A system for AI training data protection using a distributed encryption computing and differential privacy system

Abstract

The application provides a distributed encryption computing and differential privacy system for AI training data protection, and relates to the technical field of artificial intelligence and privacy computing. The system comprises: a device capability sensing and protection domain division module, which dynamically divides devices participating in federated training into a TEE trusted domain, a homomorphic encryption domain and a differential privacy domain based on a distributed soft bus of the Hongmeng; an adaptive differential privacy noise adding module, which dynamically allocates a privacy budget and independently adds noise according to the information entropy of each dimension of the gradient for the differential privacy domain device; a secure aggregation module, integrated in the TEE inside the parameter server, which decrypts and aggregates the gradients of different domains; and a privacy budget tracing module, which records and checks the privacy budget consumption of each device by using a distributed ledger. The application realizes the collaborative optimization of the privacy protection strength of heterogeneous devices and the model accuracy while resisting gradient leakage attacks through a three-level differentiated protection and adaptive noise adding mechanism.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and privacy computing technology, and in particular to the HarmonyOS distributed encrypted computing and differential privacy system for protecting AI training data. Background Technology

[0002] With the rapid development of large-scale models and generative artificial intelligence, the contradiction between the demand for massive amounts of high-quality data for model training and the protection of data privacy is becoming increasingly prominent. HarmonyOS, with its distributed soft bus capabilities, can connect various terminals such as mobile phones, personal computers, industrial terminals, and IoT devices into a super terminal, enabling cross-device collaborative AI training. Federated learning, as a distributed training paradigm of "data stays put, model moves," is widely used in such multi-device collaborative scenarios: each participating device trains its model locally using private data, only uploading updated model parameters to a central server, which then aggregates and updates the global model, thus theoretically achieving the privacy protection goal of "data not leaving its domain."

[0003] However, existing federated learning schemes face a serious threat of gradient leakage attacks in distributed scenarios. Research shows that gradient parameters uploaded during model training are not absolutely secure. Attackers can use techniques such as gradient matching and deep gradient inversion to reconstruct the user's original training data from the intercepted gradients. In the HarmonyOS distributed environment, the diverse types of participating devices and complex communication paths further expand the attack surface, making the risk of gradient leakage particularly prominent. To address these risks, existing technologies attempt to introduce differential privacy into federated learning frameworks, obfuscating the original information by adding noise to the gradients. However, such schemes generally adopt a uniform noise-adding mode. To achieve real-time operation on resource-constrained edge devices, a trade-off often needs to be struck between model accuracy and privacy protection strength, making it difficult to effectively resist gradient leakage attacks while ensuring training effectiveness. Therefore, how to effectively resist gradient leakage attacks and protect the privacy of users' original data in distributed collaborative training scenarios, while taking into account model training accuracy and the computational resource limitations of edge devices, has become an urgent technical problem to be solved in this field. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection, in order to solve or improve the technical problems existing in the prior art.

[0005] The technical solution of this invention is implemented as follows: a HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection, comprising: The device capability awareness and protection domain partitioning module is configured to acquire device capability information of multiple HarmonyOS devices participating in federated training based on the HarmonyOS distributed soft bus, and dynamically partition the multiple HarmonyOS devices into trusted execution environments based on the device capability information. Trusted domain, homomorphic encryption domain, and differential privacy domain are defined, with the division result directly determining the type of gradient protection strategy adopted by each device, so that devices with different resource capabilities can adopt privacy protection methods that match their capabilities. An adaptive differential privacy noise module is configured to start in response to the partitioning result for a device divided into the differential privacy domain, calculate the information entropy of each dimension of the local gradient, and dynamically allocate a privacy budget according to the information entropy of each dimension to independently add noise associated with the allocated privacy budget to each dimension of the local gradient, thereby generating a noisy gradient to minimize the loss of model accuracy while consuming the same total privacy budget. The security aggregation module is integrated into the parameter server or the elected master node. In the configuration, the protection domain to which each device belongs is identified before aggregation, and the corresponding processing logic is selected based on the identification result to receive and process gradient data from each domain. Internally, the gradient data is decrypted and aggregated to generate a global model update, which is then utilized. Hardware isolation ensures that gradient data remains secure even if the operating system is compromised during the aggregation process; The privacy budget tracking module is configured to use a distributed ledger to record the privacy budget consumed by each device in each round of training, so that the security aggregation module can verify whether the privacy budget consumption of each device exceeds a preset threshold before aggregation, in order to prevent malicious devices from forcing the system to reduce noise intensity by over-consuming the privacy budget, thereby creating conditions for gradient inversion and restoration attacks.

[0006] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention, through a device capability awareness and protection domain partitioning module, dynamically identifies device capabilities based on the HarmonyOS distributed soft bus, and differentiates heterogeneous devices into a TEE trusted domain, a homomorphic encryption domain, and a differential privacy domain. This allows devices with different resource capabilities to adopt matching gradient protection strategies, overcoming the high overhead or insufficient protection problems caused by existing federated learning schemes that uniformly add noise or use single encryption on end-devices. Furthermore, for resource-constrained devices, an adaptive differential privacy noise-adding module is constructed, dynamically allocating the privacy budget based on the information entropy of each dimension of the gradient and adding noise independently, while maintaining the same total privacy... The budget allocation assigns higher budgets to dimensions that have a greater impact on model accuracy, effectively alleviating the contradiction between the strength of privacy protection and model accuracy in traditional unified differential privacy noise addition. Furthermore, by combining the security aggregation module and the privacy budget traceability module, the aggregation process is ensured by using TEE hardware isolation, and the privacy budget is traceable and over-consumption is intercepted through a distributed ledger. This prevents malicious devices from leaking original data through gradient inverse reconstruction attacks, thus achieving a systematic optimization that balances the strength of privacy protection, model training accuracy, and device resource adaptability in a distributed federated learning scenario composed of heterogeneous HarmonyOS devices.

[0007] The above overview is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments, and features described above, further aspects, embodiments, and features of the invention will become readily apparent from the accompanying drawings and the following detailed description. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a block diagram of the overall system structure of the present invention; Figure 2 This is a diagram of the device capability sensing and protection domain division module of the present invention; Figure 3 This is a diagram of the adaptive differential privacy noise-adding module of the present invention; Figure 4 This is a diagram of the internal processing logic of the security aggregation module of the present invention; Figure 5 This is a timing diagram of the collaborative training protocol of the present invention. Detailed Implementation

[0010] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0011] This application provides a HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection, including: The device capability awareness and protection domain partitioning module is configured to acquire device capability information of multiple HarmonyOS devices participating in federated training based on the HarmonyOS distributed soft bus, and dynamically partition the multiple HarmonyOS devices into trusted execution environments based on the device capability information. Trusted domain, homomorphic encryption domain, and differential privacy domain are defined, and the result of the division directly determines the type of gradient protection strategy adopted by each device, so that devices with different resource capabilities can adopt privacy protection methods that match their capabilities. The adaptive differential privacy noise module is configured to start in response to the partitioning result for devices divided into the differential privacy domain, calculate the information entropy of each dimension of the local gradient, and dynamically allocate the privacy budget according to the information entropy of each dimension, so as to independently add noise corresponding to the allocated privacy budget to each dimension of the local gradient, generate a noisy gradient, thereby minimizing the model accuracy loss under the condition of consuming the same total privacy budget. The security aggregation module is integrated into the parameter server or the elected master node. In the configuration, the protection domain to which each device belongs is identified before aggregation, and the corresponding processing logic is selected based on the identification result. Gradient data from each domain is received and processed. Internally, the gradient data is decrypted and aggregated to generate a global model update, which is then utilized. Hardware isolation features ensure that gradient data remains secure even if the operating system is compromised during the aggregation process; The privacy budget tracking module is configured to use a distributed ledger to record the privacy budget consumed by each device in each round of training. This allows the security aggregation module to verify whether the privacy budget consumption of each device exceeds a preset threshold before aggregation, thus preventing malicious devices from reducing the noise intensity of the system by over-consuming the privacy budget, thereby creating conditions for gradient inversion attacks.

