Homomorphic encryption trusted privacy protection method and system based on hierarchical federated learning

Abstract

The application belongs to the technical field of homomorphic encryption, and particularly relates to a homomorphic encryption trusted privacy protection method and system based on hierarchical federated learning, which comprises the following steps: extracting semantic features, structural features and context features of local data items, calculating comprehensive sensitivity scores and mapping to four-level sensitivity levels; matching homomorphic encryption parameters, access control strategies and audit strategies according to the scores and end-edge-cloud level; obtaining gradients by training an end-side node, homomorphic encryption and uploading an edge node after identity authentication; checking and homomorphic aggregation in a trusted execution environment of the edge node to generate edge aggregation ciphertext and trusted verification credentials; decrypting and updating a model after global homomorphic aggregation of a cloud-side node and issuing it level by level; determining a differential privacy noise scale according to the score in a trusted execution environment in an inference stage, adding noise and outputting and auditing; and the application realizes the system integration of homomorphic encryption and trusted mechanism under the hierarchical federated learning architecture, and takes into account safety, efficiency and compliance.

Description

Technical Field

[0001] This invention belongs to the field of homomorphic encryption technology, and particularly relates to a trusted privacy protection method and system for homomorphic encryption based on hierarchical federated learning. Background Technology

[0002] With the increasing application of artificial intelligence technology in data-sensitive businesses such as international trade, existing federated learning privacy protection solutions typically employ a centralized parameter server architecture. Each participant trains locally, then uploads the gradients using homomorphic encryption, and aggregates them as ciphertext on the server side. Alternatively, they may rely solely on a trusted execution environment for isolation protection during the inference phase. However, in multi-party collaborative scenarios in international trade, the data held by different participants varies significantly in terms of sensitivity, cross-border compliance requirements, and computing power. This centralized, single-strength protection approach cannot be adapted to the differentiated configuration of homomorphic encryption strategies and trusted verification mechanisms based on data sensitivity levels and node levels within a hierarchical federated learning architecture. This results in a disconnect between encryption protection and the trusted execution environment, differential privacy, and compliance auditing, making it difficult to achieve end-to-end hierarchical trusted privacy protection from data collection, local training, edge aggregation to global updates in the cloud. Furthermore, applying high-strength homomorphic encryption and frequent trusted verification to all levels to enhance security would incur significant computational overhead and communication latency, failing to meet the performance requirements of actual business operations. Therefore, how to achieve the systematic integration and hierarchical collaboration of homomorphic encryption and trusted mechanisms in a hierarchical federated learning architecture, while ensuring the security and compliance of multi-level data in international trade and taking into account the efficiency of model training and inference, is an urgent problem to be solved in this field. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention proposes a homomorphic encryption trusted privacy protection method and system based on hierarchical federated learning. The method includes: acquiring local data items from each participant, extracting semantic features, structural features, and contextual features, fusing and calculating a comprehensive sensitivity score, and mapping it to a four-level sensitivity level; matching homomorphic encryption parameters, access control policies, and audit policies from a pre-defined policy matrix based on the score and the participant's hierarchy in the edge-cloud hierarchical architecture; the edge node trains gradients based on a global model and local data, encrypts and prunes the gradients according to the homomorphic encryption parameters, and uploads them to the edge node after identity authentication and permission verification; the edge node verifies the legality of the encrypted gradients and performs homomorphic aggregation within a trusted execution environment, generating edge-aggregated ciphertext and trusted verification credentials, which are then uploaded to the cloud; the cloud node performs global homomorphic aggregation, decrypts and updates the global model parameters, and encrypts and distributes them to each participant; during the inference phase, the data to be inferred is input into the trusted execution environment, a differential privacy noise scale is determined based on the comprehensive sensitivity score, noise is added to the output, and audit logs are recorded according to the audit policy. This invention achieves the system integration of homomorphic encryption and trusted mechanisms under a hierarchical federated learning architecture, ensuring data security while also taking into account computational efficiency and compliance.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] Homomorphic encryption trusted privacy protection methods based on hierarchical federated learning include:

[0006] Acquire local data items from each participant, extract semantic features, structural features, and contextual features, fuse them to calculate a comprehensive sensitivity score, and map it to a preset four-level sensitivity level;

[0007] Based on the comprehensive sensitivity score and the level of the participating party in the end-edge-cloud hierarchical architecture, the corresponding homomorphic encryption parameters, access control policies and audit policies are matched from the preset policy matrix;

[0008] The edge node trains gradients based on the global model and local data, encrypts the cropped gradients according to the homomorphic encryption parameters, and performs identity authentication and permission verification on the participants according to the access control policy before uploading the encrypted gradients to the edge node.

[0009] Edge nodes perform legality verification and homomorphic aggregation on the received encryption gradients within a trusted execution environment, generating edge aggregated ciphertext and trusted verification credentials, which are then uploaded to the cloud-side nodes.

[0010] The cloud-side node performs global homomorphic aggregation on each edge aggregate ciphertext based on the trusted verification credential, decrypts it, updates the global model parameters, and then distributes the encrypted global model parameters to each participant level by level.

[0011] During the inference phase, the data to be inferred is input into the trusted execution environment, the differential privacy noise scale is determined based on the comprehensive sensitivity score, the inference result is noise-added and output, and the audit log is recorded according to the audit strategy.

[0012] Specifically, a comprehensive sensitivity score is calculated and mapped to a preset four-level sensitivity level, including:

[0013] Multilingual word segmentation and domain terminology recognition are performed on the local data items, and the recognition results are input into a pre-trained encoder to obtain the semantic features.

[0014] The structural features are obtained by parsing the field structure, field nesting relationships, and metadata of the local data items;

[0015] Perform cross-field context parsing on the local data item and its associated data item to obtain the context features;

[0016] The semantic features, structural features, and context features are normalized respectively, and then input into a pre-trained feature weighting fusion network for feature weighting fusion to obtain fused features;

[0017] The fused features are input into multiple pre-trained scoring networks to obtain multiple corresponding evaluation values;

[0018] The multiple evaluation values ​​are weighted and summed according to preset weights to obtain the comprehensive sensitivity score;

[0019] The comprehensive sensitivity score is mapped to the four sensitivity levels according to the preset mapping table, and the mapping result is adjusted by context rules using the preset domain rule base to obtain the final sensitivity level.

[0020] Specifically, matching corresponding homomorphic encryption parameters, access control policies, and audit policies from a pre-defined policy matrix includes:

[0021] It can obtain the real-time computing load, available communication bandwidth, key management capabilities, and homomorphic ciphertext aggregation capabilities of end-side nodes, edge nodes, and cloud-side nodes.

[0022] Using the comprehensive sensitivity score and the level as the first matching condition, the initial homomorphic encryption parameters, the initial access control policy, and the initial audit policy are determined from the preset policy matrix;

[0023] The initial homomorphic encryption parameters are adjusted based on the real-time computing load and the homomorphic ciphertext aggregation capability: if the real-time computing load is higher than a first load threshold, the initial homomorphic encryption parameters are replaced with homomorphic encryption parameters whose computational complexity is lower than the first complexity threshold.

[0024] Specifically, matching the corresponding homomorphic encryption parameters, access control policies, and audit policies from the preset policy matrix also includes:

[0025] If the homomorphic ciphertext aggregation capability does not meet the ciphertext aggregation condition corresponding to the initial homomorphic encryption parameter, then the initial homomorphic encryption parameter is replaced with a homomorphic encryption parameter that matches the homomorphic ciphertext aggregation capability.

[0026] Based on a preset set of cross-border data compliance rules, the initial access control policy is subjected to cross-level permission inheritance verification and permission intersection determination. When the permission set of the first level and the permission set of the second level have inconsistent authorization for the same cross-level operation, the initial access control policy is adjusted to an inter-level access control policy that satisfies the permission constraints of each level.

[0027] Based on the sensitivity level and operation type corresponding to the comprehensive sensitivity score, the initial audit strategy is refined into audit strategies for cross-layer aggregation operations and parameter distribution operations, resulting in the final audit strategy.

[0028] Specifically, gradients are obtained by training based on a global model and local data, including:

[0029] Obtain the real-time computing load of the endpoint; when the real-time computing load is higher than the first load threshold, freeze a preset number of layer parameters in the global model that are close to the input layer, and only perform forward and backward propagation on the remaining layers of the global model to obtain the initial gradient;

[0030] When the real-time computing load is not higher than the first load threshold, forward propagation and backward propagation are performed on all layers of the global model to obtain the initial gradient.

[0031] Before performing the forward and backward propagation, the training samples in the local data are divided into multiple training sample groups based on the comprehensive sensitivity score.

[0032] Specifically, the gradients obtained by training based on the global model and local data also include:

[0033] Configure the corresponding learning rate and local training rounds for each training sample group, and calculate the group gradient for each training sample group.

[0034] The gradients of each training sample group are weighted and merged according to the proportion of the number of samples in each group to obtain the initial gradient.

[0035] The initial gradient is weighted and averaged with the historical gradient obtained in the previous training round to obtain the corrected local gradient, which is then used as the gradient to be clipped.

[0036] Specifically, the clipped gradient is encrypted according to the homomorphic encryption parameters, including:

[0037] Obtain the numerical range of the clipped gradient;

[0038] Based on the plaintext modulus and preset scaling factor in the homomorphic encryption parameters, the clipped gradient is quantized and encoded to convert the floating-point gradient into an integer gradient represented by the plaintext modulus.

[0039] Determine whether the numerical range of the integer gradient is contained within the representable numerical range corresponding to the plaintext modulus;

[0040] If the numerical range of the integer gradient is not included in the representable numerical range, then adjust the preset scaling factor or reselect the plaintext modulus until the numerical range of the integer gradient is included in the representable numerical range.

[0041] Pack multiple elements in the integer gradient into the same ciphertext, perform homomorphic encryption according to the homomorphic encryption parameters, and obtain the encrypted gradient;

[0042] If the ciphertext modulus, ciphertext length, or key space in the homomorphic encryption parameters corresponding to each edge node are inconsistent, the encryption gradient is converted into ciphertext that matches the unified ciphertext modulus and unified key space required for the edge node to perform homomorphic aggregation, and then uploaded to the edge node.

[0043] Specifically, after authenticating and verifying the identities and permissions of the participants according to the access control policy, the encryption gradient is uploaded to the edge node, including:

[0044] Obtain the identity credentials and authorization tokens of the participating parties;

[0045] Perform cross-trust domain certificate chain verification on the identity credential and query the revocation status corresponding to the identity credential;

[0046] When the revocation status is not revoked and the cross-trust domain certificate chain verification is successful, multi-factor authentication is performed on the participating party, and the multi-factor authentication includes the verification of two or more authentication factors;

[0047] Obtain the role authorization information and authorization time window from the permission token, compare the authorization time window with the current time, and compare the role authorization information with the operation type of uploading encryption gradient.

[0048] Specifically, after authenticating and verifying the identities and permissions of the participants according to the access control policy, the encryption gradient is uploaded to the edge node, which also includes:

[0049] When the current time does not belong to the authorized time window, or the role authorization information does not contain the operation type of uploading the encryption gradient, the uploading of the encryption gradient is rejected; when the current time belongs to the authorized time window and the role authorization information contains the operation type of uploading the encryption gradient, the identity of the participant is bound to the encryption gradient to generate an upload credential.

[0050] The encryption gradient and the upload credential are sent together to the edge node so that the edge node can verify the binding relationship between the encryption gradient and the identity identifier in encrypted form.

[0051] Specifically, the edge nodes perform validity verification and homomorphic aggregation on the received cryptographic gradients within the trusted execution environment, including:

[0052] Obtain the remaining secure memory capacity of the trusted execution environment and the ciphertext length of a single encryption gradient;

[0053] The upper limit of the number of encryption gradients loaded in a single batch is determined based on the remaining capacity of the secure memory and the length of the ciphertext, and the received encryption gradients are loaded into the secure memory in batches according to the upper limit of the number of encryption gradients.

[0054] Homomorphic addition is performed on each batch of loaded encryption gradients to obtain intermediate aggregated ciphertext, and the intermediate aggregated ciphertext is written to the external memory of the trusted execution environment;

[0055] For the encrypted gradient or the intermediate aggregated ciphertext loaded from the external memory, an integrity verification value is calculated based on the page key and page identifier. After successful verification, the ciphertext is decrypted and loaded into the secure memory, and the memory access order is hidden by using an unintentional random access storage method.

[0056] Specifically, the edge nodes perform validity verification and homomorphic aggregation on the received cryptographic gradients within the trusted execution environment, which also includes:

[0057] For each encryption gradient, verify the ciphertext range proof uploaded by the end node along with the encryption gradient; when the ciphertext range proof fails to be verified, or the numerical range corresponding to the ciphertext range proof is not included in the preset legal gradient numerical range, mark the encryption gradient as an abnormal gradient and exclude it from the homomorphic aggregation.

[0058] When generating the trusted verification credential, the list of cryptographic gradient identifiers participating in this homomorphic aggregation, the batch division, and the aggregation order of each batch are recorded, and an aggregation execution record is generated.

[0059] Calculate the first hash value of the aggregated execution record, the second hash value of the input cryptographic gradient set, and the third hash value of the output edge-aggregated ciphertext;

[0060] The first hash value, the second hash value, and the third hash value are concatenated and then signed using the signature key of the trusted execution environment to obtain the trusted verification credential.

[0061] Specifically, based on the trusted verification credential, global homomorphic aggregation is performed on each edge-aggregated ciphertext, including:

[0062] Receive edge aggregated ciphertext, trusted verification credentials, and credential generation timestamp uploaded by each edge node;

[0063] For each of the trusted verification credentials, the signature is verified using the public key corresponding to the signature key of the trusted execution environment, and the aggregated execution record hash value, the input cryptographic gradient set hash value, and the output edge aggregated ciphertext hash value are extracted from the trusted verification credentials.

[0064] The output edge-aggregated ciphertext hash value is compared with the actual hash value of the received corresponding edge-aggregated ciphertext, and the difference between the credential generation timestamp and the current time is compared with the preset valid duration.

[0065] When the output edge-aggregated ciphertext hash value is inconsistent with the actual hash value, or when the difference exceeds the preset valid duration, the edge-aggregated ciphertext is rejected.

[0066] When the output edge-aggregated ciphertext hash value is consistent with the actual hash value, and the difference does not exceed the preset valid duration, the edge-aggregated ciphertext is added to the global homomorphic aggregation set.

[0067] Specifically, performing global homomorphic aggregation on each edge-aggregated ciphertext based on the trusted verification credential also includes:

[0068] Obtain the homomorphic encryption parameters, quantization scaling factor, and noise budget parameters corresponding to each edge-aggregated ciphertext;

[0069] When the ciphertext modulus, ciphertext length, or key space of each edge-aggregated ciphertext is inconsistent, each edge-aggregated ciphertext is converted into ciphertext with a unified ciphertext modulus and a unified key space.

[0070] Obtain the current noise level of each edge-aggregated ciphertext after conversion, and compare the current noise level with a preset noise threshold;

[0071] When any current noise level exceeds the preset noise threshold, a ciphertext refresh operation is performed on the corresponding edge-aggregated ciphertext until the current noise level is lower than the preset noise threshold.

[0072] The weights of each edge node are calculated based on the data quality and data volume of the participants corresponding to each edge node. Homomorphic scalar multiplication and homomorphic addition are performed on each edge aggregate ciphertext in the ciphertext domain to obtain the globally weighted aggregate ciphertext.

[0073] Specifically, performing global homomorphic aggregation on each edge-aggregated ciphertext based on the trusted verification credential also includes:

[0074] The globally weighted aggregated ciphertext is homomorphically normalized, and noise is added to the ciphertext domain according to the differential privacy budget determined by the adaptive privacy budget allocation algorithm in the current training round. When adding noise to the ciphertext domain, samples are taken from a discrete noise distribution that matches a preset continuous noise distribution, and the discretization error is calculated. The discretization error is included in the differential privacy budget calculation of subsequent rounds.

[0075] Homomorphic decryption is performed on the global encrypted gradient after adding noise to obtain the integer plaintext gradient; the integer plaintext gradient is dequantized according to the quantization scaling factor to obtain the floating-point global gradient, and the dequantization residual is retained;

[0076] The global model parameters are updated based on the floating-point global gradient and the inverse quantization residual to obtain the updated global model parameters.

[0077] Specifically, performing global homomorphic aggregation on each edge-aggregated ciphertext based on the trusted verification credential also includes:

[0078] For each participant, based on the comprehensive sensitivity score and the level of the participant, the homomorphic encryption parameters and access control policies corresponding to the participant are obtained from the preset policy matrix.

[0079] The updated global model parameters are encrypted using the public key of the participating party and the re-encryption key of the participating party's level, generating participating party encrypted parameters. The receiver's identity is then bound to the participating party encrypted parameters and sent to the edge node.

[0080] The edge node verifies the identity of the recipient according to the access control policy, and forwards the participant's encrypted parameters after converting them into ciphertext that can be decrypted by the participant's public key using the re-encryption key. The edge node is unable to decrypt the participant's encrypted parameters.

[0081] A homomorphic cryptographic trusted privacy protection system based on hierarchical federated learning includes:

[0082] The data sensitivity module is configured to: acquire local data items from each participant, extract semantic features, structural features and contextual features, fuse them to calculate a comprehensive sensitivity score, and map it to a preset four-level sensitivity level;

[0083] The policy matching module is configured to match corresponding homomorphic encryption parameters, access control policies, and audit policies from a preset policy matrix based on the comprehensive sensitivity score and the level of the participant in the end-edge-cloud hierarchical architecture.

[0084] The encrypted upload module is configured as follows: the edge node trains gradients based on the global model and local data, encrypts the cropped gradients according to the homomorphic encryption parameters, and uploads the encrypted gradients to the edge node after authenticating the identities and verifying the permissions of the participants according to the access control policy.

[0085] The trusted verification module is configured such that: the edge node performs legality verification and homomorphic aggregation on the received encryption gradient within the trusted execution environment, generates edge aggregated ciphertext and trusted verification credentials, and uploads them to the cloud-side node;

[0086] The model update module is configured as follows: the cloud-side node performs global homomorphic aggregation on each edge aggregation ciphertext based on the trusted verification credential, decrypts and updates the global model parameters, and then sends the encrypted global model parameters down to each participant level by level.

[0087] The differential privacy audit module is configured to: input the data to be inferred into the trusted execution environment during the inference phase, determine the differential privacy noise scale based on the comprehensive sensitivity score, add noise to the inference result and output it, and record audit logs according to the audit strategy.

[0088] Compared with the prior art, the beneficial effects of the present invention are:

[0089] This invention achieves end-to-end privacy protection through a mechanism that integrates homomorphic encryption and a trusted execution environment within an edge-cloud hierarchical federated learning architecture. This mechanism encompasses data sensitivity grading, differentiated homomorphic encryption parameter matching, edge trusted aggregation, cloud global aggregation, and differential privacy inference. Its advantages are twofold: First, by matching encryption and access control strategies based on comprehensive sensitivity scoring and node hierarchy, highly sensitive data receives strong protection while reducing computational overhead for low-sensitivity data, thus improving system efficiency while ensuring security. Second, edge nodes complete ciphertext validity verification and homomorphic aggregation within the trusted execution environment, generating trusted verification credentials. The cloud then performs global aggregation based on these credentials, preventing ciphertext substitution and unauthorized access, and ensuring the verifiability and integrity of the aggregation results. Simultaneously, during the inference phase, a differential privacy noise scale is determined based on sensitivity scoring within the trusted execution environment. Noise is added to the inference results, and tiered auditing is implemented, reducing the risk of privacy leakage and meeting cross-border compliance requirements. Therefore, this invention solves the problems of fragmented encryption protection and trusted mechanisms, and the imbalance between efficiency and security caused by single-strength protection in existing centralized federated learning, achieving secure, efficient, and compliant privacy protection in a hierarchical federated learning scenario. Attached Figure Description

[0090] Figure 1 This is a flowchart of the homomorphic encryption trusted privacy protection method based on hierarchical federated learning in Embodiment 1 of the present invention;

[0091] Figure 2 This is a block diagram of the homomorphic encryption trusted privacy protection system based on hierarchical federated learning, which is the third embodiment of the present invention. Detailed Implementation

[0092] Example 1

[0093] Please see Figure 1 The present invention provides an embodiment of a homomorphic encryption trusted privacy protection method based on hierarchical federated learning, comprising the following steps:

[0094] S1. Obtain local data items from each participant, extract semantic features, structural features and contextual features, fuse them to calculate a comprehensive sensitivity score, and map them to a preset four-level sensitivity level.

[0095] S2. Based on the comprehensive sensitivity score and the level of the participant in the end-edge-cloud hierarchical architecture, match the corresponding homomorphic encryption parameters, access control policies and audit policies from the preset policy matrix;

[0096] S3. The edge node trains the gradient based on the global model and local data, encrypts the cropped gradient according to the homomorphic encryption parameters, and uploads the encrypted gradient to the edge node after authenticating the identity and verifying the permissions of the participants according to the access control policy.

[0097] S4. The edge node performs legality verification and homomorphic aggregation on the received encryption gradient within the trusted execution environment, generates edge aggregated ciphertext and trusted verification credentials, and uploads them to the cloud-side node.

[0098] S5. The cloud-side node performs global homomorphic aggregation on each edge aggregation ciphertext based on the trusted verification credential, decrypts it, updates the global model parameters, and sends the encrypted global model parameters down to each participant level by level.

[0099] S6. During the inference phase, the data to be inferred is input into the trusted execution environment, the differential privacy noise scale is determined according to the comprehensive sensitivity score, the inference result is noise-added and output, and the audit log is recorded according to the audit strategy.

[0100] Example 2

[0101] It should be further explained that, in this embodiment, the calculation of a comprehensive sensitivity score and its mapping to a preset four-level sensitivity system includes:

[0102] S101. Perform multilingual word segmentation and domain terminology recognition on the local data items, and input the recognition results into a pre-trained encoder to obtain the semantic features, specifically:

[0103] S1011. Obtain the original text of the local data item and input the original text into a multilingual word segmenter; the multilingual word segmenter adopts an unsupervised word segmentation model based on the SentencePiece algorithm, and its vocabulary covers sub-word units of languages ​​such as Chinese, English, French, German, and Spanish, with a vocabulary size of 110,000; perform sub-word segmentation on the original text to obtain a word segmentation sequence composed of sub-word units.

