A privacy-enhanced data security aggregation method and system for federated learning

Abstract

The application discloses a privacy-enhanced data security aggregation method and system for federated learning, and relates to the technical field of security aggregation for federated learning.The method comprises the following steps: generating public key parameters, a basic private key of a user terminal and an aggregation decryption private key; splitting the basic private key into multiple secret shares and cross-distributing the secret shares to all user terminals; extracting model features of a global model by each online user terminal, dynamically binding the basic private key and the model features, homomorphically encrypting gradient update values, homomorphically aggregating the ciphertext gradients, and requesting the online user terminals to provide secret shares held by the online user terminals and belonging to offline user terminals when the number of online user terminals meets a threshold value; restoring the basic private key of the offline user terminals by using a threshold reconstruction algorithm, compensating and decrypting the aggregated ciphertext gradients, obtaining global plaintext gradients, and updating the global model, so that the privacy-enhanced data security aggregation method has high security, good robustness and excellent performance.

Description

Technical Field

[0001] This invention belongs to the field of secure aggregation technology for federated learning, specifically relating to a privacy-enhancing data security aggregation method and system for federated learning. Background Technology

[0002] With the widespread deployment of artificial intelligence technology and increasingly stringent data privacy regulations, federated learning has become an important distributed machine learning method for breaking down "data silos" and achieving cross-domain collaborative modeling. This method allows multiple clients to jointly train a global model by sharing model updates while retaining their original data locally, thereby fully exploring the potential value of multi-source data. In this process, how to efficiently and robustly complete the global aggregation of massive model parameters while ensuring the absolute privacy of the local data of each participant has become a core problem that urgently needs to be solved. Especially in application scenarios such as healthcare and financial risk control, where data security and model accuracy requirements are extremely high, the joint training of large-scale deep neural networks is often accompanied by gradient interactions with massive dimensions. If transmission and aggregation are performed directly in plaintext, it is not only highly susceptible to inference attacks such as gradient suppression attacks leading to sensitive privacy leaks, but also faces the serious challenge of frequent node disconnections or even malicious poisoning by participants. Therefore, exploring a privacy-enhancing and secure aggregation method that can simultaneously resist multi-dimensional threats, balance high computational efficiency and strong fault tolerance, and constructing a robust federated learning collaborative system has significant research value.

[0003] Existing research has made some progress in secure aggregation techniques for federated learning, typically combining homomorphic encryption, secure multi-party computation (MPC), or differential privacy to enhance privacy protection. For example, patent CN120811569A, "A Federated Learning System Based on Multi-Key Homomorphic Encryption and Adaptive Differential Privacy," discloses a scheme that combines multi-key Paillier threshold encryption with differential privacy to address the problems of single-key leakage and collusion attacks. Patent CN120263490A, "A Composite Method for Privacy Computation Protocol Based on Parameter Secure Transformation," achieves protocol integration by constructing an interface between an MPC encryption module and a deep learning framework, enhancing defense against malicious client poisoning attacks. However, these solutions have the following shortcomings: when dealing with large-scale models, traditional encryption and high-frequency interaction lead to excessive computation and communication overhead, making it difficult to meet the requirements of high efficiency and real-time operation; frameworks that rely on the "semi-honest" assumption lack parameter consistency verification and are extremely vulnerable to model inference attacks such as gradient suppression launched by malicious servers, posing a single point of leakage risk; at the same time, the existing architecture has stringent requirements for network stability and lacks an effective fault tolerance mechanism to deal with high-frequency node disconnections, resulting in poor system robustness and thus limiting its practical application and promotion.

[0004] In summary, the existing technologies have the following problems: (1) Federated learning has a single security protection dimension and lacks a two-way collaborative defense architecture. Most related technologies are based on the ideal assumption of "semi-honest" servers or only focus on defending against client poisoning behavior, failing to build a two-way security defense mechanism that simultaneously constrains malicious clients and malicious servers. This one-way protection results in extremely poor adaptability of the protocol to the actual deployment environment, making it difficult to meet the security requirements of multi-party collaboration in complex distributed scenarios. (2) When facing large-scale deep neural networks, the computation and communication overhead is too large, and the scalability is insufficient. Existing algorithms for secure aggregation in federated learning have extremely complex key management when dealing with massive model parameters. As the number of clients participating in collaboration increases or the model dimension expands, the algorithm is difficult to achieve efficient expansion, which seriously restricts the training efficiency and application promotion of federated learning in large-scale data processing scenarios. (3) The fault tolerance capability in the face of dynamic network environments is weak, and the overall robustness of the system needs to be improved. Existing privacy-preserving federated learning systems have extremely stringent requirements for the stability of communication networks. In actual distributed environments, client disconnection due to equipment failure or network latency occurs frequently. Existing solutions lack efficient and low-overhead key recovery mechanisms. If a few nodes go offline, it often leads to the failure of a single round of aggregation tasks, resulting in high retransmission costs and extremely poor system reliability.

[0005] Therefore, how to provide a privacy-enhancing data security aggregation method for federated learning that is highly secure, robust, and high-performance has become an important issue. Summary of the Invention

[0006] To address the aforementioned problems in the existing technology, this invention provides a privacy-enhancing data security aggregation method and system for federated learning.

