A privacy protection-oriented zero-trust security aggregation method in a vehicle networking scene

Abstract

This invention belongs to the field of vehicle-to-everything (V2X) security aggregation and privacy protection technology, proposing a zero-trust secure aggregation method for privacy protection in V2X scenarios. Vehicle nodes derive a one-time mask seed using the shared session key and the current version number of the participation eligibility status list as input factors. This generates a random mask matrix, which is then used to mask local gradient updates before being uploaded to the Remote State Unit (RSU). The RSU performs pre-screening of participation eligibility and batch signature verification before forwarding the data to the Restricted System Model (RSM). Upon meeting a preset demasking trigger condition, the RSM reconstructs the random mask matrix, performs controlled demasking on the mask gradients to recover the true gradients, calculates an adaptive credit value based on historical performance, and dynamically updates the participation eligibility status list. Finally, it directly aggregates the true gradients corresponding to the valid vehicle set to update the global model. This invention achieves a unified approach to continuous authentication auditing, gradient privacy protection, and training efficiency through deep binding between version numbers and underlying cryptographic primitives.

Description

Technical Field

[0001] This invention pertains to vehicle-to-everything (V2X) security aggregation and privacy protection technologies, specifically relating to a zero-trust security aggregation method and system for privacy protection in V2X scenarios. Background Technology

[0002] Privacy-preserving collaborative training allows numerous clients to jointly train machine learning models without uploading raw data. Typically, clients train locally and then upload model gradients or updated parameters to an aggregation platform, which then summarizes and distributes the updated global model. This approach can mitigate privacy leaks caused by the direct sharing of sensitive data such as vehicle location, trajectory, and driving behavior in connected vehicles.

[0003] However, in the dynamic network environment of vehicle-to-everything (V2X) communication, simply encrypting or masking gradients cannot efficiently solve the security issues in multi-node privacy-preserving collaborative training. On the one hand, malicious vehicles may compromise the overall model quality by poisoning updates, tampering with features, or submitting low-quality model updates. On the other hand, factors such as high-speed vehicle movement and bandwidth fluctuations can also introduce disconnections, delays, or low-quality updates, leading to decreased training efficiency. Furthermore, even if malicious vehicles are identified in existing solutions, the aggregation end may still select such vehicles for aggregation in subsequent rounds, resulting in insufficient auditing and continuous control capabilities.

[0004] The zero-trust concept emphasizes "never trust, continuous verification," requiring that no participant in the system be trusted by default, and that every access and submission should be verified and re-evaluated. However, directly overlaying traditional zero-trust authentication mechanisms onto such privacy-preserving collaborative training mechanisms often introduces additional authentication rounds and higher communication overhead, which is detrimental to real-time training in connected vehicle scenarios. Therefore, a zero-trust secure aggregation method is needed that is suitable for connected vehicle scenarios, prioritizes privacy protection, and balances continuous authentication, abnormal node suppression, and training efficiency. This method should reduce the additional communication and computational overhead of continuous authentication without increasing the number of interaction rounds, and enhance the controllability and stability of the training process in dynamic connected vehicle environments. Summary of the Invention

[0005] Purpose of the invention: The purpose of this invention is to address the problems faced by privacy-preserving collaborative training in the Internet of Vehicles (IoV) such as continuous participation of malicious vehicles, decreased training efficiency in dynamic environments, and insufficient continuous auditing capabilities of existing solutions, by providing a zero-trust secure aggregation method for privacy protection in the IoV scenario.

[0006] Technical Solution: The zero-trust security aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario described in this invention is structured within a collaborative training system comprising a Trusted Management Entity (RSM), a Semi-Honest Forwarding and Authentication Entity (RSU), and several vehicle nodes, and includes the following steps:

[0007] Step S1, System Initialization: The RSM generates system public parameters, management key pairs, and a versioned list of participation eligibility statuses, and broadcasts the system public parameters, management public key, initial global model, and the current version number of the versioned list of participation eligibility statuses to the RSU and vehicle nodes; the RSU and the vehicle nodes generate their respective local key pairs based on the system public parameters.

[0008] Step S2, Local Training and Mask Gradient Generation: In the current collaborative training round, the vehicle node performs local training based on the received global model to obtain a local gradient update, and negotiates a session key with the RSM. The vehicle node derives a one-time mask seed using the session key and the current version number of the versioned participation eligibility status list as input factors, generates a random mask matrix, and adds the local gradient update to the random mask matrix to obtain the mask gradient. The vehicle node generates a signature for the message containing the mask gradient and the current version number of the versioned participation eligibility status list, encapsulates it as a local update message, and uploads it to the corresponding RSU.

[0009] Step S3, RSU side authentication and forwarding: The RSU performs pre-screening and signature verification of the received local update message based on the versioned participation qualification status list issued in the previous round; without restoring the actual local gradient update of the vehicle node, the verified mask gradient and vehicle abnormal status information are signed and forwarded to the RSM.

[0010] Step S4, RSM-side controlled demasking, anomaly detection, and credit assessment: The RSM verifies the messages forwarded by the RSU. If the preset controlled demasking trigger condition is met, it reconstructs a random mask matrix synchronously with the corresponding vehicle node using the current version number of the versioned participation eligibility status list as one of the input factors. Controlled demasking is then performed on the corresponding mask gradient to restore the true local gradient updates of each vehicle node. The RSM performs anomaly detection on the restored true local gradient updates to determine the valid vehicle set and corresponding anomaly evidence. The RSM updates the participation eligibility status of each vehicle node by combining the anomaly evidence and the vehicle anomaly status information, incrementing the version number of the versioned participation eligibility status list, and generating a versioned participation eligibility status list for the next round.

[0011] Step S5, Direct Aggregation of Real Gradients and Global Model Update: The RSM directly performs an aggregation operation on the real local gradient updates corresponding to each vehicle node in the effective vehicle set to obtain the real aggregated gradient of the current round, and updates the global model based on the real aggregated gradient; The RSM broadcasts the updated global model and the versioned participation eligibility status list for the next round to the RSU and vehicle nodes to enter the next round of collaborative training.

[0012] Further, in step S2, the vehicle node inputs the session key, the current round identifier, the vehicle pseudo-identity identifier, and the current version number of the versioned participation qualification status list into a pseudo-random function with one-way and avalanche effects to derive the one-time mask seed. When the current version number of the versioned participation qualification status list is inconsistent with the version number used by the vehicle node, the random mask matrices reconstructed by both parties do not match, resulting in an abnormal gradient after controlled demasking. The abnormal gradient is identified in the anomaly detection and generates anomaly evidence, triggering the update of the participation qualification status quantity, thus forming a closed-loop binding mechanism between participation qualification control and underlying cryptography.

[0013] Furthermore, the preset controlled demasking triggering conditions include the following conditions that must be met simultaneously: the signature verification of the RSU forwarding message is successful, the round identifier is consistent with the current collaborative training round, the version number of the versioned participation qualification status list meets the current valid version requirements, the vehicle pseudo identity is not in a revoked state, and the mask commitment value is consistent with the uploaded message.

