A secure federated learning method based on proxy re-encryption and homomorphic encryption

Abstract

The application discloses a kind of security federal learning methods based on proxy re-encryption and homomorphic encryption, it is related to privacy computing and cryptography application technical field, including: key generation center generates Paillier cryptosystem public parameter and each entity key pair;And before each round of training, random mask that meets weighted sum is zero is generated and is distributed to each local training end secretly;Local training end is superposed with random mask model parameter and is encrypted by Paillier, and combined identity identification generates hash digest upload;Proxy re-encryption node carries out integrity verification and identity authentication to ciphertext, and proxy re-encryption is carried out using two-stage re-encryption key;Aggregation server generates aggregation ciphertext using the additive homomorphic property of Paillier cryptosystem, completes division operation in plaintext domain after decryption, generates new global model and issues, iteration until convergence.The application realizes model parameter whole process ciphertext protection, while maintaining model precision, resist gradient inversion, model theft and collusion attack.

Description

Technical Field

[0001] This invention relates to the fields of privacy computing and cryptographic applications, specifically to a secure federated learning method based on proxy re-encryption and homomorphic encryption. Background Technology

[0002] Federated learning is a distributed machine learning framework. Its core idea is that each participant trains the model locally, leaving only the original data on their local machine. Only the model parameters are uploaded to the aggregation point for aggregation and global model distribution, thus reducing the privacy risks associated with centralized data aggregation. It can be applied to data-sensitive scenarios such as smart healthcare and financial risk control. However, existing federated learning solutions still have technical limitations in parameter transmission and aggregation: model parameters carry sensitive features related to local data, allowing attackers to reconstruct training data through gradient inversion and membership inference; attackers can infer the model structure by repeatedly obtaining global model parameters, leading to model theft. Furthermore, the lack of integrity verification and authentication in the transmission link allows malicious attackers to tamper with parameters or forge updates, causing a decrease in global model accuracy or even training failure.

[0003] To address the aforementioned limitations, a mask-based secure aggregation protocol generates pairs of random masks from each local training endpoint and superimposes them on the model update. This allows the masks to cancel each other out during the summation process at the aggregation endpoint, thus completing aggregation without knowing the model update of any single local training endpoint. However, this method requires key negotiation and secret share distribution between local training endpoints before each training round. Communication overhead increases quadratically with the number of participants, and additional rounds are needed to recover from participant disconnections, making it difficult to adapt to the multi-round iterative nature of federated learning. Furthermore, the mask mechanism only supports summation operations; the aggregation result is still presented in plaintext at the aggregation endpoint, and it lacks key domain conversion capabilities, making it impossible to transfer decryption authorization. The protocol itself also fails to solve the problems of parameter integrity verification and identity authentication.

[0004] On the other hand, proxy re-encryption schemes can achieve secure authorization of decryption permissions by converting ciphertext between different key domains through re-encryption without decrypting the original ciphertext. However, the ciphertext space of existing proxy re-encryption schemes usually does not possess additive homomorphic properties. The proxy can only complete ciphertext conversion and cannot perform summation or constant multiplication operations on multiple ciphertexts. If directly applied to federated learning, the aggregation end cannot perform weighted average calculation based on sample size in the ciphertext state and still needs to decrypt before aggregation, thus failing to protect privacy. When using homomorphic encryption alone, each local training end often shares the same key pair. Once the aggregation end colludes with any local training end, it can obtain decryption capabilities, and the ciphertext is bound to a single key domain, making it impossible to flexibly transfer authorization.

[0005] In summary, to address the shortcomings of existing schemes in terms of model parameter confidentiality, weighted average calculation in ciphertext state, unified key domain conversion, parameter integrity verification, and identity authentication, a secure federated learning method based on proxy re-encryption and homomorphic encryption is proposed. Summary of the Invention

[0006] The main objective of this invention is to provide a secure federated learning method based on proxy re-encryption and homomorphic encryption, which ensures that the model parameters remain in ciphertext throughout the entire process of transmission, re-encryption, and aggregation. The method performs sample-weighted average calculation of the model in the ciphertext domain, while simultaneously realizing parameter integrity verification and identity authentication. This overcomes the shortcomings of existing technologies, such as plaintext exposure, inability to aggregate ciphertext, complex key management, and lack of integrity protection.

