Federal learning verifiable security aggregation method under double cloud servers
By employing a federated learning approach under dual cloud servers and utilizing key negotiation to generate masks and verification codes, the verifiability problem of the aggregation process in federated learning is solved, achieving secure and efficient model updates and privacy protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUILIN UNIV OF ELECTRONIC TECH
- Filing Date
- 2026-02-03
- Publication Date
- 2026-04-17
AI Technical Summary
Existing federated learning lacks verifiable aggregation oversight mechanisms for privacy protection, posing a risk of sensitive information leakage, and traditional methods are insufficient to effectively supervise and verify the correctness of the aggregation process.
The system employs a dual-cloud server architecture. The client negotiates three sets of keys with the auxiliary node group to generate a single-value mask and a verification code. The client randomly generates the mask, splits and encrypts the gradient, and uploads it to the cloud server for aggregation. Finally, the client verifies the correctness of the aggregated verification code.
While ensuring high security, it significantly reduces the computational and communication overhead of the verification process, provides a verifiable and secure aggregation mechanism, and ensures the authenticity and integrity of model updates.
Smart Images
Figure CN121887393A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of privacy computing technology, specifically to a federated learning verifiable secure aggregation method under dual cloud servers. Background Technology
[0002] With the widespread application of artificial intelligence technology, the generation of massive amounts of data has provided abundant resources for intelligent analysis, while also raising serious concerns about privacy protection. An ideal data processing model should adhere to the principle of "data usable but not visible," meaning that raw information should not be disclosed to unauthorized entities when performing analysis and computation tasks. This principle aims to restrict the direct flow of data at the architectural level, laying the foundation for subsequent privacy protection technologies. In environments where data is distributed across various terminal devices, achieving secure and efficient collaborative learning becomes a key challenge. Simply relying on centralized data processing models not only faces enormous transmission and storage overhead but also poses significant privacy and security risks. Federated learning, as a cutting-edge distributed machine learning paradigm, offers a highly promising solution. The core idea of this framework is collaborative modeling without exchanging raw data. Specifically, each participant uses only local data for model training and participates in collaboration by uploading model parameter updates instead of raw data. These local updates are integrated through a secure aggregation mechanism to generate a global model, which is then distributed to each participant for the next round of training. In this way, federated learning can effectively reduce the risk of raw data leakage while promoting the collaborative use of data value, providing technical feasibility for breaking down "data silos."
[0003] However, federated learning still faces multiple challenges in practical deployment, and its security and privacy guarantees are not absolute. Among these, the issue of data and model integrity leakage is increasingly prominent: untrusted service providers may replace the original model with a simpler one, or even forge aggregation results to return to users, in order to reduce computational costs or launch malicious attacks. Furthermore, even without directly exposing the original data, frequent model updates may still contain sensitive information, making them vulnerable to privacy attacks such as member inference and attribute inference. More seriously, traditional privacy-preserving aggregation mechanisms generally lack efficient and verifiable methods, making it difficult for participating parties to effectively supervise and verify the correctness of the aggregation process, thus making it difficult to reliably guarantee the authenticity and integrity of model updates. Summary of the Invention
[0004] The purpose of this invention is to provide a verifiable and secure aggregation method for federated learning under dual cloud servers, which aims to solve the technical problems of existing federated learning privacy protection technologies lacking verifiable aggregation supervision mechanisms and having the risk of sensitive information leakage.
[0005] To achieve the above objectives, this invention provides a verifiable and secure aggregation method for federated learning under dual cloud servers, comprising the following steps:
[0006] Step 1: Set up a group of auxiliary nodes. Each client negotiates three sets of keys with each auxiliary node to generate secret values. After aggregation, two sets of single-value masks and one set of verification codes are obtained. The client performs random generation on the single-value masks.
[0007] Step 2: The client splits the gradient horizontally, reshapes the gradient vector to obtain a two-dimensional vector, and then splits it again; it uses the sum of the local key negotiation values as a mask for encryption, and uses the sum of another set of key negotiation values and the gradient to generate a verification code. The mask gradient and the verification code are then uploaded to two cloud servers for aggregation.
[0008] Step 3: The two cloud servers each aggregate the gradient and the verification code, then concatenate the gradients, and a designated server performs the overall aggregation. Each server receives the sum of keys sent by the auxiliary node, performs masking, and sends the aggregated model and aggregated verification code to each client.
[0009] Step 4: The client recalculates the expected verification code based on the received aggregation model and compares it with the received aggregate verification code for verification.