[0014] Furthermore, in step S4, the anomaly detection employs a multi-candidate screening mechanism based on distance scores: calculating the Euclidean distance between the true local gradient update of each vehicle node and other vehicle nodes, and selecting the nearest candidate for each vehicle node. The sum of the Euclidean distances to each of the three neighbors is used as the final distance score, where satisfy , This represents the total number of vehicle nodes within the system. The number of malicious vehicle nodes that the system can tolerate; sorted by score from lowest to highest, the lowest-scoring nodes are listed first. Each vehicle node is assigned to the valid vehicle set, and vehicle nodes whose scores exceed the preset abnormal threshold are recorded as abnormal vehicle nodes.

[0015] Furthermore, in step S5, the direct execution of the aggregation operation can be performed using an arithmetic average method, or by allocating aggregation weights based on the adaptive credit value, historical contribution, or local data volume of each vehicle node for weighted summation.

[0016] This invention also provides the above-mentioned privacy-preserving zero-trust security aggregation method, applied to the trusted management entity RSM and the semi-honest forwarding and authentication entity RSU in a collaborative training system, including:

[0017] The RSM generates system public parameters, management key pairs, and a versioned list of participation eligibility statuses, and broadcasts the system public parameters, management public key, initial global model, and the current version number of the versioned list of participation eligibility statuses to vehicle nodes and the RSU within the system.

[0018] The RSU receives local update messages uploaded by multiple vehicle nodes, performs pre-screening and batch signature verification of the vehicle nodes' participation eligibility based on the versioned participation eligibility status list, and forwards the verified mask gradient and vehicle abnormal status information to the RSM after signing without restoring the real local gradient update.

[0019] After the preset controlled demasking triggering condition is met, the RSM synchronously reconstructs the random mask matrix with the current version number of the versioned participation qualification status list as one of the input factors, and performs controlled demasking on the mask gradient to restore the true local gradient update of each vehicle node.

[0020] The RSM performs anomaly detection on the real local gradient update after recovery, determines the valid set of vehicles and corresponding anomaly evidence, and updates the participation qualification status of each vehicle node in combination with the vehicle anomaly status information and increments the version number to generate a versioned participation qualification status list for the next round.

[0021] The RSM directly performs an aggregation operation on the real local gradient updates corresponding to the valid vehicle set to obtain the latest global model, and then distributes the latest global model and the versioned participation eligibility status list for the next round.

[0022] This invention also provides the above-mentioned privacy-preserving zero-trust secure aggregation method, applied to vehicle nodes in a collaborative training system, comprising:

[0023] Receive the system public parameters, management public key, global model, and current version number of the versioned participation eligibility status list broadcast by the trusted management entity RSM, and generate a local key pair based on the system public parameters;

[0024] The global model is trained based on the local dataset to obtain local gradient updates, and the session key is obtained by performing key negotiation with the management terminal public key using the local session private key;

[0025] A one-time mask seed is derived using the session key and the current version number of the versioned participation eligibility status list as input factors. A random mask matrix is ​​generated using a pseudo-random number generator. The local gradient update is added to the random mask matrix to obtain the mask gradient.

[0026] A signature is generated for the message containing the mask gradient and the current version number of the versioned participation eligibility status list, forming a local update message and uploading it to the semi-honest forwarding and authentication entity RSU. The RSU performs participation eligibility pre-screening and batch signature verification without restoring the real local gradient update. The RSM performs controlled demasking, anomaly detection based on the real local gradient update, participation eligibility status quantity update, and direct aggregation operation after the preset controlled demasking trigger condition is met.

[0027] Beneficial effects: Compared with the prior art, the advantages of the present invention are as follows:

[0028] (1) The current version number of the versioned participation eligibility status list is used as one of the input factors of the pseudo-random function. When a malicious vehicle is disqualified, the RSM increments the version number to generate a new versioned participation eligibility status list. Even if the malicious vehicle bypasses the edge pre-screening of RSU, the random mask matrix derived from the expired version number will inevitably not match the random mask matrix synchronously reconstructed by the RSM side based on the latest version number. The abnormal gradient generated after controlled demasking has an abnormally high Euclidean distance score with the normal gradient. It is automatically identified and abnormal evidence is generated in the anomaly detection in step S4, which further triggers the update of the participation eligibility status quantity. This mechanism ensures that the security property of "any subsequent submission of a disqualified vehicle cannot pass the gradient quality review at the aggregation end" is guaranteed by cryptography, rather than relying solely on access control at the logic layer. Compared with the existing technology that only performs revocation control at the business logic layer, this invention can eliminate the security risk of malicious vehicles continuing to participate in aggregation after bypassing the edge authentication node.

[0029] (2) The RSU is positioned as a semi-honest forwarding and authentication entity that cannot recover the true local gradient update. The RSU only holds zero-knowledge proof verification credentials and does not hold the session key required to perform demasking. This isolates the privacy snooping capabilities of intermediate nodes from the key holding level. At the same time, the RSM, as a trusted management entity, can only perform controlled demasking after the preset controlled demasking trigger conditions are met, and performs anomaly detection and credit evaluation on the recovered true local gradient update. This layered trust design ensures that no intermediate node can recover the true local gradient update during the entire gradient transmission process from RSU to RSM, while the RSM can perform a complete quality audit on the true gradient.

[0030] (3) Since five controlled demasking triggering conditions must be met simultaneously—RSU signature verification passed, round identifier consistent, version number valid, vehicle pseudo-identity not revoked, and mask commitment value consistent—RSM refuses to execute controlled demasking for any message that fails any of these verifications, thus blocking subsequent gradient recovery and aggregation processes with a single verification failure. Compared to traditional aggregation schemes that rely on only a single authentication, the multi-dimensional verification mechanism of this invention exponentially increases the difficulty for attackers to bypass all verification dimensions simultaneously, significantly improving the system's comprehensive defense capability against multiple types of attacks without increasing additional communication rounds.

[0031] (4) The design of directly embedding zero-knowledge signature verification into the normal gradient upload process and integrating RSU-side batch signature verification and RSM-side multidimensional consistency verification into a single message transmission process eliminates the need for any additional interaction rounds during the online collaborative training phase. Compared to schemes that independently superimpose traditional zero-trust authentication mechanisms into the federated learning process (which typically require additional challenge-response handshakes), this invention reduces the number of communication round trips in the online phase to the same level as ordinary federated learning schemes while maintaining the same level of security, effectively adapting to the dynamic characteristics of vehicle networks with high-speed vehicle movement and fluctuating communication bandwidth. Experiments show that the computational and communication overhead in the online phase increases linearly with the number of vehicles participating in the system, and the key generation overhead in the establishment phase is a one-time offline operation that has no impact on online training efficiency.

[0032] (5) The mechanism by which the RSU signs the timeout evidence with its signature key, including the vehicle node pseudo-identity identifier, the current round identifier, and the timeout time, possesses cryptographic non-repudiation and can be used as an objective basis for determining disconnection behavior in the credit assessment process. Compared to the existing schemes that rely solely on the server to determine communication anomalies, the timeout evidence of this invention is generated and endorsed by the RSU with an independent signature key, making the basis for determining disconnection behavior verifiable. Compared to existing technologies, this reduces the false judgment rate caused by network jitter and provides an auditable chain of evidence for subsequent credit assessment.