[0007] Based on the first main aspect of the present invention, a secure federated learning method based on proxy re-encryption and homomorphic encryption is provided, which is implemented through four types of entities: a key generation center, a local training terminal, a proxy re-encryption node, and an aggregation server, and specifically includes the following steps:

[0008] The key generation center generates system public parameters for the Paillier cryptosystem based on security parameters, generates key pairs for each local training terminal and aggregation server, generates its own re-encryption key pair, and assigns a unique identifier to each local training terminal; the key generation center generates a random mask that satisfies the weighted sum of zero before each round of training and secretly distributes it to each local training terminal.

[0009] The aggregation server initializes and distributes the global model. Each local training terminal receives and uses local data to complete model training and obtain local model parameters. The random mask is superimposed and then Paillier encrypted to obtain the ciphertext of the model parameters. At the same time, a hash digest containing its own identity is generated, and the ciphertext of the model parameters and the hash digest are uploaded to the proxy re-encryption node.

[0010] The proxy re-encryption node performs integrity verification and identity authentication on the ciphertext of model parameters, and uses the two-level re-encryption key to perform proxy re-encryption, completing the conversion of the ciphertext to the aggregation server key field;

[0011] The aggregation server receives the re-encrypted model parameter ciphertext, uses the additive homomorphic property of the Paillier cryptosystem to generate aggregate ciphertext, decrypts the aggregate ciphertext using its own private key, performs division in the plaintext field, and generates a new global model.

[0012] The updated global model is then distributed to each local training end to begin the next round of federated learning training, until the global model converges or reaches the preset number of training rounds.

[0013] In this invention, the scalar multiplication homomorphic property and the additive homomorphic property of the Paillier cryptosystem are combined and applied to the ciphertext after proxy re-encryption. The model averaging operation is decomposed into two stages: ciphertext field and weighted summation and plaintext field division. This bypasses the inherent limitation of homomorphic encryption that does not support ciphertext division, making the ciphertext aggregation result strictly equivalent to the plaintext FedAvg in mathematics. At the same time, the two-level re-encryption achieves the separation of key management responsibilities, and no single entity can hold the original ciphertext and the corresponding decryption private key at the same time, thus resisting collusion attacks from the system structure level.

[0014] This invention also employs a trusted key generation center to uniformly generate keys for each entity and derive two-level re-encryption keys. During the proxy re-encryption stage, the two levels of keys are used sequentially for re-encryption, transforming the ciphertext scattered across the key domains of each local training node into a unified key domain on the aggregation server. This mechanism avoids pairwise key negotiation between local training nodes, reducing communication overhead from quadratic to linear. This invention concatenates the unique identifier of each local training node with the ciphertext of model parameters to calculate a hash digest. The proxy re-encryption node recalculates and compares this hash, achieving both integrity verification and lightweight authentication in a single hash operation. Illegal or tampered ciphertext is discarded and retransmitted before entering the re-encryption process, avoiding unnecessary computational overhead.

[0015] As a further preferred option, in the aforementioned method, when the local model parameters are floating-point numbers, each local training end performs fixed-point scaling on the floating-point model parameters according to a preset scaling factor before superimposing the random mask, maps them to integers, and then performs random mask superposition and Paillier encryption.

[0016] After the aggregation server decrypts the weighted sum and performs division in the plaintext field, it restores the global model parameters using the same scaling factor to recover the actual floating-point global model parameters.

[0017] In the above technical solution, by utilizing the mathematical equivalence of the fixed-point method, the scaling factor remains constant throughout the entire encryption, re-encryption, homomorphic aggregation, and decryption process. Therefore, the ciphertext domain aggregation result, after being multiplied by the scaling factor, is consistent with the result of directly weighting the floating-point numbers, without introducing any quantization error. This mechanism is performed by the local training end before the mask is superimposed, and the aggregation server performs the reverse restoration after obtaining the weighted sum and completing the plaintext division. The two stages use the exact same scaling factor to ensure mathematical closure, establishing a reliable mapping bridge between the floating-point model parameters and the Paillier integer plaintext space, enabling the homomorphic encryption scheme to be practically applied to federated learning scenarios where floating-point tensors are the core data form.

[0018] As a further preferred embodiment, in the aforementioned method, the execution steps of the proxy re-encryption node for integrity verification and identity authentication of the model parameter ciphertext are as follows:

[0019] During the initialization phase, the proxy re-encryption node obtains a complete list of identity identifiers for all local training terminals from the key generation center.

[0020] After receiving the ciphertext of the model parameters and the hash digest, the proxy re-encryption node searches for the corresponding identity in the identity list, concatenates it with the received ciphertext of the model parameters, and recalculates the hash value.