[0012] The system works in concert through multiple functional modules to address the risk of gradient leakage in distributed collaborative training and to balance the strength of privacy protection with model accuracy.

[0013] In a preferred embodiment of the present invention, the above modules are based on the HarmonyOS operating system (…). The distributed capability framework is implemented. The device capability awareness and protection domain partitioning module calls the HarmonyOS distributed soft bus. and Interface, obtain information from each device An object containing the device (Whether TEE is supported) (Calculation ability score) and (Current load) and other attributes. The adaptive differential privacy noise-adding module, security aggregation module, and privacy budget tracing module serve as a distributed task scheduling unit, utilizing the HarmonyOS system. To perform collaboration. The parameters of the server where the security aggregation module is located... Environment, through Establish secure sessions with each HarmonyOS device to ensure the confidentiality of data transmission and aggregation processes.

[0014] First, the system includes a device capability awareness and protection domain partitioning module. This module is configured to acquire device capability information from multiple HarmonyOS devices participating in federated training based on the HarmonyOS distributed soft bus. Specifically, the device capability information includes the device's processor type, memory size, and whether it supports specific security instruction sets. This information is obtained through a proactive reporting mechanism when the device joins the network or through a query mechanism of network management tools. Based on this, the module dynamically partitions multiple HarmonyOS devices into trusted execution environments according to the acquired device capability information. The system is divided into trusted domains, homomorphic encryption domains, and differential privacy domains. The division is based on preset rules including the device's computing resources and security hardware support. Therefore, the division directly determines the type of tiered protection strategy adopted by each device, ensuring that devices with different resource capabilities use privacy protection methods that match their capabilities.

[0015] Secondly, the system includes an adaptive differential privacy noise-adding module. This module is configured to activate in response to the partitioning result for devices divided into differential privacy domains. This module calculates the information entropy of each dimension of the local gradient. Specifically, the information entropy is calculated through statistical analysis of the numerical distribution of each gradient dimension, or by evaluating the importance of each dimension based on a pre-trained model. Based on this, the module dynamically allocates the privacy budget according to the information entropy of each dimension. For example, a proportional allocation mechanism is used to distribute the total privacy budget to different gradient dimensions based on the magnitude of the information entropy of each dimension. Further, the module independently adds noise corresponding to the allocated privacy budget to each dimension of the local gradient, generating a noisy gradient. The noise is generated by a random number generator, and its scale is correlated with the allocated privacy budget. Thus, under the condition of consuming the same total privacy budget, the model accuracy loss is minimized.

[0016] Furthermore, the system includes a security aggregation module. This module is integrated into the parameter server or the elected master node. In this module, we identify the protection domain to which each device belongs before aggregation. Specifically, we obtain this information by querying the device domain partitioning table generated by the device capability awareness and protection domain partitioning module. Based on the identification results, this module selects the appropriate processing logic to receive and process gradient data from each domain. For example, for data from... The gradient from the trusted domain is received directly; the gradient from the homomorphic encryption domain undergoes decryption preprocessing; and the gradient from the differential privacy domain is received directly with added noise. Internally, the gradient data is decrypted and aggregated to generate a global model update. The decryption operation is performed within... Internally, the aggregation process involves summing or averaging the received gradients. Thus, utilizing... Hardware isolation features ensure that gradient data remains secure even if the operating system is compromised during the aggregation process.

[0017] Finally, the system includes a privacy budget tracking module. This module is configured to use a distributed ledger to record the privacy budget consumed by each device during each training round. Specifically, the distributed ledger is a simple shared log file that records the privacy budget consumption declared by each device during each gradient upload. This record is used by the secure aggregation module to verify whether the privacy budget consumption of each device exceeds a preset threshold before aggregation. For example, the secure aggregation module periodically reads the ledger records and checks the cumulative privacy budget consumption of each device. This is to prevent malicious devices from forcing the system to reduce noise intensity by over-consuming the privacy budget, thereby providing exploitable conditions for gradient inversion attacks.

[0018] As one specific implementation, this application provides a configuration method for a device capability awareness and protection domain partitioning module. This module utilizes the device discovery and capability query mechanism of the HarmonyOS distributed soft bus to obtain real-time computing capability information, security capability information, and current load status of multiple HarmonyOS devices. Based on the acquired information, devices supporting chip-level trusted execution environments and whose computing capabilities exceed a first threshold are partitioned into... Trusted domains; will not be supported Devices with computing power exceeding the second threshold are classified into the homomorphic encryption domain; and devices with computing power below the second threshold are classified into the differential privacy domain.

[0019] Specifically, the HarmonyOS distributed soft bus enables seamless connectivity and capability sharing between devices. Its device discovery and capability query mechanism allows the system to detect available HarmonyOS devices in the network in real time and query their detailed attributes, including computing performance metrics (such as floating-point performance, number of cores, and clock speed), hardware security modules (such as TEE and SE) and their versions, as well as the current device's memory usage, CPU utilization, network bandwidth, and other load status. Real-time acquisition of this information ensures the dynamic and accurate division of protection domains, adapting to changes in device status.

[0020] Chip-level Trusted Execution Environment (TEX) It can provide confidentiality and integrity protection for data and code, even if the operating system is compromised. Internal data and execution processes remain secure. The first threshold is a preset computing power indicator, comprehensively evaluated based on the device's CPU clock speed, number of cores, and AI computing chip performance. It will simultaneously meet the requirements for supporting... Devices whose computing power exceeds the first threshold are included. Trusted domains enable these devices to perform high-strength cryptographic operations and process sensitive data in hardware-isolated environments, providing the highest level of privacy protection.

[0021] The second threshold is another computational capability indicator, lower than the first threshold, but sufficient to support a certain strength of encrypted computation. It will not support... However, devices with computing power exceeding the second threshold are classified as homomorphic encryption devices. Leveraging the computing power of these devices, privacy protection is provided through software-level homomorphic encryption technology. Specifically, a partial homomorphic encryption algorithm is used to encrypt sensitive gradients, allowing for encryption without hardware... To enable privacy-preserving computation when supported.

[0022] Differential privacy is a technique that protects individual privacy by adding noise to data. It has relatively low computational overhead and does not require high device computing power. Devices with computing power below the second threshold are classified into the differential privacy domain because these devices (including sensors and smart home terminals) have limited resources and cannot handle the computational demands. Alternatively, homomorphic encryption can lead to high computational overhead. By employing differential privacy mechanisms, these devices add noise to the gradients locally before uploading, thereby reducing the performance requirements of the devices while ensuring a predetermined level of privacy protection and expanding the range of participating devices in federated learning.