[0010] Optionally, in step 1, each client and each auxiliary node execute a session based on the key negotiation protocol, generating two pairs of initial negotiation values, which are used as mask seed values. Before using the mask seed values, the client randomizes each pair of initial negotiation values using a pseudo-random number generator to obtain two pairs of randomized mask values:
[0011]
[0012] in, Indicates the client identifier. Indicates the auxiliary node identifier. and These represent the first and second sets of initial negotiated values obtained by the client and the auxiliary node, respectively. and These are the corresponding randomization mask values.
[0013] Optionally, the execution process of step 2 includes the following steps:
[0014] Step 2.1: The client splits the gradient vector obtained from local training into sub-vectors according to a preset partitioning rule. and They were uploaded to two different cloud servers respectively;
[0015] Step 2.2: The client uses the sum of the first set of randomized mask values from the local aggregation. The gradient is encrypted using an additive mask. The specific encryption method is as follows:
[0016]
[0017] in, Indicates the total number of auxiliary nodes. and Clients respectively With auxiliary nodes The first and second sets of initial negotiated values obtained through negotiation For the same pseudo-random number generation function, the generated numbers are... and These are the encrypted mask gradient parts;
[0018] Step 2.3: Use the sum of another set of randomized mask values The integrity verification code is generated using local gradient generation, and the calculation form of the verification code is as follows:
[0019]
[0020] in, Random numbers generated locally on the client side are used to enhance the collision resistance and unforgeability of the CAPTCHA; the generated... and These are the corresponding gradient parts. and The verification code;
[0021] Step 2.4: The client will use the encrypted mask gradient. , and its corresponding verification code , The data was uploaded to two different cloud servers for subsequent aggregation and verification processing.
[0022] Optionally, the execution process of step 3 includes the following steps:
[0023] Step 3.1: Each of the two cloud servers performs an aggregation calculation on the received encryption gradient and verification code:
[0024]
[0025] in, Indicates the total number of auxiliary nodes. and These are the corresponding gradient parts. and The verification code; after aggregation, the two aggregated gradients are concatenated horizontally in the reverse process of the splitting operation to restore the original gradient size;
[0026] Step 3.2: Specify one server to perform a total aggregation on the concatenated gradient and CAPTCHA:
[0027]
[0028] Each server receives the sum of keys sent by the auxiliary nodes. Masking is performed, and the aggregation model and aggregation verification code are sent to the user. During the aggregation process, each server receives the sum of the negotiated keys from each client, sent by the auxiliary nodes. This is used to securely eliminate the mask during the aggregation phase;
[0029] Step 3.3: Specify the server to send the aggregated model gradients and aggregated verification codes to each client.
[0030] Optionally, in step 4, after receiving the aggregated model gradient and the aggregated verification code, the client verifies the correctness of the aggregated verification code:
[0031]
[0032] If the equation holds true, it means that the aggregation gradient has not been tampered with and the verification is successful; otherwise, the verification is deemed to have failed, the client rejects the aggregation result for this round, and reports the abnormal status to the system.
[0033] This invention provides a verifiable and secure aggregation method for federated learning under dual cloud servers. Each client negotiates three sets of keys with each auxiliary node, which serve as two sets of single-value masks and one set of verification codes. The client needs to randomly generate these masks. After training, the client horizontally splits the gradient vectors. Specifically, the gradient vector is first reshaped to obtain a two-dimensional vector, and then split. The sum of the locally negotiated key values is used as a mask for encryption. The sum of the other set of negotiated key values and the gradient are used to generate the verification code. The mask gradient and verification code are uploaded to the two cloud servers for aggregation. Each cloud server aggregates the gradient and verification code, then concatenates the gradients. A designated server performs the final aggregation. Each server receives the sum of keys sent by the auxiliary node, performs mask removal, and sends the aggregated model and aggregated verification code to the user. The user verifies the correctness of the aggregated verification code. This invention reduces the computational overhead during the verification process while ensuring high security. Attached Figure Description
[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0035] Figure 1 This is a flowchart illustrating the steps of a verifiable and secure aggregation method for federated learning under dual cloud servers according to the present invention.
[0036] Figure 2 This is a schematic diagram illustrating the principle architecture of a federated learning verifiable secure aggregation method under dual cloud servers according to the present invention.
[0037] Figure 3 This is a mask encryption diagram of a verifiable secure aggregation method for federated learning under dual cloud servers according to the present invention. Detailed Implementation
[0038] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.