[0007] The technical problem to be solved by this invention is achieved through the following technical solution: In a first aspect, the present invention provides a privacy-enhancing data security aggregation method for federated learning, the privacy-enhancing data security aggregation method comprising: The Trust Center generates public key parameters based on the improved Paillier algorithm and the basic private key of the user terminal, and generates an aggregated decryption private key for the cloud service provider; the basic private key of each user terminal is split into multiple secret shares and cross-distributed to all user terminals; After the cloud service provider distributes the current global model parameters, each online user terminal extracts the model features of the global model, dynamically binds its own basic private key to the model features, and homomorphically encrypts the gradient update amount obtained from local training to obtain the ciphertext gradient. After receiving the ciphertext gradient, the cloud service provider performs homomorphic aggregation. When the number of online user terminals meets the threshold, it requests the secret share held by the online user terminals that belongs to the offline user terminals. The basic private key of the offline user terminals is restored through the threshold reconstruction algorithm to compensate and decrypt the aggregated ciphertext gradient to obtain the global plaintext gradient. The cloud service provider uses the global plaintext gradient to update the global model.

[0008] Secondly, the present invention provides a privacy-enhanced data security aggregation system for federated learning, the privacy-enhanced data security aggregation system comprising: The Trust Center is used to generate public key parameters based on the improved Paillier algorithm and the basic private key of user terminals, and to generate aggregate decryption private keys for cloud service providers; it splits the basic private key of each user terminal into multiple secret shares and cross-distributes them to all user terminals. The cloud service provider is used to distribute the current global model parameters; The online user terminal in each user terminal is used to extract the model features of the global model, dynamically bind its own basic private key to the model features, and homomorphically encrypt the gradient update amount obtained from local training to obtain the ciphertext gradient. The cloud service provider is also used to receive the ciphertext gradient and perform homomorphic aggregation, and when the number of online user terminals meets the threshold, it requests the secret share held by the online user terminal that belongs to the offline user terminal, restores the basic private key of the offline user terminal through the threshold reconstruction algorithm, and compensates and decrypts the aggregated ciphertext gradient to obtain the global plaintext gradient. The cloud service provider is also used to update the global model using the global plaintext gradient.

[0009] This invention provides a privacy-enhancing data security aggregation method for federated learning. In this method, the user terminal extracts model features from the global model distributed by the cloud service provider and dynamically binds its own basic private key to these model features before encryption. Since the model features differ across rounds or different global models, the user terminal's basic private key and model features are dynamically bound. Therefore, any tampering with or malicious construction of the global model will cause the encrypted private key generated by the user terminal after dynamic binding to mismatch with the decryption parameters expected by the cloud service provider. This prevents malicious servers from launching gradient suppression attacks or attribute inference attacks by distributing customized parameters, effectively defending against model replacement and poisoning attacks that may be launched by malicious servers in distributed training. From a mathematical and underlying logical perspective, this method ensures the consistency and legitimacy of the defense among participating nodes and completely blocks the privacy inference risk caused by the distribution of fake models.

[0010] The trusted center splits the base private key of each user terminal into multiple secret shares and cross-distributes them to all user terminals. When some user terminals are offline, the cloud service provider only needs to collect the secret shares held by online user terminals that belong to offline user terminals. A threshold reconstruction algorithm can then be used to reconstruct the base private key of the offline user terminals, and subsequently, the aggregated ciphertext gradient can be compensated and decrypted. This process does not require offline user terminals to retransmit data or restart the training task, significantly improving the robustness and business continuity of the federated learning system under conditions of incomplete participation.

[0011] The gradient update is converted into an encrypted state before leaving the user terminal, allowing the cloud service provider to perform homomorphic aggregation without decryption or being aware of the plaintext. This mechanism removes the cloud service provider's direct access to the user terminal's original privacy, significantly improving the overall performance and security of the system.

[0012] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0013] Figure 1 This is a flowchart illustrating a privacy-enhancing data security aggregation method for federated learning provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the privacy-enhancing data security aggregation method for federated learning provided in this embodiment of the invention during the data upload process; Figure 3 This is a schematic diagram of the structure of a privacy-enhancing data security aggregation system for federated learning provided in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the principle of a privacy-enhancing data security aggregation system for federated learning provided in an embodiment of the present invention. Detailed Implementation

[0014] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0015] To address the shortcomings of existing secure aggregation protocols for federated learning, such as insufficient security under malicious server inference attacks, poor robustness in node downtime scenarios, and excessive computational and communication overhead during large-scale parameter processing, this invention provides a privacy-enhanced secure data aggregation method for federated learning. (See also...) Figure 1 , Figure 1 This is a flowchart illustrating a privacy-enhancing data security aggregation method for federated learning provided by an embodiment of the present invention, specifically including the following steps: In step S101, the Trusted Center generates public key parameters based on the improved Paillier algorithm and the basic private key of the user terminal, and generates an aggregated decryption private key for the cloud service provider; the basic private key of each user terminal is split into multiple secret shares and cross-distributed to all user terminals.

[0016] In this embodiment of the invention, given system security parameters The Trusted Authority (TA) executes the improved Paillier algorithm. First, it constructs globally universal public key parameters. . These represent system security parameters, used to set the key length and security strength level. The modulus parameter, which is the product of two large prime numbers, is used to determine the mathematical range of the ciphertext space. The base parameter is a fundamental generator in homomorphic encryption algorithms, used to construct the core base of the ciphertext. This represents the public key auxiliary parameter in the homomorphic encryption algorithm, used to achieve blinding. Subsequently, the trusted center calculates the unique underlying private key for each user terminal's Data Owner (DO). It also generates aggregated decryption private keys for cloud service providers (CSPs). Once generated, the Trusted Center distributes the aforementioned key and operating parameters to the corresponding user terminals and server nodes via a secure channel.