[0023] As one specific implementation, this application further provides a specific configuration for the adaptive differential privacy noise-adding module, which includes: calculating the information entropy of each dimension of the local gradient, wherein the dimension with higher information entropy contributes more to model convergence; and allocating the total privacy budget... The privacy budget is dynamically allocated to each dimension according to the proportion of information entropy in each dimension, so that dimensions with high information entropy receive a larger sub-privacy budget. A smaller sub-privacy budget is obtained by adding less noise and lowering the information entropy dimension. To add significant noise, among which , This represents the total number of gradient dimensions. Indicates the first Sub-privacy budgets are allocated to each dimension to allocate more budget to dimensions with a greater impact on model accuracy, while maintaining the same total privacy budget; a Gaussian mechanism is employed based on the sub-privacy budgets allocated to each dimension. Determine noise scale ,satisfy ,in For gradient sensitivity, The gradient sensitivity is the relaxation term. This is determined through gradient clipping: the gradient is calculated during each local training session. Then, the device first performs L2 norm clipping on the gradient, that is... ,in The preset clipping threshold is used; after clipping, the gradient sensitivity is... Equal to the clipping threshold ,Right now Clipping threshold The relaxation term is preset based on the statistical characteristics of the gradient distribution, for example, it can be set to the 90th percentile of the L2 norm of the historical gradients of all participating devices, to ensure that the gradient is not over-clipping in most cases. This represents the failure probability allowed by differential privacy, and its value is related to the total number of training rounds. and the total number of data records Relevant, should meet To ensure the rigor of the overall privacy budget; appropriate measures can be determined based on the data scale and training plan of the specific application scenario, according to the above principles. Values, for example, in embodiments of the present invention, are taken as follows: Noise is added independently to each dimension to generate the noisy gradient. ,in For the original gradient, the first... dimensional components, With a mean of 0 and a variance of Gaussian noise.

[0024] Specifically, the calculation of information entropy for each dimension of the local gradient is used to quantify the importance of each gradient dimension for model updates and convergence. Information entropy is a metric for measuring the uncertainty of a random variable; here, it is used to measure the magnitude or importance of changes in gradient dimensions. Gradient dimensions with higher information entropy contain more information and have a greater impact on the direction of model parameter updates and convergence speed. Calculation methods include: statistically analyzing the historical values ​​of the local gradient over a certain training period to calculate the variance and standard deviation of each dimension, or quantifying the distribution of gradient values ​​using the Shannon entropy formula. In this way, the system can identify gradient dimensions that have a more critical impact on model performance.

[0025] Based on this, privacy budget As a core parameter for measuring the strength of privacy protection in differential privacy mechanisms, a smaller value indicates higher privacy protection, but usually comes with greater noise introduction and model accuracy loss. This technical solution proposes a dynamic allocation strategy based on information entropy to optimize the utilization efficiency of the privacy budget. Specifically, the system allocates the total privacy budget according to the information entropy of each dimension calculated above. Proportionally allocate to each gradient dimension: Define a mapping function to allocate dimensions with higher information entropy values ​​to larger sub-privacy budgets. Dimensions with lower information entropy values ​​are allocated to smaller sub-privacy budgets. This allocation method ensures that key dimensions that contribute significantly to model convergence receive a larger privacy budget, thus introducing relatively less noise during subsequent noise addition to preserve their original information. Dimensions with less impact on the model are allocated a smaller privacy budget, allowing for the introduction of more noise and consuming more privacy budget to enhance overall privacy protection without significantly affecting model performance. Mathematically, this allocation strategy is expressed as the sum of all sub-privacy budgets equals the total privacy budget, i.e. ,in This represents the total number of gradient dimensions.

[0026] Furthermore, the Gaussian mechanism protects privacy by adding random noise that follows a Gaussian distribution to the data. In this implementation, for each gradient dimension, the system determines privacy based on its assigned sub-privacy budget. Determine the appropriate noise scale Noise scale The calculation is based on the aforementioned formula, where... Represents gradient sensitivity, used to quantify the maximum possible impact of a single data record on the gradient value; This is a relaxation term, used to loosen strict requirements. Differential privacy is defined as allowing for a violation of privacy guarantees with an extremely low probability in exchange for better usability. This is achieved through a formula for sub-privacy budgeting. The larger the noise scale The smaller the value, the smaller the added noise amplitude. Conversely, The smaller, The larger the value, the greater the added noise. Ultimately, the system adds noise to each gradient dimension. Independent additions with a mean of 0 and a variance of Gaussian noise Generate a noisy gradient This independent noise addition method ensures that each dimension receives a level of privacy protection commensurate with its importance, while maintaining overall differential privacy guarantees.

[0027] As one specific implementation method, the above The trusted domain, homomorphic encryption domain, and differential privacy domain form a three-tiered protection system. Among them, the... The trusted domain utilizes hardware isolation to ensure high security of the core gradient during use; the homomorphic encryption domain encrypts the transmission of sensitive feature dimensions using a partially homomorphic encryption algorithm; and the differential privacy domain provides privacy protection for resource-constrained devices through adaptive noise addition based on information entropy. The synergistic effect of this three-tiered protection system makes it possible for devices lacking [specific features / capabilities] to [protect privacy]. Furthermore, sensors and smart home terminal devices with limited computing power can obtain gradient leakage protection capabilities without performing high-overhead encryption operations, enabling differentiated privacy protection for devices with different resource capabilities under a unified framework.

[0028] This three-tiered protection system systematically organizes protection mechanisms with different security levels and computational overheads to adapt to the diverse capabilities of devices in federated learning environments. By clearly defining the functional positioning and interrelationships of each protection domain, this system ensures that training data receives appropriate privacy protection throughout the entire federated learning process, regardless of device capabilities. The trusted domain leverages hardware isolation to provide high security during the processing and aggregation of core gradients; the homomorphic encryption domain employs a partially homomorphic encryption algorithm, protecting sensitive information while avoiding the high computational overhead of full-dimensional encryption; the differential privacy domain provides effective privacy protection for resource-constrained devices with lower computational cost through adaptive noise addition based on information entropy. The synergistic effect of this three-tiered protection system is reflected in the fact that the system allocates devices to the most suitable protection domain based on their actual capabilities, and leverages the complementary advantages of each domain to achieve differentiated privacy protection for devices with different resource capabilities within a unified framework.

[0029] As one specific implementation, this application further provides that the device for the homomorphic encryption domain is configured to: employ an improved Partial homomorphic encryption algorithm, the improved version Partial homomorphic encryption algorithms refer to those based on standard... Based on the algorithm, efficiency optimizations have been made for federated learning scenarios, specifically including: in the key generation stage, a more efficient prime number generation algorithm is adopted to shorten initialization time; encryption operations are encapsulated into a unified system-level interface for homomorphic encryption domain devices to call, adapting to the HarmonyOS distributed environment; and support for selective encryption of only sensitive feature dimensions in the gradient, reducing encryption computation overhead. These improvements maintain... While maintaining the homomorphism of addition, the algorithm improves encryption efficiency on resource-constrained devices. Only sensitive feature dimensions within the local gradient are encrypted during transmission, while non-sensitive dimensions are transmitted in plaintext.