[0104] S1012. Perform multi-pattern matching between the segmented sequence and a pre-built trade domain terminology rule base; the trade domain terminology rule base contains more than 5,000 trade-sensitive terms, covering categories such as price terms, customer identification, shipping terms, and tariff classification; the multi-pattern matching is implemented using an Aho-Corasick automaton, specifically as follows:

[0105] S1012-1. Each trade-sensitive term in the trade domain terminology rule base is split into a pattern string by character or sub-word unit and inserted into a Trie tree in sequence; each node of the Trie tree includes a set of transition edges, a pointer to invalid links, and an output list; the root node represents an empty string, and each node reached from the root node through the transition edges represents a prefix.

[0106] S1012-2. Traverse the Trie tree using a breadth-first search; for the direct child nodes of the root node, set their invalid links to point to the root node; for the remaining nodes, backtrack layer by layer along the invalid links of their parent nodes to find if there is a node that is the same as the current transition edge; if there is, set that node as the invalid link of the current node; if there is still no identical transition edge after backtracking to the root node, set the invalid link to point to the root node.

[0107] S1012-3. During the construction of broken links, the output list of each node's broken link nodes is merged into the output list of that node, so that the output list of each node contains all trade-sensitive terms corresponding to all pattern strings ending with that node.

[0108] S1012-4. Iterate through each segmentation unit in the segmentation sequence, starting from the current state node. If the current node has a transition edge that matches the current segmentation unit, move along the transition edge to the next state node. If there is no matching transition edge, jump along the invalid link of the current node and repeatedly check whether there is a matching transition edge until the root node is reached. After updating the current state node, check the output list of the node. When the output list is not empty, determine that the corresponding trade-sensitive term is matched, and record the matched trade-sensitive term and the start and end positions of the term in the segmentation sequence.

[0109] S1012-5. For each matched trade-sensitive term, insert a first special placeholder before the start position of the term in the word segmentation sequence. The first special placeholder is used to mark the beginning of the domain term. Insert a second special placeholder after the end position of the term. The second special placeholder is used to mark the end of the domain term. Wherein, the first special placeholder and the second special placeholder are both special markers predefined in the vocabulary of the pre-trained encoder, and the vocabulary of the pre-trained encoder contains the identifiers of the first special placeholder and the second special placeholder.

[0110] S1013. Input the segmented sequence after inserting domain term tags into the pre-trained encoder, specifically:

[0111] S1013-1. Add a predefined sequence start marker to the beginning of the word segmentation sequence after the insertion of the domain term marker, and add a predefined sequence end marker to the end to obtain the input sequence; the sequence start marker and the sequence end marker are both special markers in the vocabulary of the pre-trained encoder.

[0112] S1013-2. Input each word segmentation unit, each domain term tag, the sequence start tag, and the sequence end tag in the input sequence into the embedding layer of the pre-trained encoder; the embedding layer includes a word embedding matrix and a position embedding matrix; the word embedding matrix has a dimension of 110000×768, and the position embedding matrix has a dimension of 512×768; map each tag to a word embedding vector through the word embedding matrix, and generate a position embedding vector through the position embedding matrix according to the position index of the tag in the input sequence; add the word embedding vector and the position embedding vector element by element to obtain the input embedding vector sequence.

[0113] S1013-3. Input the input embedding vector sequence into the first Transformer encoding layer; in each Transformer encoding layer, first perform the calculation of the multi-head self-attention sub-layer: set the number of attention heads to 12, and the query vector dimension, key vector dimension, and value vector dimension of each attention head are all 64; for each attention head, use the first linear transformation matrix, the second linear transformation matrix, and the third linear transformation matrix to map each vector in the input embedding vector sequence to the query vector, key vector, and value vector respectively; in this embodiment, the first linear transformation matrix, the second linear transformation matrix, and the third linear transformation matrix are all pre-trained... The learnable parameter matrices of the multi-head self-attention sublayers in the encoder all have a dimension of 768×64. Their construction method is as follows: during the initialization phase, element values ​​of each matrix are randomly generated using a normal distribution with a mean of 0 and a standard deviation of 0.02. During the pre-training phase of the pre-trained encoder, the first linear transformation matrix, the second linear transformation matrix, and the third linear transformation matrix, along with other parameters of the pre-trained encoder, participate in backpropagation, and the element values ​​in the matrices are updated using gradient descent. When transferring to the sensitivity evaluation task of this embodiment, the matrix weights saved after the pre-training of the pre-trained encoder are directly loaded and kept as learnable parameters, and continued to be updated during the fine-tuning phase.

[0114] S1013-4. For each attention head, calculate the dot product of the query vector corresponding to each position and the key vector corresponding to all positions, and divide by the scaling factor 8 to obtain the attention score; perform softmax normalization on the attention score to obtain the attention weight; and sum the attention weight with the corresponding value vector to obtain the output sequence of the attention head.

[0115] S1013-5. Concatenate the output sequences of the 12 attention heads along the vector dimension to obtain a concatenated vector; perform a linear transformation on the concatenated vector using a fourth linear transformation matrix with a dimension of 768×768 to obtain the output sequence of the multi-head self-attention sub-layer; perform residual concatenation between the output sequence of the multi-head self-attention sub-layer and the input embedding vector sequence, and perform layer normalization to obtain the first intermediate vector sequence.

[0116] S1013-6. Input the first intermediate vector sequence into a feedforward neural network sub-layer; the feedforward neural network sub-layer includes a first fully connected layer, an activation layer, and a second fully connected layer; the input dimension of the first fully connected layer is 768, the output dimension is 3072, and the activation function of the activation layer is GELU; the input dimension of the second fully connected layer is 3072, and the output dimension is 768; perform residual connection between the output sequence of the feedforward neural network sub-layer and the first intermediate vector sequence, and perform layer normalization to obtain the output vector sequence of the current Transformer coding layer.

[0117] S1013-7. Use the output vector sequence of the current Transformer coding layer as the input of the next Transformer coding layer, and repeat S1013-3 to S1013-6 until the calculation of 12 Transformer coding layers is completed; take the vector corresponding to each word segmentation unit in the output vector sequence of the 12th Transformer coding layer as the hidden state vector of that word segmentation unit; use the hidden state vector sequence as the output of the pre-trained encoder.

[0118] S1014. Perform average pooling on the latent state vector corresponding to each word segmentation to obtain a semantic feature vector of fixed dimension; specifically:

[0119] S1014-1 Obtain the hidden state vector sequence output by the 12th Transformer encoding layer of the pre-trained encoder described in S1013; the hidden state vector sequence corresponds one-to-one with each marker in the input sequence, including the hidden state vector corresponding to each word segmentation unit, the hidden state vector corresponding to the sequence start marker, the hidden state vector corresponding to the sequence end marker, and the hidden state vector corresponding to each domain term marker.

[0120] S1014-2. Remove the hidden state vectors corresponding to the sequence start marker, the sequence end marker, and the domain term marker from the hidden state vector sequence, and retain only the hidden state vectors corresponding to each word segmentation unit to obtain the set of hidden state vectors to be pooled.

[0121] S1014-3. Sum the hidden state vectors in the set of hidden state vectors to be pooled element by element according to the vector dimension to obtain a sum vector with dimension 768.

[0122] S1014-4. Count the number N of hidden state vectors in the set of hidden state vectors to be pooled; divide each element in the sum vector by N to obtain the average pooled vector, and output the vector as the semantic feature.

[0123] S102. Parse the field structure, field nesting relationship, and metadata of the local data item to obtain the structural features, specifically:

[0124] S1021. Parse the file format or database structure of the local data item; when the local data item comes from a JSON file, use a JSON parser to traverse key-value pairs layer by layer to extract field names, field paths, field data types, and field level depths; when the local data item comes from an XML file, use an XML parser to parse element tags and attributes to extract field names, field paths, field data types, and field level depths; when the local data item comes from a relational database table, read the database metadata table to extract field names, field data types, and primary / foreign key relationships.

[0125] S1022. Extract the nesting relationship of the local data item; when the local data item is a nested object or array element, record its parent node path and child node path to form a nesting relationship graph; the nesting relationship graph uses field paths as nodes and inclusion relationships as directed edges, with the direction of the edges pointing from the parent node to the child node.

[0126] S1023. Extract the metadata of the local data item; the metadata includes field creation time, field modification time, field source system and field owner identifier; timestamp the field creation time and field modification time, and classify the field source system and field owner identifier.

[0127] S1024. The field structure information is encoded into a first vector, the nested relationship graph is encoded into a second vector through a graph convolutional network, and the metadata is encoded into a third vector; the graph convolutional network contains two layers, and the output dimension of each graph convolution is 128; the first vector, the second vector, and the third vector are concatenated to obtain the structural feature.

[0128] S103. Perform cross-field context parsing on the local data item and its associated data item to obtain the context features, specifically:

[0129] S1031. Determine the set of associated data items corresponding to the local data item; the set of associated data items includes at least one associated data item that belongs to the same business document, the same contract, or the same transaction record as the local data item; specifically, using the record identifier of the record where the local data item is located as the key, retrieve other field values ​​that are the same as the record identifier in the associated data storage, use the retrieved field values ​​as associated data items, and form the set of associated data items.

[0130] S1032. The local data items and the associated data item set are concatenated into a text sequence in a preset order. The preset order is: first the local data items, then arrange the associated data items in the original order of the fields in the record. The text sequence is input into a second pre-trained encoder with the same structure as the pre-trained encoder in S101 to obtain a joint hidden state representation of the local data items and the associated data item set. The second pre-trained encoder and the pre-trained encoder share the same set of pre-training parameters.

[0131] S1033. A graph attention network is used to encode the relationship between the local data item and the associated data item set. The nodes of the graph attention network are the local data item and the associated data item, and the edges are field reference relationships or primary-foreign key relationships. The graph attention network contains two graph attention layers, each layer using 8 attention heads. Each attention head calculates the attention weight between adjacent nodes and performs a weighted summation of the features of adjacent nodes to obtain the updated representation of each node. The updated representation corresponding to the local data item is taken as the graph embedding vector. In this embodiment, the initial feature of each node in the graph attention network is taken from the hidden state representation of the corresponding field of the node output by the second pre-trained encoder in S1032. The dimension of the hidden state representation is 768. If the node is an associated data item, the vector of the associated data item at the corresponding position in the joint hidden state representation is taken. If the node is a local data item, the vector of the local data item at the corresponding position in the joint hidden state representation is taken. The initial features of the nodes are not subjected to additional linear transformations before being input into the graph attention network.

[0132] S1034. The joint hidden state representation and the graph embedding vector are concatenated to obtain the context feature; both the joint hidden state representation and the graph embedding vector are vectors of dimension 768, and the concatenation results in a context feature vector of dimension 1536.

[0133] S104. The semantic features, structural features, and context features are normalized respectively, and then input into a pre-trained feature weighting fusion network for feature weighting fusion to obtain fused features, specifically:

[0134] S1041. Perform L2 normalization on the semantic features, structural features, and context features respectively; for any feature vector v, the L2 normalization calculation method is: v'=v / ||v||2, where ||v||2 is the Euclidean norm of v; thus obtaining the normalized semantic features, normalized structural features, and normalized context features.

[0135] S1042. The normalized semantic features, normalized structural features, and normalized context features are input as three input vectors into the pre-trained feature weighting fusion network; the feature weighting fusion network adopts a multi-head attention mechanism, and the number of attention heads is set to 8.

[0136] S1043. In the feature-weighted fusion network, the normalized semantic features are used as the query vector, and the normalized semantic features, normalized structural features, and normalized context features are used together as the key vector and value vector to calculate the attention weight; the formula for calculating the attention weight is: α_i = softmax(Q K_i T / ), where Q is the query vector, K_i is the i-th key vector, d is the vector dimension, and α_i is the i-th attention weight; calculate for each attention head to obtain 8 sets of attention weights.

[0137] S1044. The attention weights corresponding to each attention head are weighted and summed with the corresponding value vectors to obtain 8 attention head outputs; the 8 attention head outputs are concatenated and linearly transformed through a fully connected layer to output the fused feature; the output dimension of the fully connected layer is 256.

[0138] S105. The fused features are input into multiple pre-trained scoring networks to obtain multiple corresponding evaluation values, specifically as follows:

[0139] S1051. Construct four parallel pre-trained scoring networks; the four parallel pre-trained scoring networks are all multilayer perceptrons, each multilayer perceptron includes an input layer, a first hidden layer, a second hidden layer and an output layer; the dimension of the input layer is the same as the dimension of the fused feature, which is 256; the dimension of the first hidden layer is 256, and the activation function is ReLU; the dimension of the second hidden layer is 64, and the activation function is ReLU; the dimension of the output layer is 1.

[0140] S1052. The fused features are respectively input into the four parallel pre-trained scoring networks; the first pre-trained scoring network outputs the content sensitivity score; the second pre-trained scoring network outputs the regulatory relevance score; the third pre-trained scoring network outputs the business value score; and the fourth pre-trained scoring network outputs the privacy risk score.

[0141] S1053. The activation function of the output layer of each pre-trained scoring network is the Sigmoid function, and the output score value is between 0 and 1; four evaluation values ​​are obtained: content sensitivity score, regulatory relevance score, business value score, and privacy risk score.

[0142] S106. The multiple evaluation values ​​are weighted and summed according to preset weights to obtain the comprehensive sensitivity score, specifically as follows:

[0143] S1061. Obtain preset weight coefficients; the preset weight coefficients include content sensitivity weight w1, regulatory relevance weight w2, business value weight w3, and privacy risk weight w4; in this embodiment, w1=0.4, w2=0.3, w3=0.2, w4=0.1, and satisfy w1+w2+w3+w4=1. The weight settings in this embodiment are based on the following: Content sensitivity is used to quantify the quantity and intensity of sensitive terms, sensitive fields, or sensitive patterns contained in local data items, directly determining the degree of substantial damage caused when data items are leaked. It is the most important determining factor in the comprehensive sensitivity score, hence it is assigned the highest weight of 0.4; Regulatory relevance is used to characterize the degree of matching between data items and cross-border data compliance rules (such as the General Data Protection Regulation of country A1, the Personal Information Protection Law of country A2, etc.), affecting whether data processing behavior triggers compliance review or prohibitive constraints. Its importance is second only to content sensitivity, hence it is assigned a weight of 0.3; Business value is used to measure the criticality of data items for business operations, transaction completion, or decision support. The higher the value, the greater the business loss when the data is accessed or tampered with without authorization; therefore, it is assigned a weight of 0.2. Privacy risk is used to assess the possibility that a data item is associated with a specific natural person or can be associated with other data to identify a natural person. It is a supplementary and corrective item to the first three scores, so it is assigned the lowest weight of 0.1. Through the above weight configuration, the comprehensive sensitivity score can highlight the core factor of content sensitivity while reasonably incorporating the impact of regulatory relevance, business value, and privacy risk. This ensures that the score results are positively correlated with the actual harm of data leakage and compliance risks, thereby providing an accurate and reproducible basis for sensitivity classification for the differentiated matching of homomorphic encryption parameters, access control policies, and audit policies in the edge-cloud hierarchical architecture.

[0144] S1062. Multiply the content sensitivity score by w1 to obtain a first product; multiply the regulatory relevance score by w2 to obtain a second product; multiply the business value score by w3 to obtain a third product; multiply the privacy risk score by w4 to obtain a fourth product; add the first product, the second product, the third product, and the fourth product to obtain the comprehensive sensitivity score.

[0145] S1063. The comprehensive sensitivity score is limited to between 0 and 1; if the comprehensive sensitivity score is greater than 1, the value is 1; if the comprehensive sensitivity score is less than 0, the value is 0.

[0146] S107. Map the comprehensive sensitivity score to the four sensitivity levels according to the preset mapping table, and adjust the mapping results using contextual rules based on the preset domain rule base to obtain the final sensitivity level, specifically as follows:

[0147] S1071. Match the comprehensive sensitivity score with a preset mapping table; the preset mapping table contains four scoring intervals: the first interval is [0.75, 1.0], corresponding to the first level of sensitivity; the second interval is [0.5, 0.75), corresponding to the second level of sensitivity; the third interval is [0.25, 0.5), corresponding to the third level of sensitivity; the fourth interval is [0, 0.25), corresponding to the fourth level of sensitivity; determine the interval to which the comprehensive sensitivity score belongs, and use the corresponding level as the initial sensitivity level.

[0148] S1071-1. Construct the correspondence between the four-level sensitivity classification system and the preset mapping table: the first level of sensitivity corresponds to pricing strategy, profit margin, and key customer information; the second level of sensitivity corresponds to transaction terms, pricing, and customs account; the third level of sensitivity corresponds to goods details, transportation plan, and payment terms; the fourth level of sensitivity corresponds to general product description and public trade terms; and the data category corresponding to the initial sensitivity level is used as the current data category identifier.

[0149] S1072. Call the preset domain rule base; the preset domain rule base contains more than 5,000 trade-sensitive terms and more than 200 sensitive patterns; the trade-sensitive terms and sensitive patterns are pre-labeled by those skilled in the art according to sensitivity levels; use the same Aho-Corasick automaton as described in S101 to match the local data items, determine whether the local data items contain terms or patterns that match the preset domain rule base, and obtain the labeling level corresponding to the matched terms or patterns.

[0150] S1073. When the local data item contains terms or patterns labeled as Level 1, if the initial sensitivity level is lower than Level 1, the initial sensitivity level is adjusted to Level 1; when the local data item contains only terms or patterns labeled as Level 4, and the comprehensive sensitivity score is in the fourth interval, Level 4 is maintained; when the local data item does not match any terms or patterns, the initial sensitivity level remains unchanged.

[0151] S1074. Output the sensitivity level adjusted by the preset domain rule base as the final sensitivity level. In this embodiment, after the initial sensitivity level is adjusted in S1073, the data category identifier should be updated synchronously to the data category corresponding to the final sensitivity level in S1071-1; the final output includes the final sensitivity level and the updated data category identifier, and the two are consistent.

[0152] As a concrete example, suppose a participant's local data item is the "Unit Price Clause" field in an export contract. Its original text is "Unit price: USD 1,250 per metric ton CIF Rotterdam". After being segmented by a multilingual tokenizer, this text is matched against a trade domain terminology rule base, identifying the two trade-sensitive terms "Unit price" and "CIF Rotterdam" and inserting domain terminology tags. This is then input into a multilingual BERT variant pre-trained encoder, and after 12 Transformer encoding layers, the segmented latent state vector is average-pooled to obtain a semantic feature vector with a dimension of 768. Simultaneously, the JSON path "$.contract.pricing.unit_price" of this field is parsed. Its field level depth is 3, data type is string, and source system is ERP. Combining this with the field nesting relationship diagram and metadata encoding, structural features are obtained. This field is then compared with "payment_terms" and "incoter" in the same contract. The context features are obtained by concatenating related fields such as "ms" and then encoding them through a second pre-trained encoder and a graph attention network. After L2 normalization of the semantic features, structural features, and context features, they are input into a feature weighting fusion network to obtain a fusion feature with a dimension of 256. This fusion feature is then input into four pre-trained scoring networks to obtain a content sensitivity score of 0.92, a regulatory relevance score of 0.85, a business value score of 0.78, and a privacy risk score of 0.88. After being weighted and summed with weights of 0.4, 0.3, 0.2, and 0.1, a comprehensive sensitivity score of 0.884 is obtained, which falls into the first interval [0.75, 1.0], and the initial sensitivity level is level one. The preset domain rule base is called to match "Unit price" and mark it as a level one trade sensitive term. Since the initial level is not lower than level one, the final sensitivity level remains level one, and the corresponding data category is price strategy. The final sensitivity level L1 and data category identifier are output for subsequent matching of the preset strategy matrix.

[0153] It should be further explained that, in this embodiment, matching the corresponding homomorphic encryption parameters, access control policies, and audit policies from the preset policy matrix includes:

[0154] S201. Obtain the real-time computing load, available communication bandwidth, key management capabilities, and homomorphic ciphertext aggregation capabilities of the end-side nodes, edge nodes, and cloud-side nodes, specifically:

[0155] S2011. Deploy lightweight monitoring agents on the edge nodes, cloud nodes, and endpoint nodes respectively. The monitoring agents collect CPU utilization, memory usage, disk read / write speed, and network interface transmit / receive speed of each node at preset time intervals, and calculate the weighted average of CPU utilization and memory usage as the real-time computing load of that node. The preset time interval can be set to 5 seconds, based on the optimal collection period determined by those skilled in the art according to the load fluctuation characteristics of the edge-cloud hierarchical federated learning system and the resource consumption constraints of the monitoring agent. In the edge nodes, the real-time computing load is characterized by the weighted average of CPU utilization and memory usage. The dynamic changes of this load indicator are mainly affected by factors such as training task scheduling, homomorphic encryption computation, and data upload. Its significant fluctuations typically occur on a timescale of several seconds to tens of seconds. Setting the collection period to 5 seconds... It can effectively capture significant changes in real-time computing load within no more than two collection cycles, ensuring sufficient timeliness of input data for subsequent comparisons with the first load threshold and homomorphic encryption parameter adjustment operations. Simultaneously, the 5-second collection cycle keeps the frequency of collection operations by the monitoring agent low per unit time. The additional CPU time slice usage and memory accesses caused by metric reading, weighted average calculation, and node capability report encapsulation have negligible impact on the normal training and encrypted upload tasks of the edge nodes. This value avoids the monitoring agent itself becoming a significant source of computing load for the edge nodes due to an excessively short collection cycle, and also avoids load perception lag due to an excessively long collection cycle. Thus, it achieves an engineering-acceptable balance between timeliness and resource overhead, providing a stable and reliable monitoring data foundation for adaptive strategy adjustments based on real-time computing load under the edge-cloud hierarchical architecture.

[0156] S2012. The monitoring agent obtains the available communication bandwidth between each node and its upper-level node through link status detection. Specifically, the monitoring agent sends probe data packets to the upper-level node, records the time from sending the probe data packets to receiving confirmation, and divides the size of the probe data packets by the time to obtain an estimated value of the available communication bandwidth.

[0157] S2013. The monitoring agent reads the key management module configuration of this node to obtain key management capabilities; the key management capabilities include: supported key storage types, supported maximum number of keys, whether it has a hardware security module, and whether it supports key escrow and key rotation.

[0158] S2014. The monitoring agent reads the homomorphic encryption algorithm library information configured in this node and obtains the homomorphic ciphertext aggregation capability. The homomorphic ciphertext aggregation capability includes: supported homomorphic encryption algorithm identifiers, supported homomorphic addition operations, supported homomorphic scalar multiplication operations, supported maximum ciphertext modulus, supported maximum ciphertext polynomial degree, and ciphertext refresh operation support status.