[0017] In this embodiment of the invention, the basic private key of each user terminal is split into multiple secret shares and cross-distributed to all user terminals, including: A threshold cryptography mechanism is adopted, which divides the basic private key of each user terminal into multiple secret shares based on a preset threshold value and cross-distributes them to all user terminals, so that each user terminal holds its own basic private key and the secret shares of other user terminals.

[0018] To improve system fault tolerance, the Trusted Center introduces a threshold cryptography mechanism to distribute the underlying private keys held by each user terminal. The Trusted Center sets threshold values ​​based on preset security requirements. The basic private key of each user terminal is further divided into multiple interrelated secret shares, which are then cross-distributed to all participating user terminals within the system. Through this threshold cryptography mechanism, each user terminal not only holds its own basic private key but also stores secret shares from other users. .in, and Both represent user terminal indexes. Specifically refers to user terminals User terminals held The secret share.

[0019] In this embodiment of the invention, step S101 completes the system environment initialization and parameter distribution operations, with the trusted center completing the construction of the underlying cryptographic environment. A public-private key pair based on the improved Paillier algorithm is generated, including public key parameters, the user terminal's basic private key and aggregated decryption private key, and a spatial domain hash mapping rule, i.e., a hash function. Subsequently, a threshold cryptography mechanism, such as the Shamir threshold secret sharing mechanism, is introduced to split the user terminal's basic private key into multiple secret shares. Finally, the basic private key and secret shares are distributed to each user terminal, while the public key parameters and aggregated decryption private key are distributed to the cloud service provider, providing mathematical support for subsequent anti-disconnection and fault tolerance.

[0020] Specifically, determine the system security parameters. And select parameter values ​​that meet the requirements of the improved Paillier algorithm and hash function, including Parameters, including public key parameters. .

[0021] Based on the selected parameter values, the Trust Center generates a public-private key pair for the improved Paillier algorithm. Subsequently, a threshold cryptography mechanism is introduced, setting the system's fault tolerance threshold value to... and the basic private key Split into A secret share.

[0022] Subsequently, the trusted center performs parameter and key distribution. See also Figure 2 , Figure 2 This is a schematic diagram illustrating the privacy-enhancing data security aggregation method for federated learning provided in this embodiment of the invention during the data upload process, where ciphertext is aggregated with the private key. and public key parameters Send the user's terminal's basic private key to the cloud service provider. and secret share Distributed to each user terminal participating in the computation .

[0023] Complete identity authentication and secure channel configuration among all participating parties, and establish a cross-level channel security benchmark.

[0024] In step S102, after the cloud service provider distributes the current global model parameters, each online user terminal extracts the model features of the global model, dynamically binds its own basic private key with the model features, and then homomorphically encrypts the gradient update amount obtained from local training to obtain the ciphertext gradient.

[0025] In this embodiment of the invention, after receiving the current global model parameters from the cloud service provider, the user terminal calls a hash function to generate model features to ensure the consistency, legality, and reliability of the global information.

[0026] In this embodiment of the invention, each online user terminal extracts the model features of the global model and dynamically binds its own basic private key to the model features, including: Each online user terminal uses a preset hash function to calculate the model features of the global model, and uses an improved Paillier algorithm to bind the model features with its own basic private key to obtain an encrypted private key.

[0027] During the training phase, the cloud service provider distributes the current global model parameters to all online user terminals. Upon receiving the global model parameters, each online user terminal calls a preset hash function to perform spatial domain mapping, generating a hash feature fingerprint of the global model as its model features. Subsequently, the user terminals use an improved Paillier algorithm to process the obtained model features. With the underlying private key The final encrypted private key is obtained through the binding process. This ensures that the cloud service provider can correctly decrypt and recover the aggregated ciphertext gradient only when all participating online user terminals are trained under the same global model. The global model parameters in the first round of training are the initial global model parameters obtained by the cloud service provider through random weight initialization based on the global model architecture required for training.

[0028] The user terminal performs model evolution and error calculation on local private data, and uses parameter decomposition and encapsulation technology to transform the generated gradient update into a high-dimensional dense structure. Under the premise of ensuring that the data does not leave the domain, the encrypted information, i.e. the ciphertext gradient, is synchronized to the cloud service provider.

[0029] In one implementation, the gradient update obtained from local training is homomorphically encrypted to obtain the ciphertext gradient, which includes: The gradient update amount obtained from local training is transformed from the original gradient tensor structure into an integer feature matrix adapted for homomorphic encryption operations. Using an encrypted private key and based on an improved Paillier algorithm, an element-wise encrypted transformation is performed on the integer feature matrix to generate the ciphertext gradient.

[0030] In this embodiment of the invention, after completing key binding, each user terminal performs forward prediction and backpropagation calculations on the distributed global model based on its local private dataset. Through local iterative evolution, the user terminal extracts the current global model prediction result. With real labels The error deviation between them. Specifically, the user terminal uses a preset loss function to calculate the error deviation, i.e., the loss value. Then, based on this loss value, the gradient update amount of the global model is calculated using the gradient descent algorithm. is the loss function. For example, if the global model is an image recognition model, the ground truth label refers to the label vector that maps the true classification of the image, and the prediction result refers to the class probability distribution output by the forward propagation of the global model.