[0030] Specifically, improved Some homomorphic encryption algorithms support addition and multiplication between ciphertext and plaintext in ciphertext state. Encryption gradients from multiple devices can be aggregated without decryption. The improved method used in this application... Partial homomorphic encryption algorithms are based on standard Based on the algorithm, optimizations are made for federated learning scenarios through adjustments to parameter selection, key management mechanisms, or computational processes to improve encryption and decryption efficiency or adapt to certain encryption requirements. Its partial homomorphic properties primarily support addition operations, aligning with the needs of gradient aggregation.

[0031] Simultaneously, only sensitive feature dimensions within the local gradient are encrypted during transmission. These "sensitive feature dimensions" are specific components of the local gradient vector that contain user privacy information or are crucial to model security. These dimensions may directly or indirectly reflect the user's personal data, behavioral patterns, or sensitive attributes. Identifying sensitive dimensions can be achieved in various ways, such as pre-defining them based on domain expert knowledge or dynamically identifying them through data analysis (e.g., feature importance analysis, sensitivity analysis). Once sensitive dimensions are determined, the device only performs encryption operations on these specific gradient components. This selective encryption strategy significantly reduces the amount of data requiring complex homomorphic encryption computations, thereby reducing the device's computational burden and communication bandwidth requirements.

[0032] Furthermore, non-sensitive dimensions are transmitted in plaintext. These non-sensitive dimensions are components of the local gradient that, after evaluation, contain little or no privacy information, and whose risk of leakage is within acceptable limits. These dimensions typically contribute little to model training or have low information entropy, making them difficult to reverse engineer for inferring the original data. For these non-sensitive dimensions, the device does not require encryption and transmits them directly in plaintext, thereby avoiding unnecessary encryption and decryption overhead and improving data transmission and aggregation efficiency.

[0033] As one specific implementation, this application further provides that the above-mentioned Trusted domain devices are configured to migrate core training logic and gradient aggregation operations to a chip-level trusted execution environment and utilize hardware isolation mechanisms to ensure the security of gradient data during use.

[0034] Specifically, the Devices in the trusted domain are identified by the device capability awareness and protection domain segmentation module as supporting chip-level trusted execution environments (CLE). Devices whose computing power meets a specific threshold. These devices have the ability to provide security isolation at the hardware level and are the highest-level participants in the entire system.

[0035] The core training logic refers to the key algorithms and data processing flows executed on the local device during federated learning, used to calculate model gradients via backpropagation. Migrating this logic to a chip-level trusted execution environment ensures that these sensitive computations no longer run within the device's general operating system environment, but are instead loaded into a hardware-protected, independent secure area. Sensitive information such as model weights, training data subsets, and intermediate gradient calculation results will be stored within this environment. The data is processed internally to prevent operating system-level malware or attacks from stealing or tampering with it.

[0036] The gradient aggregation operation, for For trusted domain devices, this refers to the preprocessing, encryption, or preparation operations performed on the gradients after they are generated locally, in order to facilitate final aggregation by the parameter server or master node. The device needs to perform format conversion, signing, or encryption operations on the local gradients. These operations, if... External execution may still expose gradient information. Migrating these operations to... Internally, it ensures that the gradient exits the device. It had always been under protection.

[0037] The chip-level trusted execution environment ( This is a hardware-enforced isolated execution environment, creating a secure region within the main processor to ensure the confidentiality and integrity of the code and data loaded into it. This is achieved by placing the core training logic and gradient aggregation operations within a secure region. Internally, it effectively prevents external software (including the operating system itself) from spying on and interfering with these sensitive operations.

[0038] The hardware isolation mechanism ensures, through physical or logical isolation, that The internal execution environment is completely separated from the external environment. Even if the device's general operating system is compromised, malicious programs cannot access or tamper with it. Internal code, data, and execution state. This mechanism provides the highest level of protection for gradient data during use, ensuring its confidentiality and integrity while the data is processed by the CPU, effectively compensating for the protection blind spots of traditional encryption technologies during the data decryption process.

[0039] As one specific implementation, this application further provides a specific configuration of the security aggregation module as follows: in the... Internally, the encryption gradient received from the homomorphic encryption domain... use Additive homomorphism performs ciphertext field aggregation, satisfying ,in express Encryption is performed, and the aggregation result is decrypted to obtain the plaintext aggregated gradient; the noisy gradient received from the differential privacy domain is then processed. Based on known noise parameters Perform noise filtering or retention; from the... The gradients received in the trusted region are aggregated with the processed gradients to generate the global model update; through... The remote authentication mechanism proves the integrity of the global model update calculation process to each device.

[0040] The security aggregation module is in Internally, the cryptographic gradient received from the homomorphic cryptographic domain... use Additive homomorphism performs ciphertext field aggregation. The encryption algorithm supports additive homomorphism, meaning the product of two ciphertexts corresponds to the sum of their plaintexts. When the secure aggregation module receives encryption gradients from multiple devices in the homomorphic encryption domain... At that time, Internally, multiplication operations are performed directly on these ciphertext gradients. Thus, gradient aggregation is achieved in the ciphertext domain. After the ciphertext aggregation is completed, Internally, the aggregation result is decrypted using its security key to obtain the aggregation gradient in plaintext form. This method avoids... External decryption of sensitive gradients ensures the confidentiality of gradients during the aggregation process. Internal configuration can be preset or negotiated securely. The encryption algorithm requires a public and private key. Devices in the homomorphic encryption domain use the public key to encrypt local gradients. The security aggregation module... Internally, these ciphertexts are received and called. The algorithm library provides ciphertext multiplication functions for aggregation, followed by... Decrypt using the private key stored internally.

[0041] Meanwhile, the secure aggregation module adds noise to the gradient received from the differential privacy domain. Based on known noise parameters Noise filtering or retention is performed. Devices in the differential privacy domain adaptively add noise based on the information entropy of their local gradients before uploading the gradients to achieve privacy protection. The secure aggregation module receives these noisy gradients. Then, based on a pre-set strategy or known noise parameters... Determine how to handle this noise. The noise parameters... The noise is generated by the adaptive differential privacy noise-adding module during the addition of noise and securely transmitted to the secure aggregation module, or recorded in the distributed ledger of the privacy budget traceability module. Processing methods include: filtering out some noise to improve model accuracy, estimating and canceling some noise using statistical methods or machine learning techniques; or directly retaining the noise and aggregating it as part of the gradient to simplify the processing flow and maintain the strictness of differential privacy. Internal storage or receiving noise parameters uploaded by various devices If noise removal is chosen, signal processing techniques such as Kalman filtering and Wiener filtering are used, or mean estimation and subtraction operations are performed based on the statistical characteristics of the noise. If noise retention is chosen, the noise gradient is directly applied. It serves as an effective gradient in subsequent aggregation.