[0039] Please see Figure 1 This invention provides a verifiable and secure aggregation method for federated learning under dual cloud servers, comprising the following steps:
[0040] Step 1: Set up a group of auxiliary nodes. Each client negotiates three sets of keys with each auxiliary node to generate secret values. After aggregation, two sets of single-value masks and one set of verification codes are obtained. The client performs random generation on the single-value masks.
[0041] Step 2: The client splits the gradient horizontally, reshapes the gradient vector to obtain a two-dimensional vector, and then splits it again; it uses the sum of the local key negotiation values as a mask for encryption, and uses the sum of another set of key negotiation values and the gradient to generate a verification code. The mask gradient and the verification code are then uploaded to two cloud servers for aggregation.
[0042] Step 3: The two cloud servers each aggregate the gradient and the verification code, then concatenate the gradients, and a designated server performs the overall aggregation. Each server receives the sum of keys sent by the auxiliary node, performs masking, and sends the aggregated model and aggregated verification code to each client.
[0043] Step 4: The client recalculates the expected verification code based on the received aggregation model and compares it with the received aggregate verification code for verification.
[0044] The following description, in conjunction with specific embodiments and execution processes, provides further details:
[0045] like Figure 2 The diagram illustrates the architecture and principle of a federated learning verifiable secure aggregation method under dual cloud servers according to the present invention.
[0046] Step 1: Each client negotiates three sets of keys with each auxiliary node, which serve as two sets of single-value masks and one set of verification codes. The client also needs to randomly generate these masks.
[0047] In this step, each client and each auxiliary node execute a secure key negotiation protocol to generate three independent sets of secret values. The first two sets of secret values are aggregated to form a first-type mask used for gradient encryption; the third set of secret values is aggregated to form a second-type mask used to generate an integrity verification code. A pseudo-random generator is added to process the masks, participating in the randomization process of the first two sets of masks to ensure that each generated mask is unpredictable and forward-secure. The client performs secure hashing and random permutation operations on all secret values locally to generate the final mask sequence, preventing reuse attacks and correlation analysis.
[0048] Specifically, each client executes a key negotiation protocol-based session with each auxiliary node in the auxiliary node group, generating two pairs of initial negotiation values, which are used as mask seed values. Before using the mask seed values, the client randomizes each pair of initial negotiation values using a pseudo-random number generator, obtaining two pairs of randomized mask values, denoted as...
[0049]
[0050] in Indicates the client identifier. Indicates the auxiliary node identifier. and These represent the first and second sets of initial negotiated values obtained by the client and the auxiliary node, respectively. and These are the corresponding randomized mask values; the randomization process ensures that the mask values are unpredictable and forward-secure in each federated learning round, preventing eavesdropping and replay attacks.
[0051] Step 2: The client splits the gradient horizontally, reshapes the gradient vector to obtain a two-dimensional vector, and then splits it again; it uses the sum of the local key negotiation values as a mask for encryption, and uses the sum of another set of key negotiation values and the gradient to generate a verification code. The mask gradient and the verification code are then uploaded to two cloud servers for aggregation.
[0052] In this step, after the client completes model training locally, it performs structured processing on the resulting gradient vectors: first, it performs a dimensionality transformation operation on the gradients, reshaping them into a two-dimensional matrix; then, it splits the matrix into several sub-blocks along the row or column direction, the splitting method being determined by preset structural parameters. The client uses a locally aggregated first-type mask to perform homomorphic additive mask encryption on each sub-block, and simultaneously uses a second-type mask and the original gradients to generate corresponding verification codes. The encrypted mask gradients and verification codes maintain a format correspondence for subsequent integrity verification.
[0053] Specifically, the client splits the gradient vector obtained from local training into two parts according to a preset partitioning rule. and The two gradients are uploaded to two different cloud servers; the client uses the sum of the first set of randomized mask values aggregated locally. The gradient is encrypted using an additive mask. The specific encryption method is as follows:
[0054]
[0055] in, Indicates the total number of auxiliary nodes. and Clients respectively With auxiliary nodes The first and second sets of initial negotiated values obtained through negotiation For the same pseudo-random number generation function, and These are the encrypted mask gradients uploaded to the two cloud servers. The client uses the sum of another set of randomized mask values. The integrity verification code is generated using local gradient generation, and the calculation form of the verification code is as follows:
[0056]
[0057] in, Random numbers generated locally on the client side are used to enhance the collision resistance and unforgeability of the CAPTCHA; and These are the corresponding gradient parts. and The verification code.
[0058] Finally, the client will use the encrypted mask gradient. , and its corresponding verification code , The data was uploaded to two different cloud servers for subsequent aggregation and verification processing.