[0031] After obtaining the gradient update, the user terminal decomposes the high-dimensional gradient tensor structure with complex precision (such as floating-point) and maps it into an integer feature matrix adapted to the underlying cryptographic operations. Subsequently, the user terminal uses an improved homomorphic encryption operator to perform element-wise cryptomorphic transformation on the transformed gradient matrix, generating a ciphertext gradient with additive homomorphic properties, and finally uploads it to the cloud service provider.

[0032] Specifically, when the user terminal receives the first... Round global model parameters Next, the model features of the current global model are extracted using a preset hash function. These model features serve as the core variables for subsequent verification; only if the cloud service provider honestly distributes a consistent model can aggregation and decryption proceed successfully.

[0033] Before uploading data, the user terminal constructs an encrypted private key by combining model features with its own basic private key, and performs dynamic binding encryption on the gradient update amount according to the improved Paillier algorithm to generate ciphertext gradients. ,in This represents the gradient update amount. Ultimately, as shown... Figure 2 As shown, the user terminal uploads the encrypted gradient to the cloud service provider.

[0034] In this embodiment of the invention, the cloud service provider distributes global model parameters to each user terminal. After receiving the global model parameters, the user terminal uses a preset hash function to extract the model features of the current global model. These model features will be retained as core variables for generating dynamic encryption operators. Only if the cloud service provider honestly distributes completely consistent models can each user terminal generate mutually matching ciphertext based on the same model features; otherwise, it will directly cause the cloud service provider to fail to decrypt in the final aggregation stage.

[0035] The user terminal performs model training on a local private dataset and calculates the gradient update. To prevent the leakage of global model details, the user terminal mathematically combines the model features with its own underlying private key and performs dynamic binding encryption on the gradient update using an improved Paillier algorithm. After encryption, the user terminal uploads the encrypted gradient to the cloud service provider.

[0036] In step S103, after receiving the ciphertext gradient, the cloud service provider performs homomorphic aggregation. When the number of online user terminals meets the threshold, the provider requests the secret share held by the online user terminals that belongs to the offline user terminals. The provider then restores the basic private key of the offline user terminals through the threshold reconstruction algorithm to compensate and decrypt the aggregated ciphertext gradient, thereby obtaining the global plaintext gradient.

[0037] The cloud service provider receives ciphertext gradients from different user terminals. Leveraging the additive homomorphic properties of the improved Paillier algorithm, it directly performs global aggregation calculations of the ciphertext gradients in the ciphertext domain. Simultaneously, the cloud service provider monitors the system topology in real time, accurately identifying and labeling user terminals that are offline or in abnormal states in the current network round.

[0038] In this embodiment of the invention, the cloud service provider performs homomorphic aggregation after receiving the ciphertext gradient, including: After receiving the ciphertext gradient, the cloud service provider calls the public key parameter and uses the additive homomorphic property of the improved Paillier algorithm to perform a series of multiplications on the ciphertext gradient to obtain the globally aggregated ciphertext.

[0039] The cloud service provider receives ciphertext gradients from various user terminals. Once received, it performs a global aggregation operation on the ciphertext gradients using the additive homomorphic property of the improved Paillier algorithm. Specifically, for the received ciphertext gradients, homomorphic aggregation is performed through a series of multiplications to obtain the globally aggregated ciphertext.

[0040] Throughout the aggregation cycle, the cloud service provider monitors the status of user terminals in real time, marking the set D of user terminals that are offline or in an abnormal state in this round of network activity, and the set A of user terminals that are currently online. If so, then proceeding to the next collaborative decryption phase is allowed.

[0041] After entering the collaborative decryption phase, online user terminals proactively upload their own secret shares of other user terminals to the cloud service provider.

[0042] In this embodiment of the invention, the basic private key of the offline user terminal is restored using a threshold reconstruction algorithm to compensate and decrypt the aggregated ciphertext gradient, thereby obtaining the global plaintext gradient, including: For each offline user terminal, the basic private key of the offline user terminal is reconstructed using Lagrange interpolation based on multiple secret shares belonging to that offline user terminal. The model features of the global model are extracted by a hash function. These model features are then used as an exponent to perform modular exponentiation on the reconstructed basic private key to generate the corresponding compensation operator. The global plaintext gradient is obtained by homomorphically multiplying the compensation operator with the global aggregated ciphertext.

[0043] After collecting a sufficient number of secret shares, the cloud service provider reverse-engineers the underlying private key of the offline user terminal through threshold cryptography mechanisms such as Lagrange interpolation.

[0044] The cloud service provider uses model features as an exponent to perform modular exponentiation on the base private key to generate a corresponding compensation operator. This compensation operator is then homomorphically multiplied with the resulting global aggregated ciphertext to eliminate masking errors introduced by offline user terminals, ultimately decrypting the true global plaintext gradient.

[0045] The following will explain the specific computational process of the improved Paillier algorithm: Given a The Trust Center randomly selects two large ones. prime number and And calculate the modulus parameter. Next, calculate the first private key parameter. ,in This represents the least common multiple. A random number is chosen as the base parameter in the homomorphic encryption algorithm. It belongs to multiplication group ,Right now The conditions are met. The auxiliary function is , here Substitute , This represents the greatest common divisor. The second private key parameter is then calculated. Obtain the private key and public key .

[0046] Then the Trust Center needs to select a random large integer. satisfy and guarantee Then the public key auxiliary parameters are calculated. Finally, the public key parameter is obtained. .

[0047] In order to generate the basic private key for each user terminal, for For each user terminal, the Trusted Center will first... Randomly divided into A random number },in The Trust Center will then select a random positive integer. This serves as the task ID for each secure aggregation. Finally, the underlying private key is calculated. It is distributed to each user terminal. This represents the total number of user terminals.