[0042] In addition, the security aggregation module will... The gradients received in the trust region are aggregated with the processed gradients to generate the global model update. Internally, the plaintext aggregated gradient (decrypted) from the homomorphic encryption domain and the noisy gradient (noise-processed) from the differential privacy domain have been obtained. Meanwhile, The trusted domain device securely transmits the raw gradients to the TEE of the secure aggregation module. The secure aggregation module then stores these three types of gradients (…). The original gradient in the trusted domain, the decryption aggregate gradient in the homomorphic encryption domain, and the gradient after adding noise / processing in the differential privacy domain are all present in the following data. The final weighted average or other aggregation algorithm is performed in a hardware-isolated environment to generate the global model update for this round of training. Internally, it implements standard federated learning aggregation algorithms, such as federated averaging ( For gradients from different domains, different weights are assigned based on their source and processing method, or an arithmetic average is directly applied. The entire aggregation process is... This is done in a hardware-isolated environment to ensure the security of gradient data during the aggregation calculation process.

[0043] Finally, through The remote authentication mechanism proves the integrity of the global model update calculation process to each device. Provides a remote authentication mechanism, allowing HarmonyOS devices to act as remote entities for verification. The mechanism ensures that the internally running secure aggregation module is as expected and tamper-proof, and that its execution environment is secure. Through this mechanism, the secure aggregation module generates a certificate containing its identity, runtime code hash, and aggregation result signature, and sends it to each device. Upon receiving the certificate, each device verifies its authenticity and integrity, thereby trusting that the received global model update is securely and correctly computed. After completing the global model update, the internal security aggregation module calls... The provided remote authentication API generates an aggregated result hash. An authentication report containing information such as identity verification and module code integrity metrics. This report is provided by... The hardware key is used for signing. After receiving the report, each device verifies the signature using the pre-configured TEE public key and checks whether the metric in the report is consistent with the expected security aggregation module.

[0044] As one specific implementation, this application further provides a specific implementation method for the privacy budget traceability module. The privacy budget traceability module is specifically configured to: store, in the distributed ledger, the sub-privacy budget consumed by each device each time it uploads a differential privacy gradient in the form of a hash chain. and the corresponding noise parameters The record is then broadcast for verification by other devices, ensuring its immutability through distributed consensus. Before aggregation, the secure aggregation module reads the verified cumulative privacy budget consumption value from the distributed ledger. If the cumulative consumption value of any device exceeds the preset threshold If the device fails to upload the gradient, it will be rejected to prevent malicious devices from forcing the system to reduce noise intensity by overspending the privacy budget; the system also provides the function of cross-validating the distributed ledger records among devices to ensure the immutability and auditability of the records.

[0045] Specifically, distributed ledgers offer high transparency and immutability. Employing a hash chain structure, each new record (including the sub-privacy budget consumed when a device uploads a differential privacy gradient)... and noise parameters Each record is hashed and linked to the previous record, forming a continuous, tamper-proof chain. This structure ensures that any modification to a historical record will result in a change in the subsequent hash value, thus being detected. These records are broadcast to all participating devices for verification and are validated through a distributed consensus mechanism (such as proof-of-work). Proof of Rights Or Byzantine tolerance They reached an agreement to ensure the immutability of records, providing a basis for subsequent auditing and penalty mechanisms.

[0046] Before performing gradient aggregation, the security aggregation module proactively queries the distributed ledger to obtain the total privacy budget consumed by each device since the start of training. This cumulative value has been verified through distributed consensus by all participating devices, ensuring high reliability. The system has a preset maximum allowed privacy budget threshold. This limit is used to restrict the total privacy budget that a single device can consume throughout the entire training process. If the security aggregation module detects a device's cumulative privacy budget consumption... If the threshold is exceeded, the gradient data uploaded by the device in the current round is immediately rejected. This mechanism effectively prevents malicious devices from attempting to reduce the overall privacy protection strength of the system by continuously uploading gradients with extremely low noise (i.e., consuming a large amount of privacy budget), thereby creating conditions for gradient inversion attacks. By rejecting its gradients, the system forces malicious devices to comply with the preset privacy protection policy, maintaining the overall security of federated learning.

[0047] Furthermore, in addition to the verification capabilities provided by the distributed consensus mechanism itself, this scheme also allows and encourages all devices participating in federated learning to cross-validate records on the distributed ledger. Any device can independently check whether the privacy budget consumption records uploaded by other devices comply with the protocol, including checking the integrity of the hash chain and the logical consistency of the records. This cross-validation mechanism further enhances the transparency and credibility of the distributed ledger, making any attempt to tamper with records risky and likely to be discovered and exposed by other devices collectively. It not only ensures the immutability of records but also provides comprehensive auditability, enabling system administrators or auditors to trace and review the privacy budget consumption history of each device at any time, thereby enhancing the fairness and security of the system.

[0048] As one specific implementation, this application further provides a collaborative training protocol module, which is configured to perform the following collaborative training process: initialization, local training, domain protection, secure aggregation, and model distribution and iteration.

[0049] This collaborative training protocol module is the core coordinator of the entire distributed encrypted computing and differential privacy system, responsible for defining and managing the entire lifecycle of federated learning. Its role is to decompose the complex process of federated learning into a series of steps and ensure that these steps are executed in a predetermined order and according to rules. This module is implemented as a software service or a set of application programming interfaces (APIs), running on the parameter server or the elected master node, responsible for communicating and coordinating with all HarmonyOS devices participating in the training. It ensures that devices in different protection domains can upload data and update models according to a unified protocol, thereby maintaining the system's integrity and efficiency.

[0050] During the initialization phase, the collaborative training protocol module broadcasts detailed information about the AI ​​training task, including model architecture, training objectives, and hyperparameters, to all potential participating devices. Simultaneously, the device capability awareness and protection domain partitioning module dynamically partitions devices based on their computing power, security capabilities, and current load status, using the HarmonyOS distributed soft bus's device discovery and capability query mechanism. The system consists of a trusted domain, a homomorphic encryption domain, and a differential privacy domain. After the protection domains are defined, the collaborative training protocol module distributes the initialized global model to all participating devices, serving as the starting point for local training on each device.

[0051] The process then proceeds to the local training phase, where each HarmonyOS device participating in the training utilizes its local private dataset to perform one or more rounds of local training based on the received model. During this process, the device calculates the gradient of the model parameters relative to the local data according to the training algorithm; these local gradients reflect the direction and extent of the model's optimization on the local data and form the basis for subsequent aggregation and generation of global model updates.

[0052] Then comes the domain protection phase, for those classified as... In trusted domain devices, the locally computed gradients are securely passed to the device's chip-level trusted execution environment. Inside. With robust hardware isolation, gradient data receives a high level of security before uploading, preventing its theft by malware at the device operating system level. For devices classified into homomorphic encryption domains, sensitive feature dimensions in local gradients are identified and utilized using improved... Some homomorphic encryption algorithms encrypt only these sensitive dimensions, while transmitting non-sensitive dimensions in plaintext. This approach protects critical privacy information while reducing the computational overhead of encryption. For devices divided into differential privacy domains, the adaptive differential privacy noise-adding module dynamically allocates the privacy budget based on the information entropy of each dimension of the local gradient, and independently adds noise associated with the allocated privacy budget to each dimension of the local gradient to generate a noisy gradient. Subsequently, the privacy budget tracking module records the privacy budget consumed by the device in this training and updates the privacy budget record in the distributed ledger.

