Novel federal learning framework operation method with full-period safety

Abstract

The invention discloses a novel federated learning framework operation method with full-period security, which belongs to the field of federated learning and comprises three stages of integration of TSME-HA and TSRW-ED algorithms, coverage submission, aggregation and distribution. The TSME-HA realizes eavesdropping, exit and late attack resistance through Paillier homomorphic encryption and threshold secret sharing; the TSRW-ED completes identity authentication, copyright tracing and Byzantine protection through a two-stage reversible watermark. The two algorithms cooperate to form a complete-cycle safe closed loop, additional communication rounds are not needed, and the privacy, integrity and availability of the model are guaranteed.

Description

Technical Field

[0001] This invention belongs to the field of federated learning, and in particular relates to a novel federated learning framework operation method with full-cycle security. Background Technology

[0002] In today's era of rapid information technology development, artificial intelligence and machine learning technologies have made tremendous progress. Among them, federated learning, as an emerging distributed machine learning paradigm, optimizes the global model by aggregating users' local model updates, effectively mitigating the risk of data privacy breaches in centralized learning. However, the open network environment and distributed architecture of federated learning present numerous security challenges throughout the training cycle.

[0003] Federated learning architectures consist of a closed-loop system comprised of three phases: model submission, aggregation, and distribution, within a training cycle. Existing secure federated learning architectures often only address security issues at specific phases, failing to provide full-cycle security guarantees. This limitation severely impacts the practical application and usability of federated learning, as ensuring security at only a limited number of phases offers little benefit in improving the overall security of federated learning. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a novel federated learning framework operation method with full-cycle security, comprising:

[0005] The trusted institution performs system initialization, generating public parameters, Paillier key pairs, user mask keys, and watermark seed sequences.

[0006] The user end uses the threshold single mask encryption algorithm TSME-HA based on homomorphic addition to encrypt the local model parameters, and calls the first stage of the two-stage reversible watermarking algorithm TSRW-ED in the encryption domain to embed the user watermark in the encryption result.

[0007] After the server verifies the user watermark, it uses the homomorphic aggregation mechanism supported by TSME-HA to aggregate the effective encryption model, and calls the second stage of TSRW-ED to embed the server watermark in the aggregated ciphertext.

[0008] The client receives the aggregated ciphertext with the server watermark, decrypts it, extracts and verifies the server watermark using TSRW-ED, and uses homomorphic hashing to verify the integrity of the aggregation result.

[0009] Among them, TSME-HA and TSRW-ED work together in the three stages of submission, aggregation and distribution to form a full-cycle security closed loop.

[0010] Optionally, the TSME-HA algorithm includes:

[0011] During the key generation phase, the trusted institution selects the Paillier parameter and generates the user mask key;

[0012] During the encryption phase, the client uses the Paillier public key to perform homomorphic encryption on the model parameters and generates a noisy mask based on the mask key.

[0013] During the secret sharing phase, the noise mask is divided into threshold secret sharing shares and distributed to other users;

[0014] During the aggregation phase, the server reconstructs the mask key of the exiting user using the share of online users and performs homomorphic addition aggregation on the cryptographic model;

[0015] During the decryption phase, the user terminal uses the Paillier private key and the reconstructed mask key to recover the plaintext model.

[0016] Optionally, the secret sharing phase of the TSME-HA includes:

[0017] Using the user mask key as a secret, construct a polynomial of degree t to generate n shares;

[0018] The share is distributed to n users through a secure channel, such that any t+1 online users can reconstruct the mask key, and at most t users can be allowed to log out.

[0019] Optionally, the first stage of the TSRW-ED includes:

[0020] The user client generates a pseudo-random sequence of length L based on the watermark seed sequence;

[0021] The user's identity, current training round, and digital signature are concatenated into plaintext watermark and then encrypted with a pseudo-random sequence.

[0022] The plaintext watermark is divided into blocks and embedded into the redundant space of the encryption model parameters. The embedding process keeps the ciphertext length and homomorphic properties unchanged.

[0023] Optionally, the process of embedding the watermarked plaintext into the redundant space of the encryption model parameters after segmentation includes:

[0024] For each model parameter ciphertext, calculate the embedding conditions;

[0025] If the conditions are met, the watermark bits are operated on with the ciphertext to generate ciphertext with the user watermark;

[0026] If the conditions are not met, select a new random number until the embedding conditions are met.

[0027] Optionally, the second stage of the TSRW-ED includes:

[0028] The server constructs a global watermark plaintext, which includes the identifier for the next round of training.

[0029] Select redundant positions in the aggregated ciphertext and embed the global watermark using a pseudo-random sequence;

[0030] After embedding, an aggregated ciphertext with a server watermark is generated for user verification.