[0033] (6) The system incorporates both timeout evidence (communication layer anomalies) generated by RSU and anomalous evidence (model layer anomalies) generated by RSM into the adaptive credit score calculation. It also assigns different weighted penalty coefficients to disconnection behavior, targeted attack behavior, and non-targeted attack behavior. This mechanism integrates two independent dimensions—communication reliability and gradient quality—into the system's trust assessment of vehicle nodes. Compared to existing designs that assess node trust based on only a single dimension, the dual-source evidence-driven mechanism of this invention understandably reduces trust assessment bias caused by missing information in a single dimension, allowing the credit score to more accurately reflect the overall behavioral quality of vehicle nodes.

[0034] (7) After performing controlled demasking in step S4, RSM directly performs aggregation operations on the real local gradient updates corresponding to the valid vehicle set in step S5, instead of performing summation on the mask gradients and then uniformly subtracting the sum of the random matrix, as is the traditional SecAgg-style aggregation process. After completing the anomaly screening, this invention directly reuses the real gradients recovered in step S4, eliminating a complete mask summation operation and the corresponding demasking operation. Compared with existing SecAgg-like schemes, this invention reduces the computational time complexity of the server in each round of aggregation, and in scenarios with a large number of participating vehicles, it can be understood to reduce the computational time of a single round of aggregation on the server.

[0035] This invention constructs a deep physical binding mechanism between business layer access control and underlying cryptographic primitives by incorporating the version number of the versioned participant eligibility status list into the input chain of cryptographic primitives. This ensures that any change in participant eligibility status is automatically propagated to the unreproducibility of the underlying mask matrix. Controlled demasking triggering conditions and anomaly detection mechanisms work together to ensure that even messages authenticated by RSU still undergo multi-dimensional verification and gradient quality review by RSM. Timeout evidence and anomalous evidence are independently generated and signed by RSU and RSM respectively, jointly driving the dynamic update of adaptive credit values, forming a closed-loop security architecture with four interconnected layers: "communication layer awareness + model layer review + credit layer evaluation + cryptographic layer binding." This overall synergistic effect allows the system to maintain the convergence accuracy of the global model even under extreme conditions where the proportion of malicious vehicles reaches the tolerance limit, while ensuring that any submissions from unauthorized nodes cannot substantially affect the global model. Without introducing additional interaction rounds, it achieves an organic unity of continuous authentication auditing, privacy protection, anomalous node suppression, and training efficiency. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the architecture of the present invention;

[0037] Figure 2 This is a flowchart illustrating the implementation of the present invention;

[0038] Figure 3 This is a diagram of the three-layer zero-trust mechanism of the present invention;

[0039] Figure 4 This is a schematic diagram of the physical topology of the training rounds of the present invention. Detailed Implementation

[0040] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the embodiments described.

[0041] Example 1: The zero-trust security aggregation method for privacy protection in the Internet of Vehicles scenario proposed in this example is applied to a two-layer collaborative training architecture consisting of RSM (Trusted Management Entity), RSU (Semi-honest Forwarding and Authentication Entity), and vehicle nodes.

[0042] like Figure 1 As shown, the system is divided into logical modules:

[0043] (1) Vehicle Node: Includes modules such as local dataset, local gradient calculation, and gradient mask generation. As a participating node in collaborative training, the vehicle is responsible for training the model using local data, calculating gradient updates, performing mask processing, and generating zero-knowledge signatures for uploading.

[0044] (2) RSU side: Includes modules such as signature verification and timestamp checking. The RSU is deployed along the road. As a semi-honest entity, it cannot recover the original gradient of the vehicle. It is only responsible for verifying the legitimacy of the vehicle based on the timestamp and zero-knowledge proof certificate, and forwarding the verified mask gradient to the RSM.

[0045] (3) RSM side: It is mainly responsible for generating system parameters, negotiating keys with vehicles, controlling demasking to recover vehicle gradient updates, identifying abnormal vehicles, calculating vehicle credit values, and also has modules for RSU signature verification, abnormal vehicle identification, adaptive trust assessment, and updating and broadcasting the global model. RSM is not only responsible for aggregating and generating the latest global model, but also has system auditing and trust management capabilities.

[0046] like Figure 4 As shown, from the perspective of physical network topology, the upper layer is the server side, and the lower layer is the vehicle side. The upper-layer entities are the RSM and RSU, which communicate with each other via wired channels. The lower-layer entities are the vehicle nodes, which communicate with the upper-layer entities wirelessly. The server side is divided into multiple regions (e.g., region A, region D, etc.), each region deploying edge node RSUs. Multiple RSUs are connected to a unified cloud or regional management terminal RSM via wired communication. The vehicle side constitutes an in-vehicle ad hoc network, in a dynamic mobile state, and the vehicles interact with passing RSUs via wireless communication (e.g., C-V2X or 5G networks).

[0047] Example 2: The cryptographic primitives used in this implementation include a key agreement protocol, a pseudo-random number generator, and a zero-knowledge proof signature mechanism. The key agreement protocol includes the parameter generation algorithm KA.param(), the key generation algorithm KA.gen(), and the shared key agreement algorithm KA.agree(); the pseudo-random number generator PRG is used to generate a random matrix for the gradient mask based on the short random seed obtained through negotiation; the zero-knowledge proof signature mechanism is used for vehicles to sign the mask gradient, and RSU and RSM perform step-by-step verification to ensure continuous authentication without leaking gradient privacy.

[0048] The aggregation protocol in this invention comprises two parts: an establishment phase and an online phase. The establishment phase is a one-time offline process; the online phase is repeated in each round of collaborative training iterations. The online phase further includes a masking step and an aggregation step: in the masking step, the vehicle trains a local model, calculates local gradients, masks the local gradients, and generates a signature; in the aggregation step, RSU verifies the vehicle and forwards the verified gradients, RSM further verifies the RSU, identifies abnormal vehicles, performs demasking aggregation, and updates the global model. This design achieves a combination of zero-trust mechanism and privacy-preserving collaborative training aggregation process without adding extra interaction rounds, specifically including the following steps:

[0049] Step S1: System Initialization

[0050] The RSM generates system common parameters and broadcasts these parameters, along with the initial global model for collaborative training, to the RSUs and vehicles. The RSM acts as a trusted management entity, responsible for generating common parameters, key negotiation, vehicle authentication, identifying abnormal vehicles, and updating the global model. The RSU, a semi-honest forwarding and authentication entity, cannot recover the original gradient updates from vehicles; it receives and verifies model updates uploaded by vehicles, performs signature verification, and forwards valid gradients to the RSM. Vehicles are responsible for local training, calculating local gradients, and uploading masks and signatures. After receiving the common parameters generated by the RSM, vehicles generate group key pairs and session key pairs. The RSUs, upon receiving the common parameters, generate corresponding group key pairs, thus completing registration before collaborative training aggregation. Furthermore, this system employs a two-layer vehicular network collaborative training architecture. The upper layer includes the RSM and RSUs, while the lower layer includes multiple vehicles as collaborative training participants. The RSM and RSUs communicate via a wired channel, while vehicles interact with the RSUs / RSMs wirelessly.