[0021] If the recalculated hash value is equal to the hash digest, the verification is successful, indicating that the encrypted model parameters have not been tampered with during transmission and the sender's identity is legitimate.

[0022] If the calculated hash value is not equal to the hash digest, the verification fails, the proxy re-encryption node discards the ciphertext of the model parameters and requests a re-upload from the corresponding local training end.

[0023] The above technical solution utilizes the anti-identification and anti-collision properties of the SHA-256 hash function. Since the identity identifier is known only to the key generation center and the corresponding local training terminal, even if an attacker intercepts the ciphertext, they cannot construct a valid hash digest containing the correct identity identifier. Therefore, successful verification proves that the data has not been tampered with and that its source is authentic. This solves the problem of missing integrity verification and identity authentication that is common in existing technologies. Furthermore, the proxy re-encryption node only allows the ciphertext to enter the subsequent re-encryption and aggregation process after successful verification. If the verification fails, the ciphertext is discarded and a retransmission is requested from the corresponding local training terminal. This pre-filtering mechanism avoids the unnecessary overhead and potential pollution caused by malicious or corrupted data entering the ciphertext calculation process.

[0024] Meanwhile, the SHA-256 secure hash algorithm is used in the verification, with an output length of 256 bits, which has high collision resistance and is suitable for scenarios involving the integrity verification of model parameters.

[0025] As a further preferred embodiment, in the aforementioned method, the two-level re-encryption key is generated as follows:

[0026] The first-level re-encryption key is generated locally by the local training terminal. It uses its own private key and the public key of the key generation center to generate the first-level re-encryption key according to the Paillier proxy re-encryption scheme. Its expression is:

[0027] ;

[0028] in, This represents the first-level re-encryption key; This represents the proxy re-encryption key generation function; Indicates the first The private key of a local training device; This represents the public key of the key generation center; The modulus representing the Paillier cryptosystem; Indicates the local training node's index;

[0029] After generating the first-level re-encryption key on the local training end, it is sent to the proxy re-encryption node;

[0030] The second-level re-encryption key is generated by the key generation center using its own private key and the aggregation server's public key, and its expression is:

[0031] ;

[0032] in, This represents the second-level re-encryption key; This represents the proxy re-encryption key generation function; This represents the private key of the key generation center; This represents the public key of the aggregation server; The modulus representing the Paillier cryptosystem;

[0033] After generating the second-level re-encryption key, the key generation center sends it to the proxy re-encryption node.

[0034] In the two-level re-encryption key generation mechanism, the conventional practice of the data owner directly generating the one-way re-encryption key to the authorized party in traditional proxy re-encryption is abandoned. The first encryption key of this mechanism is generated locally by the local training end using its own private key. Proxy re-encryption ensures that the private key cannot be deduced from the re-encryption key. The two-level keys are generated by different entities and sent to the proxy re-encryption stage respectively. Therefore, although the proxy re-encryption node holds the two-level keys, it cannot obtain any local training end private key. Although the key generation center has all the private keys, it does not directly participate in the ciphertext re-encryption operation. No single entity can simultaneously meet the two conditions of holding the ciphertext and holding the corresponding decryption private key. Mathematically, this blocks the successful path of collusion attacks and overcomes the technical problem that the proxy can only complete ciphertext conversion and cannot perform ciphertext field summation on multiple ciphertexts, lacking the ability to convert key fields.

[0035] As a further preferred embodiment, in the aforementioned method, the execution steps for the proxy re-encryption node to receive the first-level re-encryption key and the second-level re-encryption key for proxy re-encryption are as follows:

[0036] The proxy re-encryption node performs two re-encryption operations on the ciphertext of model parameters that have passed integrity verification and identity authentication. First, the first-level re-encryption key is used to convert the ciphertext of model parameters that have passed integrity verification and identity authentication into intermediate ciphertext.

[0037] The intermediate ciphertext is then converted into the final ciphertext using the second-level re-encryption key;

[0038] After two proxy re-encryptions, the encrypted model parameters, originally located in the local training key domain, are transferred to the aggregation server key domain.