[0031] Optionally, the coordination mechanism includes:

[0032] TSME-HA provides encryption and masking protection during the submission phase, supports homomorphic addition and key reconstruction during the aggregation phase, and supports decryption and integrity verification during the distribution phase.

[0033] TSRW-ED uses user watermarks for identity authentication during the submission phase, watermark verification to prevent late arrival attacks during the aggregation phase, and server watermarks and hash verification to prevent Byzantine attacks during the distribution phase.

[0034] Among them, TSME-HA and TSRW-ED share the watermark seed sequence and common parameters.

[0035] Optionally, the full-cycle security closed loop includes:

[0036] Submission phase: The user end uses the TSME-HA encryption model and embeds the user watermark through TSRW-ED to prevent internal eavesdropping and identity forgery;

[0037] Aggregation phase: The server implements homomorphic aggregation and exit tolerance through TSME-HA, and verifies the model source and integrity through TSRW-ED to prevent late arrival attacks;

[0038] Distribution phase: The user terminal decrypts the model through TSME-HA and verifies the server watermark and homomorphic hash through TSRW-ED to prevent Byzantine attacks and collusion attacks.

[0039] On the other hand, the present invention also provides an electronic device including a memory, a processor, and a computing program stored in the memory and executable on the processor, wherein the processor implements the method when executing the computing program.

[0040] On the other hand, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method.

[0041] Compared with the prior art, the present invention has the following advantages and technical effects:

[0042] This invention proposes a novel federated learning framework, FL-Fcs, with full-cycle security. This framework divides the full-cycle security of federated learning into submission phase security, aggregation phase security, and distribution phase security. By integrating technologies such as homomorphic encryption, masking, secret sharing, reversible watermarking, digital signatures, and homomorphic hashing, it achieves privacy protection, identity authentication, and availability verification for federated learning models. Compared with existing technologies, FL-Fcs can achieve secure authentication of identity and copyright without affecting homomorphic aggregation and decryption results, effectively resisting eavesdropping, quitting, late arrival attacks, Byzantine attacks, and collusion attacks, while ensuring the verifiability of participation, providing comprehensive security guarantees for federated learning. Attached Figure Description

[0043] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0044] Figure 1 This is a flowchart of the FL-Fcs framework according to an embodiment of the present invention;

[0045] Figure 2 This is a schematic diagram illustrating the difference between the eavesdropping results of an internal eavesdropper and the actual results in an embodiment of the present invention.

[0046] Figure 3 This is a schematic diagram illustrating the difference between the decryption result of a late attack and the actual result in an embodiment of the present invention.

[0047] Figure 4 This is a schematic diagram illustrating the bit error rate variation of homomorphic hashing under different levels of Byzantine attacks according to an embodiment of the present invention.

[0048] Figure 5 This is a schematic diagram illustrating the difference between the homomorphic hash of the aggregation model and the homomorphic hash promised by the server under different Byzantine attacks in an embodiment of the present invention.

[0049] Figure 6 This is a schematic diagram comparing the training efficiency of models under the FedAvg and FL-Fcs frameworks in this embodiment of the invention.

[0050] Figure 7 This is a schematic diagram illustrating the total running time cost under different disconnection rates according to an embodiment of the present invention;

[0051] Figure 8 This is a schematic diagram illustrating the total communication cost under different disconnection rates according to an embodiment of the present invention. Detailed Implementation

[0052] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0053] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0054] Example 1

[0055] This embodiment provides a novel federated learning framework operation method with full-cycle security, including:

[0056] The trusted institution performs system initialization, generating public parameters, Paillier key pairs, user mask keys, and watermark seed sequences.

[0057] The user end uses the threshold single mask encryption algorithm TSME-HA based on homomorphic addition to encrypt the local model parameters, and calls the first stage of the two-stage reversible watermarking algorithm TSRW-ED in the encryption domain to embed the user watermark in the encryption result.

[0058] After the server verifies the user watermark, it uses the homomorphic aggregation mechanism supported by TSME-HA to aggregate the effective encryption model, and calls the second stage of TSRW-ED to embed the server watermark in the aggregated ciphertext.

[0059] The client receives the aggregated ciphertext with the server watermark, decrypts it, extracts and verifies the server watermark using TSRW-ED, and uses homomorphic hashing to verify the integrity of the aggregation result.

[0060] Among them, TSME-HA and TSRW-ED work together in the three stages of submission, aggregation and distribution to form a full-cycle security closed loop.