[0159] S2015. Each node encapsulates the aforementioned real-time computing load, available communication bandwidth, key management capabilities, and homomorphic ciphertext aggregation capabilities into a node capability report and sends it to the coordination node that performs the matching execution policy; the coordination node can be any designated node among cloud-side nodes or edge nodes.

[0160] S202. Using the comprehensive sensitivity score and the level as the first matching condition, determine the initial homomorphic encryption parameters, the initial access control policy, and the initial audit policy from the preset policy matrix, specifically as follows:

[0161] S2021. Construct the preset policy matrix; the preset policy matrix uses four sensitivity levels as row indices and terminal-side, edge-side, and cloud-side layers as column indices. Each matrix unit stores the homomorphic encryption parameters, access control policies, and audit policies corresponding to that level and its combination. The homomorphic encryption parameters include the homomorphic encryption algorithm identifier, key length, plaintext modulus, and polynomial coefficient modulus. The access control policies include role-based authorization rules, authorization time windows, and authentication strength levels. The audit policies include audit trail levels and audit record storage methods, specifically:

[0162] S2021-1. When constructing the preset policy matrix, the protection policy matrix is ​​used as the initial mapping basis. The protection policy matrix is ​​arranged in four sensitivity levels as rows and encryption method, access control, data processing method, and audit trail as columns. Specifically: the encryption method corresponding to the first sensitivity level is homomorphic encryption plus trusted execution environment, access control is multi-factor authentication plus role restriction, data processing method is local processing or zero-knowledge proof, and audit trail is full-process audit plus real-time alarm; the encryption method corresponding to the second sensitivity level is homomorphic encryption or obfuscation, access control is role authorization plus time restriction, data processing method is federated learning or secure multi-party computation, and audit trail is critical operation audit; the encryption method corresponding to the third sensitivity level is differential privacy or lightweight encryption, access control is basic authorization mechanism, data processing method is de-identification plus lightweight protection computation, and audit trail is periodic audit; the encryption method corresponding to the fourth sensitivity level is basic de-identification technology, access control is general access control, data processing method is standard computation process, and audit trail is sampling audit.

[0163] The encryption method column in the protection policy matrix is ​​mapped to the homomorphic encryption parameter in the preset policy matrix, the access control column is mapped to the access control policy in the preset policy matrix, and the audit trail column is mapped to the audit policy in the preset policy matrix. Simultaneously, based on the differences in computing power between the endpoint, edge, and cloud layers, the mapped homomorphic encryption parameter, access control policy, and audit policy are adjusted in strength according to their respective layers within each matrix unit of the preset policy matrix to obtain a matrix unit value matching that layer.

[0164] Table 1: Preset Strategy Matrix

[0165]

[0166] In this embodiment, Table 1 serves as a protection strategy matrix, with four sensitivity levels as rows and encryption method, access control, data processing method, and audit trail as columns. It defines the basic protection measures to be adopted under different sensitivity levels: Level L1 requires dual protection of homomorphic encryption and trusted execution environment, multi-factor authentication and role restriction, local processing or zero-knowledge proof, and full-process auditing plus real-time alarms; Level L2 requires homomorphic encryption or obfuscation processing, role authorization plus time restriction, federated learning or secure multi-party computation, and auditing of critical operations; Level L3 requires differential privacy or lightweight encryption, basic authorization mechanism, de-identification plus lightweight protected computation, and periodic auditing; Level L4 only requires basic de-identification technology, general access control, standard computation process, and sampling auditing. In this embodiment, the table serves as the initial mapping basis for constructing the edge-cloud pre-defined policy matrix: First, the encryption method column is mapped to homomorphic encryption parameters (e.g., L1 corresponds to BFV homomorphic encryption parameters, including key length, plaintext modulus, polynomial coefficient modulus, etc.), the access control column is mapped to access control policies (e.g., L1 corresponds to multi-factor authentication plus role restriction), and the audit trail column is mapped to audit policies (e.g., L1 corresponds to full-process audit plus real-time alarm). Then, the strength of the policies in each matrix unit is adjusted according to the differences in computing power at the edge, cloud, and end-to-end levels, forming a complete pre-defined policy matrix with sensitivity level as the row and level as the column. Taking the "Unit Price Clause" field in a previous export contract as an example, this field, after comprehensive sensitivity assessment, outputs a final sensitivity level of L1. If participant A is located at the end-side level, the "L1-End-Side" unit is queried from the pre-set policy matrix to obtain the initial homomorphic encryption parameters, which are BFV algorithm parameters (key length 128 bits, plaintext modulus 65537, polynomial coefficient modulus 8192). The initial access control policy is multi-factor authentication plus role restriction, and the initial audit policy is full-process auditing plus real-time alarms. Subsequently, based on the real-time computing load of this end-side node (e.g., 8...), The initial parameters are verified and adjusted based on the following: (5% not exceeding the first load threshold of 90%) and the homomorphic ciphertext aggregation capability (such as support for the BFV algorithm, a maximum ciphertext modulus of 65537, and support for homomorphic addition and ciphertext refresh). This ultimately determines the homomorphic encryption parameters, access control policies, and audit policies actually used by the participant in this training round. In this way, while ensuring L1 level data security, the parameters are adapted to the actual computing and aggregation capabilities of the end-side nodes, avoiding unnecessary overhead caused by uniform high-strength encryption, and achieving differentiated privacy protection based on sensitivity level and hierarchical collaboration.

[0167] S2022: Receive the comprehensive sensitivity score and the level of the participant in the end-edge-cloud hierarchical architecture output by S1; map the comprehensive sensitivity score to four sensitivity levels, and use the level and the level as row index and column index to locate the corresponding matrix unit in the preset strategy matrix.

[0168] S2023. Read the homomorphic encryption parameters, access control policies and audit policies stored in the matrix unit, and use them as the initial homomorphic encryption parameters, initial access control policies and initial audit policies, respectively.

[0169] S203. Adjust the initial homomorphic encryption parameters according to the real-time computing load and the homomorphic ciphertext aggregation capability: If the real-time computing load is higher than a first load threshold, replace the initial homomorphic encryption parameters with homomorphic encryption parameters whose computational complexity is lower than the first complexity threshold, specifically:

[0170] S2031. Compare the real-time computing load of each node obtained in S201 with a preset first load threshold; the first load threshold can be set to 90%, and when the real-time computing load of any node is higher than 90%, the node is determined to be in a high load state.

[0171] S2032. When it is determined that a node is under high load, homomorphic encryption parameters with computational complexity lower than a first complexity threshold are selected from a preset homomorphic encryption parameter candidate set. The computational complexity is expressed as the average time required to perform a single homomorphic multiplication on a preset reference device. The first complexity threshold can be set to 10 milliseconds, which is set based on the preferred engineering threshold determined by those skilled in the art based on the training and encryption upload time budget of the edge node under resource-constrained conditions, the typical computational overhead of the homomorphic encryption scheme, and the real-time requirements of edge-cloud federated learning. When the real-time computational load of the edge node is higher than the first load threshold, the system needs to replace the initial homomorphic encryption parameters with parameters with lower computational complexity to ensure that the gradient encryption operation will not further exacerbate the node resource shortage. The average time of a single homomorphic multiplication of 10 milliseconds corresponds to the time required to perform a single homomorphic multiplication on a preset reference device. An upper limit is set for the overhead of performing a core ciphertext multiplication on the reference device. This value ensures that when multiple gradient elements are encrypted in batches using ciphertext packing technology, the total time of all homomorphic encryption operations in a single training round can be controlled within the acceptable processing latency range of the edge node. This avoids timeouts in the local training-encryption-upload link or a continuous increase in node load due to excessive encryption time. At the same time, the 10-millisecond threshold also takes into account the typical performance of current mainstream homomorphic encryption algorithm libraries on edge computing hardware. It can retain enough candidate parameters for replacement while meeting basic security strength. This prevents the threshold from being too low, resulting in too few selectable parameters or a significant decrease in security strength. It also prevents the threshold from being too high, which would prevent high-load nodes from obtaining effective performance mitigation. Thus, an engineering-acceptable balance is achieved between encryption efficiency, security strength, and node availability.

[0172] In this embodiment, the preset reference device is set based on a benchmark hardware environment predefined by those skilled in the art to ensure the consistency, reproducibility, and comparability of the homomorphic encryption parameter computational complexity evaluation results. This device typically selects a processor platform representative of the actual computing power of the main nodes in the edge-cloud hierarchical architecture, and fixes its key parameters such as clock speed, number of cores, cache capacity, memory frequency, and instruction set support, while disabling dynamic frequency adjustment, hyper-threading, and background tasks that may affect the time consumption of a single homomorphic multiplication. In specific implementation, the preset reference device can be set as a machine equipped with a specified multi-core CPU, memory of fixed capacity and frequency, and running the same operating conditions as each node. The physical machine or equivalent virtual machine of the version homomorphic encryption algorithm library has its hardware configuration and software environment kept constant as controlled variables. During evaluation, a single homomorphic multiplication is performed on multiple sets of random plaintext on this device. After removing the first execution and obvious outliers, the average execution time is taken as the computational complexity index of the corresponding homomorphic encryption parameter. Through the above benchmarking settings, the comparison of computational complexity between different homomorphic encryption parameters can eliminate the interference of device heterogeneity, operating environment fluctuations and measurement errors. This provides an objective, stable and reproducible quantitative basis for subsequent parameter replacement based on real-time computing load and the first complexity threshold, as well as for selecting appropriate homomorphic encryption parameters in the process of matching with the homomorphic ciphertext aggregation capability.

[0173] S2033. The preset homomorphic encryption parameter candidate set contains multiple homomorphic encryption parameters with different computational complexities. Each parameter is pre-labeled with its corresponding computational complexity and security strength. When selecting, parameters whose security strength meets the current sensitivity level requirements and whose computational complexity is lower than the first complexity threshold are given priority.

[0174] S2034. Replace the initial homomorphic encryption parameter with the selected homomorphic encryption parameter to obtain the adjusted homomorphic encryption parameter; if there is no parameter in the candidate set that simultaneously satisfies the security strength and computational complexity conditions, select the parameter with the highest security strength and the lowest computational complexity, and reduce the encryption strength requirement corresponding to the current sensitivity level to the lowest acceptable level.

[0175] S204. If the homomorphic ciphertext aggregation capability does not satisfy the ciphertext aggregation condition corresponding to the initial homomorphic encryption parameters, then the initial homomorphic encryption parameters are replaced with homomorphic encryption parameters that match the homomorphic ciphertext aggregation capability, specifically as follows:

[0176] S2041. Read the ciphertext aggregation conditions corresponding to the homomorphic encryption parameters adjusted in S203; the ciphertext aggregation conditions include: each ciphertext participating in the aggregation must use the same ciphertext modulus, the same polynomial coefficient modulus and the same key space, and the sum of the noise margins of each ciphertext does not exceed a preset noise threshold.

[0177] S2042. Compare the homomorphic ciphertext aggregation capability obtained in S201 with the ciphertext aggregation conditions item by item. The comparison items include whether the supported homomorphic encryption algorithm identifier is consistent, whether the supported maximum ciphertext modulus covers the modulus value required by the ciphertext aggregation conditions, whether the supported maximum ciphertext polynomial degree covers the required value, whether homomorphic addition operation is supported, and whether ciphertext refresh operation is supported.

[0178] S2043. When any comparison item in the homomorphic ciphertext aggregation capability does not satisfy the ciphertext aggregation condition, it is determined that it is not satisfied; a replacement parameter that simultaneously satisfies the following conditions is selected from the preset homomorphic encryption parameter candidate set: the ciphertext aggregation condition corresponding to the replacement parameter is completely covered by the homomorphic ciphertext aggregation capability, and the computational complexity of the replacement parameter is not higher than the preset upper limit value, and the security strength is not lower than the minimum security strength corresponding to the current sensitivity level.

[0179] S2044. Replace the initial homomorphic encryption parameter with the replacement parameter; if there is no replacement parameter in the candidate set that meets the conditions, select the parameter that is closest to the homomorphic ciphertext aggregation capability and has the highest security strength, and adjust the aggregation strategy to only aggregate the subset of ciphertext that meets the ciphertext aggregation conditions.

[0180] S205. Based on a preset set of cross-border data compliance rules, perform cross-level permission inheritance verification and permission intersection determination on the initial access control policy. When the permission set of the first level and the permission set of the second level have inconsistent authorizations for the same cross-level operation, adjust the initial access control policy to an inter-level access control policy that satisfies the permission constraints of each level, specifically as follows:

[0181] S2051. Load the preset cross-border data compliance rule set; the preset cross-border data compliance rule set includes a multi-country regulatory compliance mapping table, which is arranged by data category as rows and by applicable regulations as columns, with each cell storing the corresponding compliance requirements; the applicable regulations include the General Data Protection Regulation of country a1, the Personal Information Protection Act of country a2, the Consumer Privacy Act of country a3, and the Personal Data Protection Act of country a4, as shown in Table 2:

[0182] Table 2: Multi-country regulatory compliance mapping table

[0183]

[0184] In this embodiment, the multi-country regulatory compliance mapping table consists of a data category dimension and an applicable regulatory dimension. The data category dimension is divided into five categories based on sensitivity level: trade secrets, personally identifiable information, transaction data, product information, and public information. The applicable regulatory dimension includes four categories: Country A1's General Data Protection Regulation (GDPR), Country A2's Personal Information Protection Law, Country A3's Consumer Privacy Law, and Country A4's Personal Data Protection Law. Additionally, a comprehensive protection strategy column is included. Each cell in the multi-country regulatory compliance mapping table stores the compliance requirements of the corresponding data category under the corresponding regulation. For example, trade secret data is subject to the GDPR of Country A1. The compliance requirements are: high-strength encryption; under the personal information protection law of country A2, cross-border assessment; under the consumer privacy law of country A3, informed consent; and under the personal data protection law of country A4, high-strength encryption. The corresponding comprehensive protection strategy is to simultaneously satisfy high-strength encryption, cross-border assessment, and informed consent. The compliance requirements for personally identifiable information under the General Data Protection Regulation (GDPR) of country A1 are anonymization and consent; under the personal information protection law of country A2, separate consent and localization; under the consumer privacy law of country A3, opt-out; and under the personal data protection law of country A4, compliance is required. The requirement is explicit consent, and the corresponding comprehensive protection strategy is to simultaneously satisfy anonymization, explicit consent, and the right to opt out; the compliance requirements for transaction data under the General Data Protection Regulation (GDPR) of country A1 are encryption and purpose restriction; the compliance requirements under the Personal Data Protection Act of country A2 are minimum necessity and encryption; the compliance requirements under the Consumer Privacy Act of country A3 are disclosure and notification; and the compliance requirements under the Personal Data Protection Act of country A4 are purpose restriction. The corresponding comprehensive protection strategy is to simultaneously satisfy encryption, purpose restriction, and minimum necessity; the compliance requirements for product information under the GDPR of country A1, the Consumer Privacy Act of country A3, and the Personal Data Protection Act of country A4 are... All are basic protections. The compliance requirements under the personal information protection law of country a2 are classified management, and the corresponding comprehensive protection strategy is to satisfy both classified management and basic protection. The compliance requirements for public information under the four types of regulations are all minimum requirements, and the comprehensive protection strategy is the minimum requirement. After a person skilled in the art determines the data category and applicable regulations involved in the current cross-layer operation in S2052, he / she can use the data category as the row index and the applicable regulations as the column index to directly extract the corresponding compliance requirements in the multi-country regulatory compliance mapping table, and use the extracted compliance requirements as the permission constraints for subsequent cross-layer permission inheritance verification and permission intersection determination.

[0185] S2052. Determine the data category involved in the current cross-layer operation and the applicable regulations corresponding to the level of the participating parties; extract the compliance requirements corresponding to the data category and applicable regulations from the multi-country regulatory compliance mapping table as permission constraints.

[0186] S2053. Perform cross-level permission inheritance verification on the initial access control policy; specifically, check whether the permission set of the first level contains permission items inherited from the second level permission set; when a permission item in the second level permission set does not exist in the first level permission set and is not within the scope of inheritance, the inheritance verification is determined to fail.

[0187] S2054. Perform permission intersection determination; compare the authorization status of the first-level permission set and the second-level permission set for the same cross-level operation (such as cross-level aggregation operation, parameter delivery operation); when the two levels grant one authorization and deny the other for the same cross-level operation, it is determined that there is inconsistent authorization.

[0188] S2055. When inheritance verification fails or inconsistent authorization is determined in the permission intersection, the initial access control policy is adjusted to an inter-level access control policy. The inter-level access control policy generates independent permission rules for the first level and the second level respectively, so that the permission rules of the first level meet the compliance requirements applicable to the first level, the permission rules of the second level meet the compliance requirements applicable to the second level, and a permission negotiation step is added at the cross-level operation entry point.

[0189] S206. Based on the sensitivity level and operation type corresponding to the comprehensive sensitivity score, the initial audit strategy is refined into audit strategies for cross-layer aggregation operations and parameter distribution operations, resulting in the final audit strategy, specifically:

[0190] S2061. Obtain the sensitivity level corresponding to the comprehensive sensitivity score and the type of operation currently being performed; the operation type includes cross-layer aggregation operation, parameter distribution operation, gradient upload operation, identity authentication operation and inference operation.

[0191] S2062. Find the audit strategy corresponding to the sensitivity level and the operation type from the preset audit strategy mapping table; the preset audit strategy mapping table is divided into four sensitivity levels and operation types, wherein the first level of sensitivity level cross-layer aggregation operation and parameter distribution operation corresponds to full-process audit plus real-time alarm, the second level of sensitivity level cross-layer aggregation operation and parameter distribution operation corresponds to critical operation audit, the third level of sensitivity level cross-layer aggregation operation and parameter distribution operation corresponds to periodic audit, and the fourth level of sensitivity level cross-layer aggregation operation and parameter distribution operation corresponds to sampling audit.

[0192] S2063. Based on the identified audit strategy, refine the audit record content and storage method. For full-process audit with real-time alerts, the audit record content includes the operation initiator identifier, operation time, operation type, input ciphertext identifier set, output ciphertext identifier, list of participating nodes, and permission verification results, and triggers a real-time alert when an abnormal operation is detected. For critical operation audits, the audit record content only includes the operation time, operation type, number of participating parties, and summary of aggregated results. For periodic audits, summarize audit records and generate audit reports according to a preset cycle. For sampling audits, randomly select operation records for auditing according to a preset ratio.

[0193] S2064. The refined audit strategy is output as the final audit strategy for use by subsequent edge nodes, cloud nodes and inference stages when performing audit trails.

[0194] As a concrete example, in an international trade transaction, participant A has its end-side node located in country a2, its edge node in country a4, and its cloud-side node in country a1. Participant A holds price terms data from an export contract. After evaluation by S1, this data outputs a final sensitivity level of L1, corresponding to the data category of pricing strategies within trade secrets. Participant A is located at the end-side level. In S201, the monitoring agent deployed on the edge node collects the running status every 5 seconds. At a certain collection moment, the CPU utilization rate is 90% and the memory utilization rate is 77.5%. The real-time computing load is obtained by weighting the CPU utilization rate by 60% and the memory utilization rate by 40%, which is 90%×0.6+77.5%×0.4=85%. The available communication bandwidth is measured to be 20 megabits per second by probing data packets. In this embodiment, the real-time computing load is represented by the weighted average of CPU utilization rate and memory utilization rate, with the weights set to 60% and 40%, respectively. The weighting is based on the preferred weight allocation determined by those skilled in the art based on the resource consumption characteristics of the edge node in the federated learning training and homomorphic encryption upload process: the edge node performs operations such as global model forward propagation, back propagation, gradient pruning, quantization encoding, and homomorphic encryption, all of which are computationally intensive tasks. The CPU utilization rate directly reflects the current degree of occupancy and remaining computing resources of the node. Computing power is a key bottleneck factor determining whether the above tasks can be completed within the preset time, and therefore it is given a high weight of 60%. Memory occupancy mainly reflects the resident state of model parameters, training samples, intermediate gradients, and encrypted data in the node. Its impact on the time consumption of computationally intensive tasks is relatively indirect, reflecting more the system resource occupancy level than the computing throughput capacity, and therefore it is given a lower weight of 40%. Through the above weighting method, the real-time computing load index can more sensitively reflect the actual computing pressure of the edge node during the training and encryption process, ensuring that when the central processor is close to saturation, the index can rise in time and trigger the corresponding layer freezing or homomorphic encryption parameter replacement operation. At the same time, it avoids misjudging the node load status due to instantaneous fluctuations in memory occupancy, thereby achieving an engineering-acceptable balance between the accuracy of computing bottleneck identification and the stability of system status assessment, and providing a reliable basis for the adaptive strategy adjustment based on real-time load under the edge-cloud hierarchical architecture.

[0195] The local key management module configuration is read to confirm support for hardware security modules and key rotation. The homomorphic encryption algorithm library is read to confirm support for the BFV homomorphic encryption algorithm, with a maximum ciphertext modulus of 65537, a maximum ciphertext polynomial degree of 8192, and ciphertext refresh operation support. These capability indicators are encapsulated into a node capability report and sent to the cloud-side node acting as the coordinating node. In S202, the coordinating node uses the L1 level and end-side level as indexes to query the matrix unit in the preset policy matrix, which is row L1 and column end-side, to read the initial homomorphic encryption parameters, which are the BFV algorithm parameters (key length 128 bits, plaintext modulus 65537, polynomial coefficient modulus 8192). The initial access control policy is multi-factor authentication plus role restriction, and the initial audit policy is full auditing plus real-time alarm. In S203, the real-time computing load of 85% is compared with the first load threshold of 90%. Since 85% is lower than 90%, homomorphic encryption parameter replacement is not triggered. In S204, the homomorphic ciphertext aggregation capability of the end node is compared item by item with the ciphertext aggregation conditions corresponding to the initial homomorphic encryption parameters: the algorithm identifier is BFV, the maximum ciphertext modulus of 65537 is equal to the required modulus value, the maximum polynomial degree of 8192 is equal to the required degree, homomorphic addition is supported, and ciphertext refresh is supported. If all comparison items are satisfied, it is determined that the homomorphic ciphertext aggregation capability covers the ciphertext aggregation conditions, and no parameter replacement is required. In S205, the data category involved in the current cross-layer operation is determined to be trade secrets, and the applicable regulations involve GDPR of country a1 and PIPL of country a2. High-strength encryption requirements are extracted from the multi-country regulatory compliance mapping table with trade secrets as rows and GDPR as columns, and cross-border assessment requirements are extracted with trade secrets as rows and PIPL as columns. When performing cross-layer permission inheritance verification on the initial access control policy, it was found that edge nodes authorized the parameter distribution operation, while cloud nodes defaulted to denying the same operation, resulting in inconsistent authorization states. Therefore, the access control policy was adjusted to an inter-layer access control policy: edge nodes only perform encrypted uploads, edge nodes are allowed to execute aggregation after completing cross-border assessment verification, and cloud nodes are allowed to execute global aggregation only after receiving the cross-border assessment approval certificate from the edge node. In S206, based on the L1 level and the type of cross-layer aggregation operation, full-process auditing with real-time alerts is matched from the preset audit policy mapping table. The final audit policy requires audit records to include the operation initiator identifier, operation time, operation type, input ciphertext identifier set, output ciphertext identifier, participating node list, and permission verification result, and to trigger real-time alerts when unauthorized access is detected.