[0048] Finally, the trusted center will aggregate the decryption private keys. Distributed to cloud service providers.

[0049] Before performing data encryption, the user terminal first obtains the global model parameters for this round of aggregation tasks from the cloud service provider. The user terminal uses a hash function Calculate the model features of the global model. And further calculate the final encrypted private key for the user terminal. .

[0050] Assume the gradient update amount is The ciphertext gradient includes: ; in, Indicates user terminal The ciphertext gradient; Indicates user terminal gradient update amount; Indicates the base parameter; Indicates public key auxiliary parameters; Indicates user terminal The generated encrypted private key; Represents modulo operation; Indicates the modulus parameter; Indicates user terminal The generated randomized blinding parameters satisfy , Table of system security parameters.

[0051] The cloud service provider receives encrypted gradients uploaded from various online user terminals and performs a global aggregation operation on the encrypted gradients using a homomorphic aggregation formula: ; in, Indicates globally aggregated ciphertext; Indicates to user terminal The operation of multiplying the ciphertext gradient; Indicates user terminal The ciphertext gradient; Represents modulo operation; This represents the modulus parameter.

[0052] Then, the CSP uses aggregation to decrypt the private key. Decryption yields the global plaintext gradient : .

[0053] Wherein, the auxiliary function is , here Substitute .

[0054] After receiving the encrypted gradients uploaded by each user terminal, the cloud service provider performs a linear summation operation on the multi-source encrypted gradients using homomorphic aggregation, without needing to decrypt them or being aware of the plaintext information. Simultaneously, the cloud service provider monitors the participation status of user terminals in real time, automatically identifying and labeling abnormal or offline user terminals, providing topology support for the robust operation of the system.

[0055] For globally aggregated ciphertext, online user terminals meeting a preset threshold ratio participate in a collaborative reconstruction process. Utilizing the secret share held by each user terminal, a threshold cryptography mechanism is used to offset computational biases introduced by offline user terminals, reconstructing the complete global plaintext gradient. Subsequently, this global plaintext gradient is used to update the global model parameters, completing this round of parameter optimization.

[0056] In one implementation, the threshold cryptography mechanism is specifically the Shamir threshold secret sharing mechanism, which includes the following steps: Select the secrets that need to be protected, namely the user terminal's underlying private key and a... All mathematical operations are performed within a finite field. The process is conducted online, with the total number of participating user terminals set to [number]. And set the threshold value for secret reconstruction according to security requirements. ; Construct a number of order -1 random polynomial Its constant term is set as the base private key, and the following formula is used. To refer to on behalf of: ; Among them, polynomial coefficients All are in a finite field A secret share is randomly selected from within the system, and a dedicated share is calculated and allocated to each user terminal: ,in ; The formal independent variable introduced to construct the random polynomial, when calculating the th... When the secret share of each user terminal is... The value is assigned to the index of the user terminal. .

[0057] When at least When calculating a secret share, reconstruction is performed using Lagrange interpolation. The calculation process involves taking a polynomial in... To recover the secret value The formula is as follows:

[0058] Lagrange polynomial The definition of is:

[0059] in, Indicates except the first The first user terminal One user terminal; Indicates the first The x-coordinate of the interpolation point for each user terminal; Indicates the first The x-coordinate of the interpolation point for each user terminal.

[0060] The above algorithm guarantees that it has less than The group holding a secret share cannot deduce any information about the underlying private key and possesses a share greater than or equal to [amount missing]. Each group of secret shares can uniquely and accurately reconstruct the underlying private key.

[0061] In step S104, the cloud service provider updates the global model using the global plaintext gradient.

[0062] In this embodiment of the invention, after completing a single round of global model update, the cloud service provider first extracts the prediction accuracy of the current global model or the number of iterations already executed, and evaluates whether the global model has reached a preset convergence threshold or a preset maximum number of iterations. If the evaluation passes, the finally optimized global model is directly output, and the current federated computing task ends.

[0063] In one implementation, the privacy-enhancing data security aggregation method also includes: Evaluate whether the updated global model has reached the preset convergence threshold; If the threshold is not reached, the key rotation mechanism is triggered according to the predefined dynamic protection strategy. The public key parameters, the user terminal's basic private key, and the aggregate decryption private key are regenerated. The updated global model parameters are used as the current global model parameters. The steps of the cloud service provider issuing the current global model parameters are re-executed until the global model reaches the convergence threshold.

[0064] In this embodiment of the invention, if the global model has not yet reached convergence, the trusted center will trigger a key rotation mechanism based on a predefined dynamic protection strategy to regenerate the underlying security parameters. This involves regenerating the public key parameters based on the improved Paillier algorithm and the user terminal's basic private key, and regenerating the aggregated decryption private key for the cloud service provider. The updated keys are then redistributed to each user terminal and the cloud service provider. Subsequently, the system, carrying the latest round of global model parameters, begins the next round of collaborative training, effectively preventing brute-force attacks or long-term monitoring threats against fixed keys.

[0065] Specifically, the cloud service provider uses the calculated global plaintext gradient to update the global model and generate the global model parameters for the next round. It is then broadcast to each user terminal to initiate the next round of collaborative training.