[0061] This embodiment divides the entire lifecycle security of federated learning into security during the submission phase, aggregation phase, and distribution phase. By integrating technologies such as homomorphic encryption, masking, secret sharing, reversible watermarking, digital signatures, and homomorphic hashing, it achieves privacy protection, identity authentication, and availability verification for the federated learning model. Compared with existing technologies, FL-Fcs can achieve secure authentication of identity and copyright without affecting homomorphic aggregation and decryption results, effectively resisting eavesdropping, logout, late arrival attacks, Byzantine attacks, and collusion attacks, while ensuring the verifiability of participation, providing comprehensive security guarantees for federated learning.

[0062] This embodiment designs two core algorithms: the Threshold Single Mask Encryption Algorithm based on Homomorphic Addition (TSME-HA) and the Two-Stage Reversible Watermarking Algorithm for the Encryption Domain (TSRW-ED). TSME-HA innovatively integrates single mask, homomorphic encryption, and secret sharing technologies. Through two layers of secret sharing mechanisms, it addresses user logout and late arrival attacks, and resists internal eavesdropping. TSRW-ED integrates encryption, watermarking, and homomorphic hashing for security authentication without affecting homomorphic aggregation and decryption results. The design of these two algorithms solves the challenge of cross-stage integration of security technologies, enabling FL-FCS to achieve full-cycle security protection.

[0063] This embodiment theoretically derives the correctness and security of FL-Fcs and experimentally verifies its ability to resist eavesdropping, tampering, Byzantine, and late-arrival attacks under different exit settings. Experimental results show that, compared to state-of-the-art federated learning frameworks, FL-Fcs possesses strong scalability and can efficiently ensure the security of the entire training process. This provides a solid theoretical and experimental foundation for the practical application of FL-Fcs, demonstrating the feasibility and effectiveness of this framework in real-world scenarios.

[0064] Paillier cryptography is a public-key encryption system based on the compound residual problem, supporting homomorphic addition and scalar multiplication. Among numerous PHE schemes, the Paillier scheme stands out due to its high efficiency and complete security proofs. The Paillier cryptographic scheme consists of the following algorithm:

[0065] (1) Key generation. First, select two large prime numbers p and q of equal length, satisfying gcd(pq,(p-1)(q-1))=1, and calculate the product of p and q, N=pq; then, choose any integer. And satisfy gcd(L(g λ modN 2 ),N)=1, where:

[0066] L(x) = (x-1) / N;

[0067] λ = lcm(p-1, q-1);

[0068] μ=(L(g λ modN 2 )) -1 modN;

[0069] Then the public key pk = (N, g) and the private key sk = (λ, μ).

[0070] (2) Encryption. Select any random number. And gcd(r,N)=1, given plaintext The corresponding ciphertext is:

[0071] c = Enc(m,r) = g m r N modN 2 ;

[0072] (3) Decryption. Input ciphertext c, satisfying... Calculate plaintext m:

[0073] m = Dec(c) = L(c) λ modN 2 μmodN;

[0074] (4) Reversible watermarks on Paillier;

[0075] In the Paillier cryptosystem, the introduction of random numbers results in a one-to-many mapping between plaintext and ciphertext, leading to redundancy within the ciphertext. By utilizing information hiding techniques in the ciphertext field, watermark information can be embedded in these redundant parts, enabling the coexistence of ciphertext and watermark.

[0076] Paillier is embedded once;

[0077] The plaintext carrier is m, the information to be embedded is b, and a random number is selected. Ciphertext c is generated by encryption using formula (4). If LWN(c,Len(b)) = b, return ciphertext c; otherwise, select a random number again. Until LWN(c,Len(b)) = b.

[0078] Paillier secondary embedding;

[0079] The ciphertext is c, the information to be embedded is b, and a random number is selected. The ciphertext c0 is generated by encrypting the plaintext number 0 using formula (4), and the calculation is performed. if Then return the ciphertext. Otherwise, choose again. until until.

[0080] The meanings are shown in Table 1:

[0081] Table 1

[0082]

[0083] Homomorphic hashing is a special type of hash function that allows certain operations to be performed on a hash value, and the result of these operations is the same as the result of performing the same operations on the original data. A linear homomorphic hash function typically consists of two basic algorithms: LHH.Gen and LHH.Hash.

[0084] {G,g,(β1,β2,…,β d )}←LHH.Gen(1 κ ,1 d Given a security parameter κ and a vector dimension d, the algorithm outputs common parameters, including a cyclic group G of prime order q, a generator g, and d distinct elements β1, β2, ..., βn. d ∈G, and a large prime number p h .

[0085] h←LHH.Hash(W): Given a matrix W with d elements, first stretch W into a d-dimensional vector, and the algorithm will output its corresponding homomorphic hash value.