[0051] Step S2: Local Training and Mask Gradient Generation

[0052] In the During wheel-to-wheel collaborative training, the vehicle receives the current global model. The model is trained based on the local dataset, and gradient updates are obtained. The vehicle further negotiates the session key with the RSM side to obtain the session key generation random matrix. The random matrix is ​​then used to mask the local gradient update, resulting in the masked local gradient. The vehicle then generates a zero-knowledge signature for the local gradient behind the mask and sends it to the RSU along with the upload message.

[0053] Step S3: RSU-side authentication and forwarding

[0054] After receiving local upload messages from multiple vehicles, the RSU checks the validity of the timestamps in the messages and performs batch verification of vehicle signatures based on a zero-knowledge verification algorithm. For vehicle mask gradients that pass verification, the RSU retains them as a valid gradient set and forwards this valid gradient set to the RSM. During the aggregation process, the RSU collects at least [data from...]. The system processes messages from each vehicle and terminates the current round if a sufficient number of messages are not received within a preset timeout period. Vehicles that fail to upload their local gradients on time are considered offline vehicles. The RSU will compile a valid gradient set from the verified vehicle mask gradients, sign the valid gradient set, and send it to the RSM.

[0055] Step S4: Controlled demasking on the RSM side, anomaly detection, and credit assessment

[0056] After receiving the valid gradient set forwarded by the RSU, the RSM first verifies the RSU signature. Then, the RSM recovers the shared session key corresponding to each vehicle, generates the corresponding random matrix, and performs controlled demasking on the mask gradient of each vehicle to obtain the gradient update of the corresponding vehicle in the current round. The RSM then performs abnormal vehicle identification based on the recovered vehicle gradient update and performs adaptive trust evaluation based on the vehicle's response time and historical update performance to obtain the credit value of each vehicle. When the vehicle credit value is lower than a preset threshold, the vehicle is revoked, preventing it from passing the subsequent authentication process performed by the RSU. The RSM sends the updated vehicle credit status information, the list of revoked vehicles, or the set of trusted vehicles to the RSU for use in subsequent rounds of authentication screening.

[0057] Step S5: Direct aggregation of true gradients and global model update

[0058] RSM generates corresponding session keys and random matrices for each valid vehicle. It sums the mask gradients corresponding to the set of valid vehicles after anomaly detection to obtain the mask aggregation result. RSM further uses the random matrices corresponding to each valid vehicle to perform mask demasking to obtain the global model for the current round. RSM broadcasts the updated global model to the valid vehicles in the current round, enabling each vehicle to enter the next round of collaborative training based on the latest global model.

[0059] Combination Figure 2 (Implementation flowchart) and Figure 3 (Three-layer zero-trust mechanism diagram) This invention embeds a zero-trust mechanism into the collaborative training aggregation process, with the core idea of ​​"never trusting, always verifying." In each round of training, no participant is pre-assuming trustworthiness. Instead, through continuous authentication, abnormal vehicle identification, and adaptive trust evaluation, vehicles participating in collaborative training are continuously monitored and dynamically re-evaluated to achieve effective vehicle selection, abnormal vehicle removal, and reliable global model updates. The specific protocol flow includes a setup phase (a one-time offline process) and an online collaborative training phase (executed in each iteration). The detailed steps are as follows: Example 3: Step S1, System Initialization

[0060] S1.1, RSM generates system common parameters and management key pair

[0061] RSM selects security parameters ,run Generate system common parameters, among which For large prime numbers, For model In the sense of a generator, this public parameter serves as the fundamental parameter for each entity within the system to perform subsequent key generation, key negotiation, and gradient privacy protection processing.

[0062] RSM operation Generate a management key pair, where For the management public key, For the management terminal's private key, Used for subsequent key negotiation by vehicle nodes. Saved locally by RSM.

[0063] S1.2, RSM Initialize Versioned Participation Eligibility Status List

[0064] RSM initializes a versioned list of participation eligibility statuses. Record the pseudo-identity identifiers of all legitimate vehicle nodes in the current round. and the current global list version number (Initial value) The version number of the versioned list of participation eligibility statuses increments each time the participation eligibility status changes (vehicle nodes are disqualified or re-included), and the change in the version number directly affects the derivation result of the underlying mask matrix.

[0065] S1.3, RSM broadcast initialization information

[0066] RSM will use system common parameters Management public key Collaborative training of the initial global model List of current versioned participation eligibility statuses and the current round identifier (initial round) The broadcast is sent to all RSUs and vehicle nodes within the system.

[0067] S1.4, Vehicle Node and RSU generate local key pairs

[0068] The vehicle and RSU each generate their respective required key pairs, and each vehicle node... Upon receiving public parameters Then, vehicle verification key pairs are generated respectively. : Used for subsequent zero-knowledge proof signatures, where To prove the private key, For the corresponding public key; vehicle session key pair : Used to perform key negotiation with RSM, where For session private key, This is the session public key; the vehicle node will use its own session public key. and vehicle fake identification tags Register with RSM and complete the collaborative training registration.

[0069] Each RSU receives system common parameters. Then, an RSU signature key pair is generated. This is used to sign and endorse the edge verification set and timeout evidence for subsequent forwarding, ensuring the non-repudiation of the evidence chain. RSU registers its own signing public key with RSM.

[0070] Each entity completes system registration and pre-training preparations, providing a foundation for session key negotiation and gradient masking in the online phase; after completing the distribution of common parameters and the generation of key pairs for each entity, the system initialization phase ends; among them, RSU and vehicles complete registration with RSM, and the generated group key pairs are used for subsequent zero-knowledge signature and identity authentication processes, while session key pairs are used for key negotiation with RSM in the online phase.

[0071] In step S1, in addition to generating the usual common parameters In addition, RSM will initialize a versioned list of participation eligibility statuses, which records the pseudo-identity of currently legitimate vehicles and the current global round version number. After receiving the parameters, the vehicle node not only generates a vehicle session key pair for session key negotiation, but also a vehicle proof key pair for zero-knowledge proof signing. Since the RSU is a semi-honest entity, the RSU also generates an RSU signature key pair to endorse subsequently forwarded evidence and messages, ensuring the non-repudiation of the evidence chain.

[0072] Example 4: Step S2, Local Training and Mask Gradient Generation

[0073] S2.1, Local Model Training

[0074] The vehicle receives the current global model and performs local training, in the... During wheel-to-wheel collaborative training, the vehicle receives the current global model. Based on local dataset After completing model training, the local gradient update is calculated:

[0075]

[0076] in Train the loss function for the model. The vehicle nodes do not send raw data to any external entities. and plaintext gradient .

[0077] S2.2 Key Negotiation and Session Key Calculation

[0078] To avoid privacy breaches, vehicles do not send raw data and gradients to external systems. Vehicle node Using its own session private key Public key of the RSM management terminal Perform the key negotiation protocol to calculate the shared session key known only to the vehicle and the RSM: ,in, This represents the public key used for session key negotiation on the RSM side.

[0079] Due to the symmetry of key negotiation, RSM can also use its management private key. With vehicle nodes Session public key Calculate the same shared session key: This ensures that the RSM side can synchronously derive a one-time mask seed.