[0196] It should be further explained that, in this embodiment, the gradient is obtained by training based on the global model and local data, including:

[0197] S301. Obtain the real-time computing load of the endpoint; when the real-time computing load is higher than a first load threshold, freeze a preset number of layer parameters near the input layer in the global model, and only perform forward and backward propagation on the remaining layers of the global model to obtain the local gradient, specifically:

[0198] S3011. The current real-time computing load is read by the monitoring agent deployed on the edge node. The real-time computing load is a weighted average of CPU utilization and memory usage. Specifically, the weighted average is calculated with a 60% weight for CPU utilization and a 40% weight for memory usage, and is taken as the real-time computing load. In this embodiment, model training on the edge node is a computationally intensive task. The influence of CPU utilization on training time is higher than that of memory usage. Therefore, those skilled in the art set the weight of CPU utilization to 60% and the weight of memory usage to 40% to more accurately reflect the actual load status of the edge node during federated training.

[0199] S3012. Compare the real-time computing load with a preset first load threshold. In this embodiment, the first load threshold can be set to 90%. In this embodiment, the first load threshold is set to 90% because when the overall load of the edge node exceeds 90%, the remaining computing resources are insufficient to complete the training task of all layers within the preset time. If the threshold is set too low, it will frequently trigger layer freezing, resulting in a decrease in model convergence performance. If it is set too high, it may not be able to trigger the protection mechanism in time. Therefore, 90% is a reasonable threshold for balancing training quality and resource protection.

[0200] S3013. When the real-time computing load exceeds the first load threshold, determine the number of global model layers to be frozen. The global model is a neural network model, comprising an input layer, multiple hidden layers, and an output layer connected in sequence. A predetermined number of consecutive layers near the input layer are determined as frozen layers. The predetermined number of layers is dynamically determined based on the proportion by which the real-time computing load exceeds the first load threshold: when the real-time computing load exceeds the first load threshold by no more than 10%, freeze the first three layers near the input layer; when the real-time computing load exceeds the first load threshold by more than 10% but no more than 20%, freeze the first five layers near the input layer; when the real-time computing load exceeds the first load threshold by more than 20%, freeze the first seven layers near the input layer. In this embodiment, the number of frozen layers is adjusted in segments according to the proportion by which the real-time computing load exceeds the first load threshold because the more the load exceeds the threshold, the less computing resources are available on the edge nodes, requiring more pre-frozen layers near the input layer to reduce the computational load. Pre-frozen layers near the input layer typically extract general features and have a relatively small impact on the overall expressive power of the model, so they are frozen first. Setting three, five, and seven layers in segments allows those skilled in the art to provide differentiated training overhead control when resource constraints vary.

[0201] S3014. Mark the parameters of the frozen layer as non-updateable, and keep the parameter values ​​of the frozen layer unchanged during this forward and backward propagation process; perform forward propagation on the remaining layers in the global model other than the frozen layer to obtain the prediction output.

[0202] S3015. Calculate the loss value based on the predicted output and the corresponding label; perform backpropagation on the remaining layer to calculate the gradient of each parameter in the remaining layer; use the gradient of the remaining layer as the local gradient obtained in this training, and do not calculate or update the gradient of the frozen layer.

[0203] S302. When the real-time computing load is not higher than the first load threshold, forward and backward propagation are performed on all layers of the global model to obtain the initial gradient, specifically as follows:

[0204] S3021. When the real-time computing load is not higher than the first load threshold, keep the parameters of all layers in the global model in an updatable state and do not perform a freeze operation.

[0205] S3022. Input the training samples from the local data into the global model in batches; the size of each batch is determined based on the available memory of the edge node, for example, set to 32 training samples. In this embodiment, the batch size is set to 32, which is a trade-off between the available memory capacity of the edge node and the stability of gradient estimation; too large a batch will lead to insufficient memory or increased computational latency, while too small a batch will increase gradient estimation noise. 32 is a commonly used value by those skilled in the art to balance training efficiency and convergence stability under the conditions of this edge device.

[0206] S3023. Perform forward propagation on all layers of the global model to obtain the predicted output; calculate the loss value based on the predicted output and the corresponding label; perform backpropagation on all layers of the global model to calculate the gradient of each parameter in all layers, and use the gradient of all layers as the initial gradient.

[0207] S303. Before performing the forward and backward propagation, the training samples in the local data are divided into multiple training sample groups based on the comprehensive sensitivity score, specifically:

[0208] S3031. Obtain the comprehensive sensitivity score calculated by S1; the comprehensive sensitivity score is used to characterize the sensitivity of each training sample, and the score value is between 0 and 1.

[0209] S3032. Based on the comprehensive sensitivity score, the training samples are divided into four training sample groups: the first-level training sample group corresponds to the score interval [0.75, 1.0], the second-level training sample group corresponds to the score interval [0.5, 0.75), the third-level training sample group corresponds to the score interval [0.25, 0.5), and the fourth-level training sample group corresponds to the score interval [0, 0.25]. In this embodiment, the division interval of the four training sample groups adopts the same score interval as the sensitivity level mapping in S1071. This is to ensure the consistency between the training sample grouping and the sensitivity grading results, so that the differentiated configuration of the learning rate and training rounds of each group can accurately correspond to the data sensitivity level, and avoid deviations between grouping and grading.

[0210] S3033. For each training sample, its comprehensive sensitivity score is compared with the four score intervals mentioned above to determine the sensitivity level to which the training sample belongs, and the training sample is assigned to the corresponding training sample group, resulting in four training sample groups. In this embodiment, each training sample corresponds to a local data item, and the comprehensive sensitivity score of the local data item has been calculated and stored in S1; when executing S3033, the stored comprehensive sensitivity score corresponding to each training sample is directly read, and the samples are grouped according to the preset score interval, without the need to recalculate the sensitivity score.

[0211] S304. Configure the corresponding learning rate and local training epochs for each training sample group, and calculate the group gradient for each training sample group. Specifically:

[0212] S3041. Based on the sensitivity level corresponding to each training sample group, configure different learning rates for each training sample group; specifically, the learning rate for the first-level training sample group is configured as 0.001, the learning rate for the second-level training sample group is configured as 0.005, the learning rate for the third-level training sample group is configured as 0.01, and the learning rate for the fourth-level training sample group is configured as 0.02. In this embodiment, setting a smaller learning rate for training sample groups with higher sensitivity levels is to reduce the update magnitude of model parameters by highly sensitive samples, reduce the impact of highly sensitive samples on model output, and reduce the model's memorization of highly sensitive samples; setting a larger learning rate for low-sensitivity sample groups is beneficial to make full use of low-sensitivity samples to accelerate model convergence; the above learning rate values ​​are determined based on the commonly used learning rate range in the pre-trained model fine-tuning process and the distribution of the four groups of samples in this embodiment.

[0213] S3042. Based on the sensitivity level corresponding to each training sample group, configure different local training rounds for each training sample group; specifically, the local training rounds for the first-level training sample group are configured as 1, for the second-level training sample group as 2, for the third-level training sample group as 3, and for the fourth-level training sample group as 5. In this embodiment, fewer local training rounds are set for the high-sensitivity sample group to reduce the risk of overfitting and privacy leakage caused by multiple trainings of high-sensitivity samples on the edge; more local training rounds are set for the low-sensitivity sample group to fully extract the general patterns in the low-sensitivity samples and improve the model's generalization ability; this value is determined based on the computational power of the edge nodes and the constraints of federated learning communication efficiency.

[0214] S3043. For each training sample group, use mini-batch stochastic gradient descent optimization. According to the learning rate and local training rounds corresponding to the group, perform forward propagation and backward propagation on the training samples in the group respectively, and calculate the group gradient corresponding to the group. The mini-batch size of the mini-batch stochastic gradient descent can be set to 16.

[0215] S305. Weight the gradients of each training sample group according to the proportion of the number of samples in each group to obtain the initial gradient, specifically as follows:

[0216] S3051. Count the number of samples in each training sample group.

[0217] S3052. Calculate the proportion of the number of samples in each training sample group to the total number of samples in all training sample groups, and obtain the first proportion, the second proportion, the third proportion and the fourth proportion respectively.

[0218] S3053. Multiply the group gradient of the first-level training sample group by the first proportion, multiply the group gradient of the second-level training sample group by the second proportion, multiply the group gradient of the third-level training sample group by the third proportion, and multiply the group gradient of the fourth-level training sample group by the fourth proportion. Add the four products together to obtain the merged local gradient.

[0219] S306. A weighted average is calculated between the initial gradient and the historical gradient obtained in the previous training round to obtain the corrected local gradient. This corrected local gradient is then used as the gradient to be clipped. Specifically:

[0220] S3061. Obtain the historical gradient obtained in the previous training round; if the current round is the first training round, initialize the historical gradient as a zero vector with the same dimension as the initial gradient.

[0221] S3062. Set the momentum coefficient; in this embodiment, the momentum coefficient can be set to 0.9; multiply each element of the historical gradient by the momentum coefficient 0.9 to obtain a first product vector; multiply each element of the initial gradient by 0.1 to obtain a second product vector; add the first product vector and the second product vector element by element to obtain the corrected local gradient. In this embodiment, the momentum coefficient is set to 0.9, which is an empirical value commonly used by those skilled in the art in stochastic gradient descent optimization. This value can effectively smooth the historical gradient direction, reduce the random fluctuation of the current gradient, improve the stability of local model training, and at the same time, it will not introduce too much historical gradient bias.

[0222] S3063. The corrected local gradient is used as the gradient to be clipped for subsequent gradient clipping and encryption steps.

[0223] It should be further explained that, in this embodiment, encrypting the clipped gradient according to the homomorphic encryption parameters includes:

[0224] S307. Obtain the numerical range of the clipped gradient, specifically as follows:

[0225] S3071. Perform gradient clipping on the gradient to be clipped; a preset clipping threshold is C, which can be set to 1.0 in this embodiment; calculate the L2 norm of the gradient to be clipped; when the L2 norm is greater than the clipping threshold C, multiply each element of the gradient to be clipped by the ratio of C to the L2 norm to obtain the clipped gradient; when the L2 norm is not greater than the clipping threshold C, directly use the gradient to be clipped as the clipped gradient. In this embodiment, the clipping threshold C is set to 1.0, which is determined based on the statistical distribution of the local gradient norm; by analyzing the norm distribution of the historical training gradients of the edge nodes, the L2 norm of most gradients is concentrated below 1.0. Setting the clipping threshold to 1.0 can prevent gradient explosion while retaining most of the effective gradient information, avoiding excessive clipping that leads to insufficient model training.

[0226] S3072. Traverse all elements in the clipped gradient, record the minimum and maximum values ​​among all elements, and obtain the numerical range of the clipped gradient.

[0227] S308. Based on the plaintext modulus and preset scaling factor in the homomorphic encryption parameters, the clipped gradient is quantized and encoded to convert the floating-point gradient into an integer gradient represented by the plaintext modulus, specifically as follows:

[0228] S3081. Obtain the final homomorphic encryption parameters obtained after adjustment in S2, and read the plaintext modulus and preset scaling factor from the final homomorphic encryption parameters; in this embodiment, the preset scaling factor can be set to 10.6 In this embodiment, the preset scaling factor is set to 10. 6 This is to preserve sufficient decimal precision during floating-point gradient quantization encoding; the absolute value of the gradient elements obtained from training edge nodes is typically in the range of 10. -3 Up to 10 -1 Between, multiply by 10 6 After rounding, it can retain six decimal places of precision, while the value of the integer gradient will not exceed the representable range of commonly used plaintext moduli, thus balancing quantization accuracy and range security.

[0229] S3082. For each floating-point element in the clipped gradient, multiply the floating-point element by the preset scaling factor, and round the product result to obtain the corresponding integer element; if a product result is positive and the decimal part is 0.5, round it up; if it is negative and the decimal part is 0.5, round it away from zero; form an integer gradient from all integer elements.

[0230] S3083. Use the integer gradient as the plaintext gradient to be encrypted.

[0231] S309. Determine whether the numerical range of the integer gradient is included in the representable numerical range corresponding to the plaintext modulus, specifically:

[0232] S3091. Obtain the minimum and maximum values ​​of all integer elements in the integer gradient, and determine the numerical range of the integer gradient.

[0233] S3092. Determine the representable numerical range corresponding to the plaintext modulus based on the plaintext modulus; when using signed representation, the plaintext modulus with a negative representable numerical range is divided by 2 and rounded down to the plaintext modulus with a positive representable numerical range, then subtracted by 1. In this embodiment, the plaintext modulus with a negative representable numerical range under signed representation is divided by 2 and rounded down to the plaintext modulus with a positive representable numerical range, then subtracted by 1. This is a commonly used plaintext encoding method in homomorphic encryption algorithms, which can simultaneously represent positive and negative gradients and ensure symmetry near the zero value, avoiding additional decoding errors introduced by offset encoding.

[0234] S3093. Determine whether the numerical range of the integer gradient is completely contained within the representable numerical range corresponding to the plaintext modulus; if the minimum value of the numerical range of the integer gradient is greater than or equal to the minimum value of the representable numerical range, and the maximum value of the numerical range of the integer gradient is less than or equal to the maximum value of the representable numerical range, then it is determined to be contained within; otherwise, it is determined not to be contained within.

[0235] S310. If the numerical range of the integer gradient is not included in the representable numerical range, then adjust the preset scaling factor or reselect the plaintext modulus until the numerical range of the integer gradient is included in the representable numerical range, specifically:

[0236] S3101. When S309 determines that the numerical range of the integer gradient is not included in the representable numerical range, an adjustment operation is performed.

[0237] S3102. The adjustment operation includes two methods: The first method is to reduce the preset scaling factor by decreasing it by a preset step size, for example, multiplying it by 0.1, and repeating S308 and S309 to re-quantize and encode and re-determine the interval; the second method is to reselect homomorphic encryption parameters with a larger plaintext modulus from the homomorphic encryption parameter candidate set used in S2, and repeating S308 and S309. In this embodiment, when the integer gradient value interval exceeds the plaintext modulus representable interval, the preset scaling factor is gradually reduced by 0.1 times. This can quickly narrow the value range of the integer gradient without excessive loss of quantization accuracy, avoiding the loss of low-order gradient information due to excessive reduction at once, which would affect the model convergence accuracy.

[0238] S3103. Repeat the above adjustment operation until the numerical range of the integer gradient is contained within the representable numerical range, and record the final preset scaling factor and plaintext modulus used.

[0239] S311. Pack multiple elements in the integer gradient into the same ciphertext, perform homomorphic encryption according to the homomorphic encryption parameters, and obtain the encryption gradient, specifically as follows:

[0240] S3111. A single-instruction multiple-data packing technique is used to sequentially fill multiple elements of the integer gradient into the coefficient positions of multiple plaintext polynomials. The number of coefficients in each plaintext polynomial is determined by the polynomial coefficient modulus in the homomorphic encryption parameters. When the total number of elements of the integer gradient exceeds the coefficient capacity of a single plaintext polynomial, the filling is performed using multiple plaintext polynomials. In this embodiment, using the single-instruction multiple-data packing technique to fill multiple integer gradient elements into the coefficient positions of the same plaintext polynomial can fully utilize the ciphertext slot capacity of the homomorphic encryption algorithm, significantly reducing the number of encrypted ciphertexts for high-dimensional gradients, thereby reducing the communication and computational overhead during edge node aggregation.

[0241] S3112. Using the public key in the homomorphic encryption parameters, perform homomorphic encryption on each plaintext polynomial to generate the corresponding ciphertext polynomial.

[0242] S3113. Combine all the ciphertext polynomials in order to obtain the encryption gradient; the encryption gradient is stored in the form of a ciphertext array.

[0243] S312. If the ciphertext modulus, ciphertext length, or key space in the homomorphic encryption parameters corresponding to each edge node are inconsistent, the encryption gradient is converted into ciphertext that matches the unified ciphertext modulus and unified key space required for homomorphic aggregation by the edge node, and then uploaded to the edge node. Specifically:

[0244] S3121. Compare whether the ciphertext modulus, ciphertext length, and key space corresponding to the current edge node are consistent with the unified ciphertext modulus and unified key space required for the edge node to perform homomorphic aggregation.

[0245] S3122. When there is inconsistency, a ciphertext conversion operation is performed. The ciphertext conversion operation includes ciphertext modulus switching and key space remapping. The ciphertext modulus switching uses a modulus switching algorithm to convert the ciphertext from the current ciphertext modulus to the unified ciphertext modulus, while adjusting the ciphertext noise. Key space remapping is performed by re-encrypting the plaintext gradient locally using the edge node's public key, or by using a re-encryption key to convert the current ciphertext into ciphertext under the edge node's key space. In this embodiment, when the encryption gradient uploaded by the end node is inconsistent with the ciphertext modulus or key space required for edge node aggregation, the modulus switching algorithm can adjust the ciphertext modulus and control the growth of ciphertext noise, while key space remapping can ensure that the ciphertext can be aggregated under the edge node's key space. The combination of the two can achieve the unification of heterogeneous ciphertext parameters without leaking the plaintext gradient, ensuring the correctness and security of subsequent homomorphic aggregation.

[0246] S3123. Upload the converted encryption gradient to the edge node; if they match, directly upload the encryption gradient to the edge node without performing a conversion operation.

[0247] It should be further explained that, in this embodiment, after authenticating and verifying the identities and permissions of the participants according to the access control policy, the encryption gradient is uploaded to the edge node, including:

[0248] S313. Obtain the identity credentials and authorization tokens of the participating parties, specifically as follows:

[0249] S3131, The edge node reads the participant's identity credentials from local secure storage; the identity credentials are digital certificates, containing the participant's public key, participant identifier, and the certificate issuer's digital signature. In this embodiment, digital certificates are used for the participant's identity credentials because digital certificates can establish cross-trust domain relationships through a certificate chain verification mechanism, and the certificate contains the participant's public key, facilitating subsequent verification of the participant's signature on the uploaded credentials, thus meeting the cross-domain identity authentication requirements in the edge-cloud hierarchical architecture.

[0250] S3132, The end node reads the permission token of the participant from the local secure storage; the permission token is issued by the permission management service and includes role authorization information and authorization time window; the role authorization information includes a list of allowed operation types; the authorization time window includes start time and end time.

[0251] S314. Perform cross-trust domain certificate chain verification on the identity credential and query the revocation status corresponding to the identity credential, specifically as follows:

[0252] S3141. Perform cross-trust domain certificate chain verification on the identity credential. The verification process is as follows: starting from the identity credential, verify the signatures of each level of certificate step by step until tracing back to the root certificate of the local trust. If any signature verification fails or the certificate chain is broken, the cross-trust domain certificate chain verification is deemed unsuccessful. In this embodiment, performing cross-trust domain certificate chain verification on the identity credential is to establish a unified identity trust foundation between different trust domains; at the same time, querying the revocation status can promptly identify revoked identity credentials, preventing leaked or expired credentials from being used to upload illegal credentials.

[0253] S3142. Query the revocation status of the identity credential; obtain the revocation status of the identity credential by initiating a query to the certificate revocation list or online certificate status protocol service; the revocation status includes revoked and not revoked; if the query returns revoked, the identity credential is determined to be untrustworthy.

[0254] S315. When the revocation status is not revoked and the cross-trust domain certificate chain verification is successful, multi-factor authentication is performed on the participating party. The multi-factor authentication includes verification of two or more authentication factors, specifically:

[0255] S3151. Determine whether the revocation status is not revoked and whether the cross-trust domain certificate chain verification is successful; if both conditions are met, proceed to the multi-factor authentication step; otherwise, refuse authentication.

[0256] S3152. Perform multi-factor authentication on the participants; the multi-factor authentication includes a first authentication factor and a second authentication factor; the first authentication factor is the signature of the random challenge by the private key held by the participant, and the signature is verified using the public key in the identity credential; the second authentication factor is a one-time dynamic password or biometric comparison, wherein the one-time dynamic password is generated by the hardware token held by the participant and is synchronized with the local time during verification, and the biometric comparison is completed by calling the local biometric verification module. In this embodiment, the first authentication factor uses the signature of the random challenge by the participant's private key, which can strongly bind the participant's identity based on a cryptographic mechanism; the second authentication factor uses a one-time dynamic password or biometric comparison, which can prevent attackers from directly passing authentication if the private key is stolen; the combination of the two factors can significantly improve the reliability of identity authentication.

[0257] S3153. When all authentication factors in the multi-factor authentication pass verification, the identity authentication is deemed successful; otherwise, the identity authentication is deemed unsuccessful, and subsequent permission verification is rejected.

[0258] S316. Obtain the role authorization information and authorization time window from the permission token, compare the authorization time window with the current time, and compare the role authorization information with the operation type of uploading encryption gradients. Specifically:

[0259] S3161. Parse role authorization information from the permission token; the role authorization information includes a list of allowed operation types.

[0260] S3162. Parse the authorization time window from the permission token; the authorization time window includes a start time and an end time. In this embodiment, setting role authorization information and an authorization time window in the permission token is to implement the principle of least privilege and the timeliness of permissions; the role authorization information only contains a list of allowed operation types, which can prevent participants from exceeding their authority to perform other operations; the authorization time window limits the effective time of permissions, reducing the security risks caused by the long-term validity of the permission token.

[0261] S3163. Obtain the current time and determine whether the current time falls within the authorized time window; at the same time, determine whether the operation type of uploading the encryption gradient is included in the operation type list in the role authorization information.

