aggregated parameter to obtain an updated global model;

[0307] broadcasting, by the server, the updated global model to the client.

[0308] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the computer program can include the processes of the above-mentioned embodiments of the methods. Any reference to memory, storage, databases, or other media in this application shall include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM), or external cache memory. As an illustration but not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus DRAM (RDRAM), direct Rambus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0309] In summary, the application discloses a model parameter aggregation method and system based on flow security multi-party computation, a terminal device and a medium, relates to the technical field of federated learning, the method is applied to a server and a client interacting with the server, the client is pre-provided with an exit stage, the exit stage refers to any stage before the server converts the bit secret share into an arithmetic secret share after the client updates the parameters, the method comprises the following steps: setting the initialization parameters of the global model through the server, and broadcasting the initialization parameters to the client; the client updates the parameters based on the local data and the initialization parameters, obtains updated local parameters, constructs the updated local parameters into a bit secret share, and sends the bit secret share to the server; the server receives the bit secret share, converts the bit secret share into an arithmetic secret share, and calculates the 2-norm of the arithmetic secret share using the square and tuple; the server checks the 2-norm, and after the check is passed, the arithmetic secret share is aggregated to obtain an aggregated parameter, and the global model is updated using the aggregated parameter to obtain an updated global model; the server broadcasts the updated global model to the client. Through the dual-server and multi-client architecture, the application realizes efficient verification by combining the square and tuple, reduces the communication volume and the calculation amount, improves the 2-norm calculation efficiency, thereby resisting malicious client attacks, ensuring the security of parameter aggregation, balancing efficiency and robustness, and effectively solving the problem of safe aggregation of model parameters in federated learning. At the same time, a dynamic exit mechanism of the client is designed to support multi-stage safe exit without affecting the operation of the protocol, and the adaptability of the system to dynamic changes of devices is enhanced.

[0310] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0311] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled persons in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A model parameter aggregation method based on flow security multi-party computation, characterized in that, The method is applied to a server and a client interacting with the server, the client being pre-provided with an exit phase, the exit phase referring to any phase before the client performs parameter updating and before the server converts bit secret shares into arithmetic secret shares, the method comprising: setting, by the server, an initialization parameter of a global model, and broadcasting the initialization parameter to the client; performing, by the client, parameter updating based on local data and the initialization parameter, obtaining updated local parameters, and constructing the updated local parameters into bit secret shares and sending the bit secret shares to the server; receiving, by the server, the bit secret shares, converting the bit secret shares into arithmetic secret shares, and calculating a 2-norm of the arithmetic secret shares using a square and tuple; checking, by the server, the 2-norm, and after the check passes, aggregating the arithmetic secret shares to obtain aggregated parameters, and updating the global model using the aggregated parameters to obtain an updated global model; broadcasting, by the server, the updated global model to the client.

2. The model parameter aggregation method based on flow secure multi-party computation according to claim 1, characterized in that, When there are multiple clients, the setting of the exit phase for the clients comprises: for any of the clients, confirming the exit phase of the client before the parameter updating is performed; after the execution of the exit phase ends, the client exits.

3. The model parameter aggregation method based on secure multi-party computation of flow according to claim 1, characterized in that, When there are two servers, the performing, by the client, of parameter updating based on local data and the initialization parameter to obtain updated local parameters and constructing the updated local parameters into bit secret shares and sending the bit secret shares to the server comprises: inputting, by the client, the local data and the initialization parameter into a preset model training function to obtain updated local parameters, the updated local parameters being used to adjust parameters of a global model; converting, by the client, the updated local parameters into a binary form to obtain a bit sequence composed of a plurality of bits; splitting, by the client, each bit of the bit sequence to generate two corresponding bit secret shares, wherein the two bit secret shares combined can restore the bit sequence; sending, by the client, the two bit secret shares to two servers respectively.