[0059] Step 3: The two cloud servers each aggregate the gradient and the verification code, then concatenate the gradients, and a designated server performs the overall aggregation. Each server receives the sum of keys sent by the auxiliary node, performs masking, and sends the aggregated model and aggregated verification code to each client.
[0060] In this step, two cloud servers receive mask gradients and verification codes from each client, and perform homomorphic aggregation operations within their respective servers: the mask gradients are added element-wise in ciphertext, and the verification codes are aggregated into a global verification value. After aggregation, one designated server is responsible for reassembling the split gradient sub-blocks into a complete gradient vector according to the original structural parameters and performing global aggregation calculation. Each server then receives the sum of global key negotiation values corresponding to all clients sent by the auxiliary node, and uses this sum to homomorphically eliminate the mask component in the aggregated gradient, recovering the usable plaintext aggregated gradient, while retaining the aggregated verification code for verification.
[0061] Specifically, the two cloud servers each aggregate gradients and verification codes, then concatenate the gradients, and a designated server performs the overall aggregation. Each server receives the sum of keys sent by the auxiliary node, performs masking, and sends the aggregated model and aggregated verification code to the user.
[0062] In this step, each of the two cloud servers performs an aggregation calculation on the received encryption gradient and verification code:
[0063]
[0064] in, Indicates the total number of auxiliary nodes. and These are the corresponding gradient parts. and The verification code. After aggregation, the two aggregated gradients are concatenated horizontally, following the reverse process of the splitting operation, to restore the original gradient size. One server is designated to perform the final aggregation on the concatenated gradient and the verification code:
[0065]
[0066] Each server receives the sum of keys sent by the auxiliary nodes. Masking is performed, and the aggregation model and aggregation verification code are sent to the user. During the aggregation process, each server receives the sum of the negotiated keys from each client, sent by the auxiliary nodes. This is used to securely remove the mask during the aggregation phase. Finally, the designated server distributes the aggregated model gradients and aggregated CAPTCHA to each client for subsequent verification and model updates.
[0067] In the above steps, the specific encryption and decryption technology used in this invention operates on the following principle: the client and the auxiliary node perform key negotiation to generate a mask. Randomization is performed using a pseudo-random generator. Please refer to the diagram illustrating the principle and steps. Figure 3 .
[0068] in , Represents the client serial number. This represents the auxiliary node number. After the client completes local training, it will perform a mask encryption operation. The principle that ensures privacy is not compromised is that, for a single client, the local gradient uses [a specific method / mechanism] during encryption. Even with a mask, if the server colludes with auxiliary nodes, according to the threat model settings, it cannot collude with all auxiliary nodes simultaneously, thus failing to effectively obtain local gradients. Similarly, when the server colludes with clients, according to the threat model settings, it cannot collude with all clients simultaneously. When this situation is generalized to all... When a client is on a local server, the server cannot effectively obtain the local gradient.
[0069] During decryption, Each auxiliary node will sum its own values and provide the server with a mask to achieve mask elimination. However, considering that the server, auxiliary nodes, or clients may collude, they will be unable to decrypt the local gradient. The sum of all auxiliary nodes and Since the total number of negotiation keys for all clients is the same, mask elimination can be achieved to obtain lossless aggregation results.
[0070] Step 4: The client recalculates the expected verification code based on the received aggregation model and compares it with the received aggregate verification code for verification.
[0071] In this step, the client uses the locally stored second-type mask secret value and the received aggregation model to recalculate the expected verification code and compares it with the received aggregated verification code. This verification process is implemented through lightweight hash comparison or finite-field arithmetic operations, ensuring the integrity and authenticity of the aggregation result while avoiding complex cryptographic operations. If the verification passes, the client accepts the aggregation model for subsequent training or inference; otherwise, an exception handling mechanism is triggered, rejecting the abnormal result and reporting it to the audit node. This method significantly reduces the computational and communication overhead of the verification phase while maintaining strong security assumptions.
[0072] The specific operating procedure is as follows:
[0073] After receiving the aggregated model gradient and the aggregated CAPTCHA, the client verifies the correctness of the aggregated CAPTCHA using the following formula:
[0074]
[0075] If the equation holds true, it indicates that the aggregated gradient has not been tampered with, and the verification passes; otherwise, the verification fails, the client rejects the aggregation result for that round, and reports the abnormal status to the system. The verification mechanism is based on lightweight algebraic operations, which significantly reduces the computational and communication overhead of the verification phase while ensuring security.