[0086]

[0087] In addition to the basic collision resistance of hash functions, linear homomorphic hash algorithms also possess homomorphism, meaning that for two distinct vectors W1 and W2, the following equation holds true:

[0088]

[0089] This embodiment constructs a threshold single-mask encryption algorithm (TSME-HA) based on homomorphic addition, including:

[0090] TSME-HA, based on the Paillier homomorphic encryption system, integrates a two-layer secret sharing (SS) mechanism with single mask (SM) technology to achieve full-cycle security against internal eavesdropping, user logout fault tolerance, and server late arrival attacks. Its core lies in utilizing threshold cryptography and homomorphic addition properties to ensure the security and availability of the encryption model during the submission and aggregation phases.18

[0091] TSME-HA.Setup(κ)→para sys ,para pub The system takes the safety parameter κ as input and generates a large prime number (p, q) that satisfies... And calculate N = p × q, and choose a random integer g that satisfies 0 < g < N. 2 Large prime number u satisfies Calculate v = g u modN 2 At the same time, generate a large prime number q. s Satisfy 2 2κ-1 ≤q s ≤2 2κ -1, output system parameter para sys =(p,q,g,N,v,q) s ,u) and common parameter para pub=(g,N,v,q) s ).

[0092] TSME-HA.KeyGen(X,para sys ,n)→keys:The system will collect the system parameters of X. sys Using the threshold scheme n as input, compute the key λ = lcm(p-1, q-1) and μ = (L(g λ modN 2 )) -1 modN, where By using Shamir's secret sharing with 0 as the partition secret, an n-1 degree polynomial f is constructed using Formula 9. ss Set X = {x i} 1≤i≤n As input, generate the secret {y} using an (n,n) threshold scheme. i} 1≤i≤n For each y i Output key set keys = {key i =(λ,μ,y) i )} 1≤i≤n .

[0093] TSME-HA.Share(X,para sys ,y1,n,t)→share: Secret S1=y1, construct a polynomial f of degree t-1 using formula 9 ss and with set X = {x i} 1≤i≤n The noise mask is segmented into {(x) by using an (t,n) threshold scheme as input. i ,v (1,i) =f ss (x i ))}x i∈X and share = {v (1,i)} 1≤i≤n As output.

[0094] TSME-HA.Enc(m,para sys ,key1,g')→c: The system will store the plaintext m and system parameter para sys Using the key key1 and noise base g' as input, select a random number. Select random number Calculate c = g m v r g'y i r' N modN 2 .

[0095] TSME-HA.Agg(C,Sd ,para pub ,g')→c agg The system will reconstruct the secret S from the ciphertext set C. d Common parameters pub Using the noise base g' as input, calculate

[0096] TSME-HA.Dec(c,para sys ,key1)→m: The system will store the ciphertext c and the system parameter para sys and key para sys As input, calculate

[0097] This embodiment constructs a two-stage reversible watermarking algorithm (TSRW-ED) for the encrypted domain, including:

[0098] TSRW-ED embeds a watermark in the encrypted domain using Reversible Data Hiding (RDH-ED) technology to achieve identity authentication, copyright traceability, and resistance to Byzantine attacks, while ensuring that the watermark embedding does not affect the homomorphism of the model. The algorithm consists of a first-stage embedding (FSI) on the user side and a second-stage embedding (SSI) on the server side, corresponding to the security requirements of the submission and distribution stages, respectively.

[0099] TSRW-ED.Setup(k s ,epochs)→seeds: The system will store the key k s The total number of rounds (epochs) is taken as input, and k is used as the input. s Generate a seed list of length epochs: seeds = {s epochs =Hash(k) s ),s epochs-1 =Hash(s) epochs ),…,s2=Hash(s3),s1=Hash(s2)}.

[0100] TSRW-ED.WmGen(ρ,epoch,seeds)→sign epcoh The system takes the secret information ρ, the current epoch of the watermark, and the seed list s as input. It uses seeds s. epoch Input a random number generator to generate a pseudo-random sequence seq epoch =PRG(s epoch ), and calculate watermark information.

[0101] TSRW-ED.FSI(sign1,W1,para sys ,key1,L wm ,G)→Wwm The system divides the watermark information into blocks: sign1 = (b1||b2||…||b d There are d blocks in total. Model parameter m j ∈W1 where j≤d, select the noise base g' in the noise base matrix G. j Calculate c repeatedly j =TSME-HA.Enc(m j ,para sys ,key1,g' j ), until LWN(c) is satisfied. j ,L wm )=b j Return ciphertext c j Model parameters {m k} k＞d Directly perform C k =TSME-HA.Enc(m k ,para sys (key1). Returns the watermarked encrypted model W. wm .