[0262] S317. When the current time does not belong to the authorized time window, or the role authorization information does not contain the operation type for uploading the encryption gradient, the upload of the encryption gradient is rejected; when the current time belongs to the authorized time window and the role authorization information contains the operation type for uploading the encryption gradient, the participant's identity identifier is bound to the encryption gradient to generate an upload credential, specifically:

[0263] S3171. When the comparison result of S316 meets any of the following conditions, the upload of the encryption gradient shall be rejected: the current time does not belong to the authorized time window; or the role authorization information does not contain the operation type of the upload encryption gradient.

[0264] S3172. When the comparison result of S316 simultaneously meets the following two conditions, the binding operation is performed: the current time belongs to the authorized time window, and the role authorization information contains the operation type of the upload encryption gradient.

[0265] S3173. In the binding operation, the identity identifier of the participant is obtained; the joint digest of the identity identifier and the encryption gradient is calculated, and the joint digest is signed using the private key of the participant to generate an upload credential; the calculation of the joint digest uses a hash algorithm, such as SHA-256. In this embodiment, calculating the joint digest of the participant's identity identifier and encryption gradient and signing it with the participant's private key can bind the identity and gradient in ciphertext state, preventing the upload credential from being intercepted and combined with mismatched ciphertext, thereby avoiding credential rebinding attacks; using a hash algorithm to calculate the digest can reduce the signature data length and ensure a one-to-one correspondence between the digest and the original data.

[0266] S318. The encryption gradient and the upload credential are sent together to the edge node, so that the edge node can verify the binding relationship between the encryption gradient and the identity identifier in encrypted form, specifically:

[0267] S3181. Package the encryption gradient and the upload credential into an upload data packet.

[0268] S3182. The uploaded data packet is sent to the edge node through a secure communication channel.

[0269] S3183. After receiving the uploaded data packet, the edge node verifies the signature of the uploaded credential in encrypted form; it verifies the signature validity using the public key of the participating party, and checks the binding relationship between the joint digest in the uploaded credential and the cryptographic gradient and the identity identifier to confirm the credibility of the source of the cryptographic gradient; if the signature verification fails or the joint digest does not match, the cryptographic gradient is rejected. In this embodiment, the joint digest calculation uses the SHA-256 hash algorithm because SHA-256 is a widely used secure hash algorithm with collision resistance and one-wayness, which can guarantee the integrity and non-forgeability of the digest in the uploaded credential, and the computational cost is within the acceptable range of the edge node.

[0270] As a concrete example, in an international trade participant A, the end-side node is located in country a2, the edge node is located in country a4, and the cloud-side node is located in country a1. Participant A's local data consists of a batch of export contract price terms samples, totaling 1000 training samples. Each sample includes a unit price field, currency, trade terms, etc. After S1 evaluation, the overall sensitivity score is 0.884, corresponding to the first sensitivity level L1.

[0271] In S301, the monitoring agent deployed on the edge nodes collects metrics every 5 seconds. At a certain moment, the CPU utilization is 90% and the memory utilization is 77.5%. A weighted average of 60% and 40% yields a real-time computing load of 90% × 0.6 + 77.5% × 0.4 = 54% + 31% = 85%, which is below the first load threshold of 90%. Therefore, the global model execution layer is not frozen. The global model is a neural network model containing an input layer, five hidden layers, and an output layer. The input layer has a dimension of 256, each of the five hidden layers has a dimension of 512, and the output layer has a dimension of 10. All layer parameters remain updatable. The mini-batch size is set to 32.

[0272] Before training, based on the comprehensive sensitivity score of each training sample calculated by S1, the 1000 training samples were divided into four training sample groups: Level 1 group (100 samples), Level 2 group (200 samples), Level 3 group (300 samples), and Level 4 group (400 samples), accounting for 10%, 20%, 30%, and 40% respectively. The learning rates for the four training sample groups were configured as 0.001, 0.005, 0.01, and 0.02 respectively, with 1, 2, 3, and 5 local training epochs respectively. For Level 1 group, mini-batch stochastic gradient descent was used with a mini-batch size of 16, a learning rate of 0.001, and 1 training epoch, resulting in the group gradient vector G1; for Level 2 group, G2 was obtained; for Level 3 group, G3 was obtained; and for Level 4 group, G4 was obtained; the dimension of each group gradient vector was 768. The gradient vectors were then weighted and merged according to the proportion of samples in each group: Local gradient = 0.1×G1 + 0.2×G2 + 0.3×G3 + 0.4×G4. Assuming the historical gradient of the previous training round is H and the momentum coefficient is 0.9, then the corrected local gradient = 0.9 × H + 0.1 × local gradient, which is used as the gradient to be clipped.

[0273] Then, gradient clipping is performed on the gradient to be clipped, with a preset clipping threshold C=1.0. The L2 norm of the gradient to be clipped is calculated to be 1.8, which is greater than 1.0. Therefore, the scaling factor is calculated as 1.0 ÷ 1.8 = 0.556. Each element of the gradient to be clipped is multiplied by 0.556 to obtain the clipped gradient. The minimum element in the clipped gradient is -0.8, and the maximum element is 0.9. Therefore, the numerical range is [-0.8, 0.9].

[0274] Next, quantization encoding will be performed. The initial preset scaling factor is 10.6 Multiply each floating-point element in the clipped gradient by 10. 6 Then round to the nearest integer to obtain the integer gradient; for example, the element -0.8 multiplied by 10 6 Equals -800000, element 0.9 multiplied by 10 6 The integer gradient is equal to 900000, and other elements are similar. The numerical range of the integer gradient is [-800000, 900000]. The plaintext modulus in the current homomorphic encryption parameters is 65537, which is represented by a signed value and has a representable numerical range of [-32768, 32767]. Since -800000 is less than -32768 and 900000 is greater than 32767, the numerical range of the integer gradient is not included in the representable numerical range. Therefore, the preset scaling factor is adjusted to 10. 3 After requantization, the element is -0.8 multiplied by 10. 3 Equals -800, element 0.9 multiplied by 10 3 The value equals 900. The integer gradient's numerical range is [-800, 900], which is contained within [-32768, 32767]. Therefore, a scaling factor of 10 is ultimately used. 3 .

[0275] Next, using a single instruction multiple data (SID) packing technique, the 768 elements of the integer gradient are sequentially filled into the coefficient positions of the plaintext polynomial. The modulus of the polynomial coefficients in the current homomorphic encryption parameters is 8192, and the coefficient capacity is also 8192, which is greater than 768. Therefore, only one plaintext polynomial is needed, and the unfilled coefficient positions are filled with 0. Homomorphic encryption is then performed on the plaintext polynomial using the public key in the BFV homomorphic encryption parameters to generate one ciphertext polynomial, thus obtaining the encrypted gradient.

[0276] After comparison, it was found that the ciphertext modulus used by the end node and the edge node are both 65537, the ciphertext length is the same, and the key space is the same. Therefore, there is no need to perform ciphertext conversion, and the encryption gradient can be directly prepared for uploading.

[0277] Before uploading, obtain participant A's digital certificate and authorization token. The digital certificate contains participant A's public key, participant identifier A_ID, and certificate issuer signature. The certificate chain consists of: the root certificate CA_root trusted locally by the end node, the intermediate certificate CA_intermediate, and participant A's certificate Cert_A. Verification starts with Cert_A. The signature of Cert_A is verified using the public key of CA_intermediate, and then the signature of CA_intermediate is verified using the public key of CA_root. The certificate chain verification is successful. The serial number of Cert_A is queried through the online certificate status protocol service, and the revocation status is returned as not revoked. Subsequently, multi-factor authentication is performed. The first authentication factor is the signature of participant A's private key on the random challenge "CHALLENGE_20240125_1000", and the signature is verified as valid using the public key in the digital certificate. The second authentication factor is the one-time dynamic password "123456", which is verified by synchronizing with the local time.

[0278] The role authorization information in the permission token includes a list of operation types: uploading encrypted gradients and receiving global model parameters; the authorization time window is from 9:00 AM to 6:00 PM on January 25, 2024; the current time is 10:00 AM on January 25, 2024, which falls within the authorization time window, and the "upload encrypted gradients" operation type is included in the role authorization information; therefore, a joint digest is calculated using the participant's identity identifier A_ID and the encrypted gradient, the digest algorithm is SHA-256, and the joint digest is signed using participant A's private key to generate an upload credential.

[0279] Finally, the encryption gradient and upload credentials are packaged into an upload data packet and sent to the edge node through a secure communication channel. The edge node verifies the upload credential signature using participant A's digital certificate public key in encrypted form, and checks the binding relationship between the federated digest, encryption gradient, and identity identifier. Once confirmed, the edge node receives the encryption gradient.

[0280] It should be further explained that, in this embodiment, the edge node performs legality verification and homomorphic aggregation on the received encryption gradient within the trusted execution environment, including:

[0281] S401. Obtain the remaining secure memory capacity of the trusted execution environment and the ciphertext length of a single encryption gradient, specifically:

[0282] S4011. The edge node calls the secure memory query interface within the trusted execution environment to read the current remaining capacity of the secure memory and obtain the remaining capacity of the secure memory in bytes; the secure memory is an isolated physical memory area within the trusted execution environment, which is physically isolated from external memory.

[0283] S4012. For each received encryption gradient, read its ciphertext structure metadata to obtain the ciphertext length of a single encryption gradient; the ciphertext length includes the number of coefficients of the ciphertext polynomial and the number of bytes of each coefficient, which is determined by the polynomial coefficient modulus and the ciphertext modulus in the homomorphic encryption parameters in S3.

[0284] S4013. Record the remaining capacity of the secure memory and the ciphertext length of the single encryption gradient for use in the subsequent calculation of the maximum number of loads per batch.

[0285] In this embodiment, the remaining capacity of secure memory is obtained in real time through the memory management module of the trusted execution environment, and the ciphertext length of a single encryption gradient is determined by the ciphertext format output by the homomorphic encryption algorithm library. Using these two as the basis for batch processing is to maximize the efficiency of single batch processing without exceeding the secure memory capacity, and to avoid triggering frequent page swapping due to secure memory overflow caused by loading too much ciphertext in a single batch.

[0286] S402. Determine the upper limit of the number of encryption gradients loaded in a single batch based on the remaining capacity of the secure memory and the ciphertext length, and load the received encryption gradients into the secure memory in batches according to the upper limit of the number of encryption gradients, specifically as follows:

[0287] S4021. Divide the remaining capacity of the secure memory by the ciphertext length of a single encryption gradient to obtain the maximum loadable quantity; then reserve a security margin of 10% of the remaining secure memory capacity to obtain the upper limit of the number of encryption gradients loaded in a single batch; if the upper limit of the number of encryption gradients loaded in a single batch is less than 1, then take 1. In this embodiment, the calculation method for the upper limit of the number of encryption gradients loaded in a single batch is as follows: first, multiply the remaining secure memory capacity by 90% to obtain the secure memory capacity available for ciphertext loading, then divide the available secure memory capacity by the ciphertext length of a single encryption gradient and round down to obtain the upper limit of the number of encryption gradients loaded in a single batch; this calculation method clearly reserves a 10% security margin and will not cause secure memory overflow due to the memory occupied by intermediate aggregated ciphertext and aggregated execution records.

[0288] S4022. According to the received encryption gradient order, load the encryption gradients from external memory into the secure memory in sequence, not exceeding the upper limit of the single batch loading quantity, as the current batch.

[0289] S4023. Repeat the loading operation until all received encryption gradients have been loaded in batches.

[0290] In this embodiment, a 10% safety margin is reserved in the calculation of the maximum number of items loaded in a single batch. This is to leave memory space for the intermediate aggregated ciphertext and aggregated execution record generated by homomorphic aggregation, and to prevent the trusted execution environment from being forced to page or the task from being interrupted due to the exhaustion of safe memory during the aggregation process. When the remaining safe memory capacity is less than the length of one ciphertext, it is still set to 1 to avoid deadlock.

[0291] S403. Perform homomorphic addition on each batch of loaded encryption gradients to obtain intermediate aggregated ciphertext, and write the intermediate aggregated ciphertext to the external memory of the trusted execution environment, specifically:

[0292] S4031. Homomorphically aggregate the encryption gradients in the current batch; specifically, if there is only one encryption gradient in the current batch, then the encryption gradient is directly used as the intermediate aggregated ciphertext; if there are multiple encryption gradients in the current batch, then the first encryption gradient is used as the initial intermediate aggregated ciphertext, and the second encryption gradient is homomorphically added to the initial intermediate aggregated ciphertext to obtain the updated intermediate aggregated ciphertext. The remaining encryption gradients are then homomorphically added to the previously updated intermediate aggregated ciphertext in turn until all encryption gradients in the current batch participate in the aggregation to obtain the intermediate aggregated ciphertext of the current batch.

[0293] S4032. Write the intermediate aggregated ciphertext of the current batch to the external memory of the trusted execution environment and release the space it occupies in the secure memory.

[0294] S4033. Repeat S4031 to S4032 for each batch until all batches have completed homomorphic aggregation, resulting in intermediate aggregated ciphertexts for multiple batches.

[0295] In this embodiment, the intermediate aggregated ciphertext is written to external memory immediately after each batch of aggregation in order to free up space for the next batch when the secure memory capacity is limited; homomorphic addition is performed in the ciphertext domain, and the edge nodes cannot know the plaintext gradient content, thus ensuring the privacy of the aggregation process.

[0296] S404. For the encrypted gradient or intermediate aggregated ciphertext loaded from the external memory, calculate the integrity verification value according to the page key and page identifier. After successful verification, decrypt and load it into the secure memory, and hide the memory access order using an unintentional random access storage method, specifically:

[0297] S4041. When it is necessary to load the encryption gradient or intermediate aggregated ciphertext from external memory, it is read in units of pages; each page contains a page identifier, version number, encrypted page content and storage integrity verification value.

[0298] S4042. Based on the master key and the page identifier and version number of the page, generate the page key of the page through the key derivation function; the key derivation function is a pre-set secure hash function within the trusted execution environment.

[0299] S4043. Using the page key, the page content, the page identifier, and the version number as input, calculate the integrity verification value using the hash message authentication code algorithm; compare the calculated integrity verification value with the integrity verification value stored on the page; if the comparison matches, use the page key to decrypt the encrypted page content of the page to obtain the plaintext page content, and load it into the secure memory; if the comparison does not match, discard the page and terminate this homomorphic aggregation.

[0300] S4044. When accessing external memory, an unintentional random access storage method is adopted to make the memory access sequence independent of the ciphertext content and hide the memory access order; at the same time, constant-time operations are used for ciphertext-related operations in secure memory, and independent cache partitions are set up for the ciphertext data of different participants to prevent cache side-channel attacks.

[0301] In this embodiment, the page key is derived from the master key, page identifier, and version number. Each page has an independent page key, which can prevent memory page replacement attacks. The process terminates if the integrity verification value comparison fails, preventing the ciphertext in external memory from being tampered with and entering the aggregation. The triple mechanism of unintentional random access storage, constant-time operation, and cache isolation is used to prevent attackers from inferring side-channel information such as the number of participants and the aggregation order by observing memory access patterns, time differences, or cache conflicts.

[0302] S405. For each encryption gradient, verify the ciphertext range proof uploaded by the end node along with the encryption gradient; when the ciphertext range proof fails verification, or the numerical range corresponding to the ciphertext range proof is not included in the preset valid gradient numerical range, mark the encryption gradient as an abnormal gradient and exclude it from the homomorphic aggregation, specifically:

[0303] S4051. Check if each encryption gradient is accompanied by a proof of the ciphertext range; if not, mark the encryption gradient as an abnormal gradient.

[0304] S4052. For the cryptographic gradient with an attached ciphertext range proof, verify the validity of the ciphertext range proof. The ciphertext range proof is generated by the edge node when generating the cryptographic gradient. The edge node verifies the signature or zero-knowledge proof of the range proof in the ciphertext state. When the signature verification fails or the zero-knowledge proof verification fails, it is determined that the ciphertext range proof verification fails and the cryptographic gradient is marked as an abnormal gradient.

[0305] S4053. Parse the numerical range corresponding to the encryption gradient from the verified ciphertext range proof; compare the parsed numerical range with the preset valid gradient numerical range; when the parsed numerical range is not included in the preset valid gradient numerical range, mark the encryption gradient as an abnormal gradient. In this embodiment, the ciphertext range proof is a Bulletproofs zero-knowledge proof, which includes the lower and upper bounds of the plaintext gradient numerical range declared by the edge node; while verifying the validity of the proof, the edge node extracts the lower and upper bounds from the public input of the proof to obtain the numerical range corresponding to the encryption gradient; the public input is the numerical range parameter uploaded by the edge node along with the proof when generating the ciphertext range proof.

[0306] S4054. Exclude all cryptographic gradients marked as anomalous gradients from this homomorphic aggregation, and only perform homomorphic aggregation on cryptographic gradients that are not marked as anomalous gradients.

[0307] In this embodiment, the preset legal gradient value range is jointly determined by the gradient clipping threshold in S3 and the final scaling factor during quantization encoding; for example, when the clipping threshold is 1.0 and the final scaling factor is 10... 3 When the valid gradient value range is [-1000, 1000], the ciphertext range proof allows edge nodes to determine whether the gradient value is within the valid range without decrypting the gradient. Excluding abnormal gradients can prevent malicious or faulty nodes from uploading abnormal gradients to interfere with aggregation. In this embodiment, the valid gradient value range is set to [-1000, 1000]. This setting is based on the cryptographically verifiable constraint determined by those skilled in the art based on the product relationship between the gradient pruning threshold and the quantization scaling factor: after the edge node obtains the gradient to be pruned during training, the gradient is first pruned using a preset pruning threshold C=1.0, so that the absolute value of any element in the pruned gradient does not exceed 1.0; then, the gradient is pruned using a preset scaling factor s=10. 3 The floating-point gradient is quantized by multiplying each floating-point element by 10. 3 The integer gradient is obtained by rounding down, therefore the upper limit of the absolute value of the integer gradient elements is 1.0 × 10⁻⁶. 3 =1000, thus naturally forming a valid numerical range [-1000, 1000]; this range also serves as the preset valid gradient numerical range for edge nodes to verify Bulletproofs range proofs in ciphertext state, used to determine whether the plaintext gradient numerical range declared by the edge node is within the maximum limit allowed by pruning and quantization during training, so that edge nodes can exclude abnormal gradients or maliciously injected gradients that exceed the valid range without decryption, ensuring that subsequent homomorphic aggregation only includes valid ciphertext inputs that meet the model training stability and numerical encoding constraints.

[0308] S406. When generating the trusted verification credential, record the list of encryption gradient identifiers participating in this homomorphic aggregation, the batch division, and the aggregation order of each batch, and generate an aggregation execution record, specifically as follows:

[0309] S4061. Before starting homomorphic aggregation, initialize the aggregation execution record.

[0310] S4062. Record a list of all cryptographic gradient identifiers participating in this homomorphic aggregation; the cryptographic gradient identifier is a globally unique identifier assigned to each cryptographic gradient upon receipt, which can be a hash digest or sequence number of the cryptographic gradient.

[0311] S4063. Record batch segmentation information; the batch segmentation information includes the set of encryption gradient identifiers loaded in each batch, the loading order of each batch, and the batch number.

[0312] S4064. Record the aggregation order of each batch; the aggregation order of each batch includes the homomorphic addition order between encryption gradients within each batch, and the subsequent aggregation order between aggregated ciphertexts in the middle of each batch.

[0313] S4065. Merge the above-mentioned encryption gradient identifier list, batch division information and batch aggregation order to generate an aggregation execution record.

[0314] In this embodiment, recording the list of encryption gradient identifiers, batch division, and aggregation order of each batch participating in this homomorphic aggregation is to enable the trusted verification credential to reflect the actual aggregation trajectory of the edge node on the input ciphertext set, prevent the edge node from discarding part of the ciphertext or replacing the ciphertext before generating the credential, and ensure the verifiability and integrity of the aggregation result.

[0315] S407. Calculate the first hash value of the aggregated execution record, the second hash value of the input encryption gradient set, and the third hash value of the output edge-aggregated ciphertext, specifically as follows:

[0316] S4071. Serialize the aggregated execution record into a byte string according to a preset format, and calculate the first hash value on the serialization result using a preset hash algorithm; the preset hash algorithm may be SHA-256.

[0317] S4072. All input encryption gradients participating in this homomorphic aggregation are concatenated into a byte string in the order of recording, and the second hash value is calculated on the concatenation result using the preset hash algorithm.

[0318] S4073. Serialize the output edge-aggregated ciphertext into a byte string according to the ciphertext format, and calculate the third hash value on the serialization result using the preset hash algorithm.

[0319] In this embodiment, SHA-256 is used as the preset hash algorithm because it has collision resistance and one-wayness, and can map the aggregated execution record, the input ciphertext set and the output ciphertext to a fixed-length digest respectively. Moreover, the collision probability is extremely low, ensuring that each hash value in the trusted verification credential corresponds one-to-one with the corresponding data.

[0320] S408. Concatenate the first hash value, the second hash value, and the third hash value, and then sign the concatenation using the signature key of the trusted execution environment to obtain the trusted verification credential, specifically as follows:

[0321] S4081. The first hash value, the second hash value, and the third hash value are concatenated in a preset order to obtain a concatenated byte string; the preset order is the first hash value first, the second hash value in the middle, and the third hash value last.

[0322] S4082. Read the signature private key in the trusted execution environment; the signature private key is generated by the trusted execution environment during initialization and is stored only in the secure memory of the trusted execution environment, and cannot be read from the outside.

[0323] S4083. Use the signature private key to digitally sign the concatenated byte string to obtain a signature value; the digital signature algorithm can be RSA or ECDSA.

[0324] S4084. Encapsulate the signature value, the first hash value, the second hash value, and the third hash value together to generate the trusted verification credential, and upload the trusted verification credential along with the edge aggregated ciphertext to the cloud-side node.

[0325] In this embodiment, the trusted execution environment's signature private key is held only by the trusted execution environment, and the signature cannot be forged by external parties. The signature of the three hash values ​​can cryptographically bind the aggregated execution record, the set of input ciphertexts, and the output edge aggregated ciphertext, so that the cloud-side node can determine whether the edge aggregated ciphertext is obtained by aggregating all legal inputs in the order of the records by verifying the signature and comparing the hash values, thus preventing credential replay, ciphertext replacement, or mismatch between the credential and the ciphertext.