[0066] In this embodiment of the invention, the user terminal extracts the model features of the global model distributed by the cloud service provider, dynamically binds its own basic private key to the model features, and then encrypts them. Since the model features differ between different rounds or different global models, the user terminal's basic private key and model features are dynamically bound. Therefore, any tampering or malicious construction of the global model will cause the encrypted private key generated by the user terminal after dynamic binding to mismatch with the decryption parameters expected by the cloud service provider. This prevents malicious servers from launching gradient suppression attacks or attribute inference attacks by distributing customized parameters, effectively defending against model replacement and poisoning attacks that malicious servers may launch during distributed training. From a mathematically fundamental perspective, this ensures the consistency and legitimacy of the defense among participating nodes, completely blocking the privacy inference risk caused by the distribution of fake models.

[0067] The trusted center splits the base private key of each user terminal into multiple secret shares and cross-distributes them to all user terminals. When some user terminals are offline, the cloud service provider only needs to collect the secret shares held by online user terminals that belong to offline user terminals. A threshold reconstruction algorithm can then be used to reconstruct the base private key of the offline user terminals, and subsequently, the aggregated ciphertext gradient can be compensated and decrypted. This process does not require offline user terminals to retransmit data or restart the training task, significantly improving the robustness and business continuity of the federated learning system under conditions of incomplete participation.

[0068] The gradient update is converted into an encrypted state before leaving the user terminal, allowing the cloud service provider to perform homomorphic aggregation without decryption or being aware of the plaintext. This mechanism removes the cloud service provider's direct access to the user terminal's original privacy, significantly improving the overall performance and security of the system.

[0069] This invention optimizes the key management and computation process of traditional algorithms, significantly improving the computational efficiency of encryption and decryption operations without negatively impacting the original security strength. This effectively alleviates the computational bottleneck and transmission pressure in large-scale data processing, and significantly enhances the performance and security of the privacy data security aggregation system.

[0070] Based on the same inventive concept, embodiments of the present invention also provide a privacy-enhanced data security aggregation system for federated learning, see [link to relevant documentation]. Figure 3 , Figure 3 This is a schematic diagram of the structure of a privacy-enhancing data security aggregation system for federated learning provided in an embodiment of the present invention. The privacy-enhancing data security aggregation system includes: The Trust Center is used to generate public key parameters based on the improved Paillier algorithm and the basic private key of user terminals, and to generate aggregate decryption private keys for cloud service providers; it splits the basic private key of each user terminal into multiple secret shares and cross-distributes them to all user terminals. The cloud service provider is used to distribute the current global model parameters; The online user terminals in each user terminal are used to extract the model features of the global model, dynamically bind their own basic private key to the model features, and homomorphically encrypt the gradient update amount obtained from local training to obtain the ciphertext gradient. The cloud service provider also receives the ciphertext gradient and performs homomorphic aggregation. When the number of online user terminals meets the threshold, it requests the secret share held by the online user terminals that belongs to the offline user terminals. The underlying private key of the offline user terminals is restored through the threshold reconstruction algorithm to compensate and decrypt the aggregated ciphertext gradient to obtain the global plaintext gradient. Cloud service providers also use it to update global models using global plaintext gradients.

[0071] First, we will introduce and explain the Trusted Center, user terminals, and cloud service providers: As the central hub for system key management, the Trusted Center is responsible for generating and distributing global model parameters. Its core functions include: configuring public key parameters based on the improved Paillier algorithm, the user terminal's basic private key, the aggregated decryption private key, and the spatial domain hash mapping rules; using the Shamir threshold secret sharing mechanism to split the user's basic private key into multiple secret shares to enhance the system's robustness under incomplete participation conditions; distributing the user terminal's basic private key and the secret shares of other user terminals to the user terminal, and distributing public key parameters and aggregated decryption private keys to the cloud service provider; and performing dynamic key updates after multiple iterations to ensure long-term attack resistance security.

[0072] As the local execution unit of federated learning, the user terminal is responsible for model evolution on the local device. Its core functions include: receiving global model parameters from the cloud service provider and calculating its model features using a hash function to identify and intercept potential inference attacks; calculating gradient update amounts on local private data and performing dynamic binding encryption based on the improved Paillier algorithm using the hash function and the base private key; and in the collaborative decryption phase, the user terminal uploads its own share of the secret to ensure that the cloud service provider can aggregate and decrypt the data.

[0073] As the logical aggregation center for global data, the cloud service provider is responsible for integrating the training results of various user terminals in an encrypted environment. Its core functions include: integrating the encrypted gradients of multiple user terminals globally; performing aggregation calculations based on an improved Paillier algorithm after receiving encrypted data uploaded by user terminals; real-time detection and labeling of offline or abnormal user terminals in the network; and during the decryption phase, collecting the secret shares of online user terminals and reconstructing the underlying private keys of offline user terminals to fully decrypt the global plaintext gradients obtained from the aggregation of the remaining online users.

[0074] See Figure 4 , Figure 4 This is a schematic diagram illustrating the principle of a privacy-enhancing data security aggregation system for federated learning provided in an embodiment of the present invention. Furthermore, the trusted center includes: The key update module is used to trigger the key iteration mechanism after multiple rounds of iteration, and to perform dynamic updates of the underlying system keys to ensure anti-attack security during long-term operation. The security baseline configuration module is used to configure the public key parameters based on the improved Paillier algorithm, the user terminal's basic private key, the aggregated decryption private key, and the hash function; The key splitting module is used to split the user terminal's base private key into multiple secret shares using the Shamir threshold secret sharing mechanism, thereby enhancing the system's robustness under incomplete participation conditions. The key and parameter distribution module is used to distribute the basic private key to user terminals and the secret share of other user terminals, while distributing the public key parameter and the aggregated decryption private key to cloud service providers. During system initialization, the Trusted Center first generates and prepares the initial security key through the key update module, laying the foundation for subsequent dynamic defense and key management. Then, the security baseline configuration module generates public key parameters, the user terminal's basic private key, the aggregated decryption private key, and the hash function. Next, the key splitting module introduces a threshold cryptography mechanism to rationally split the basic private key into multiple secret shares. Afterwards, with the help of the key and parameter distribution module, these security parameters and secret shares are distributed to various user terminals and cloud service providers, laying the foundation for subsequent fault tolerance and encrypted aggregation computation. Furthermore, to address long-term security threats, the key update module periodically triggers a security key reset after multiple iterations, maintaining the system's dynamic defense capabilities through rolling key updates.