[0102] TSRW-ED.SSI(sign1,W1,para pub ,L wm →W wm The system divides the watermark information sign1 into blocks, sign1 = (b1||b2||…||b d There are d blocks in total. Model parameter m j ∈W1 where j≤d, randomly select a random number. calculate And calculate m = (m × c0) mod N 2 ,if Then return the watermarked ciphertext Otherwise, select a new random number. Return watermarked encryption model W wm .

[0103] TSRW-ED.Ext(W wm ,epoch,seeds,L wm → ρ: For each encryption parameter pass Obtain watermark information sign = (b1||b2||…||b d Using a pseudo-random number generator to generate a pseudo-random sequence seq epoch =PRG(s epoch ),calculate

[0104] TSME-HA and TSRW-ED work together in the following ways:

[0105] Submission phase: TSME-HA encryption model parameters, TSRW-ED embedded user watermark, resisting internal eavesdropping and identity forgery.

[0106] Aggregation phase: TSME-HA handles key reconstruction for outgoing users, TSRW-ED verifies the model source, and prevents server late-arrival attacks.

[0107] Distribution phase: TSME-HA ensures decryption correctness, and TSRW-ED resists Byzantine attacks through hash verification, achieving verifiable participation.

[0108] Through cross-validation, the two technologies achieve cross-stage integration of security technologies without introducing additional communication overhead, ensuring privacy, authentication, and availability throughout the entire federated learning lifecycle.

[0109] Figure 1 The flowchart of the FL-Fcs framework in this embodiment illustrates the five stages and data / control flow of the novel federated learning framework operation method (FL-Fcs) with full-cycle security during a complete training cycle.

[0110] The system initialization phase is led by a Trusted Institution (TI), which completes user registration, parameter generation, and key distribution, laying the foundation for full-cycle security.

[0111] The user registration and identity generation process includes: the user submits a registration request to TI, and TI generates a user index list U1 and a set of unique identifiers. in Ensure identity traceability.

[0112] The parameter and key initialization process includes: TI running TSME-HA.Setup(κ) based on security parameter κ to generate system parameter para. sys and common parameters para pub And through TSME-HA.KeyGen(X,para sys (n) Generate Paillier key pairs and mask key sets. Where y i A user-specific mask key is provided. The server sets the global training epochs, threshold t, and seed key k. s Aggregate weights {ω i} i∈U1 and training ID (ID) P ID C ), and together with the user, execute TSRW-ED.Setup(k s(epochs) generate watermark seed sequences seeds.

[0113] The process of secret sharing and pre-allocation includes: after the user receives the parameters, they use TSME-HA.Share(X,para) sys The algorithm (y1,n,t) will mask the key y i Divided into (t,n) threshold shared values and v (i,j) Send to other users to ensure that subsequent aggregation phases are resistant to user logout.

[0114] The model submission phase (anti-eavesdropping and identity forgery) includes the following processes:

[0115] After users complete local training, the model parameters are encrypted and watermarked to ensure privacy and authentication during the submission process.

[0116] Local model training and weighting: Users train local data based on a unified model and hyperparameters on the server, generating updated parameters W. i and through W weight,i =ω i W i Calculate the weighted parameters, where ω i The aggregate weight assigned to the server.

[0117] Signature and watermark plaintext generation: Initialize homomorphic hash LHH.Gen(1 κ ,1 d ), calculate the hash value h of the weighted parameters. i =LHH.Hash(W weight,i ), and use the user's RSA private key Sk i Generate signature Constructing watermark plaintext ρ i =(ID) B ||ID P ||σ i ||x i ||ID C ), where ID B ID for the previous training round C This is the training ID for the current round.

[0118] Encryption and watermark embedding: Users can embed watermarks via TSRW-ED.WmGen(ρ i (epoch,seeds) generates watermarked ciphertext Where seq epoch =PRG(s epoch ), and utilize TSRW-ED.FSI(sign i,epoch W weight,i ,para sys,key i ,L wm G epoch ) to W weight,i Encryption, where G epoch For ID-based C The generated noise matrix, L wm The length of the watermark block is determined by the sign. i,epoch Embedded encryption model to generate watermarked ciphertext. Submit to the server.

[0119] The model aggregation phase (resistance to exit and late arrival attacks) includes the following processes:

[0120] The server verifies the watermark and aggregates the model, resisting user logout and malicious attacks through layered secret sharing.

[0121] Watermark verification and user list update: The server uses TSRW-ED.Ext(W wm ,epoch,seeds,L wm →ρ: Extract watermark ρ i Verify ID B ID P ID C and signature σ i The validity of the model is evaluated, invalid models are rejected, and a list of exiting users, U, is generated. d And the online user list U2. Online users receive U d Then, calculate the shared secret of the user who logged out and And submit it to the server.