[0039] By introducing an intermediate key field, the key conversion process is decomposed into two independent proxy re-encryption operations. The proxy re-encryption node does not access any plaintext data or possess any private key information during the entire process; it only performs mathematical transformations of the ciphertext. Therefore, the confidentiality of the ciphertext is fully guaranteed during the re-encryption stage. The ciphertext after the two transformations retains the additive homomorphic property of the Paillier cryptosystem. The re-encryption operation does not change the algebraic structure of the plaintext carried by the ciphertext. Therefore, the transformed ciphertext can still support subsequent scalar multiplication and addition homomorphic operations, overcoming the fundamental defect in existing proxy re-encryption schemes that the ciphertext lacks homomorphic properties.

[0040] As a further preferred embodiment, in the aforementioned method, the steps for generating the aggregated ciphertext are as follows:

[0041] The aggregation server receives the re-encrypted model parameter ciphertext and uses the homomorphic property of the Paillier cryptosystem to perform the weighted summation in the model averaging calculation in the ciphertext state.

[0042] First, homomorphic scalar multiplication is performed. The aggregation server then performs a modular exponentiation operation on each re-encrypted model parameter ciphertext, with the number of samples from that local training end as the exponent.

[0043] ;

[0044] in, This represents the ciphertext after a scalar multiplication operation. This represents the ciphertext of the re-encrypted model parameters; Indicates the first The number of local training samples held by each local training endpoint; The modulus representing the Paillier cryptosystem;

[0045] Based on the scalar multiplication homomorphism property of the Paillier cryptosystem, modular exponentiation in the ciphertext field is equivalent to constant multiplication in the plaintext field, thus completing the weighted summation in the ciphertext state according to the number of samples.

[0046] After weighting, homomorphic multiplication aggregation is performed. The aggregation server performs ciphertext multiplication on the ciphertexts after scalar multiplication of all local training ends to obtain the aggregated ciphertext.

[0047] According to the additive homomorphic property of the Paillier cryptosystem, ciphertext multiplication is equivalent to plaintext addition, thus completing weighted summation in the ciphertext state.

[0048] In the above technical solution, based on the homomorphic mathematical principle of the Paillier cryptosystem, modular exponentiation in the ciphertext field is equivalent to constant multiplication in the plaintext field, and multiplication in the ciphertext field is equivalent to addition in the plaintext field. Therefore, the combination of the above two operations is strictly equivalent to weighted summation in the plaintext field without introducing any approximation or precision loss. The aggregation server can complete all core calculations in the ciphertext state without decryption and aggregation, thus ensuring the confidentiality of model parameters in this aggregation process. This solves the technical defects of the aggregation end being unable to complete the weighted average calculation required for federated learning model averaging in the ciphertext state and the masking system only supporting summation.

[0049] As a further preferred embodiment, in the aforementioned method, the steps for decrypting the aggregated ciphertext using one's own private key are as follows:

[0050] The aggregation server uses its own private key to decrypt the aggregated ciphertext, and the aggregation server's private key contains two components.

[0051] First, the ciphertext is aggregated by performing a modular exponentiation on the first component of the aggregation server's private key to obtain an intermediate result. Then, an auxiliary function is applied to the intermediate result to map it to the modular space, and then it is multiplied by the second component of the aggregation server's private key to obtain the weighted sum of the plaintext.

[0052] The auxiliary function is defined as follows: ;in, Indicates the input variables of the function; This represents the modulus of the Paillier cryptosystem.

[0053] In the above decryption process, although it is performed by the aggregation server, its individual decryption of any local training end can only obtain the value masked by a random mask, and cannot separate the real model parameters. However, after decrypting the aggregated ciphertext, due to the guarantee of the zero-sum condition of the mask, the mask terms are canceled out, and what is obtained is the correct weighted sum of the real model parameters of the local training end. This characteristic of being indistinguishable by single ciphertext and correctly solvable by aggregated ciphertext ensures that even under an honest but curious aggregation server model, the privacy protection of the model parameters of the local training end can be effectively guaranteed without sacrificing the accuracy of the aggregation result. This solves the defects of existing technologies where the aggregation end naturally touches the complete parameter vector of each local end and the aggregation result is still presented in plaintext form on the aggregation end.

[0054] Based on a second key aspect of the present invention, a secure federated learning system based on proxy re-encryption and homomorphic encryption for implementing the aforementioned method is provided, comprising:

[0055] The key generation center is used to generate the common system parameters required to construct the Paillier cryptosystem, generate key pairs for each local training terminal, and generate its own re-encryption key pair. Before the start of each round of training, it generates a set of random masks that satisfy the condition that the weighted sum is zero and distributes them to the corresponding local training terminals through a secure channel.