[0076] In summary, compared with the prior art, the present invention has the following beneficial effects:
[0077] A secure, efficient, and reliable federated learning framework has been effectively constructed, providing theoretical support and technical assurance for the practical application of federated learning in privacy-sensitive scenarios.
[0078] The above description discloses only one preferred embodiment of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art will understand that all or part of the processes of the above embodiments can be implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.
Claims
1. A verifiable and secure aggregation method for federated learning under dual cloud servers, characterized in that, Includes the following steps: Step 1: Set up a group of auxiliary nodes. Each client negotiates three sets of keys with each auxiliary node to generate secret values. After aggregation, two sets of single-value masks and one set of verification codes are obtained. The client performs random generation processing on the single-value masks. Step 2: The client splits the gradient horizontally, reshapes the gradient vector to obtain a two-dimensional vector, and then splits it again; it uses the sum of the local key negotiation values as a mask for encryption, and uses the sum of another set of key negotiation values and the gradient to generate a verification code. The mask gradient and the verification code are then uploaded to two cloud servers for aggregation. Step 3: The two cloud servers each aggregate the gradient and the verification code, then concatenate the gradients, and a designated server performs the overall aggregation. Each server receives the sum of keys sent by the auxiliary node, performs masking, and sends the aggregated model and aggregated verification code to each client. Step 4: The client recalculates the expected verification code based on the received aggregation model and compares it with the received aggregate verification code for verification.
2. The federated learning verifiable secure aggregation method under dual cloud servers as described in claim 1, characterized in that, In step 1, each client and each auxiliary node execute a session based on the key negotiation protocol, generating two pairs of initial negotiation values, which are used as mask seed values. Before using the mask seed values, the client randomizes each pair of initial negotiation values using a pseudo-random number generator, obtaining two pairs of randomized mask values: in, Indicates the client identifier. Indicates the auxiliary node identifier. and These represent the first and second sets of initial negotiated values obtained by the client and the auxiliary node, respectively. and These are the corresponding randomization mask values.
3. The federated learning verifiable secure aggregation method under dual cloud servers as described in claim 2, characterized in that, The execution process of step 2 includes the following steps: Step 2.1: The client splits the gradient vector obtained from local training into sub-vectors according to a preset partitioning rule. and They were uploaded to two different cloud servers respectively; Step 2.2: The client uses the sum of the first set of randomized mask values from the local aggregation. The gradient is encrypted using an additive mask. The specific encryption method is as follows: in, Indicates the total number of auxiliary nodes. and Clients respectively With auxiliary nodes The negotiated result The initial negotiated values of Group 1 and Group 2 For the same pseudo-random number generation function, the generated numbers are... and are the gradient parts of the encrypted mask, respectively; Step 2.3: Use the sum of another set of randomized mask values The integrity verification code is generated using local gradient generation, and the calculation form of the verification code is as follows: in, Random numbers generated locally on the client side are used to enhance the collision resistance and unforgeability of the CAPTCHA; the generated... and These are the corresponding gradient parts. and The verification code; Step 2.4: The client will use the encrypted mask gradient. , and its corresponding verification code , The data was uploaded to two different cloud servers for subsequent aggregation and verification processing.
4. The verifiable and secure aggregation method for federated learning under dual cloud servers as described in claim 3, characterized in that, The execution process of step 3 includes the following steps: Step 3.1: Each of the two cloud servers performs an aggregation calculation on the received encryption gradient and verification code: in, Indicates the total number of auxiliary nodes. and These are the corresponding gradient parts. and The verification code; after aggregation, the two aggregated gradients are concatenated horizontally in the reverse process of the splitting operation to restore the original gradient size; Step 3.2: Specify one server to perform a total aggregation on the concatenated gradient and CAPTCHA: Each server receives the sum of keys sent by the auxiliary nodes. Masking is performed, and the aggregation model and aggregation verification code are sent to the user; during the aggregation process, each server receives the sum of the negotiated keys from each client sent by the auxiliary node. This is used to securely eliminate the mask during the aggregation phase; Step 3.3: Specify the server to send the aggregated model gradients and aggregated verification codes to each client.
5. The federated learning verifiable secure aggregation method under dual cloud servers as described in claim 3, characterized in that, In step 4, after receiving the aggregated model gradient and the aggregated verification code, the client verifies the correctness of the aggregated verification code: If the equation holds true, it means that the aggregation gradient has not been tampered with and the verification is successful; otherwise, the verification is deemed to have failed, the client rejects the aggregation result for this round, and reports the abnormal status to the system.