[0053] After each device completes local training and domain protection, the collaborative training protocol module coordinates the devices to upload the protected gradient data to the parameter server or the elected master node. At this point, the security aggregation phase begins. Upon receiving this gradient data from different protection domains, the security aggregation module integrates it... Internally, the appropriate processing logic is selected based on the protection domain to which each device belongs: the encryption gradient received from the homomorphic encryption domain is processed. use Additive homomorphism is used to perform ciphertext domain aggregation, and the aggregation result is decrypted to obtain the plaintext aggregated gradient; the noisy gradient received from the differential privacy domain is then processed. Based on known noise parameters Perform noise filtering or retention; from The gradients received in the trust region are aggregated with the processed gradients described above. Finally, all gradient data are aggregated to generate a global model update. This process utilizes... The hardware isolation feature ensures the security of gradient data during the aggregation process.

[0054] Finally, in the model delivery and iteration phase, after the security aggregation module generates a global model update, the collaborative training protocol module broadcasts this update to all HarmonyOS devices participating in the training. Each device receives the updated model and applies it to its local model, thus completing one round of federated learning iteration. Subsequently, the system enters the next round of local training, domain protection, security aggregation, and model delivery until the preset training rounds or model convergence conditions are reached.

[0055] As a specific implementation, this application further provides a HarmonyOS distributed encrypted computing and differential privacy method for AI training data protection, the method comprising the following steps: First, in step S1, the device capabilities of multiple HarmonyOS devices participating in federated training are perceived based on the HarmonyOS distributed soft bus, and these multiple HarmonyOS devices are dynamically divided into... Trusted domain, homomorphic encryption domain, and differential privacy domain; among them, devices that support chip-level trusted execution environments and whose computing power exceeds a first threshold are classified into... Trusted domains, not supported However, devices with computing power exceeding the second threshold are classified into the homomorphic encryption domain, while devices with computing power below the second threshold are classified into the differential privacy domain.

[0056] Secondly, in step S2, on the device in the differential privacy domain, the information entropy of each dimension of the local gradient is calculated, and the total privacy budget is calculated based on the information entropy of each dimension. The privacy budget is allocated proportionally to each dimension, so that dimensions with high information entropy receive a larger sub-privacy budget. A smaller sub-privacy budget is obtained by adding less noise and lowering the information entropy dimension. To add significant noise, and employ a Gaussian mechanism based on the stated sub-privacy budget. Determine noise scale Noise is added independently to each dimension to generate a noisy gradient.

[0057] Next, in step S3, in the parameter server... Internally, it receives and aggregates gradient data from various protection domains; before aggregation, it reads the cumulative privacy budget consumed by each device from the distributed ledger. If the cumulative consumption of any device exceeds the preset threshold If the gradient is not found, the gradient uploaded by that device this time will be rejected; gradients that pass verification will be rejected. Internally, aggregation processing is performed to generate a global model update. Finally, in step S4, the global model update is distributed to each device via the HarmonyOS distributed soft bus to complete one round of collaborative training and enter the next round of training iteration.

[0058] Through the above technical solutions, this application provides a systematic federated learning collaborative training process, effectively solving the technical problem of how to organically integrate HarmonyOS distributed encrypted computing with various protection mechanisms of differential privacy systems to achieve a balance between data privacy security and model training efficiency. Specifically, this method first ensures that devices with different resource capabilities can adopt privacy protection strategies that match their capabilities by dynamically sensing device capabilities and dividing protection domains, avoiding unnecessary computational overhead or insufficient protection. Second, in the differential privacy domain, an adaptive privacy budget allocation mechanism based on gradient information entropy can minimize model accuracy loss while consuming the same total privacy budget, effectively improving the practicality of differential privacy protection. Furthermore, in the parameter server... Internally, secure aggregation is performed, and the privacy budget is verified using a distributed ledger. This not only ensures the security of the aggregation process through hardware isolation but also effectively prevents attacks from malicious devices through a budget traceability mechanism. Ultimately, through... By employing a three-tiered collaborative protection system encompassing the trusted domain, homomorphic encryption domain, and differential privacy domain, along with an adaptive privacy budget allocation based on gradient information entropy, this method not only blocks gradient leakage attack paths but also achieves dual optimization of differentiated privacy protection and model accuracy across devices with varying resource capabilities. This significantly enhances the security and efficiency of federated learning in heterogeneous device environments.

[0059] The present invention also provides an embodiment of the practical application of the method of the present invention: I. Application Scenarios A core transportation hub area in a smart city was selected as an application example. This area deployed various HarmonyOS devices: 10 devices equipped with… The system comprises a flagship smartphone (for vehicle location and driving behavior analysis), eight AI-enabled smart traffic cameras (for license plate recognition and vehicle trajectory tracking), and 15 resource-constrained IoT sensors (for collecting road geomagnetic, environmental noise, and meteorological data). These devices, connected via HarmonyOS distributed soft bus, form a super terminal to jointly train a federated learning-based traffic flow and congestion prediction model, aiming to predict traffic flow at major intersections over the next 15 minutes. The initial global model is distributed from a regional edge server (master node), which also integrates… Environment. All participating devices face the risk of data privacy breaches—vehicle trajectories, driver behavior, and other highly sensitive information.

[0060] II. Specific Implementation and Numerical Calculations at Each Stage: (I) Round 1: Initialization and Protection Domain Division Equipment capability awareness and protection domain division: The system uses the device discovery and capability query mechanism of HarmonyOS distributed soft bus to obtain the computing power, security capabilities and load status of all devices in real time, and dynamically divides the protection domains accordingly. The results are shown in Table 1.

[0061] Table 1. Results of Equipment Capability Awareness and Protection Domain Division (Some Representative Equipment)

[0062] Classification criteria: Supports chip-level Devices with a computing power score of ≥80 are included. Trusted domains; not supported Devices with a computing power score of ≥60 are classified into the homomorphic encryption domain; devices with a computing power score <60 are classified into the differential privacy domain.

[0063] 2. Initialization and Model Distribution: The master node (regional edge server) broadcasts the training task (predicting traffic flow at intersections in the next 15 minutes; the model is a shallow neural network with 512 parameters and 4 fully connected layers) through the collaborative training protocol module, and also sends the initial global model. Distribute to all participating devices.

[0064] (II) Round 1: Local Training and Domain Protection TEE Trusted Domain Device ( ): Local training: The device uses locally stored vehicle GPS trajectory and driving behavior data (such as braking frequency and lane change frequency) to calculate the local gradient through backpropagation. (Dimension d=512).

[0065] Intra-domain protection: Gradient Input to chip level Inside, and in Internally, it is signed and encapsulated before being uploaded to the master node. Throughout the entire computation and upload process, the gradient data is completely invisible at the operating system level. Even if the device's operating system is compromised by malware, the gradient data cannot be stolen.

[0066] Homomorphic encryption domain device ( ): Local training: The smart camera uses locally collected license plate recognition data and vehicle trajectory video streams to calculate the local gradient. (dimension) ).

[0067] Intra-domain protection: Based on preset rules, 15 dimensions in the gradient that are strongly correlated with specific vehicle identity and license plate number are identified as sensitive feature dimensions. An improved method is adopted. Partial homomorphic encryption algorithms use the public key broadcast by the master node to encrypt only these 15 sensitive dimensions, generating ciphertext gradients. The remaining 497 non-sensitive dimensions (such as overall traffic flow statistics and average vehicle speed) are transmitted in plaintext. This selective encryption strategy significantly reduces the computational overhead of encryption.

[0068] Upload: Will and Package and upload to the master node.