[0056] Multiple local training endpoints are used to complete model training using local data and generate local model parameters. After overlaying a random mask, the endpoints use their own private key to perform Paillier encryption to obtain the ciphertext of the model parameters. They then use their own identity and the ciphertext of the model parameters to generate a hash digest and upload the hash digest and the ciphertext of the model parameters.

[0057] The proxy re-encryption node is used to perform integrity verification and identity verification on the encrypted model parameters. By performing re-encryption operations, it is uniformly converted to the aggregation server key domain.

[0058] The aggregation server is responsible for receiving the re-encrypted model parameter ciphertext forwarded by the proxy re-encryption node, and using the homomorphic property of the Paillier cryptosystem, performing a weighted summation operation based on the number of samples in the ciphertext. It decrypts the aggregated ciphertext using its own private key to obtain the weighted sum of the local model parameters. The aggregation server divides this weighted sum by the total number of samples in the plaintext field to obtain the new global model parameters, and then sends them to each local training terminal to enter the next round of training.

[0059] Based on a third key aspect of the present invention, an electronic device is provided, comprising: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0060] The memory stores a computer program that, when executed by the processor, causes the processor to perform the aforementioned secure federated learning method based on proxy re-encryption and homomorphic encryption.

[0061] Based on a fourth key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed, implements the aforementioned secure federated learning method based on proxy re-encryption and homomorphic encryption.

[0062] Compared with existing technologies, this invention provides a secure federated learning method based on proxy re-encryption and homomorphic encryption. First, by combining proxy re-encryption with Paillier homomorphic encryption, this invention ensures that model parameters remain in ciphertext throughout the entire process of transmission, re-encryption, and aggregation. The aggregation end can complete the sample-weighted model average calculation without ever accessing any plaintext model parameters from the local training end, overcoming the privacy leakage and model theft problems caused by plaintext uploads and aggregations. Simultaneously, the introduced random masking mechanism with a weighted sum of zero ensures that even if the aggregation server actively decrypts a single local training end's ciphertext, it can only obtain the masked value and cannot extract the true model parameters. This achieves strong privacy protection for the model parameters trained on individual local training ends under an honest but curious server model.

[0063] Secondly, this invention employs a two-level re-encryption key generation mechanism, separating key management responsibilities and combining identity-based hash integrity verification and authentication, effectively resisting collusion attacks, parameter tampering, and forgery attacks. Compared to traditional technical solutions, this invention centralizes key distribution and mask generation, reducing communication overhead and interaction complexity in multiple iterations.

[0064] Finally, this invention achieves weighted summation based on the number of samples in the encrypted state while preserving the model training accuracy. Its encrypted aggregation structure is strictly consistent with the calculation result of the plaintext FedAvg without introducing any accuracy loss. At the same time, the hash verification mechanism ensures the integrity and verifiability of the parameters, making it suitable for cross-institutional federated learning scenarios with high requirements for both privacy protection and model accuracy. Attached Figure Description

[0065] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0066] Figure 1 The following is an execution flowchart of a secure federated learning method based on proxy re-encryption and homomorphic encryption in one embodiment of the present invention;

[0067] Figure 2 This diagram illustrates a system framework diagram of a secure federated learning method based on proxy re-encryption and homomorphic encryption in one embodiment of the present invention.

[0068] Figure 3The diagram illustrates the model parameter flow of a secure federated learning method based on proxy re-encryption and homomorphic encryption in one embodiment of the present invention. Detailed Implementation

[0069] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the present invention. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are merely illustrative of the essential spirit of the technical solution of the present invention.

[0070] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0071] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0072] The specific meanings of the technical terms or English abbreviations that may be used in this invention are explained as follows:

[0073] Federated learning is a distributed machine learning framework in which each participant trains the model locally without leaving the original data, and only uploads the model parameters, gradients or update values ​​to the aggregation end. The aggregation end then completes the model aggregation and global model distribution, thereby reducing the risk of privacy leakage caused by the aggregation of the original dataset in multi-party collaborative modeling.

[0074] Paillier cryptosystem: A public-key encryption algorithm based on the compound residues problem, possessing additive homomorphism and scalar multiplication homomorphism, with a plaintext space modulo... The integer ring, the ciphertext space is modulo An integer ring, where It is the product of two large prime numbers.

[0075] Proxy re-encryption: A cryptographic primitive that allows a trusted proxy node to convert ciphertext encrypted with the data owner's public key into ciphertext encrypted with the authorized user's public key without decrypting the ciphertext itself, thereby enabling secure authorization and transfer of decryption permissions.