[0075] Furthermore, the user terminal includes: The model feature extraction module is used to receive global model parameters issued by the cloud service provider and extract model features using a hash function for subsequent gradient dense state encapsulation process. The data preprocessing module is used to perform preprocessing operations such as cleaning, normalization, and encoding on the collected data to form further usable structured data; The local training and encryption module is used to calculate gradient updates on local private data; at the same time, it combines a hash function and a basic private key to perform dynamic binding encryption on the gradients based on the improved Paillier algorithm and upload them. The decryption collaboration module is used to upload the secret shares held by the user during the system's collaborative decryption phase, so as to ensure that the cloud service provider can successfully complete the aggregated decryption.

[0076] During data flow, the user terminal first uses the model feature extraction module to calculate the hash value of the received global model to obtain model features, and the data preprocessing module cleans and structures the local raw data. After completing local training, the local training and encryption module merges the extracted model features with the basic private key and performs dynamic binding encryption on the gradient update amount. Finally, in the global reconstruction phase, the decryption collaboration module uploads its own secret share to the cloud service provider as needed to ensure the smooth progress of the fault-tolerant decryption process.

[0077] Furthermore, cloud service providers include: The ciphertext aggregation module is used to receive ciphertext gradients uploaded by different user terminals and perform homomorphic aggregation of the ciphertext domain based on the improved Paillier algorithm. The node status monitoring module is used to detect and mark offline or abnormal user terminals in the network in real time during the system operation cycle. The offline recovery and decryption module is used to collect the secret share uploaded by online user terminals and restore the basic private key of the offline user terminal through a threshold mechanism. Then, using the model features as the exponent, the basic private key is subjected to modular exponentiation to obtain the compensation operator, which is then multiplied with the aggregated ciphertext gradient to finally decrypt the global plaintext gradient completely.

[0078] The model update and distribution module is used to receive the global plaintext gradient and update the global model parameters. Then, it broadcasts the updated model parameters to each user terminal as the input benchmark for the next round of training.

[0079] Upon receiving the ciphertext gradients uploaded by each user terminal, the ciphertext aggregation module in the cloud service provider directly performs homomorphic aggregation of the ciphertext domain based on the homomorphic properties of the improved Paillier algorithm. Simultaneously, the node status detection module monitors the online status of each user terminal in real time, accurately identifying and marking offline or abnormal user terminals. Subsequently, the offline recovery and decryption module uses the secret share uploaded by the online user terminal to reconstruct the underlying private key of the offline user terminal and securely decrypts the true global plaintext gradient. Finally, the model update and distribution module uses this gradient to update the global model and broadcasts the latest parameters to each user terminal, driving the entire system to begin the next cycle of model training.

[0080] In this embodiment of the invention, an improved Paillier algorithm and a Shamir threshold secret sharing mechanism are employed. During the aggregation interaction process, a hash consistency verification mechanism is introduced to force user terminals to verify the validity of the sent parameters, successfully blocking malicious server gradient suppression attacks and probe inference attacks. Furthermore, a threshold fault tolerance mechanism ensures robust operation even in environments with frequent node outages. This invention possesses core advantages such as bidirectional security protection, extremely high computational scalability, and dynamic robust fault tolerance, significantly enhancing the practical value of privacy-enhancing computation in distributed large-scale training tasks.

[0081] It should be noted that the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention.

[0082] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0083] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings and the disclosure in carrying out the claimed invention. In the description of the invention, the word "comprising" does not exclude other components or steps, "a" or "an" does not exclude a plurality, and "a plurality" means two or more, unless otherwise explicitly specified. Furthermore, while different embodiments may describe certain measures, this does not mean that these measures cannot be combined to produce good results.

[0084] As the system implementation is basically similar to the method implementation, the description is relatively simple, and relevant parts can be found in the description of the method implementation.

[0085] It should be noted that the system in this embodiment of the invention is a system that applies the flowchart of the above-described privacy-enhancing data security aggregation method for federated learning. Therefore, all embodiments of the flowchart of the above-described privacy-enhancing data security aggregation method for federated learning are applicable to this system and can achieve the same or similar beneficial effects.