4. The model parameter aggregation method based on secure multi-party computation of flow according to claim 3, characterized in that, Before the converting of the bit secret shares into arithmetic secret shares, comprising: generating, by the client, a group of client COT random numbers based on the bit sequence, and sending the client COT random numbers to two servers; cooperatively generating, by the two servers, a group of server COT random numbers, wherein one of the two servers generates a random seed and calculates a partial random number share, and the other server receives the random seed based on a preset protocol and generates a corresponding complementary random number share, the partial random number share and the complementary random number share together forming a complete server COT random number; Receiving the client COT random number sent by the client through two servers, performing a security verification protocol based on the COT random number, and obtaining a complete COT random number in combination with the server COT random number if the verification is successful; If the verification fails, the data of the client is rejected.

5. The model parameter aggregation method based on secure multi-party computation of flow according to claim 4, characterized in that, Before the bit secret share is converted into an arithmetic secret share, the system further comprises: The client generates a client square sum tuple and splits the client square sum tuple into two client square sum tuple secret shares, which are sent to two servers respectively, wherein the square sum tuple contains a target value and a plurality of random numbers, and the target value is equal to the sum of squares of all the other random numbers; A group of server square sum tuples are generated by two servers, and each server obtains a secret share corresponding to the server square sum tuple; The client square sum tuple secret share sent by the client is received by two servers, a security verification protocol based on the square sum tuple is performed, and a complete square sum tuple is obtained in combination with the server square sum tuple if the verification is successful; If the verification fails, the data of the client is rejected.

6. The model parameter aggregation method based on secure multi-party computation of flow according to claim 5, characterized in that, The bit secret share is converted into an arithmetic secret share by the server, and the 2-norm of the arithmetic secret share is calculated by using the square sum tuple, comprising: Bit operations are performed on the bit secret share by two servers respectively to obtain an integer domain arithmetic secret share of each server, wherein the sum of the arithmetic secret shares held by the two servers is equal to the updated local parameter; The arithmetic secret share and the square sum tuple are associated by two servers, wherein one of the two servers calculates a square term based on the held arithmetic secret share and the square sum tuple partial element, and the second server calculates a corresponding square term based on the locally held arithmetic secret share and the square sum tuple remaining element; The square terms of the two servers are securely interacted and combined to obtain the square sum of the arithmetic secret share, and the square sum of the arithmetic secret share is the 2-norm of the arithmetic secret share.

7. The model parameter aggregation method based on secure multi-party computation of flow according to claim 6, characterized in that, The 2-norm is checked by the server, comprising: The sign bit of the 2-norm of the arithmetic secret share is extracted by two servers to obtain a bit share of the sign bit; The bit share of the sign bit held by each of the two servers is opened; If the sign bit is negative, the data of the client is rejected.

8. A model parameter aggregation system based on secure multi-party computation of flow, characterized in that, The system is applied to a server and a client interacting with the server, the client is pre-set with an exit phase, the exit phase refers to any one phase before the bit secret share is converted into an arithmetic secret share by the server after the parameter of the client is updated, and the system comprises: An initialization parameter broadcast module is configured to set an initialization parameter of a global model by the server and broadcast the initialization parameter to the client; An initialization parameter broadcast module is configured to set an initialization parameter of a global model by the server and broadcast the initialization parameter to the client; a bit secret share construction module configured to perform parameter update based on local data and the initialization parameter by the client to obtain updated local parameters, and to construct the updated local parameters into bit secret shares and send the bit secret shares to the server; an arithmetic secret share construction module configured to receive the bit secret shares by the server, convert the bit secret shares into arithmetic secret shares, and calculate the 2-norm of the arithmetic secret shares by using square and tuple; a parameter aggregation module configured to check the 2-norm by the server, aggregate the arithmetic secret shares to obtain aggregated parameters after the check passes, and update the global model by using the aggregated parameters to obtain an updated global model; a global model broadcast module configured to broadcast the updated global model to the client by the server.

9. A terminal device, comprising: The terminal device comprises a memory, a processor, and a model parameter aggregation program based on secure multi-party computation of flow stored in the memory and executable on the processor. When the processor executes the model parameter aggregation program based on secure multi-party computation of flow, the steps of the model parameter aggregation method based on secure multi-party computation of flow are implemented.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores the model parameter aggregation program based on secure multi-party computation of flow. When the processor executes the model parameter aggregation program based on secure multi-party computation of flow, the steps of the model parameter aggregation method based on secure multi-party computation of flow are implemented.

Images