[0080] S2.3, One-time mask seed derivation

[0081] Vehicle node The following parameters are input into a pseudo-random function with unidirectional and avalanche effects to derive the one-time mask seed for the current round. :

[0082]

[0083] in To share session keys, This serves as the identifier for the current round. For vehicle false identification, This refers to the version number of the current version of the participation eligibility status list. This indicates string concatenation. In a preferred embodiment, a preset mask field can also be separated and identified. As a fifth input factor, it isolates different key derivation scenarios and prevents key reuse attacks:

[0084] Due to the avalanche effect of pseudo-random functions, when When changes occur (i.e., the version number increments), even if other input factors remain unchanged. The output will also produce completely different results, which will inevitably lead to a mismatch between the random mask matrix derived from the expired version number and the random mask matrix reconstructed on the RSM side.

[0085] S2.4 Random Mask Matrix Generation and Additive Mask Operations

[0086] Vehicle node One-time mask seed Input to a pseudo-random number generator (PRG) to generate local gradient updates. Consistent dimension random mask matrix : Since PRG is a deterministic algorithm, the same seed input will generate a consistent random bit stream, ensuring synchronous demasking on the subsequent RSM side.

[0087] The vehicle node performs an additive masking operation on its local gradient update and the random mask matrix to obtain the mask gradient:

[0088]

[0089] At this point, even if the data is intercepted during transmission, the attacker can only obtain the data after it has been randomly masked, and cannot reconstruct the true gradient. .

[0090] S2.5 Local Update Message Encapsulation and Signature

[0091] Vehicle node Constructing a mask commitment value (in (For cryptographic hash functions), and encapsulate the following into a complete local update message structure: mask gradient Current round identifier False vehicle identification System timestamp Version number of the current version of the participation eligibility status list and mask commitment value .

[0092] The vehicle node uses the vehicle proof key to generate a zero-knowledge signature on the complete message structure described above. :

[0093]

[0094] Combine the complete message structure with the signature Encapsulate them together as a local update message Upload to the corresponding RSU. Mask commitment value The introduction of this feature enables RSM to verify the integrity of the mask gradient before controlled demasking, preventing intermediate nodes from tampering with the mask gradient.

[0095] From a safety analysis perspective, let the total number of vehicles be... Honest vehicles are a collection of malicious vehicles are aggregated as ,satisfy , The global gradient is denoted as Then honest vehicle The uploaded gradient satisfies: ,in Indicates vehicle The deviation term of the uploaded gradient relative to the global gradient. The upper bound of the deviation is represented; malicious vehicles can submit any vector. This model describes the basic assumptions about the gradient update behavior of normal and malicious vehicles. Example 5: Step S3, RSU-side authentication and forwarding

[0096] S3.1 Message Gathering and Timeout Evidence Generation

[0097] In the current collaborative training round, RSU operates within the preset timeout period. The system is waiting to collect local update messages uploaded by registered vehicle nodes. If the RSU is in... No data received from a certain registered vehicle node. If a local update message is received, the RSU will generate a pseudo-identity identifier for that vehicle node. Current round identifier and timeout Evidence of timeout:

[0098]

[0099] RSU uses the RSU signature key pair Sign the timeout evidence:

[0100] This makes the evidence of timeout cryptographically non-repudiable and can serve as an objective basis for determining disconnection behavior.

[0101] S3.2, Pre-screening of eligibility

[0102] RSU obtains the versioned participation eligibility status list (including the current valid version number) issued by the previous round RSM. (and a list of pseudo-identities for revoked vehicle nodes), and perform the following pre-filtering on each received local update message:

[0103] Check the timestamp carried in the message Is it within the current valid time window?

[0104] Check if the version number of the versioned participation eligibility status list carried in the message is the currently valid version number;

[0105] Check the vehicle's fake identification carried in the message. Is it in a cancelled state?

[0106] Messages that fail any check are discarded at the edge and do not proceed to the subsequent signature verification process, saving uplink bandwidth and verification computing resources.

[0107] S3.3 Batch Zero-Knowledge Signature Verification

[0108] RSU performs batch zero-knowledge signature verification on messages that pass the pre-qualification screening:

[0109]

[0110] Messages that pass verification are considered valid gradient messages for the current round, while messages that fail verification are discarded. The batch verification mechanism leverages the batch operation characteristics of elliptic curve cryptography, significantly reducing the computational overhead of RSU compared to message-by-message verification. Because RSU uses a zero-knowledge signature verification algorithm, while verifying message authenticity, RSU structurally cannot recover the true local gradient update of the vehicle node from the mask gradient.

[0111] Since the RSU is considered a semi-honest entity in the system, this invention does not assume that the RSU is not fully trustworthy. After completing the verification of the vehicle's gradient signature, the RSU still needs to undergo further verification of its signature and forwarding behavior by the RSM, thereby achieving two-stage continuous authentication under a zero-trust architecture. Figure 3 As shown, in dynamic vehicle networking, if the RSU does not receive enough messages within the preset timeout period, the vehicle that fails to upload on time is directly regarded as a "disconnected vehicle"; the RSU obtains the latest "revoked vehicle list" issued by the RSM side in the previous round; if "vehicle 2" has been marked as a malicious vehicle and its qualification has been revoked, the RSU will directly block its connection on the edge side and refuse its participation in this round of aggregation.

[0112] S3.4 Edge Verification Set Assembly and Signature Forwarding

[0113] RSU will verify the mask gradient. The edge verification set consists of the corresponding metadata (vehicle pseudo-identity identifier, wheel identifier, version number, and verification result). Together with the timeout evidence set signed with the RSU private key, the data is assembled into a forwarding message, and the entire message is signed with the RSU signing key:

[0114]

[0115] RSU will assemble a valid gradient set from the verified vehicle mask gradients, sign the set, and send it to RSM. Upon receiving the set, RSM will verify the RSU signature and further perform abnormal vehicle identification, credit assessment, demasking aggregation, and global model update.

[0116] In step S3, the RSU checks whether the timestamp in the message is within the current validity window, and whether the status list version number carried in the message is correct. Whether it is up-to-date, if a vehicle uploads an expired version number or has been disqualified, the RSU directly discards its message at the edge, saving uplink bandwidth; if the RSU does not receive a message from a registered vehicle within a preset timeout period, the RSU generates a corresponding "timeout evidence" and signs the timeout evidence with the RSU private key as a record of the unstable state of the vehicle node in the current round of the network; the RSU performs batch verification of the pre-screened messages using zero-knowledge signatures, and sends the verified mask gradients and corresponding metadata to the RSM along with the timeout evidence to form an "edge verification set".

[0117] Example 6: Controlled demasking, anomaly detection, and credit assessment on the RSM side (detailed implementation of step S4)

[0118] S4.1 Signature verification of RSU forwarded messages

[0119] After receiving the message forwarded by the RSU, the RSM first signs the RSU. Verification is performed to confirm that the forwarding behavior of the RSU has not been tampered with, thus achieving continuous auditing of the RSU of semi-honest entities under a zero-trust architecture. Only after the RSM verifies the RSU signature can the subsequent controlled demasking trigger condition verification process proceed.