[0069] Differential privacy domain devices ( ) With geomagnetic sensors For example: Local training: The sensor uses locally acquired magnetic field change data (used to detect vehicle passage) to calculate the local gradient. (Dimension d=512).

[0070] Adaptive differential privacy noise addition: Calculate the information entropy of each dimension: The system calculates the local gradient. The information entropy has 512 dimensions. For example, the first, second, and third dimensions of gradient information entropy, which are related to the frequency of vehicle passage, are relatively high (…). ), while some edge dimensions with low information entropy are related to background magnetic field drift. ).

[0071] Dynamically allocate privacy budget: Total system privacy budget = 8.0 (set by the system administrator based on the overall privacy protection strength of this training round). Allocated according to the proportion of information entropy in each dimension, so that dimensions with high information entropy receive a larger sub-privacy budget.

[0072] Total information entropy and .

[0073] Sub-privacy budget allocated in the first dimension .

[0074] Sub-privacy budget allocated in the 200th dimension .

[0075] Add Gaussian noise independently: Gradient sensitivity (Set according to gradient clipping threshold), relaxation term .

[0076] First-dimensional noise scale:

[0077] 200th dimension noise scale .

[0078] Final noisy gradient , .

[0079] Generating a noisy gradient: Gaussian noise calculated above is added independently to all 512 dimensions to generate the final noisy gradient. .

[0080] Privacy Budget Record: Records all sub-privacy budgets consumed this time. and noise parameters These records are stored in a distributed ledger, forming a hash chain of records. For example, The record for this round is: [Round1, DeviceID: Sensor_01, 0.0335, 2.985, 0.0328, 3.048, ..., 0.00305, [32.79,..., Timestamp], and broadcast it to all participating devices for distributed consensus to ensure the immutability of the record.

[0081] (III) Round 1: Secure Aggregation and Budget Verification Pre-aggregation verification: Master node (edge ​​server) Before aggregation, the internal security aggregation module reads the cumulative privacy budget consumption of each differential privacy domain device from the distributed ledger. Since this is the first round, the cumulative consumption of all differential privacy domain devices is far below the preset threshold. (The system sets a maximum privacy budget for a single device throughout the entire training process), and all checks passed.

[0082] Internal polymerization treatment: Processing homomorphic encrypted domain data: In Internally, regarding from Received encryption gradient ,use Ciphertext field aggregation using additive homomorphism:

[0083] Subsequently, using Decrypting the internally stored private key yields the plaintext aggregated gradient. The aggregated gradient is concatenated with the plaintext gradient of the non-sensitive dimension to obtain the complete aggregated gradient. .

[0084] Processing differential privacy domain data: In Internally, receiving from Noise gradients from 15 sensors Because the statistical properties of differential privacy need to be preserved in subsequent aggregation to ensure the composability of the overall privacy budget, the secure aggregation module decides to directly retain this noise without filtering it. The aggregated gradient is obtained by averaging the 15 noisy gradients. .

[0085] deal with Trusted domain data: in Internally, receiving from The original gradient of 10 mobile phones .

[0086] Final aggregation: In Internally, the aggregated gradients from the three domains are weighted and averaged according to the number of devices to generate a global model update. The formula is:

[0087] Integrity proof: The master node passes The remote authentication mechanism generates a hash containing the aggregation result hash, the aggregation logic code hash, and... for all participating devices. The authentication report of the identity certificate proves that the aggregation computing process was executed in a secure and tamper-proof environment.

[0088] (iv) Round 1: Model Deployment and Iteration The collaborative training protocol module updates the generated global model. The training is distributed to all devices via the HarmonyOS distributed soft bus, and each device updates its local model to enter the next training iteration.

[0089] (V) Round 3: Abnormal Behavior Detection and Handling In the third round of training, a differential privacy domain device The noise sensor is attempting to upload an abnormal gradient.

[0090] Privacy budget overrun detection: The security aggregation module reads data from the distributed ledger before aggregation. Privacy budget consumed in this round The cost (including Round 1, Round 2, and the current upload) is 21.2, exceeding the preset threshold. The system determined that the device was potentially malicious, attempting to force the system to reduce its overall noise level by continuously uploading gradients with extremely low noise (i.e., consuming a large amount of privacy budget), thereby creating conditions for a gradient inversion attack.

[0091] Denial and Isolation: The security aggregation module immediately denies. The gradients uploaded in this round will trigger an alert to the system administrator. Data from this device will not be included in this round of global model updates, and subsequent requests from it will be subject to strict monitoring and rate limiting.

[0092] Traceability and Auditing: Other devices can cross-verify the distributed ledger. The records are checked for hash chain integrity and logical consistency. Because the records are stored through distributed consensus, Its historical consumption records cannot be tampered with or deleted, ensuring the transparency and auditability of the system.

[0093] (vi) Effectiveness verification and case record 1. Model accuracy comparison: After 20 rounds of training, the accuracy (mean absolute percentage error, MAPE) of the traffic flow prediction model under different schemes was compared, and the results are shown in Table 2.

[0094] Table 2 Comparison of Model Prediction Accuracy under Different Privacy Protection Schemes

[0095] As can be seen from Table 2, the solution of the present invention achieves differentiated protection (…). Homomorphic encryption, adaptive differential privacy, and information entropy-based adaptive noise reduction provide strong privacy protection while significantly reducing the model accuracy loss caused by uniform noise reduction (MAPE decreased from 14.2% to 10.1%), compared to an increase of only 1.6 percentage points in accuracy loss compared to the unprotected scheme.

[0096] 2. Performance overhead comparison: The average performance overhead of devices in different domains during a single training round is shown in Table 3.

[0097] Table 3 Comparison of single-round training performance costs for different protection zone equipment

[0098] As can be seen from Table 3, the computational overhead of the differential privacy domain device using adaptive noise addition (8ms) is much lower than that of the unified noise addition scheme (25ms), and the communication overhead is not significantly increased, which verifies the friendliness of this scheme to resource-constrained devices.

[0099] 3. Risk event recording and case storage The system automatically records relevant data on risk events and forms standardized cases, as shown in Table 4.

[0100] Table 4. Case Studies of Risk Event Records

[0101] III. Conclusion: This application utilizes device capability awareness and protection domain segmentation, adaptive differential privacy noise enhancement, The collaborative operation of modules such as secure aggregation and privacy budget traceability successfully achieved efficient and secure federated learning training on a super terminal for a smart city transportation hub composed of heterogeneous HarmonyOS devices. The system not only provides low-overhead adaptive differential privacy protection for resource-constrained IoT sensors (only 8ms of additional computation per round), but also provides... Level-compliant hardware security protection. Through adaptive noise addition based on gradient information entropy, model accuracy loss is effectively controlled (MAPE only 10.1%). Simultaneously, the privacy budget traceability module successfully detected and blocked a simulated malicious attack (cumulative cost 21.2 > threshold 20.0), verifying the system's robustness and security. This embodiment fully demonstrates the effectiveness and advancement of the system in balancing privacy protection, model accuracy, and device capability differences in a real-world distributed scenario.