[0326] As a concrete example, the edge node is located in Singapore. In a certain training round, it receives encrypted gradients uploaded by edge nodes P1, P2, P3, P4, and P5. The ciphertext length of each encrypted gradient is 131,072 bytes (128KB), and the identifiers are ID1, ID2, ID3, ID4, and ID5, respectively. The remaining secure memory capacity of the trusted execution environment is 524,288 bytes (512KB). After reserving a 10% security margin, i.e., 52,428.8 bytes, the available secure memory is 471,859.2 bytes. Dividing 471,859.2 bytes by the length of a single ciphertext, 131,072 bytes, and rounding down, we get the maximum number of bytes that can be loaded in a single batch as 3. Therefore, the 5 encrypted gradients are divided into two batches: the first batch contains ID1, ID2, and ID3, and the second batch contains ID4 and ID5. During the first batch of loading, ID1, ID2, and ID3 occupy a total of 393,216 bytes, with 78,643.2 bytes remaining in safe memory for intermediate results and temporary data. During the second batch of loading, ID4 and ID5 occupy a total of 262,144 bytes, with 209,715.2 bytes remaining in safe memory. In the first batch, ID1 and ID2 are first homomorphically added using BFV to obtain the intermediate result T1. During the homomorphic addition, since both ciphertexts come from the same parameter set and the noise budget is sufficient, the noise level of T1 after addition is approximately the sum of the noise levels of ID1 and ID2. Then, T1 and ID3 are homomorphically added to obtain the first intermediate aggregated ciphertext M1. At this point, the noise level of M1 further accumulates. M1 is then written to external memory, and its space in safe memory is released. In the second batch, ID4 and ID5 are homomorphically added to obtain the second intermediate aggregated ciphertext M2, and M2 is written to external memory. Then, M1 and M2 are loaded into secure memory from external memory: read in units of pages, each page being 4096 bytes in size, with M1 and M2 occupying a total of 64 pages, the page identifiers being 0x0001 to 0x0040, and the version number being 1 for each page; for each page, the page key is derived using a key derivation function (using HMAC-SHA256) based on the master key, the page identifier, and the version number of the page, and then the HMAC-SHA256 integrity verification value is calculated using the page key, page content, page identifier, and version number as inputs, and compared byte by byte with the integrity verification value stored in the page; after all 64 pages' integrity verification values ​​match, the page content is decrypted using the page key and loaded into secure memory; at the same time, the external memory is accessed using the Path ORAM method, and random dummy blocks are filled into the access path each time a read is performed to hide the real memory access order. After loading, BFV homomorphic addition is performed on M1 and M2 to obtain the final edge-aggregated ciphertext. The length of the final edge-aggregated ciphertext is still 131072 bytes, and the noise level is approximately the sum of the noise levels of M1 and M2.The ciphertext range proofs attached to the 5 encryption gradients are verified one by one: each ciphertext range proof is a Bulletproofs zero-knowledge proof, proving that the corresponding plaintext gradient value is within the public range; the edge nodes verify the validity of each Bulletproofs proof in the ciphertext state, and all 5 proofs are verified; the parsed value range is [-800, 900], which is included in the preset legal gradient value range [-1000, 1000], so no abnormal gradients are excluded. When generating trusted verification credentials, the aggregation execution record contains a list of cryptographic gradient identifiers {ID1, ID2, ID3, ID4, ID5} participating in the aggregation. The batches are divided into a first batch {ID1, ID2, ID3} and a second batch {ID4, ID5}. The aggregation order is as follows: ID1 and ID2 are added to obtain T1, T1 and ID3 are added to obtain M1, ID4 and ID5 are added to obtain M2, and M1 and M2 are added to obtain the final edge-aggregated ciphertext. The aggregation execution record is serialized into a byte string in JSON format, and the first hash value is calculated using SHA-256. The five input cryptographic gradients are concatenated into a byte string in the order ID1 to ID5, and the second hash value is calculated using SHA-256. The final edge-aggregated ciphertext is serialized into a byte string in ciphertext format, and the third hash value is calculated using SHA-256. Each of the three hash values ​​is 256 bits long. The first, second, and third hash values ​​are concatenated in sequence to form a 768-bit concatenation value. This concatenation is then signed using the ECDSA-P256 signing private key within the trusted execution environment to generate a DER-encoded signature value. The signature value, the first hash value, the second hash value, and the third hash value are then encapsulated into a trusted verification credential and uploaded to the cloud-side node along with the final edge-aggregated ciphertext.

[0327] It should be further explained that, in this embodiment, global homomorphic aggregation is performed on each edge-aggregated ciphertext based on the trusted verification credential, including:

[0328] S501, Receive edge aggregated ciphertext, trusted verification credentials, and credential generation timestamp uploaded by each edge node, specifically:

[0329] S5011: Cloud-side nodes listen for upload requests from each edge node through a secure communication channel and establish an independent session connection for each edge node.

[0330] S5012. Receive the data packets uploaded by each edge node, parse the data packets to obtain the edge aggregation ciphertext, the trusted verification credential, and the credential generation timestamp; the credential generation timestamp is the time read by the edge node from the secure clock in the trusted execution environment when generating the trusted verification credential.

[0331] S5013. Verify the format and length of the data packet to confirm that each field in the data packet is complete and its length meets the preset format requirements; if parsing fails or any field is missing, refuse to receive the data packet.

[0332] In this embodiment, the credential generation timestamp is read by a secure clock within the trusted execution environment and is not synchronized with external time, which can prevent edge nodes from forging or backfilling time; the cloud-side node ensures that the input data for subsequent verification operations is complete and not truncated by parsing and verifying the data packet format.

[0333] S502. For each of the trusted verification credentials, verify the signature using the public key corresponding to the signature key of the trusted execution environment, and extract the aggregated execution record hash value, the input cryptographic gradient set hash value, and the output edge aggregated ciphertext hash value from the trusted verification credential. Specifically:

[0334] S5021. Obtain the public key corresponding to the signature key of the trusted execution environment; the signature public key is generated during the initialization of the trusted execution environment and is pre-distributed to the cloud-side nodes by the edge nodes through a secure channel.

[0335] S5022. Use the signature public key to perform digital signature verification on the signature value in the trusted verification credential; the digital signature algorithm adopted is ECDSA-P256.

[0336] S5023. When the signature verification passes, extract the aggregated execution record hash value, the input encryption gradient set hash value, and the output edge aggregated ciphertext hash value from the trusted verification credential; when the signature verification fails, reject the edge aggregated ciphertext corresponding to the trusted verification credential.

[0337] In this embodiment, ECDSA-P256 is used as the digital signature algorithm because it has a good balance between security strength and signature length, and the security chip in the trusted execution environment supports hardware acceleration of the algorithm; the pre-distribution of the signature public key ensures that cloud-side nodes can independently complete signature verification without relying on online interaction with edge nodes.

[0338] S503. Compare the output edge-aggregated ciphertext hash value with the received corresponding edge-aggregated ciphertext actual hash value, and compare the difference between the credential generation timestamp and the current time with a preset valid duration, specifically:

[0339] S5031. Serialize the received corresponding edge aggregation ciphertext into a byte string according to the ciphertext format, and calculate its actual hash value using the SHA-256 hash algorithm.

[0340] S5032. Compare the actual hash value with the output edge aggregated ciphertext hash value byte by byte.

[0341] S5033. Obtain the current time, calculate the difference between the current time and the timestamp of the voucher generation, and compare the difference with a preset valid duration; the preset valid duration can be set to 60 seconds.

[0342] In this embodiment, the preset effective duration is set to 60 seconds because the normal network transmission and queuing time between the generation of edge-aggregated ciphertext and its reception on the cloud side usually does not exceed 60 seconds. If this duration is exceeded, there may be credential replay or man-in-the-middle delay attacks. Therefore, the request is rejected if the duration is exceeded, while avoiding false rejections caused by network jitter due to setting the duration too short.

[0343] S504. When the output edge-aggregated ciphertext hash value is inconsistent with the actual hash value, or the difference exceeds the preset valid duration, the edge-aggregated ciphertext is rejected, specifically:

[0344] S5041. Determine whether the output edge-aggregated ciphertext hash value is consistent with the actual hash value; if they are inconsistent, it is determined that the ciphertext does not correspond to the credential, and the edge-aggregated ciphertext is rejected.

[0345] S5042. Determine whether the difference exceeds the preset valid duration; if it does, determine that the voucher has expired or is being replayed, and reject the edge-aggregated ciphertext.

[0346] S5043. If at least one of the two conditions is met, a rejection operation is performed, and the reason for rejection is recorded in the audit log.

[0347] In this embodiment, both inconsistent hash values ​​and expired credentials are directly rejected because both indicate that the credentials or ciphertext may have been replaced, tampered with, or replayed during transmission. Direct rejection can prevent untrusted ciphertext from entering the global aggregation and ensure the correctness of subsequent aggregation results.

[0348] S505. When the output edge-aggregated ciphertext hash value is consistent with the actual hash value, and the difference does not exceed the preset valid duration, the edge-aggregated ciphertext is added to the set to be globally homomorphic aggregated, specifically:

[0349] S5051. Determine whether the output edge aggregation ciphertext hash value is consistent with the actual hash value, and whether the difference does not exceed the preset valid duration; when both conditions are met, add the edge aggregation ciphertext to the global homomorphic aggregation set.

[0350] S5052. Record the source edge node identifier, receiving time, and hash value of the edge aggregation ciphertext for subsequent aggregation and auditing.

[0351] In this embodiment, the ciphertext is added to the aggregation set only when the hash is consistent and the timestamp is valid, ensuring that each ciphertext in the set is bound to a trusted verification credential and is within its validity period, thus establishing a foundation for trusted input for global aggregation on the cloud side.

[0352] S506. Obtain the homomorphic encryption parameters, quantization scaling factor, and noise budget parameters corresponding to each edge-aggregated ciphertext, specifically:

[0353] S5061. Read the homomorphic encryption parameters corresponding to the edge aggregated ciphertext from the metadata uploaded by each edge node along with the edge aggregated ciphertext. The homomorphic encryption parameters include the homomorphic encryption algorithm identifier, ciphertext modulus, polynomial coefficient modulus, and key space identifier.

[0354] S5062. Read the quantized scaling factor from the metadata, the quantized scaling factor being the scaling factor ultimately used by the edge node in S3.

[0355] S5063. Read the noise budget parameter from the metadata, wherein the noise budget parameter is the remaining noise budget estimate of the edge-aggregated ciphertext under the current ciphertext modulus.

[0356] In this embodiment, the homomorphic encryption parameters, quantization scaling factor, and noise budget parameters are uploaded by the edge node along with the ciphertext, enabling the cloud-side node to obtain the parameters required for global aggregation without additional interaction with the edge node, thus reducing communication rounds; the noise budget parameters are used to subsequently determine whether aggregation can be performed again and whether the ciphertext needs to be refreshed.

[0357] S507. When the ciphertext modulus, ciphertext length, or key space of each edge-aggregated ciphertext is inconsistent, convert each edge-aggregated ciphertext into ciphertext with a unified ciphertext modulus and a unified key space, specifically as follows:

[0358] S5071. Compare whether the ciphertext modulus, ciphertext length and key space identifier of each edge-aggregated ciphertext are consistent.

[0359] S5072. When any comparison item is inconsistent, a ciphertext conversion operation is performed. The ciphertext conversion operation includes ciphertext modulus switching and key space remapping. The ciphertext modulus switching adopts a modulus switching algorithm to convert the ciphertext from the current ciphertext modulus to a unified ciphertext modulus and adjusts the ciphertext noise level accordingly. The key space remapping uses the re-encryption key held by the cloud-side node to convert the ciphertext from the edge node key space to the unified key space.

[0360] S5073. When all comparison items are consistent, no transformation operation is performed, and the original ciphertext is used directly for subsequent aggregation.

[0361] In this embodiment, the unified ciphertext modulus and unified key space are determined by the cloud-side node based on the parameter that appears most frequently in each edge-aggregated ciphertext, so as to minimize the number of conversions; the modulus switching and key space remapping can both be completed in the ciphertext domain, and the cloud-side node cannot know the plaintext content.

[0362] S508. Obtain the current noise level of each edge-aggregated ciphertext after conversion, and compare the current noise level with a preset noise threshold, specifically:

[0363] S5081. For each edge-aggregated ciphertext after conversion, call the noise estimation interface of the homomorphic encryption algorithm library to obtain the current noise level of the ciphertext; the current noise level is represented by the remaining proportion of the ciphertext noise budget.

[0364] S5082. Compare the current noise level with a preset noise threshold; the preset noise threshold can be set to 80% of the maximum noise budget.

[0365] In this embodiment, the preset noise threshold is set to 80% of the maximum noise budget because homomorphic addition will continue to increase noise. If the current noise level is too high, the subsequent global weighted aggregation may exceed the maximum noise budget, resulting in decryption failure. Retaining a 20% noise margin can support at least one global homomorphic addition and one homomorphic scalar multiplication.

[0366] S509. When any current noise level exceeds the preset noise threshold, a ciphertext refresh operation is performed on the corresponding edge-aggregated ciphertext until the current noise level is lower than the preset noise threshold, specifically:

[0367] S5091. When S508 comparison finds that any current noise level exceeds the preset noise threshold, it is determined that the edge-aggregated ciphertext needs to be refreshed.

[0368] S5092. Perform a ciphertext refresh operation on the edge-aggregated ciphertext that needs to be refreshed; the ciphertext refresh operation adopts the bootstrap operation in the homomorphic encryption algorithm library to reduce the ciphertext noise level in the ciphertext domain.

[0369] S5093. After refreshing, re-acquire the current noise level and compare it with the preset noise threshold; if it still exceeds the threshold, perform ciphertext refresh again until the current noise level is lower than the preset noise threshold.

[0370] In this embodiment, the ciphertext refresh adopts a homomorphic encryption bootstrap operation, which can reset the noise budget without decryption; the refresh is repeated until the noise level is lower than the preset noise threshold, ensuring that decryption will not fail due to excessive noise during subsequent global aggregation.

[0371] S510. Calculate the edge node weights based on the data quality and volume of the participants corresponding to each edge node. Perform homomorphic scalar multiplication and homomorphic addition on each edge aggregate ciphertext in the ciphertext domain to obtain the globally weighted aggregate ciphertext, specifically:

[0372] S5101. Obtain the data quality score and data volume of each edge node corresponding to the participants. The data quality score is determined based on the proportion of encryption gradients that have passed the legality verification in the historical rounds of the edge node. The data volume is the number of end-side nodes that the edge node participates in the aggregation in this round.

[0373] S5102. Multiply the normalized data quality score and data volume of each edge node to obtain the initial weight of each edge node; then normalize the initial weights of all edge nodes to obtain the weight of each edge node.

[0374] S5103. In the ciphertext domain, perform homomorphic scalar multiplication on each edge-aggregated ciphertext, multiplying the ciphertext by the integer fixed-point representation corresponding to the weight of the edge node; then perform homomorphic addition on all the ciphertexts after homomorphic scalar multiplication to obtain the globally weighted aggregated ciphertext.

[0375] In this embodiment, the weight of edge nodes is determined by both data quality and data volume. Edge nodes with higher data quality and larger data volume contribute more to global aggregation. Homomorphic scalar multiplication uses integer fixed-point representation of weights to avoid floating-point operations, which meets the plaintext space requirements of homomorphic encryption.

[0376] S511. The globally weighted aggregated ciphertext is homomorphically normalized, and noise is added to the ciphertext domain according to the differential privacy budget determined by the adaptive privacy budget allocation algorithm in the current training round; wherein, when adding noise to the ciphertext domain, sampling is performed from a discrete noise distribution that matches a preset continuous noise distribution, and the discretization error is calculated, and the discretization error is included in the differential privacy budget calculation of subsequent rounds, specifically:

[0377] S5111. Perform homomorphic normalization on the globally weighted aggregated ciphertext, multiplying it by the integer fixed-point representation corresponding to the normalization coefficient, so that the aggregation result is independent of the number of participants.

[0378] S5112. Obtain the total privacy budget, the current training epoch, and the performance history; calculate the performance improvement rate, which is the difference in performance metrics of the global model on the validation set between the current epoch and the previous epoch; calculate the training progress coefficient, which is the ratio of the current training epoch to the total training epochs; calculate the remaining privacy budget, which is the total privacy budget minus the consumed differential privacy budget.

[0379] S5113. Allocate the differential privacy budget for the current round based on the relationship between the performance improvement rate and the preset high and low thresholds: when the performance improvement rate is greater than the high threshold, allocate the remaining privacy budget multiplied by 2 times the training progress coefficient divided by the number of remaining training rounds; when the performance improvement rate is between the low and high thresholds, allocate the remaining privacy budget multiplied by the training progress coefficient divided by the number of remaining training rounds; when the performance improvement rate is less than the low threshold, allocate the remaining privacy budget multiplied by 0.5 times the training progress coefficient divided by the number of remaining training rounds; perform upper and lower bound checks on the allocation results to obtain the differential privacy budget for the current round.

[0380] S5114. When adding noise in the ciphertext domain, sampling is performed from a discrete noise distribution that matches a preset continuous noise distribution, wherein the preset continuous noise distribution is a Laplace distribution or a Gaussian distribution; the sampled continuous noise values ​​are discretized into integer noise values, the discretization error is calculated, and the discretization error is included in the differential privacy budget calculation of subsequent rounds. In this embodiment, the discrete noise distribution is constructed in the following way: a preset continuous noise distribution (Lappland distribution or Gaussian distribution) is taken, and integer points are used as sampling points within its value range. The probability density function value of the continuous noise distribution at each integer point is calculated, and the density values ​​at all integer points are normalized to obtain the probability mass function of the discrete noise distribution; during sampling, integer noise values ​​are randomly drawn from the set of integer points according to the probability mass function.

[0381] S5115. After homomorphically encrypting the integer noise value, perform homomorphic addition with the globally weighted aggregated ciphertext to complete the addition of noise to the ciphertext domain.

[0382] In this embodiment, the adaptive privacy budget allocation algorithm dynamically adjusts the budget for the current round based on the performance improvement rate. When the performance improvement is fast, more budget is allocated to accelerate convergence, and when the performance improvement is slow, less budget is allocated to save the total budget. The discrete noise distribution is matched with the continuous noise distribution, and the discretization error is included in subsequent rounds, which can ensure the accuracy of the overall privacy budget consumption.

[0383] S512. Homomorphically decrypt the global encryption gradient after adding noise to obtain the integer plaintext gradient; dequantize the integer plaintext gradient according to the quantization scaling factor to obtain the floating-point global gradient, and retain the dequantization residual, specifically:

[0384] S5121. The cloud-side node uses the homomorphic decryption private key it holds to perform homomorphic decryption on the global encrypted gradient after adding noise, and obtains the integer plaintext gradient.

[0385] S5122. Obtain the scaling factor corresponding to each edge-aggregated ciphertext and calculate a unified scaling factor; the unified scaling factor can be the average or maximum value of the scaling factors of each edge-aggregated ciphertext.

[0386] S5123. Divide each integer element in the integer plaintext gradient by the uniform scaling factor to obtain the floating-point global gradient.

[0387] S5124. Calculate the inverse quantization residual, which is the difference between each integer element in the integer plaintext gradient and the product of the floating-point global gradient and the unified scaling factor. The inverse quantization residual is retained for use in subsequent rounds when updating the global model parameters.

[0388] In this embodiment, a uniform scaling factor is used for dequantization in order to unify the scaling factors that may be different for different edge nodes and avoid gradient scale deviation caused by inconsistent scaling factors; retaining the dequantization residual can compensate for the accuracy loss caused by quantization rounding and improve the model convergence accuracy.

[0389] S513. Update the global model parameters based on the floating-point global gradient and the inverse quantization residual to obtain the updated global model parameters, specifically as follows:

[0390] S5131, Get the current global model parameters.

[0391] S5132. Add the inverse quantization residual retained from the previous training round to the inverse quantization residual of the current round to obtain the cumulative residual.

[0392] S5133. Add the floating-point global gradient to the cumulative residual to obtain the corrected global gradient.

[0393] S5134. Using the gradient descent update rule, subtract the current global model parameters from the corrected global gradient element by element according to the learning rate to obtain the updated global model parameters.

[0394] In this embodiment, the cumulative residual is used to compensate for the error caused by multiple quantization roundings, preventing the quantization error from accumulating with training rounds and affecting model convergence; the learning rate can be the same as the learning rate used for edge training or dynamically adjusted by the cloud node based on the verification performance.

[0395] S514. For each participant, based on the comprehensive sensitivity score and the level of the participant, obtain the homomorphic encryption parameters and access control policy corresponding to the participant from the preset policy matrix, specifically:

[0396] S5141. Obtain the comprehensive sensitivity score for each participant and the level of that participant in the edge-cloud hierarchical architecture.

[0397] S5142. Obtain the sensitivity level based on the comprehensive sensitivity score mapping, and locate the corresponding matrix unit in the preset strategy matrix constructed in S2 using the sensitivity level and the level as indexes.

[0398] S5143. Read the homomorphic encryption parameters and access control policy from the matrix unit, and use them as the homomorphic encryption parameters and access control policy corresponding to the participant.

[0399] In this embodiment, personalized strategies are obtained according to the sensitivity level and hierarchy of the participants because different participants have different data sensitivity and computing capabilities. Using differentiated strategies can optimize the decryption and communication overhead of each participant while ensuring security.

[0400] S515. Using the public key of the participating party and the re-encryption key of the participating party's level, the updated global model parameters are encrypted to generate participating party encrypted parameters. The receiver's identity is then bound to the participating party encrypted parameters and sent to the edge node. The edge node verifies the receiver's identity according to the access control policy, and uses the re-encryption key to convert the participating party encrypted parameters into ciphertext decryptable by the participating party's public key before forwarding it. The edge node cannot decrypt the participating party encrypted parameters. Specifically:

[0401] S5151. Obtain the public key of the participant and the re-encryption key of the level to which the participant is located; the re-encryption key is generated by the participant and the cloud-side node during the initialization phase based on the proxy re-encryption scheme.

[0402] S5152. Use the public key of the participating party to encrypt the updated global model parameters to obtain the participating party encrypted parameters; the participating party encrypted parameters are the first layer of ciphertext.

[0403] S5153. Bind the receiver's identity identifier with the participant's encrypted parameters, generate a parameter distribution data packet, and send it to the edge node.

[0404] S5154. After receiving the parameter data packet, the edge node verifies the identity of the recipient according to the access control policy of the participant. After the verification is successful, the edge node uses the re-encryption key to perform proxy re-encryption on the encrypted parameters of the participant, converting the first layer of ciphertext into a second layer of ciphertext that can be decrypted by the public key of the participant. The edge node does not hold the private key of the participant and the cloud-side decryption private key, and therefore cannot decrypt the encrypted parameters of the participant.