[0086] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A privacy-enhancing data security aggregation method for federated learning, characterized in that, The privacy-enhancing data security aggregation method includes: The Trust Center generates public key parameters based on the improved Paillier algorithm and the basic private key of the user terminal, and generates an aggregated decryption private key for the cloud service provider; the basic private key of each user terminal is split into multiple secret shares and cross-distributed to all user terminals; After the cloud service provider issues the current global model parameters, each online user terminal extracts the model features of the global model, dynamically binds its own basic private key to the model features, and then homomorphically encrypts the gradient update amount obtained from local training to obtain the ciphertext gradient. After receiving the ciphertext gradient, the cloud service provider performs homomorphic aggregation. When the number of online user terminals meets the threshold, it requests the secret share held by the online user terminals that belongs to the offline user terminals. The basic private key of the offline user terminals is restored through the threshold reconstruction algorithm to compensate and decrypt the aggregated ciphertext gradient to obtain the global plaintext gradient. The cloud service provider updates the global model using the global plaintext gradient. Each online user terminal extracts the model features of the global model and dynamically binds its own basic private key to the model features, including: Each online user terminal uses a preset hash function to calculate the model features of the global model, and uses the improved Paillier algorithm to bind the model features with its own basic private key to obtain an encrypted private key; The gradient updates obtained from local training are homomorphically encrypted to obtain ciphertext gradients, including: The gradient update quantity obtained from local training is transformed from the original gradient tensor structure into an integer feature matrix adapted for homomorphic encryption operations. Using an encrypted private key and based on an improved Paillier algorithm, an element-wise encrypted transformation is performed on the integer feature matrix to generate a ciphertext gradient.

2. The privacy-enhancing data security aggregation method according to claim 1, characterized in that, The basic private key of each user terminal is split into multiple secret shares and cross-distributed to all user terminals, including: A threshold cryptography mechanism is adopted, which divides the basic private key of each user terminal into multiple secret shares based on a preset threshold value and cross-distributes them to all user terminals, so that each user terminal holds its own basic private key and the secret shares of other user terminals.

3. The privacy-enhancing data security aggregation method according to claim 1, characterized in that, The ciphertext gradient includes: ； in, Indicates user terminal The ciphertext gradient; Indicates user terminal gradient update amount; Indicates the base parameter; Indicates public key auxiliary parameters; Indicates user terminal The generated randomized blinding parameters; Indicates user terminal The generated encrypted private key; Represents modulo operation; This represents the modulus parameter.

4. The privacy-enhancing data security aggregation method according to claim 1, characterized in that, The cloud service provider receives the ciphertext gradient and performs homomorphic aggregation, including: After receiving the ciphertext gradient, the cloud service provider calls the public key parameter and uses the additive homomorphic property of the improved Paillier algorithm to perform a series multiplication of the ciphertext gradient to obtain the globally aggregated ciphertext.

5. The privacy-enhancing data security aggregation method according to claim 4, characterized in that, The globally aggregated ciphertext includes: ； in, This represents the globally aggregated ciphertext; Indicates to user terminal The operation of multiplying the ciphertext gradient; Indicates user terminal The ciphertext gradient; Represents modulo operation; Indicates the modulus parameter; This indicates the total number of user terminals.

6. The privacy-enhancing data security aggregation method according to claim 4, characterized in that, The underlying private key of the offline user terminal is restored using a threshold reconstruction algorithm. This is then used to compensate for and decrypt the aggregated ciphertext gradient, yielding the global plaintext gradient, including: For each offline user terminal, the basic private key of the offline user terminal is reconstructed using Lagrange interpolation based on multiple secret shares belonging to that offline user terminal. The model features of the global model are extracted by a hash function. These model features are then used as an exponent to perform modular exponentiation on the reconstructed basic private key to generate the corresponding compensation operator. The compensation operator is homomorphically multiplied with the global aggregated ciphertext to obtain the global plaintext gradient.

7. The privacy-enhancing data security aggregation method according to claim 1, characterized in that, The privacy-enhancing data security aggregation method also includes: Evaluate whether the updated global model has reached the preset convergence threshold; If the threshold is not reached, a key rotation mechanism is triggered according to the predefined dynamic protection strategy to regenerate the public key parameters, the user terminal's basic private key, and the aggregated decryption private key. The updated global model parameters are then used as the current global model parameters, and the step of the cloud service provider issuing the current global model parameters is re-executed until the global model reaches the convergence threshold.

8. A privacy-enhanced data security aggregation system for federated learning, characterized in that, The privacy-enhanced data security aggregation system includes: The Trust Center is used to generate public key parameters based on the improved Paillier algorithm and the basic private key of user terminals, and to generate aggregate decryption private keys for cloud service providers; it splits the basic private key of each user terminal into multiple secret shares and cross-distributes them to all user terminals. The cloud service provider is used to distribute the current global model parameters; The online user terminal in each user terminal is used to extract the model features of the global model, dynamically bind its own basic private key to the model features, and homomorphically encrypt the gradient update amount obtained from local training to obtain the ciphertext gradient. The cloud service provider is also used to receive the ciphertext gradient and perform homomorphic aggregation, and when the number of online user terminals meets the threshold, it requests the secret share held by the online user terminal that belongs to the offline user terminal, restores the basic private key of the offline user terminal through the threshold reconstruction algorithm, and compensates and decrypts the aggregated ciphertext gradient to obtain the global plaintext gradient. The cloud service provider is also used to update the global model using the global plaintext gradient; Each online user terminal extracts the model features of the global model and dynamically binds its own basic private key to the model features, including: Each online user terminal uses a preset hash function to calculate the model features of the global model, and uses the improved Paillier algorithm to bind the model features with its own basic private key to obtain an encrypted private key; Each online user terminal homomorphically encrypts the gradient update obtained from local training to obtain the ciphertext gradient, including: The gradient update quantity obtained from local training is transformed from the original gradient tensor structure into an integer feature matrix adapted for homomorphic encryption operations. Using an encrypted private key and based on an improved Paillier algorithm, an element-wise encrypted transformation is performed on the integer feature matrix to generate a ciphertext gradient.

Images