[0102] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in the present invention, and these should all be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection, characterized in that: include: The device capability awareness and protection domain partitioning module is configured to acquire device capability information of multiple HarmonyOS devices participating in federated training based on the HarmonyOS distributed soft bus, and dynamically partition the multiple HarmonyOS devices into trusted execution environments based on the device capability information. Trusted domain, homomorphic encryption domain, and differential privacy domain are defined, with the division result directly determining the type of gradient protection strategy adopted by each device, so that devices with different resource capabilities can adopt privacy protection methods that match their capabilities. An adaptive differential privacy noise module is configured to start in response to the partitioning result for a device divided into the differential privacy domain, calculate the information entropy of each dimension of the local gradient, and dynamically allocate a privacy budget according to the information entropy of each dimension to independently add noise associated with the allocated privacy budget to each dimension of the local gradient, thereby generating a noisy gradient to minimize the loss of model accuracy while consuming the same total privacy budget. The security aggregation module is integrated into the parameter server or the elected master node. In the configuration, the protection domain to which each device belongs is identified before aggregation, and the corresponding processing logic is selected based on the identification result to receive and process gradient data from each domain. Internally, the gradient data is decrypted and aggregated to generate a global model update, which is then utilized. Hardware isolation ensures that gradient data remains secure even if the operating system is compromised during the aggregation process; The privacy budget tracking module is configured to use a distributed ledger to record the privacy budget consumed by each device in each round of training, so that the security aggregation module can verify whether the privacy budget consumption of each device exceeds a preset threshold before aggregation, in order to prevent malicious devices from forcing the system to reduce noise intensity by over-consuming the privacy budget, thereby creating conditions for gradient inversion and restoration attacks.

2. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, The specific configuration of the device capability perception and protection domain division module is as follows: Through the device discovery and capability query mechanism of the HarmonyOS distributed soft bus, the computing capability information, security capability information and current load status of the multiple HarmonyOS devices can be obtained in real time. Devices that support a chip-level trusted execution environment and have computing power exceeding a first threshold will be classified into the category described above. Trusted domain; Will not support However, devices with computing power exceeding the second threshold are assigned to the homomorphic encryption domain; Devices with computing power below the second threshold are assigned to the differential privacy domain.

3. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, The adaptive differential privacy noise-adding module is specifically configured as follows: Calculate the information entropy of each dimension of the local gradient, where the dimension with higher information entropy contributes more to model convergence; Total privacy budget The privacy budget is dynamically allocated to each dimension according to the proportion of information entropy in each dimension, so that dimensions with high information entropy receive a larger sub-privacy budget. A smaller sub-privacy budget is obtained by adding less noise and lowering the information entropy dimension. To add significant noise, among which , This represents the total number of gradient dimensions. Indicates the first Sub-privacy budgets are allocated to dimensions to allocate more budget to dimensions that have a greater impact on model accuracy, while keeping the total privacy budget the same. A Gaussian mechanism is employed, based on the sub-privacy budget allocated to each dimension. Determine noise scale ,satisfy ,in For gradient sensitivity, The relaxation term is used, and noise is added independently to each dimension to generate the noisy gradient. ,in For the original gradient, the first... dimensional components, The mean is variance is Gaussian noise.

4. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, The The trusted domain, homomorphic encryption domain, and differential privacy domain form a three-tiered protection system: The Trusted domains utilize hardware isolation to ensure the absolute safety of core gradients during use. The homomorphic encryption domain uses a partial homomorphic encryption algorithm to encrypt the transmission of sensitive feature dimensions; The differential privacy domain provides privacy protection for resource-constrained devices through adaptive noise addition based on information entropy; The three-tiered protection system works synergistically to prevent those without... Furthermore, sensors and smart home terminal devices with limited computing power can obtain gradient leakage protection capabilities without performing high-overhead encryption operations, enabling differentiated privacy protection for devices with different resource capabilities under a unified framework.

5. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, The device in the homomorphic encryption domain is configured to: employ an improved Some homomorphic encryption algorithms encrypt only the sensitive feature dimensions in the local gradient, while non-sensitive dimensions are transmitted in plaintext.

6. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, The The trusted domain device is configured to migrate the core training logic and gradient aggregation operations to a chip-level trusted execution environment, and use hardware isolation mechanisms to ensure the security of gradient data during use.

7. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, The security aggregation module is specifically configured as follows: In the Internally, the encryption gradient received from the homomorphic encryption domain... use Additive homomorphism performs ciphertext field aggregation, satisfying ,in express Encryption is performed, and the aggregation result is decrypted to obtain the plaintext aggregation gradient; The noisy gradient received from the differential privacy domain Based on known noise parameters Perform noise filtering or retention; From the The gradients received in the trusted region are aggregated with the gradients processed above to generate the global model update; pass The remote authentication mechanism proves the integrity of the global model update calculation process to each device.

8. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, The privacy budget traceability module is specifically configured as follows: In the distributed ledger, the sub-privacy budget consumed by each device each time it uploads a differential privacy gradient is stored in the form of a hash chain. and the corresponding noise parameters The record is then broadcast for verification by other devices, ensuring its immutability through distributed consensus. Before aggregation, the security aggregation module reads the verified cumulative privacy budget consumption value from the distributed ledger. If the cumulative consumption value of any device exceeds the preset threshold If the device uploads a gradient, the system will reject the current upload to prevent malicious devices from forcing the system to reduce noise intensity by excessively consuming the privacy budget. Provides the ability for cross-validation of the distributed ledger records across devices to ensure the immutability and auditability of the records.

9. The HarmonyOS distributed encrypted computing and differential privacy system for AI training data protection according to claim 1, characterized in that, It also includes a collaborative training protocol module, configured to execute the following collaborative training process: Initialization: Broadcast training tasks and divide guard domains, and distribute initial models; Local training: Each device performs training on local data and calculates local gradients; Domain protection: Trusted domain devices pass gradients in Uploaded after encryption; the homomorphic encryption domain device encrypts the sensitive dimensions before uploading; the differential privacy domain device generates a noisy gradient, uploads it, and updates the privacy budget record. Security aggregation: Generates global model updates through the security aggregation module; Model distribution and iteration: The global model update is broadcast to each device to enter the next training iteration.

10. A HarmonyOS distributed encrypted computing and differential privacy method for protecting AI training data, applied to the system described in any one of claims 1 to 9, characterized in that, Includes the following steps: Step S1: Based on the HarmonyOS distributed soft bus, perceive the device capabilities of multiple HarmonyOS devices participating in federated training, and dynamically divide the multiple HarmonyOS devices into... Trusted domain, homomorphic encryption domain, and differential privacy domain; Step S2: On the device in the differential privacy domain, calculate the information entropy of each dimension of the local gradient, dynamically allocate the privacy budget according to the information entropy of each dimension, and independently add adaptive noise to each dimension of the local gradient to generate a noisy gradient. Step S3: In the parameter server Internally, it receives and aggregates gradient data from various protection domains, with the privacy budget consumption of each device verified based on a distributed ledger before aggregation; Step S4: In the The system internally generates global model updates and distributes them to various devices via the HarmonyOS distributed soft bus to complete one round of collaborative training. Among them, through the The three-tiered collaborative protection of the trusted domain, homomorphic encryption domain, and differential privacy domain, along with the adaptive privacy budget allocation based on gradient information entropy, not only blocks gradient leakage attack paths but also achieves differentiated privacy protection and dual optimization of model accuracy for devices with different resource capabilities.

Images