[0405] S5155, The edge node forwards the converted second-layer ciphertext to the participating party.

[0406] In this embodiment, a proxy re-encryption mechanism is used to enable edge nodes to complete the ciphertext conversion without accessing the plaintext global model parameters. This ensures the confidentiality of the parameter distribution process and reduces the direct communication pressure between cloud-side nodes and participating parties by utilizing the forwarding function of edge nodes. Edge nodes cannot decrypt the data, preventing intermediate nodes from leaking or unauthorizedly obtaining global model parameters.

[0407] As a concrete example, a cloud-side node is located in the European Union. In a certain training round, it receives edge-aggregated ciphertext uploaded by three edge nodes, identified as E1, E2, and E3. Each ciphertext is 131,072 bytes (128KB) long, with credential generation timestamps of January 25, 2024, at 10:00:01, 10:00:03, and 10:00:05 respectively. The current time is 10:00:10, and the preset validity period is 60 seconds. ECDSA is used to verify the three trusted credentials. The P256 public key verification signature passed. The extracted hash values ​​of the aggregate execution record, input encryption gradient set, and output edge aggregate ciphertext were 64-bit hexadecimal strings such as 0x3a5f..., 0x9b2c..., and 0x7e1d..., respectively. These were consistent with the SHA-256 hash values ​​actually calculated by the cloud-side node for the received ciphertext, with time differences of 9 seconds, 7 seconds, and 5 seconds, respectively, all less than 60 seconds. Therefore, E1, E2, and E3 were all added to the set of global homomorphic aggregations to be completed. Subsequently, the metadata of each edge-aggregated ciphertext was read. The ciphertext modulus of E1 and E2 was 65537, and the ciphertext modulus of E3 was 32768. The key space identifiers were KS1, KS1, and KS2, respectively, which were inconsistent. Therefore, a modulus switching algorithm was performed on E3 to convert the ciphertext modulus from 32768 to 65537. Then, E3 was remapped from key space KS2 to unified key space KS1 through a proxy re-encryption key. After the conversion, the noise level of E3 increased from 50% to 60%. The noise estimation interface was called to obtain the current noise levels of the three ciphertexts: E1 was 75%, E2 was 85%, and E3 was 60%. The preset noise threshold was 80% of the maximum noise budget. Since E2's 85% exceeded the threshold, a homomorphic encryption bootstrapping refresh operation was performed on E2. After the refresh, the noise level of E2 dropped to 65%. At this point, the noise levels of the three ciphertexts were all below 80%. Next, the edge node weights are calculated. The data quality scores of the participants corresponding to the three edge nodes are 0.9, 0.8, and 0.95, respectively, and the data volumes of the participants are 100, 150, and 50, respectively. First, the product of the data quality score and the data volume is calculated to obtain 90, 120, and 47.5, with a total of 257.5. After normalization, the weights are 0.3495, 0.4660, and 0.1845, respectively. Homomorphic scalar multiplication is performed on E1, E2, and E3 in the ciphertext domain. The scalar multiplication coefficients are taken as integer fixed-point representations of the normalized weights, which are 3495, 4660, and 1845, respectively. Then, homomorphic addition is performed on the ciphertext after the three scalar multiplications to obtain the globally weighted aggregated ciphertext. Then, homomorphic normalization is performed, multiplied by the normalization coefficient 1 / 10000, to obtain the globally aggregated ciphertext that is independent of the number of participants. In this embodiment, the multiplication factor of 1 / 10000 is set based on the fact that the edge node weights are represented in integer fixed-point form in the ciphertext domain, that is, the actual normalized weights (such as 0.3495, 0.4660, 0.1845) are multiplied by 10.4 After being rounded to 3495, 4660, and 1845, the result of the weighted aggregate ciphertext is magnified by a factor of 10,000. In order to restore the global aggregation result to a numerical scale consistent with the actual weighted average and to avoid distortion of the global gradient obtained by subsequent homomorphic decryption and dequantization due to scaling bias, the weighted aggregate ciphertext needs to be normalized by multiplying by 1 / 10,000 in the ciphertext domain. This eliminates the scaling factor introduced by the integer fixed-point representation, ensures that the global gradient is independent of the number of participants and is consistent with the numerical range of the original gradient, and satisfies the constraint that only integer operations are supported in the homomorphic encryption plaintext space.

[0408] According to the adaptive privacy budget allocation algorithm, the total privacy budget is 10. The performance improvement rate of the current training round is 0.02, which is between the low threshold of 0.01 and the high threshold of 0.05. The training progress coefficient is the ratio of the current round to the total number of training rounds. The remaining privacy budget is 8, and the remaining training rounds are 40. The differential privacy budget allocated to the current round is 8 × (1 / 40) = 0.2. An integer noise value of 15 is sampled from the discrete noise distribution that matches the preset Gaussian distribution. This integer noise value is homomorphically encrypted and then homomorphically added to the globally weighted aggregated ciphertext to complete the noise addition. The homomorphic decryption private key held by the cloud-side node is used to decrypt the globally encrypted gradient after the noise is added, to obtain the integer plaintext gradient, for example, a gradient element is 1500. The scaling factor of each edge aggregated ciphertext is 10. 3 The uniform scaling factor is set to 10. 3 Divide the integer element by 10 3 The floating-point global gradient is 1.5, and the dequantized residual is 0, which is retained for subsequent rounds. The global model parameters are updated based on the floating-point global gradient and the accumulated residual, with the learning rate set to 0.001. If the corresponding element in the current global model parameters is 0.5, the updated parameters are 0.5 - 0.001 × 1.5 = 0.4985. Finally, for participant B, whose comprehensive sensitivity score is 0.9, corresponding to L1 level and located at the edge layer, the BFV homomorphic encryption parameters and access control policy are obtained from the preset policy matrix. The updated global model parameters are encrypted using participant B's public key to obtain the first layer of ciphertext. The receiver's identity identifier B_ID is bound to the first layer of ciphertext and sent to the edge node. After the edge node verifies that B_ID meets the access control policy, it uses the proxy re-encryption key to convert the first layer of ciphertext into a second layer of ciphertext that can be decrypted by participant B's private key and forwards it. The edge node cannot decrypt this ciphertext throughout the entire process.

[0409] It should be further explained that, in this embodiment, determining the differential privacy noise scale based on the comprehensive sensitivity score and adding noise to the inference result before outputting it includes:

[0410] S601. Preprocess the data to be reasoned, extract reasoning semantic features, reasoning structure features, and reasoning context features, and fuse them to obtain a comprehensive reasoning sensitivity score, specifically:

[0411] S6011. Obtain the data to be reasoned, perform multilingual word segmentation and domain term recognition on the data to be reasoned, input the recognition results into the pre-trained encoder to obtain the reasoning semantic features; the pre-trained encoder adopts the same multilingual BERT variant as in S101, which is composed of 12 layers of Transformer encoding layers stacked together, and outputs a hidden state vector with a dimension of 768. The hidden state vector is averaged and pooled to obtain the reasoning semantic features.

[0412] S6012. Parse the field structure, field nesting relationship, and metadata of the data to be inferred to obtain inference structure features. The parsing method is the same as S102, including: parsing the file format or database structure, extracting field names, field paths, field data types, and field level depth to form field structure information; extracting nesting relationships to form a nesting relationship diagram; extracting metadata and encoding it; and concatenating the field structure information, nesting relationship diagram, and metadata encoding vector to obtain inference structure features.

[0413] S6013. Perform cross-field context parsing on the data to be reasoned and its associated data items to obtain reasoning context features; the parsing method is the same as S103, including: determining the set of associated data items, concatenating the data to be reasoned and the set of associated data items into a text sequence in a preset order, inputting it into a second pre-trained encoder to obtain a joint hidden state representation; using a graph attention network to encode field reference relationships to obtain a graph embedding vector; concatenating the joint hidden state representation and the graph embedding vector to obtain reasoning context features.

[0414] S6014. Perform L2 normalization on the inference semantic features, inference structure features and inference context features respectively, and input them into the feature weighted fusion network for feature weighted fusion to obtain inference fusion features; the feature weighted fusion network is the same as in S104, adopts a multi-head attention mechanism with 8 attention heads, uses normalized semantic features as query vectors, and outputs fusion features with a dimension of 256.

[0415] S6015. The reasoning fusion features are input into four pre-trained scoring networks to obtain four evaluation values, and then weighted and summed according to preset weights to obtain a comprehensive reasoning sensitivity score. The four pre-trained scoring networks are the same as those in S105, and the preset weights are the same as those in S106, namely, content sensitivity weight 0.4, regulatory relevance weight 0.3, business value weight 0.2, and privacy risk weight 0.1.

[0416] In this embodiment, the inference phase reuses the pre-trained encoder, feature weighted fusion network, and scoring network from the training phase. Specifically, the inference phase directly loads all 12 Transformer encoding layer weights of the multilingual BERT variant saved in the training phase, the multi-head attention mechanism weights and fully connected layer weights of the feature weighted fusion network, and the multilayer perceptron weights of the four pre-trained scoring networks. During inference, only forward propagation computation is performed, without backpropagation or parameter updates. At the same time, the inference phase uses the same multilingual word segmenter, trade domain terminology rule base, field parsing method, and graph attention network structure as the training phase, and the number of attention heads (8), hidden layer dimension (768), and fused feature output dimension (256) remain consistent during feature fusion. Through the above reuse and parameter sharing, the comprehensive sensitivity score obtained in the inference stage and the comprehensive sensitivity score in the training stage are under the same scoring standard and feature space, avoiding scoring deviations caused by differences in model structure or inconsistent parameters. Furthermore, since the inference stage does not require retraining or online fine-tuning, each inference only consumes forward propagation computation, which can meet the low-latency sensitivity evaluation requirements of the edge side, while ensuring the comparability and consistency of sensitivity evaluation results between the training and inference stages.

[0417] S602. Compare the difference between the reasoning comprehensive sensitivity score and the comprehensive sensitivity score. If the absolute value of the difference is greater than a preset update threshold, then update the comprehensive sensitivity score to the reasoning comprehensive sensitivity score. Specifically:

[0418] S6021. Obtain the comprehensive sensitivity score for reasoning obtained in S601 and the comprehensive sensitivity score obtained in S1.

[0419] S6022. Calculate the difference between the reasoning comprehensive sensitivity score and the comprehensive sensitivity score, and take the absolute value of the difference.

[0420] S6023. Compare the absolute value of the difference with a preset update threshold; the preset update threshold can be set to 0.1.

[0421] S6024. When the absolute value of the difference is greater than the preset update threshold, the comprehensive sensitivity score is updated to the inference comprehensive sensitivity score; when the absolute value of the difference is not greater than the preset update threshold, the comprehensive sensitivity score remains unchanged.

[0422] S6025. Output the updated comprehensive sensitivity score for subsequent differential privacy noise scale calculation.

[0423] In this embodiment, the preset update threshold is set to 0.1 because the overall sensitivity score is between 0 and 1, and a change of 0.1 corresponds to the span of a sensitivity level range. When the difference between the score in the inference stage and the score in the training stage exceeds this threshold, it indicates that the sensitivity of the data to be inferred is significantly different from that of the training data, and the score needs to be updated to accurately reflect the actual query sensitivity. If the threshold is too small, it will lead to frequent updates and increase computational overhead; if the threshold is too large, it will not be able to reflect changes in sensitivity in a timely manner.

[0424] S603. Within the trusted execution environment, query the entropy pool status of the hardware random source; when the entropy pool status is less than a preset entropy threshold, pause sampling from the preset continuous noise distribution and call an external entropy source to replenish the entropy pool until the entropy pool status is not less than the preset entropy threshold, specifically:

[0425] S6031. Within the trusted execution environment, call the hardware random source interface to read the entropy pool state; the entropy pool state is represented by the estimated number of entropy bits.

[0426] S6032. Compare the entropy pool state with a preset entropy threshold; the preset entropy threshold can be set to 256 bits.

[0427] S6033. When the entropy pool state is less than the preset entropy threshold, sampling from the preset continuous noise distribution is paused to prevent the generation of noise using low-entropy random numbers.

[0428] S6034. Call an external entropy source to replenish the entropy pool; the external entropy source may be a hardware security module or operating system entropy source outside the trusted execution environment, and the entropy data is injected into the entropy pool through a secure channel.

[0429] S6035. After replenishment, the entropy pool state is reread. If it is still less than the preset entropy threshold, the external entropy source is called to replenish it until the entropy pool state is not less than the preset entropy threshold.

[0430] S6036. When the entropy pool state is not less than the preset entropy threshold, resume sampling from the preset continuous noise distribution.

[0431] In this embodiment, the preset entropy threshold is set to 256 bits because the minimum entropy pool level recommended by the cryptographically secure random number generator is 256 bits. Below this level, random numbers may become predictable. Calling an external entropy source to supplement the pool can ensure the randomness of noise generation and prevent attackers from performing differential attacks by predicting noise.

[0432] S604. Calculate the differential privacy noise scale based on the updated comprehensive sensitivity score and preset privacy parameters, specifically as follows:

[0433] S6041. Obtain the updated comprehensive sensitivity score and preset privacy parameters after S602; the preset privacy parameters include privacy budget ε and privacy relaxation parameter δ.

[0434] S6042. Perform query preprocessing on the data to be reasoned to obtain a preprocessed query; query preprocessing includes removing irrelevant fields, unifying the format, and standardizing the processing.

[0435] S6043. Perform sensitivity analysis on the preprocessed query and inference model, and calculate the query sensitivity; the query sensitivity is the maximum difference between adjacent query outputs.

[0436] S6044. Calculate the differential privacy noise scale based on the updated comprehensive sensitivity score, the privacy budget ε, the privacy relaxation parameter δ, and the query sensitivity; the differential privacy noise scale is directly proportional to the query sensitivity and inversely proportional to the privacy budget ε.

[0437] S6045, Output the differential privacy noise scale.

[0438] In this embodiment, the preset privacy parameters ε and δ are set according to the privacy protection strength requirements. The smaller ε is, the stronger the privacy protection and the greater the noise. The comprehensive sensitivity score is used to adjust the noise scale. High-sensitivity queries correspond to a larger noise scale, and low-sensitivity queries correspond to a smaller noise scale, so as to achieve hierarchical protection. The sensitivity analysis adopts the difference measure of adjacent query outputs to ensure the strictness of the differential privacy definition.

[0439] S605. Determine the task type of the inference task. When the task type is a classification task, generate noise using an exponential mechanism. When the task type is a regression task or a generation task, sample from a Laplace distribution or a Gaussian distribution, discretize the sampling results to obtain discrete noise values, calculate the discretization error, and include the discretization error in the differential privacy noise scale. Specifically:

[0440] S6051. Obtain the task type of the inference task; the task type is determined according to the model output type. When the output is a category label, it is determined to be a classification task. When the output is a continuous value, it is determined to be a regression task or a generation task.

[0441] S6052. When the task type is a classification task, an exponential mechanism is used to generate noise; the exponential mechanism calculates the selection probability based on the utility score corresponding to each candidate category and the differential privacy noise scale, and randomly selects a noisy category as the output according to the selection probability.

[0442] S6053. When the task type is a regression task or a generation task, continuous noise values ​​are sampled from a Laplace distribution or a Gaussian distribution; the Laplace distribution is suitable for ε-differential privacy, and the Gaussian distribution is suitable for (ε, δ)-differential privacy.

[0443] S6054. The sampled continuous noise value is discretized. The discretization method is to multiply the continuous noise value by a preset discretization coefficient and then round it to obtain a discrete noise value. At the same time, the discretization error is calculated. The discretization error is the difference between the continuous noise value multiplied by the preset discretization coefficient and the discrete noise value.

[0444] S6055. Record the discretization error and add it to the differential privacy noise scale calculation in subsequent rounds to compensate for the privacy budget deviation caused by discretization.

[0445] In this embodiment, the classification task uses an exponential mechanism because numerical noise cannot be directly added to the category output, and the exponential mechanism achieves differential privacy through probability perturbation; the regression or generation task uses a Laplace or Gaussian mechanism because numerical noise can be directly added to the continuous numerical output; discretization is used to store and encrypt noise values ​​in the digital system, and the discretization error is included in the noise scale to avoid underestimating the privacy budget.

[0446] S606. Add the discrete noise value to the inference result to obtain a noisy inference result. Perform post-processing on the noisy inference result and output it, specifically as follows:

[0447] S6061. Obtain the basic reasoning result; the basic reasoning result is calculated by the reasoning model from the preprocessed query.

[0448] S6062. Add the discrete noise value obtained in S605 to the basic inference result; for classification tasks, directly output the noisy category selected by the exponential mechanism; for regression or generation tasks, add the discrete noise value to the corresponding numerical element of the basic inference result to obtain the noisy inference result.

[0449] S6063. Post-process the inference result after adding noise; the post-processing includes truncating or limiting the range of the value after adding noise so that the result falls within a preset output range.

[0450] S6064. Output the post-processed inference results.

[0451] In this embodiment, post-processing is used to ensure that the inference results after adding noise meet the business format and range requirements, and to avoid output overflow or outliers caused by noise; the truncation operation will not significantly affect differential privacy guarantee, because the distribution difference of the results before and after truncation is already included in the noise scale.

[0452] S607. Based on the audit trail level in the audit strategy, the query identifier, noise parameter, and result summary fields in the audit record are de-identified according to the sensitivity level corresponding to the comprehensive sensitivity score. Specifically:

[0453] S6071. Obtain the audit trail level in the audit strategy; the audit trail level includes full audit with real-time alerts, key operation audit, periodic audit and sampling audit.

[0454] S6072. Determine the de-identification processing method corresponding to the current sensitivity level; the first sensitivity level adopts complete de-identification, removing direct and quasi-identifiers from the query identifier, noise parameters, and result summary; the second level adopts partial de-identification, removing direct identifiers but retaining some noise parameter summaries; the third level adopts mild de-identification, removing only the direct identity field in the query identifier; the fourth level adopts basic de-identification, only performing pseudonym processing on the query identifier.

[0455] S6073. Perform de-identification processing on the query identifier, noise parameter and result summary fields in the audit record according to the current sensitivity level to generate the de-identified audit record.

[0456] S6074. Output the de-identified audit logs.

[0457] In this embodiment, different sensitivity levels correspond to different de-identification intensities because the leakage of highly sensitive data audit records may cause greater harm; de-identification processing can reduce the risk of audit logs becoming a new leakage path, while retaining the key information required for auditing.

[0458] S608. Encrypt the de-identified audit record using homomorphic encryption parameters corresponding to the sensitivity level to obtain an encrypted audit record, specifically:

[0459] S6081. Obtain the homomorphic encryption parameter corresponding to the current sensitivity level; the homomorphic encryption parameter is obtained from the preset policy matrix in S2 and is independent of the level of the participant.

[0460] S6082. Convert the de-identified audit record into an encryptable plaintext format; when the audit record is text, first encode it into a numerical sequence.

[0461] S6083. Use the public key in the homomorphic encryption parameters to perform homomorphic encryption on the converted plaintext format to obtain an encrypted audit record; during encryption, ciphertext packing technology is used to pack multiple numerical elements into the same ciphertext.

[0462] S6084. Store the encrypted audit records in the audit storage system.

[0463] In this embodiment, homomorphic encryption is used to protect audit records, making them unreadable even if accessed without authorization. It also maintains consistency with the homomorphic encryption system used in the training phase, facilitating unified key management. Ciphertext packaging is used to reduce the number of ciphertexts and storage overhead.

[0464] S609. Obtain the set of retention periods and access permissions corresponding to the sensitivity level from the preset cross-border data compliance rule set, and apply the retention period and access permission set to the encrypted audit record, specifically as follows:

[0465] S6091. Obtain the data category corresponding to the current sensitivity level; the data category is determined by the four-level sensitivity classification system in S1071-1.

[0466] S6092. From the multi-country regulatory compliance mapping table in the preset cross-border data compliance rule set, extract the corresponding compliance requirements using the data category as the row index and the applicable regulations as the column index; the compliance requirements include a set of retention periods and access permissions.

[0467] S6093. Set the retention period of the encrypted audit record according to the extracted retention period; for example, the retention period for trade secret L1 is 10 years, personal identification information L1 is 5 years, transaction data L2 is 3 years, commodity information L3 is 2 years, and public information L4 is 1 year; the retention period is calculated from the time the audit record is created.

[0468] S6094. Set the access permissions for the encrypted audit record according to the extracted access permission set; the access permission set specifies the roles and conditions that can access the audit record, for example, only the compliance audit role can access it within the audit time window.

[0469] S6095. Implement a retention period and access permission set for the encrypted audit records, that is, retain the encrypted audit records within the retention period and delete them upon expiration; only allow access to subjects that meet the access permission set.

[0470] In this embodiment, the retention period and access permissions are determined based on a multi-country regulatory compliance mapping table, which can meet the requirements of different regulations such as GDPR and PIPL for the retention and access of audit logs; expiration deletion can reduce the risk of leakage caused by long-term storage; access restriction can prevent unauthorized entities from obtaining audit records.