[0120] S4.2 Controlled Demasking Trigger Condition Verification

[0121] RSM performs the following five consistency checks sequentially on each vehicle node message in the edge verification set. All five conditions must be met simultaneously before controlled demasking can be performed on the mask gradient of that vehicle node:

[0122] Condition ①: The signature verification of the RSU forwarded message has passed (already completed in S4.1);

[0123] Condition ②: The round identifier in the message is consistent with the current RSM collaborative training round;

[0124] Condition ③: The version number of the versioned participation eligibility status list in the message meets the current valid RSM version requirement (i.e. (Consistent with the latest version number maintained by RSM).

[0125] Condition 4: The vehicle's fake identity in the message It is not in the undo state of RSM maintenance;

[0126] Condition 5: The mask commitment value in the message With mask gradient The hash values ​​are consistent, that is .

[0127] For any vehicle node message that does not meet any of the conditions, RSM refuses to perform controlled demasking, marks the message as invalid and records it, and excludes it from subsequent anomaly detection and aggregation processes.

[0128] S4.3 Controlled demasking to recover the true gradient

[0129] For vehicle nodes that pass all five trigger condition checks RSM and vehicle node Using the same input factor, a one-time mask seed is synchronously derived and a random mask matrix is ​​reconstructed:

[0130]

[0131]

[0132]

[0133] RSM performs controlled demasking on the mask gradient to recover the vehicle nodes. Real-world gradient updates:

[0134]

[0135] Handling of version number mismatch anomalies: If a malicious vehicle node bypasses RSU pre-screening (e.g., by forging a message that passes timestamp verification), but uses an expired version number. If a derived mask seed is used, then RSM uses the currently valid version number. Reconstructed random mask matrix Use with malicious vehicles generated Completely different; the gradient generated after controlled demasking This is a meaningless anomalous gradient. In subsequent anomaly detection based on distance score, this anomalous gradient is automatically removed because its distance score is abnormally high compared to the gradient updates of other vehicle nodes, thus forming a closed-loop binding mechanism between participation eligibility control and underlying cryptography.

[0136] S4.4, Multi-candidate anomaly detection based on distance score

[0137] RSM performs distance-score-based multi-candidate anomaly detection on the true local gradient updates of all vehicle nodes after recovery.

[0138] For each vehicle node RSM computes its true local gradient update. True local gradient updates with all other vehicle nodes ( Euclidean distance between them:

[0139]

[0140] Select the nearest node for each vehicle The sum of the Euclidean distances of the vehicle node to its neighbors is used as the final distance score. :

[0141]

[0142] in Represents vehicle node of The nearest neighbor set satisfy In a preferred embodiment, take ,in This represents the total number of vehicle nodes within the system. This parameter represents the number of malicious vehicle nodes the system can tolerate. Setting this parameter ensures that the nearest neighbor set of honest vehicle nodes does not contain malicious vehicle nodes, thus enabling the distance score calculation to detect malicious updates.

[0143] RSM sorts all vehicle nodes from lowest to highest based on their final distance score, and then selects the nodes with the lowest scores. The actual local gradient updates corresponding to each vehicle node are included in the candidate honest update set, forming the effective vehicle set. Vehicles that did not enter the valid vehicle set and whose final distance score exceeded the preset abnormal threshold will be excluded. The vehicle node was identified as an abnormal vehicle node, and abnormal evidence containing a false vehicle identity identifier and an anomaly type label was generated. .

[0144] Anomaly type determination: Abnormal behavior is classified based on the distribution of distance scores: If a vehicle node has an extremely high distance score (significantly deviating from the normal distribution, such as a targeted attack by poisoning gradients in a specific direction), it is classified as a targeted attack; if the distance scores of multiple abnormal vehicle nodes are relatively dispersed (such as random noise injection), it is classified as a non-targeted attack. Different penalty coefficients are assigned to the two types of abnormal behavior for subsequent adaptive credit score calculation.

[0145] S4.5 Adaptive Credit Score Calculation and Participation Eligibility Status Update

[0146] RSM for each vehicle node Calculate its adaptive credit score From the positive feedback part and negative feedback section constitute:

[0147] in Forgetting factor ( This is used to control the rate at which historical behavior diminishes the current credit score; These are group weighting coefficients used to adjust the relative weights of positive and negative feedback. They can be increased when a more stringent penalty strategy is required. .

[0148] Positive feedback part The calculation method is as follows:

[0149] in For vehicle nodes In the most recent unit of time The number of valid updates submitted within the period. For the first The contribution score corresponding to each valid update is determined by the final distance score. After normalization or reverse mapping, the result is obtained (the lower the distance score, the higher the contribution score). If a vehicle node remains active and submits valid updates within a certain time period, its positive feedback value increases accordingly; if it does not submit gradients, the system does not directly reduce its positive feedback value, but instead adjusts it based on the number of valid updates within the time window. Natural decay.

[0150] negative feedback section The calculation method is as follows:

[0151]

[0152] in For vehicle nodes Total number of abnormal behaviors that occurred The current time unit is used. For the first The time unit corresponding to the occurrence of this abnormal behavior In order to be with the first Sub-abnormal behavior type The corresponding penalty coefficients. The penalty coefficients for the three types of abnormal behavior are as follows:

[0153] Disconnection penalty coefficient Based on the signed timeout evidence generated by the RSU;

[0154] Penalty coefficient for targeted attacks ( ): Based on the anomalous evidence generated by RSM and the distribution of distance scores;

[0155] Non-targeted attack behavior penalty coefficient ( ): Identification of anomalous evidence generated by RSM.

[0156] The three types of penalty coefficients have different weights to distinguish the different degrees of impact of proactive attack behavior and disconnection behavior caused by network instability on the quality of the global model.

[0157] S4.6, Update of eligibility status and increment of version number

[0158] When vehicle node Adaptive credit score Below the preset credit threshold At that time, RSM determines the vehicle node as an unreliable node and performs a revocation of its participation qualification: removing its pseudo-identity identifier. Record the revocation in the versioned list of participation eligibility statuses and increment the version number of the versioned list of participation eligibility statuses: The incrementing version number changes the one-time mask seed derived from all honest vehicle nodes in the next round. If a withdrawn vehicle node tries to rejoin using an old version number, its mask matrix will not match the RSM side, forming the aforementioned closed-loop binding mechanism.

[0159] RSM will send the updated versioned list of eligibility status (including the new version number) to the relevant RSUs for use in the next round of eligibility pre-screening.

[0160] Example 7: Direct aggregation of real gradients and global model update (detailed implementation of step S5)

[0161] S5.1, Direct Aggregation of Real Gradients

[0162] RSM is based on the valid vehicle set determined in step S4. Obtain the set of valid vehicles. The actual local gradient update for each vehicle node. The actual local gradient update refers to... After the RSM meets the preset demasking triggering conditions in step S4, it performs controlled demasking to update the gradient obtained from the mask gradient uploaded by the corresponding vehicle node. The preset demasking triggering conditions include at least: successful signature verification of the RSU forwarding message, the round identifier being consistent with the current collaborative training round, the version of the participation qualification status list meeting the current valid version requirements, the vehicle pseudo-identity not being in a revoked state, and the mask commitment value being consistent with the uploaded message. The RSM updates the effective vehicle set... The actual local gradient update for each vehicle node. Perform the aggregation operation to obtain the true aggregate gradient for the current round. .