[0122] Secret Reconstruction and Model Aggregation: The server reconstructs the exiting user's mask key and S using Lagrange interpolation. d =f S (0), where Utilize for Retrieve encrypted parameters using the same index in the database. By ID C Generate noise matrix G epoch Take g' index ∈G epoch And through TSME-HA.Agg(C,S d ,para pub ,g' index ) Calculate the aggregation parameters of the aggregation model [W].

[0123] Server-side watermark embedding: The server constructs a global watermark plaintext ρ s =(ID) B ||ID P ||ID N||ID C (ID) N For the next round of training ID), via TSRW-ED.SSI(sign) s,epoch ,[W],para pub ,L wm ) sign s,epoch Embedded aggregated ciphertext generates a watermarked aggregated model [W] wm .

[0124] Update distribution: Calculate update weights The server will [W] wm Weight ω and user signature Distribute to online users.

[0125] The model distribution phase (anti-Byzantine and collusive attacks) includes the following processes:

[0126] Users decrypt the model and verify its integrity to ensure that the aggregation results have not been tampered with.

[0127] Watermark Verification and Training ID Update: Users verify their watermarks using TSRW-ED.Ext([W]). wm ,epoch,seeds,L wm Extract server watermark ρ s Verify ID B and ID C To maintain continuity, update the local training ID to ID. N and ID C .

[0128] Model decryption: Decrypting the aggregated ciphertext [W] wm Execute TSME-HA.Dec([W) wm ,para sys ,key1), recover plaintext model

[0129] Integrity and Participation Verification: Decrypting User Signatures Recalculate aggregate hash and ciphertext hash If the comparison is consistent, the update is accepted; otherwise, an attack is detected.

[0130] Local model update: Adjust the decryption model Update local aggregate weights Start the next round of training.

[0131] Example 2

[0132] This embodiment provides a novel federated learning framework operation method with full-cycle security, including:

[0133] The FL-FCS user and server programs are implemented using Python 3.9.1, running Windows 10, with 16GB of RAM and an 11th generation CPU. Core TM i5-1135G7 @ 2.40-2.42GHz, Lenovo R800 NVMe M.21TB SSD, dual GPUs ( XeGraphics and NVIDIA GeForce MX450). The experiment used Python PHE 1.5.0 for modular exponentiation, Paillier encryption to convert floating-point numbers to integers with 10 decimal places for encryption, and the FL framework based on PyTorch 1.12.0 + cu116.

[0134] This embodiment first tests the performance of FL-Fcs under attacks during three security phases. Then, by adjusting variables such as model size, user size, and disconnection rate, the performance of FL-Fcs on the MNIST and Fashion-MNIST (FMNIST) datasets is evaluated under the same convolutional neural network (CNN) architecture (as shown in Table 2). MNIST (http: / / yann.lecun.com / exdb / mnist / ) and Fashion-MNIST (https: / / github.com / zalandoresearch / fashion-mnist) are used to evaluate training performance. MNIST contains 10 classes of handwritten digits, 60,000 training / 10,000 test samples, and 28×28 grayscale images; Fashion-MNIST contains 10 classes of fashion item grayscale samples, with the same size as MNIST. The global model is the CNN in the appendix. The dataset is uniformly distributed among preset users. Training samples are augmented with random rotation and translation, with a learning rate of 0.5, a batch size of 256, and cross-entropy loss and SGD optimizer are used.

[0135] Table 2

[0136]

[0137]

[0138] The security assessment process includes:

[0139] Resistance to insider eavesdropping attacks during the submission phase: In insider eavesdropping attacks, malicious users illegally obtain other users' information. The decryption is performed using a shared (λ,μ) parameter. This experiment evaluates the FL-Fcs's resistance to internal eavesdropping attacks by detecting the difference between the decryption result and the actual result. To visually demonstrate the difference between the eavesdropping parameters and the original parameters, this embodiment... Figure 2The graph lists the errors for the first 500 parameters, showing the results of the same attacker attacking different users. The differences between the decryption parameter values ​​and the true values ​​are significant and randomly distributed. This is because the ciphertext in the user-side model does not rely solely on the same key. Experimental results indicate that an insider in FL-FCS cannot extract the ciphertext from the user's data. Obtain useful information from it.

[0140] Aggregation phase resistance to late arrival attacks: In a simulation experiment of a late arrival attack, the server reconstructs the y-code of the user who logged out according to the protocol. i , trying to from The original model parameters are obtained from the [process / method / process]. To visually demonstrate the difference between the decrypted parameters after the attack and the original parameters, this embodiment [details / details]. Figure 3 The results list the errors of the first 500 parameters, showing that a malicious server was stealing data from different users. i Subsequently, the decryption difference exhibits a random distribution, making it difficult for attackers to predict the model parameters. Therefore, experimental results demonstrate that FL-Fcs can effectively resist late-delivery attacks, protecting the security and privacy of user model parameters.