[0471] As a concrete example, a participant submits a query request during the inference phase. The data to be inferred is the unit price clause field in an export contract. The original text is "Unit price: USD 1,250 per metric ton CIF Rotterdam". The query aims to predict the tariff classification corresponding to this unit price. The inference phase reuses the pre-trained encoder, feature-weighted fusion network, and scoring network from the training phase: First, the data to be inferred is segmented into sub-word units using the SentencePiece word segmenter, resulting in the word sequence "Unit", "price", "USD", "1,250", "per", "metric", "ton", "CIF", and "Rotterdam". After matching with the trade domain terminology rule base, the terms "Unit price" and "CIF Rotterdam" are identified. The first special placeholders "[TERM_START]" and "[TERM_END]" are inserted into the word sequence, resulting in the labeled sequence "[TERM_START] Unit price [TERM_END] USD 1,250 per metric ton [TERM_START] CIF Rotterdam". [TERM_END]”; The sequence is input into a 12-layer Transformer encoder. The embedding layer of the encoder maps each word and tag to a 768-dimensional embedding vector and superimposes the position embedding. After 12 layers of multi-head self-attention calculation (12 attention heads per layer, each head with 64 dimensions), the hidden state vectors corresponding to each word in the output of the 12th layer are taken. After removing special tags, the hidden state vectors of the 14 words are summed by dimension and then divided by 14 to obtain the 768-dimensional inference semantic features. Simultaneously, the JSON path "$.contract.pricing.unit_price" of this field is parsed. The field has a depth of 3, a data type of string, and originates from an ERP system. The nested relationship graph contains nodes "contract", "pricing", and "unit_price", with edges "contract→pricing" and "pricing→unit_price". After encoding with a two-layer graph convolutional network, a 128-dimensional graph embedding vector is obtained. This vector is then concatenated with the field structure information encoding and metadata encoding to obtain the inference structure feature. Next, this field is concatenated with the "payment_terms" and "incoterms" fields from the same contract to form a text sequence. This sequence is then input into a second pre-trained encoder to obtain a joint hidden state representation. After encoding the field reference relationship with a graph attention network, a graph embedding vector is obtained. The two are then concatenated to obtain a 1536-dimensional inference context feature.After L2 normalization of the inference semantic features, inference structural features, and inference context features, the input is fed into an 8-head attention mechanism feature weighted fusion network. The normalized semantic features are used as the query vector, and the semantic features, structural features, and context features are used as both key vectors and value vectors. The 8 attention heads calculate the attention weights and sum them up. After concatenation, the network outputs a 256-dimensional fusion feature through a fully connected layer. The fused feature was input into four pre-trained scoring networks, each a multilayer perceptron (256-256-64-1), using ReLU and Sigmoid activation. This yielded a content sensitivity score of 0.95, a regulatory relevance score of 0.90, a business value score of 0.80, and a privacy risk score of 0.95. These scores were then weighted and summed with weights of 0.4, 0.3, 0.2, and 0.1 respectively: 0.95×0.4+0.90×0.3+0.80×0.2+0.95×0.1=0.38+0.27+0.16+0.095=0.905, resulting in a comprehensive inference sensitivity score of 0.905. The comprehensive sensitivity score stored during training was 0.884. The difference between the two scores was 0.021, which is less than the preset update threshold of 0.1. Therefore, the original comprehensive sensitivity score of 0.884 was maintained. Within the trusted execution environment, the hardware random source entropy pool status is queried. The current entropy pool is 240 bits, which is less than the preset entropy threshold of 256 bits. Therefore, noise sampling is paused, and an external hardware security module is invoked to inject 60 bits of entropy through a secure channel. The entropy pool status is then increased to 300 bits, and sampling resumes. Preset privacy parameters ε=0.5, δ=10. -5Sensitivity analysis was performed on the preprocessed query. The maximum difference between adjacent query outputs was 1. Combined with the comprehensive sensitivity score of 0.884, the differential privacy noise scale was calculated as 1 divided by 0.5 and then multiplied by 0.884, resulting in 1.768. The inference task type was determined to be a regression task. A continuous noise value of 0.31 was sampled from the Laplace distribution. The preset discretization coefficient was 1000, resulting in an integer noise value of 310. The discretization error was 0.31×1000-310=0.0, which was included in the differential privacy noise scale of subsequent rounds. The basic inference result was 1250. The integer noise value 310 was divided by the discretization coefficient 1000 to obtain 0.31, which was added to the basic inference result to obtain 1250.31. After post-processing, it was truncated to the preset output range [0, 2000] and then output as 1250.31. In this embodiment, the integer noise value 310 is divided by the discretization coefficient 1000 because the discretization coefficient 1000 is a fixed scaling factor used in the differential privacy noise discretization process to convert continuous noise values ​​into integer representations. Its function is to enable continuous noise to be represented in integer form in encryption, storage, or fixed-point arithmetic scenarios, while restoring the true numerical scale of the noise by dividing by the same coefficient when adding noise. This operation ensures that the noise amplitude actually added to the inference result is consistent with the theoretical noise value sampled from the preset continuous noise distribution (such as the Laplace distribution), avoiding systematic deviations introduced by discretization rounding and scaling, thereby ensuring the statistical characteristics of the differential privacy noise mechanism and the accuracy of privacy budget calculation, while satisfying the constraint that only integer operations are supported in homomorphic encryption or secure computing environments. In this embodiment, the preset output range [0, 2000] is set based on the preferred output boundary determined by those skilled in the art according to the actual numerical distribution range of the inference results in the target business scenario and the post-processing truncation constraints: In inference tasks involving prediction of international trade unit prices, tariff classifications, or related amounts, the reasonable values ​​of the model output are usually concentrated in the range of 0 to 2000, which can completely cover the range of legal and interpretable prediction results in the current business scenario; the purpose of setting this preset output range is to perform post-processing truncation on the inference results after adding differential privacy noise, preventing the output from being truncated due to excessive noise amplitude. The output value deviates from the reasonable range of business operations, produces negative values ​​or abnormally high values, thereby ensuring that the output results are understandable in business operations and acceptable in format, and avoiding the leakage of relevant information about noise sampling distribution to the outside world due to extreme noise values. This range is not a redefinition of the strength of differential privacy protection, but a post-processing operation that limits the range of the output results while keeping differential privacy protection unchanged. Its numerical boundary is determined by those skilled in the art based on the prior distribution of business data and the statistical characteristics of historical model output, and is consistent with the numerical range covered by the comprehensive sensitivity score, business value weight and other evaluation dimensions of the data items in the training phase.

[0472] The audit strategy is full-process auditing with real-time alerts. The current sensitivity level is L1. The direct and quasi-identifiers in the audit log, such as query identifier "Q20240125100001", user ID "user_A", and source IP address "192.168.1.25", are completely de-identified. Only non-sensitive digests such as "L1 level query", "regression task", "output range [0, 2000]" and "timestamp 2024-01-25T10:00:10Z" are retained. The de-identified audit records are packaged and encrypted using the BFV homomorphic encryption parameters corresponding to the L1 level (plaintext modulus 65537, polynomial coefficient modulus 8192): the audit record is encoded into multiple 64-bit integers, which are then filled into the plaintext polynomial coefficient positions using a single instruction multiple data method. Each plaintext polynomial can hold 8192 coefficients. This audit record only requires one plaintext polynomial after encoding. After encryption, a single ciphertext polynomial is generated with a length of 131072 bytes and stored in the audit storage system. Compliance requirements are extracted from the multi-country regulatory compliance mapping table with trade secret L1 as the row and applicable regulations GDPR and PIPL as the columns. The retention period is determined to be 10 years, and the access permission set is set to be accessible only to the compliance audit role (role ID auditor_compliance) during the audit time window (from 9:00 to 18:00 on January 25, 2024). This retention period and access permission set are applied to the encrypted audit records, which are automatically deleted upon expiration. Unauthorized roles cannot read them.

[0473] Example 3

[0474] Please see Figure 2 Another embodiment of the present invention provides: a homomorphic encryption trusted privacy protection system based on hierarchical federated learning, comprising:

[0475] The data sensitivity module is configured to: acquire local data items from each participant, extract semantic features, structural features and contextual features, fuse them to calculate a comprehensive sensitivity score, and map it to a preset four-level sensitivity level;

[0476] The policy matching module is configured to match corresponding homomorphic encryption parameters, access control policies, and audit policies from a preset policy matrix based on the comprehensive sensitivity score and the level of the participant in the end-edge-cloud hierarchical architecture.

[0477] The encrypted upload module is configured as follows: the edge node trains gradients based on the global model and local data, encrypts the cropped gradients according to the homomorphic encryption parameters, and uploads the encrypted gradients to the edge node after authenticating the identities and verifying the permissions of the participants according to the access control policy.

[0478] The trusted verification module is configured such that: the edge node performs legality verification and homomorphic aggregation on the received encryption gradient within the trusted execution environment, generates edge aggregated ciphertext and trusted verification credentials, and uploads them to the cloud-side node;

[0479] The model update module is configured as follows: the cloud-side node performs global homomorphic aggregation on each edge aggregation ciphertext based on the trusted verification credential, decrypts and updates the global model parameters, and then sends the encrypted global model parameters down to each participant level by level.

[0480] The differential privacy audit module is configured to: input the data to be inferred into the trusted execution environment during the inference phase, determine the differential privacy noise scale based on the comprehensive sensitivity score, add noise to the inference result and output it, and record audit logs according to the audit strategy.

[0481] Example 4

[0482] An electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement a homomorphic encryption trusted privacy protection method based on hierarchical federated learning.

[0483] A computer-readable storage medium storing computer instructions that, when executed, perform a homomorphic encryption-based trusted privacy protection method based on hierarchical federated learning.

[0484] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments under the guidance of the present invention without departing from the spirit and scope of the present invention. All of these variations are within the protection scope of the present invention.

[0485] If the technical solution disclosed herein involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution disclosed herein involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the individual through pop-up information or by asking the individual to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

Claims

1. A homomorphic encryption trusted privacy protection method based on hierarchical federated learning, characterized in that, include: Acquire local data items from each participant, extract semantic features, structural features, and contextual features, fuse them to calculate a comprehensive sensitivity score, and map it to a preset four-level sensitivity level; Based on the comprehensive sensitivity score and the level of the participant in the end-edge-cloud hierarchical architecture, the corresponding homomorphic encryption parameters, access control policies and audit policies are matched from the preset policy matrix; The edge node trains gradients based on the global model and local data, encrypts the cropped gradients according to the homomorphic encryption parameters, and performs identity authentication and permission verification on the participants according to the access control policy before uploading the encrypted gradients to the edge node. Edge nodes perform legality verification and homomorphic aggregation on the received encryption gradients within a trusted execution environment, generating edge aggregated ciphertext and trusted verification credentials, which are then uploaded to the cloud-side nodes. The cloud-side node performs global homomorphic aggregation on each edge aggregate ciphertext based on the trusted verification credential, decrypts it, updates the global model parameters, and then distributes the encrypted global model parameters to each participant level by level. During the inference phase, the data to be inferred is input into the trusted execution environment, the differential privacy noise scale is determined based on the comprehensive sensitivity score, the inference result is noise-added and output, and the audit log is recorded according to the audit strategy.

2. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 1, characterized in that, The calculation of the comprehensive sensitivity score and its mapping to a preset four-level sensitivity level includes: Multilingual word segmentation and domain terminology recognition are performed on the local data items, and the recognition results are input into a pre-trained encoder to obtain the semantic features. The structural features are obtained by parsing the field structure, field nesting relationships, and metadata of the local data items; Perform cross-field context parsing on the local data item and its associated data item to obtain the context features; The semantic features, structural features, and context features are normalized respectively, and then input into a pre-trained feature weighting fusion network for feature weighting fusion to obtain fused features; The fused features are input into multiple pre-trained scoring networks to obtain multiple corresponding evaluation values; The multiple evaluation values ​​are weighted and summed according to preset weights to obtain the comprehensive sensitivity score; The comprehensive sensitivity score is mapped to the four sensitivity levels according to the preset mapping table, and the mapping result is adjusted by context rules using the preset domain rule base to obtain the final sensitivity level.

3. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 2, characterized in that, The step of matching the corresponding homomorphic encryption parameters, access control policies, and audit policies from the preset policy matrix includes: It can obtain the real-time computing load, available communication bandwidth, key management capabilities, and homomorphic ciphertext aggregation capabilities of end-side nodes, edge nodes, and cloud-side nodes. Using the comprehensive sensitivity score and the level as the first matching condition, the initial homomorphic encryption parameters, the initial access control policy, and the initial audit policy are determined from the preset policy matrix; The initial homomorphic encryption parameters are adjusted based on the real-time computing load and the homomorphic ciphertext aggregation capability: if the real-time computing load is higher than a first load threshold, the initial homomorphic encryption parameters are replaced with homomorphic encryption parameters whose computational complexity is lower than the first complexity threshold.

4. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 3, characterized in that, The step of matching corresponding homomorphic encryption parameters, access control policies, and audit policies from a preset policy matrix also includes: If the homomorphic ciphertext aggregation capability does not meet the ciphertext aggregation condition corresponding to the initial homomorphic encryption parameter, then the initial homomorphic encryption parameter is replaced with a homomorphic encryption parameter that matches the homomorphic ciphertext aggregation capability. Based on a preset set of cross-border data compliance rules, the initial access control policy is subjected to cross-level permission inheritance verification and permission intersection determination. When the permission set of the first level and the permission set of the second level have inconsistent authorization for the same cross-level operation, the initial access control policy is adjusted to an inter-level access control policy that satisfies the permission constraints of each level. Based on the sensitivity level and operation type corresponding to the comprehensive sensitivity score, the initial audit strategy is refined into audit strategies for cross-layer aggregation operations and parameter distribution operations, resulting in the final audit strategy.

5. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 4, characterized in that, The gradient obtained by training based on the global model and local data includes: Obtain the real-time computing load of the endpoint; when the real-time computing load is higher than the first load threshold, freeze a preset number of layer parameters in the global model that are close to the input layer, and only perform forward and backward propagation on the remaining layers of the global model to obtain the initial gradient; When the real-time computing load is not higher than the first load threshold, forward propagation and backward propagation are performed on all layers of the global model to obtain the initial gradient. Before performing the forward and backward propagation, the training samples in the local data are divided into multiple training sample groups based on the comprehensive sensitivity score.

6. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 5, characterized in that, The gradient obtained by training based on the global model and local data also includes: Configure the corresponding learning rate and local training rounds for each training sample group, and calculate the group gradient for each training sample group. The gradients of each training sample group are weighted and merged according to the proportion of the number of samples in each group to obtain the initial gradient. The initial gradient is weighted and averaged with the historical gradient obtained in the previous training round to obtain the corrected local gradient, which is then used as the gradient to be clipped.

7. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 6, characterized in that, The step of encrypting the clipped gradient according to the homomorphic encryption parameters includes: Obtain the numerical range of the clipped gradient; Based on the plaintext modulus and preset scaling factor in the homomorphic encryption parameters, the clipped gradient is quantized and encoded to convert the floating-point gradient into an integer gradient represented by the plaintext modulus. Determine whether the numerical range of the integer gradient is contained within the representable numerical range corresponding to the plaintext modulus; If the numerical range of the integer gradient is not included in the representable numerical range, then adjust the preset scaling factor or reselect the plaintext modulus until the numerical range of the integer gradient is included in the representable numerical range. Pack multiple elements in the integer gradient into the same ciphertext, perform homomorphic encryption according to the homomorphic encryption parameters, and obtain the encrypted gradient; If the ciphertext modulus, ciphertext length, or key space in the homomorphic encryption parameters corresponding to each edge node are inconsistent, the encryption gradient is converted into ciphertext that matches the unified ciphertext modulus and unified key space required for the edge node to perform homomorphic aggregation, and then uploaded to the edge node.

8. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 7, characterized in that, After authenticating and verifying the identities and permissions of the participants according to the access control policy, the encryption gradient is uploaded to the edge node, including: Obtain the identity credentials and authorization tokens of the participating parties; Perform cross-trust domain certificate chain verification on the identity credential and query the revocation status corresponding to the identity credential; When the revocation status is not revoked and the cross-trust domain certificate chain verification is successful, multi-factor authentication is performed on the participating party, and the multi-factor authentication includes the verification of two or more authentication factors; Obtain the role authorization information and authorization time window from the permission token, compare the authorization time window with the current time, and compare the role authorization information with the operation type of uploading encryption gradient.

9. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 8, characterized in that, After authenticating and verifying the identities and permissions of the participants according to the access control policy, the encrypted gradient is uploaded to the edge node, which also includes: When the current time does not belong to the authorized time window, or the role authorization information does not contain the operation type of the upload encryption gradient, the upload of the encryption gradient is rejected; when the current time belongs to the authorized time window and the role authorization information contains the operation type of the upload encryption gradient, the identity of the participant is bound to the encryption gradient to generate an upload credential. The encryption gradient and the upload credential are sent together to the edge node so that the edge node can verify the binding relationship between the encryption gradient and the identity identifier in encrypted form.

10. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 9, characterized in that, The edge node performs validity verification and homomorphic aggregation on the received cryptographic gradients within the trusted execution environment, including: Obtain the remaining secure memory capacity of the trusted execution environment and the ciphertext length of a single encryption gradient; The upper limit of the number of encryption gradients loaded in a single batch is determined based on the remaining capacity of the secure memory and the length of the ciphertext, and the received encryption gradients are loaded into the secure memory in batches according to the upper limit of the number of encryption gradients. Homomorphic addition is performed on each batch of loaded encryption gradients to obtain intermediate aggregated ciphertext, and the intermediate aggregated ciphertext is written to the external memory of the trusted execution environment; For the encrypted gradient or the intermediate aggregated ciphertext loaded from the external memory, an integrity verification value is calculated based on the page key and page identifier. After successful verification, the ciphertext is decrypted and loaded into the secure memory, and the memory access order is hidden by using an unintentional random access storage method.

11. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 10, characterized in that, The edge node performs validity verification and homomorphic aggregation on the received cryptographic gradients within the trusted execution environment, and also includes: For each encryption gradient, verify the ciphertext range proof uploaded by the end node along with the encryption gradient; when the ciphertext range proof fails to be verified, or the numerical range corresponding to the ciphertext range proof is not included in the preset legal gradient numerical range, mark the encryption gradient as an abnormal gradient and exclude it from the homomorphic aggregation. When generating the trusted verification credential, the list of cryptographic gradient identifiers participating in this homomorphic aggregation, the batch division, and the aggregation order of each batch are recorded, and an aggregation execution record is generated. Calculate the first hash value of the aggregated execution record, the second hash value of the input cryptographic gradient set, and the third hash value of the output edge-aggregated ciphertext; The first hash value, the second hash value, and the third hash value are concatenated and then signed using the signature key of the trusted execution environment to obtain the trusted verification credential.

12. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 11, characterized in that, The global homomorphic aggregation of each edge-aggregated ciphertext based on the trusted verification credential includes: Receive edge aggregated ciphertext, trusted verification credentials, and credential generation timestamp uploaded by each edge node; For each of the trusted verification credentials, the signature is verified using the public key corresponding to the signature key of the trusted execution environment, and the aggregated execution record hash value, the input cryptographic gradient set hash value, and the output edge aggregated ciphertext hash value are extracted from the trusted verification credentials. The output edge-aggregated ciphertext hash value is compared with the actual hash value of the received corresponding edge-aggregated ciphertext, and the difference between the credential generation timestamp and the current time is compared with the preset valid duration. When the output edge-aggregated ciphertext hash value is inconsistent with the actual hash value, or when the difference exceeds the preset valid duration, the edge-aggregated ciphertext is rejected. When the output edge-aggregated ciphertext hash value is consistent with the actual hash value, and the difference does not exceed the preset valid duration, the edge-aggregated ciphertext is added to the global homomorphic aggregation set.

13. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 12, characterized in that, The global homomorphic aggregation of each edge-aggregated ciphertext based on the trusted verification credential also includes: Obtain the homomorphic encryption parameters, quantization scaling factor, and noise budget parameters corresponding to each edge-aggregated ciphertext; When the ciphertext modulus, ciphertext length, or key space of each edge-aggregated ciphertext is inconsistent, each edge-aggregated ciphertext is converted into ciphertext with a unified ciphertext modulus and a unified key space. Obtain the current noise level of each edge-aggregated ciphertext after conversion, and compare the current noise level with a preset noise threshold; When any current noise level exceeds the preset noise threshold, a ciphertext refresh operation is performed on the corresponding edge-aggregated ciphertext until the current noise level is lower than the preset noise threshold. The weights of each edge node are calculated based on the data quality and data volume of the participants corresponding to each edge node. Homomorphic scalar multiplication and homomorphic addition are performed on each edge aggregate ciphertext in the ciphertext domain to obtain the globally weighted aggregate ciphertext.

14. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 13, characterized in that, The global homomorphic aggregation of each edge-aggregated ciphertext based on the trusted verification credential also includes: The globally weighted aggregated ciphertext is homomorphically normalized, and noise is added to the ciphertext domain according to the differential privacy budget determined by the adaptive privacy budget allocation algorithm in the current training round. When adding noise to the ciphertext domain, samples are taken from a discrete noise distribution that matches a preset continuous noise distribution, and the discretization error is calculated. The discretization error is included in the differential privacy budget calculation of subsequent rounds. Homomorphic decryption is performed on the global encrypted gradient after adding noise to obtain the integer plaintext gradient; the integer plaintext gradient is dequantized according to the quantization scaling factor to obtain the floating-point global gradient, and the dequantization residual is retained; The global model parameters are updated based on the floating-point global gradient and the inverse quantization residual to obtain the updated global model parameters.

15. The homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in claim 14, characterized in that, The global homomorphic aggregation of each edge-aggregated ciphertext based on the trusted verification credential also includes: For each participant, based on the comprehensive sensitivity score and the level of the participant, the homomorphic encryption parameters and access control policies corresponding to the participant are obtained from the preset policy matrix. The updated global model parameters are encrypted using the public key of the participating party and the re-encryption key of the participating party's level, generating participating party encrypted parameters. The receiver's identity is then bound to the participating party encrypted parameters and sent to the edge node. The edge node verifies the identity of the recipient according to the access control policy, and forwards the participant's encrypted parameters after converting them into ciphertext that can be decrypted by the participant's public key using the re-encryption key. The edge node is unable to decrypt the participant's encrypted parameters.

16. A homomorphic encryption trusted privacy protection system based on hierarchical federated learning, used to implement the homomorphic encryption trusted privacy protection method based on hierarchical federated learning as described in any one of claims 1-15, characterized in that, include: The data sensitivity module is configured to: acquire local data items from each participant, extract semantic features, structural features and contextual features, fuse them to calculate a comprehensive sensitivity score, and map it to a preset four-level sensitivity level; The policy matching module is configured to match corresponding homomorphic encryption parameters, access control policies, and audit policies from a preset policy matrix based on the comprehensive sensitivity score and the level of the participant in the end-edge-cloud hierarchical architecture. The encrypted upload module is configured as follows: the edge node trains gradients based on the global model and local data, encrypts the cropped gradients according to the homomorphic encryption parameters, and uploads the encrypted gradients to the edge node after authenticating the identities and verifying the permissions of the participants according to the access control policy. The trusted verification module is configured such that: the edge node performs legality verification and homomorphic aggregation on the received encryption gradient within the trusted execution environment, generates edge aggregated ciphertext and trusted verification credentials, and uploads them to the cloud-side node; The model update module is configured as follows: the cloud-side node performs global homomorphic aggregation on each edge aggregation ciphertext based on the trusted verification credential, decrypts and updates the global model parameters, and then sends the encrypted global model parameters down to each participant level by level. The differential privacy audit module is configured to: input the data to be inferred into the trusted execution environment during the inference phase, determine the differential privacy noise scale based on the comprehensive sensitivity score, add noise to the inference result and output it, and record audit logs according to the audit strategy.

Images