[0163] In one implementation, the true aggregate gradient The calculation process is as follows:

[0164]

[0165] in, Represents the set of valid vehicles The number of vehicle nodes in the system. Represents the vehicle nodes in the valid vehicle set. exist The corresponding local gradient update for each round.

[0166] In another implementation, RSM assigns aggregation weights to different vehicle nodes based on their credit score, historical contribution, or data volume, and calculates the true aggregation gradient according to the following formula:

[0167]

[0168] in, Represents vehicle node The aggregate weight is based on the adaptive credit value of each vehicle node. Historical contribution or local data volume determined, meeting the requirements Weighted average aggregation allows vehicle nodes with higher credit scores, stable historical contributions, or larger data volumes to have a greater impact on the update of the global model, further improving the quality of the aggregation results.

[0169] Compared to the traditional SecAgg-style aggregation scheme (which requires summing the mask gradients of all nodes and then uniformly demasking), the present invention has restored the true local gradient updates of each valid vehicle node in step S4, and directly reuses the restored gradients in step S5 to perform aggregation, eliminating a complete mask gradient summation operation and the corresponding random matrix summation and demasking operation.

[0170] S5.2 Global Model Update

[0171] RSM is based on the true aggregation gradient. Update the current global model , obtained the The latest global model of the wheel In one implementation, the latest global model is updated according to the following formula:

[0172]

[0173] Alternatively, when using gradient descent for updating, update according to the following formula:

[0174]

[0175] in, This indicates the model update step size.

[0176] S5.3, Broadcasting and the Next Iteration

[0177] RSM will update the global model The next round's versioned participation eligibility status list (including the new version number) is broadcast to all RSUs and vehicle nodes. Each vehicle node receives the latest global model, updates its local model, and proceeds to the next round based on the updated model. The training process involves multiple rounds of collaborative training. The entire training process continues until the model reaches the preset convergence criteria (such as convergence of validation set accuracy or reaching the preset maximum number of rounds). Example 8: System Performance Analysis

[0178] Communication overhead analysis: During the setup phase, the main overhead comes from broadcasting system public parameters and generating and registering key pairs for each entity. This is a one-time offline overhead and does not affect online training efficiency. During the online phase, in each iteration: vehicle nodes upload mask gradients and signature messages, increasing communication volume and gradient dimensions. and the number of participating vehicles Linear correlation; the communication volume of the RSU forwarding edge verification set is also linearly correlated; the communication volume of the RSM broadcast global model is... This scheme does not introduce any additional authentication handshake rounds during the online phase, and the number of communication round trips is the same as that of a typical federated learning scheme.

[0179] Computational overhead analysis: Vehicle node side: Each round requires one key negotiation (low overhead), one PRF calculation (low overhead), one PRG matrix generation (linearly related to gradient dimension), and one zero-knowledge signature (overhead depends on the signature scheme selection). RSU side: Batch zero-knowledge signature verification overhead is significantly reduced compared to individual verification, and the pre-screening operation overhead is negligible. RSM side: Each round executes... Subcontrolled demasking (linear), Euclidean distance-based anomaly detection ( (This can be optimized through an approximate nearest neighbor algorithm) and credit value updates (linear).

[0180] Experiments show that when the proportion of malicious vehicle nodes reaches Even when approaching the system's tolerance limit, the system can still maintain high global model accuracy. The version number cryptographic binding mechanism ensures that any subsequent commits to revoked vehicle nodes have no substantial impact at the aggregation level, giving the system strong resistance to persistent poisoning attacks.

[0181] In summary, this invention, by introducing continuous authentication, abnormal vehicle identification, adaptive trust assessment, and a mask-based secure aggregation mechanism into collaborative training for privacy protection in the Internet of Vehicles (IoV), achieves vehicle privacy protection, timely suppression of abnormal participants, and stable assurance of global model quality without increasing the number of additional interaction rounds. It is suitable for distributed learning tasks in IoV scenarios.

[0182] As described above, although the invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the invention itself. Various changes in form and detail may be made without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A zero-trust secure aggregation method for privacy protection in a vehicle-to-everything (V2X) scenario, constructed within a collaborative training system comprising a Trusted Management Entity (RSM), a Semi-Honest Forwarding and Authentication Entity (RSU), and several vehicle nodes, characterized in that... Includes the following steps: Step S1: The RSM generates system public parameters, management key pairs, and a versioned list of participation eligibility statuses and broadcasts them to the system; the RSU and vehicle nodes each generate local key pairs. Step S2: In the current collaborative training round, the vehicle node performs the following operations: It performs local training based on the received global model to obtain a local gradient update, and negotiates a session key with the RSM; it derives a one-time mask seed using the session key, the current round identifier, the vehicle pseudo-identity identifier, and the current version number of the participation qualification status list as input factors, generating a random mask matrix; it performs masking operations on the local gradient update and the random mask matrix to obtain the mask gradient, generates a signature for the message containing the mask gradient, encapsulates it as a local update message, and uploads it to the corresponding RSU; Step S3: The RSU performs pre-screening and signature verification of the received local update message based on the version of the participation qualification status list issued in the previous round; without restoring the real local gradient update, the verified mask gradient and vehicle abnormal status information are signed and forwarded to the RSM. Step S4: The RSM verifies the message forwarded by the RSU. If the preset controlled demasking triggering condition is met, it reconstructs the random mask matrix of the corresponding vehicle node, performs controlled demasking on the corresponding mask gradient to restore the true local gradient update of each vehicle node, and determines the valid vehicle set and corresponding anomaly evidence by performing anomaly detection. The anomaly evidence and the vehicle anomaly status information update the participation qualification status of each vehicle node and generate a versioned participation qualification status list for the next round. Step S5: The RSM directly performs an aggregation operation on the real local gradient updates corresponding to each vehicle node in the effective vehicle set to obtain the real aggregated gradient of the current round, and updates the global model based on the real aggregated gradient; the updated global model and the versioned participation eligibility status list for the next round are broadcast to the RSU and vehicle nodes to enter the next round of collaborative training.

2. The zero-trust secure aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario according to claim 1, characterized in that, In step S1, the RSM running parameter generation algorithm generates system common parameters containing prime number and cardinality features; the vehicle node generates a vehicle proof key pair for providing zero-knowledge proof and a vehicle session key pair for key negotiation based on the system common parameters; the RSU generates a corresponding RSU signature key pair based on the system common parameters for identity authentication and message forwarding endorsement. In step S2, the vehicle node uses the vehicle proof key to generate a zero-knowledge signature for the local update message; in step S3, the RSU uses a zero-knowledge signature verification algorithm to perform batch signature verification on messages that have passed the pre-screening for eligibility, so that the RSU cannot recover the vehicle node's true local gradient update while completing the message authenticity verification; in step S4, the RSM verifies the RSU signature of the message forwarded by the RSU to confirm that the forwarding behavior has not been tampered with, thereby achieving two-stage continuous authentication between the RSU side and the RSM side without introducing additional interaction rounds.