[0141] Resisting Byzantine Attacks in the Distribution Phase: In the Byzantine attack simulation, malicious servers employ various methods: at the parameter level, they maliciously modify model parameters by exploiting the homomorphic property of the algorithm; at the model level, they selectively ignore some user models or collude with certain users to forge models for aggregation. Attack types include: Direct Model Parameter Substitution (DSA), where the server partially replaces the correct model with its own model; Direct Model Parameter Tampering (DTA), where certain parameters are numerically modified; Malicious User Collusion Model Generation (RMA), where the server colludes with malicious users to generate fake models; and Focused Model Aggregation (FMA), where the server only aggregates models from selected users. In this experiment, this embodiment sets 10,000 model parameters and 100 users. By observing the bit error rate of the 256-bit homomorphic hash function under different attack levels and the bit error rate of homomorphic hashing when the attack ratio is 1%, the effectiveness of the FL-Fcs secure aggregation framework is evaluated. Figure 4 It can be seen that the bit error rate is normally 0, but under different attack levels, the bit error rate remains stable at around 50%. From... Figure 5 It can be seen that the homomorphic hash errors under different attacks are randomly distributed. Experimental results show that FL-Fcs can effectively resist Byzantine attacks by malicious servers.

[0142] The efficiency evaluation process includes:

[0143] like Figure 6 As shown, runtime and communication overhead: This embodiment first sets up 10 users with an exit rate of 30%, and tests are conducted using FedAvg and FL-Fcs respectively. Figure 6As shown, FL-Fcs has no negative impact on the training efficiency of the model. Subsequently, experiments were conducted for different user and model sizes, with the security parameter κ set to 1024 and the model size fixed at 50K. Tables 3 and 4 show the runtime of different steps under unreliable server and user settings.

[0144] Table 3

[0145]

[0146] Table 4

[0147]

[0148]

[0149] Throughout the algorithm, the communication complexity of secret sharing is O(n²). Encryption and decryption times depend on the model size, while watermark embedding time is only related to the watermark length. For both the server and users, the watermark extraction and decryption processes do not require significant computational resources or time. Although the user-side verification process is time-consuming, it exhibits a linear growth trend and has no significant impact on performance. The computational complexity of secret reconstruction is O(mn) (where m is the number of online users), and its time consumption increases most significantly, but it remains within an acceptable range. Although server aggregation is time-consuming, it also exhibits a linear growth trend and does not cause significant negative impacts.

[0150] Furthermore, considering that the user is using a resource-constrained mobile device, it is necessary to study the communication cost from the user's perspective. The total communication cost of the solution in this embodiment throughout the aggregation process is as follows: Figure 7 and Figure 8 As shown, the performance is higher than other solutions. This is mainly because the Paillier encryption algorithm requires a longer key length, leading to increased data transmission volume. However, the solution in this embodiment has a significant advantage in operational efficiency, enabling task processing to be completed in a shorter time and greatly improving the overall system response speed. Specifically, for large-scale systems, such as those with 500 users, when the exit rate is high (e.g., greater than 10%), the security framework in this embodiment outperforms SecAgg, SecAgg+, and VeriFL, and is comparable to EDAP.

[0151] Watermarking Efficiency: This embodiment will introduce the different stages of user-server data interaction in federated learning. This embodiment will discuss the changes in ciphertext before and after embedding, as well as the accuracy of verification information extraction and the reliability of authentication implementation. In terms of experimental setup, this embodiment uses 64 bits to represent each parameter of the model. In the experiment, the security parameter is set to 1024, and the homomorphic hash length is 256 bits. The model used is the CNN model given in the appendix, with 1,199,882 parameters. As can be seen from Table 5, after embedding authentication data into the model ciphertext, the amount of ciphertext data after embedding does not increase; therefore, no additional communication traffic is generated during the authentication process. After homomorphic aggregation of the model ciphertext, both the number of model parameters and the amount of data remain unchanged.

[0152] Table 5

[0153]

[0154] Table 6

[0155]

[0156] In this embodiment, n is set to 10 to verify the accuracy of data extraction and verification. The experiments were conducted for 100 and 300 training cycles respectively. As shown in Table 6, the specific performance of the extraction error rate (EER), decryption error rate (DER), and authentication success rate (ASR) is as follows: EER (DER) represents the extracted data and the data during embedding.