3. The zero-trust secure aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario according to claim 2, characterized in that, In step S2, the vehicle node inputs the session key, the current round identifier, the vehicle pseudo-identity identifier, the current version number of the participation qualification status list, and the preset mask field separation identifier into the key derivation function to calculate the one-time mask seed. Using the one-time mask seed as input, a pseudo-random number generator is used to generate a random mask matrix with the same dimension as the local gradient update. In step S4, the RSM and the corresponding vehicle node synchronously derive a one-time mask seed and reconstruct the random mask matrix using the same input factor. When the current version number of the versioned participation eligibility status list is inconsistent with the version number used by the vehicle node, the random mask matrices reconstructed by both parties do not match, resulting in an abnormal gradient after controlled demasking. The abnormal gradient is identified in the anomaly detection and generates anomaly evidence, triggering the update of the participation eligibility status quantity.

4. The zero-trust secure aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario according to claim 1 or 3, characterized in that, In step S3, when the RSU does not receive a local update message from the registered vehicle node within a preset timeout period, it generates timeout evidence containing the pseudo-identity identifier of the vehicle node, the current round identifier, and the timeout time, and signs the timeout evidence with the RSU signing key to form the vehicle abnormal state information. In step S4, the RSM uses the signed timeout evidence as the basis for determining disconnection behavior and incorporates it into the calculation of the participation eligibility status.

5. The zero-trust secure aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario according to claim 1, characterized in that, The vehicle node construction includes at least the mask gradient, the current round identifier, the vehicle pseudo-identity identifier, the timestamp, the version number of the participation qualification status list, and the mask commitment value to be proven message. A signature is generated for the to be proven message, and it is structured and encapsulated into a local update message and uploaded to the corresponding RSU. In step S4, the preset controlled demasking triggering conditions include the following conditions that must be met simultaneously: the signature verification of the RSU forwarding message is passed, the round identifier is consistent with the current collaborative training round, the version number of the versioned participation qualification status list meets the current valid version requirements, the vehicle pseudo identity is not in a revoked state, and the mask commitment value in the message is consistent with the hash value of the mask gradient.

6. The zero-trust secure aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario according to claim 1, characterized in that, In step S4, the anomaly detection specifically includes: the RSM calculates the Euclidean distance between the true local gradient update of each vehicle node and the true local gradient updates of other vehicle nodes, and selects the nearest one for each vehicle node. The sum of the Euclidean distances to each of the vehicle's neighbors is used as the final distance score for that vehicle node. Based on the total number of vehicle nodes in the system The number of malicious vehicle nodes tolerated by the system Confirmed, and The RSM is sorted from lowest to highest based on the final distance score, and the lowest score is ranked first. The real local gradient updates corresponding to each vehicle node are included in the candidate honest update set to form the effective vehicle set. Vehicle nodes that do not enter the effective vehicle set and whose final distance score exceeds the preset anomaly threshold are identified as abnormal vehicle nodes and anomaly evidence containing vehicle pseudo-identity identifiers and anomaly type labels is generated.

7. The zero-trust secure aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario according to claim 6, characterized in that, In step S4, the RSM is applied to any vehicle node. Calculate its adaptive credit score The adaptive credit value From the positive feedback part and negative feedback section Composition, satisfying: ； in Forgetting factor, The group weight coefficients; the positive feedback part The contribution score is positively correlated with the number of valid updates submitted by the vehicle node in the most recent unit of time and the corresponding contribution score, wherein the contribution score is obtained by reverse mapping or normalization of the final distance score; the negative feedback part The adaptive credit value is positively correlated with the total number of abnormal behaviors occurring at the vehicle node and the corresponding penalty coefficient; When the credit threshold is lower than the preset threshold, the RSM revokes the participation qualification of the vehicle node, records it in the versioned participation qualification status list and triggers version number increment; The negative feedback section The abnormal behaviors assessed include disconnection, targeted attacks, and non-targeted attacks, with each type of abnormal behavior corresponding to a penalty coefficient. , and Furthermore, the three factors have different weights; among them, disconnection behavior is determined based on the timeout evidence generated by RSU in step S3, while targeted attack behavior and non-targeted attack behavior are determined based on the abnormal evidence generated by RSM in step S4 and the final distance score distribution.

8. The zero-trust secure aggregation method for privacy protection in the vehicle-to-everything (V2X) scenario according to claim 1, characterized in that, In step S5, the direct execution of the aggregation operation specifically involves assigning aggregation weights to each vehicle node based on its adaptive credit value, historical contribution, or local data volume. ,satisfy The true aggregate gradient is obtained by weighted summation of the true local gradient updates according to the following formula: ,in For the set of valid vehicles, For vehicle nodes The actual local gradient update corresponding to the current round; Alternatively, the direct execution of the aggregation operation specifically involves calculating the arithmetic mean of the real local gradient updates corresponding to each vehicle node in the effective vehicle set to obtain the real aggregate gradient.

9. A zero-trust secure aggregation method for privacy protection in a vehicle-to-everything (V2X) scenario, applied to the trusted management entity RSM and the semi-honest forwarding and authentication entity RSU in a collaborative training system, characterized in that... The method includes: The RSM generates system public parameters, management key pairs, and a versioned list of participation eligibility statuses, and broadcasts the system public parameters, management public key, initial global model, and the current version number of the versioned list of participation eligibility statuses to vehicle nodes and the RSU within the system. The RSU receives local update messages uploaded by multiple vehicle nodes, performs pre-screening and batch signature verification of the vehicle nodes' participation eligibility based on the versioned participation eligibility status list, and forwards the verified mask gradient and vehicle abnormal status information to the RSM after signing without restoring the real local gradient update. After the preset controlled demasking triggering condition is met, the RSM synchronously reconstructs the random mask matrix with the current version number of the versioned participation qualification status list as one of the input factors, and performs controlled demasking on the mask gradient to restore the true local gradient update of each vehicle node. The RSM performs anomaly detection on the real local gradient update after recovery, determines the valid set of vehicles and corresponding anomaly evidence, and updates the participation qualification status of each vehicle node in combination with the vehicle anomaly status information and increments the version number to generate a versioned participation qualification status list for the next round. The RSM directly performs an aggregation operation on the real local gradient updates corresponding to the valid vehicle set to obtain the latest global model, and then distributes the latest global model and the versioned participation eligibility status list for the next round.

10. A zero-trust secure aggregation method for privacy protection in a vehicle-to-everything (V2X) scenario, applied to vehicle nodes in a collaborative training system, characterized in that... The method includes: Receive the system public parameters, management public key, global model, and current version number of the versioned participation eligibility status list broadcast by the trusted management entity RSM, and generate a local key pair based on the system public parameters; The global model is trained based on the local dataset to obtain local gradient updates, and the session key is obtained by performing key negotiation with the management terminal public key using the local session private key; A one-time mask seed is derived using the session key and the current version number of the versioned participation eligibility status list as input factors. A random mask matrix is ​​generated using a pseudo-random number generator. The local gradient update is added to the random mask matrix to obtain the mask gradient. A signature is generated for the message containing the mask gradient and the current version number of the versioned participation eligibility status list, forming a local update message and uploading it to the semi-honest forwarding and authentication entity RSU. The RSU performs participation eligibility pre-screening and batch signature verification without restoring the real local gradient update. The RSM performs controlled demasking, anomaly detection based on the real local gradient update, participation eligibility status quantity update, and direct aggregation operation after the preset controlled demasking trigger condition is met.

Images