[0157] Value. This embodiment modifies the embedded part by randomly modifying the value. ID in B ID C σ i ID P and the ID embedded in B ID C ID N ID P This generates incorrect authentication information, marking genuine information as true and incorrect information as false.

[0158] On the other hand, this embodiment also provides an electronic device, including a memory, a processor, and a computing program stored in the memory and executable on the processor, wherein the processor implements the method when executing the computing program.

[0159] On the other hand, this embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method.

[0160] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A novel federated learning framework operation method with full-cycle security, characterized in that, include: The trusted institution performs system initialization, generating public parameters, Paillier key pairs, user mask keys, and watermark seed sequences. The user end uses the threshold single mask encryption algorithm TSME-HA based on homomorphic addition to encrypt the local model parameters, and calls the first stage of the two-stage reversible watermarking algorithm TSRW-ED in the encryption domain to embed the user watermark in the encryption result. After the server verifies the user watermark, it uses the homomorphic aggregation mechanism supported by TSME-HA to aggregate the effective encryption model, and calls the second stage of TSRW-ED to embed the server watermark in the aggregated ciphertext. The client receives the aggregated ciphertext with the server watermark, decrypts it, extracts and verifies the server watermark using TSRW-ED, and uses homomorphic hashing to verify the integrity of the aggregation result. Among them, TSME-HA and TSRW-ED work together in the three stages of submission, aggregation and distribution to form a full-cycle security closed loop.

2. The method according to claim 1, characterized in that, The TSME-HA algorithm includes: During the key generation phase, the trusted institution selects the Paillier parameter and generates the user mask key; During the encryption phase, the client uses the Paillier public key to perform homomorphic encryption on the model parameters and generates a noisy mask based on the mask key. During the secret sharing phase, the noise mask is divided into threshold secret sharing shares and distributed to other users; During the aggregation phase, the server reconstructs the mask key of the exiting user using the share of online users, and performs homomorphic addition aggregation on the cryptographic model using the reconstructed mask key; During the decryption phase, the user terminal uses Paillier's private key to recover the plaintext model.

3. The method according to claim 1, characterized in that, The secret sharing phase of the TSME-HA includes: Using the user mask key as a secret, construct a polynomial of degree t to generate n shares; The share is distributed to n users through a secure channel, such that any t+1 online users can reconstruct the mask key, and at most t users can be allowed to log out.

4. The method according to claim 1, characterized in that, The first stage of the TSRW-ED includes: The user client generates a pseudo-random sequence of length L based on the watermark seed sequence; The user's identity, current training round, and digital signature are concatenated into plaintext watermark; The plaintext watermark is divided into blocks and embedded into the redundant space of the encryption model parameters. The embedding process keeps the ciphertext length and homomorphic properties unchanged.

5. The method according to claim 4, characterized in that, The process of embedding the watermarked plaintext into the redundant space of the encryption model parameters after segmenting it into blocks includes: For each model parameter ciphertext, calculate the embedding conditions; If the conditions are met, the watermark bits are operated on with the ciphertext to generate ciphertext with the user watermark; If the conditions are not met, select a new random number until the embedding conditions are met.

6. The method according to claim 1, characterized in that, The second phase of the TSRW-ED includes: The server constructs a global watermark plaintext, which includes the identifier for the next round of training. Select redundant positions in the aggregated ciphertext to embed the global watermark encrypted using pseudo-random sequences; After embedding, an aggregated ciphertext with a server watermark is generated for user verification.

7. The method according to claim 1, characterized in that, The coordination mechanism includes: TSME-HA provides encryption and masking protection during the submission phase, supports homomorphic addition and key reconstruction during the aggregation phase, and supports decryption and integrity verification during the distribution phase. TSRW-ED uses user watermarks for identity authentication during the submission phase, threshold masks to prevent late arrival attacks during the aggregation phase, and server watermarks and hash verification to prevent Byzantine attacks during the distribution phase. Among them, TSME-HA and TSRW-ED share the watermark seed sequence and common parameters.

8. The method according to claim 1, characterized in that, The full-cycle security closed loop includes: Submission phase: The user end uses the TSME-HA encryption model and embeds the user watermark through TSRW-ED to prevent internal eavesdropping and identity forgery; Aggregation phase: The server implements homomorphic aggregation and exit tolerance through TSME-HA, and verifies the model source and integrity through TSRW-ED to prevent late arrival attacks; Distribution phase: The user terminal decrypts the model through TSME-HA and verifies the server watermark and homomorphic hash through TSRW-ED to prevent Byzantine attacks and collusion attacks.

9. An electronic device comprising a memory, a processor, and a computing program stored in the memory and executable on the processor, characterized in that, When the processor executes the computing program, it implements the method of any one of claims 1-8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1-8.

Images