[0076] FedAvg: Federated Averaging algorithm, which calculates a weighted average of the model parameters of each local end based on the proportion of each local end's sample count to the total sample count, to obtain a new global model.

[0077] Honest but curious: a security model assumption that participants are able to correctly perform the prescribed operations according to the agreement and will not deviate from the agreement's behavior in an attempt to analyze and infer the privacy information of other participants from the received data.

[0078] Combination Figure 1 As shown, this invention provides a secure federated learning method based on proxy re-encryption and homomorphic encryption, implemented through four types of entities: a key generation center, a local training terminal, proxy re-encryption nodes, and an aggregation server. Specifically, it includes the following steps:

[0079] S100, the key generation center generates system public parameters for the Paillier cryptosystem based on security parameters, generates key pairs for each local training terminal and aggregation server, generates its own re-encryption key pair, and assigns a unique identity to each local training terminal; before each round of training, the key generation center generates a random mask secret that satisfies the weighted sum of zero and distributes it to each local training terminal.

[0080] S200, the aggregation server initializes the global model and distributes it. Each local training terminal receives and uses local data to complete model training and obtain local model parameters. The random mask is superimposed and then Paillier encrypted to obtain the ciphertext of the model parameters. At the same time, a hash digest containing its own identity is generated, and the ciphertext of the model parameters and the hash digest are uploaded to the proxy re-encryption node.

[0081] S300, the proxy re-encryption node performs integrity verification and identity authentication on the ciphertext of model parameters, and uses two-level re-encryption keys to perform proxy re-encryption, completing the conversion of ciphertext to the aggregation server key field;

[0082] S400: The aggregation server receives the re-encrypted model parameter ciphertext, uses the additive homomorphic property of the Paillier cryptosystem to generate aggregate ciphertext, decrypts the aggregate ciphertext using its own private key, performs division in the plaintext field, and generates a new global model.

[0083] S500 will then distribute the updated global model to each local training end to enter the next round of federated learning training until the global model converges or reaches the preset number of training rounds.

[0084] The method proposed in this invention employs the Paillier cryptosystem, which possesses additive homomorphic properties, as the underlying encryption algorithm. Its core technical principle is as follows:

[0085] After each local training node completes model training locally, it first overlays a random mask distributed by the key generation center that satisfies the condition of zero weighted sum onto the local model parameters. Then, it performs fixed-point number encoding and performs Paillier encryption using its own public key. The proxy re-encryption node, without possessing any private key or accessing the plaintext model parameters, uses two levels of re-encryption keys to uniformly convert the ciphertext of the model parameters in different local training node key domains to the aggregation server key domain.

[0086] The aggregation server utilizes the additive and scalar multiplication homomorphic properties of the Paillier cryptosystem to perform a weighted summation operation based on the number of samples in the ciphertext state, and then decrypts the aggregated ciphertext using its own private key.

[0087] Since all masks satisfy the constraint that the weighted sum is zero, the mask terms automatically cancel each other out during the weighted summation process. After decryption, the aggregation server can only obtain the weighted sum of all local training end model parameters, and cannot distinguish the contribution of any single local training end. Even if the aggregation server actively decrypts a single ciphertext, it can only obtain the value after it is covered by a random mask, and cannot separate the real model parameters.

[0088] Meanwhile, the local training end concatenates the encrypted model parameters with its own unique identifier to calculate a hash digest. The proxy re-encryption node recalculates and compares the digest before performing re-encryption, thus simultaneously realizing the integrity verification of model parameters and the authentication of the sender's identity on the transmission link.

[0089] To achieve the above method, combined with Figure 2 As shown, the system constructed by this invention consists of four types of entities, and the internal functional modules of each entity are divided as follows:

[0090] (1) Key Generation Center (KGC)

[0091] As a fully trusted entity, the key generation center primarily undertakes the responsibilities of system initialization and key management. The key generation center will generate two large prime numbers based on security parameters. and ,calculate And select generator The system common parameters required to construct the Paillier cryptosystem It then distributes the keys to all participating entities, and the key generation center generates public-private key pairs for each local training endpoint. Generate public-private key pairs for the aggregation server. The corresponding private key is then distributed to each entity via a secure channel.

[0092] In addition, the key generation center generates its own pair of super-encrypted public and private keys based on the system's public parameters. ,in Open to the public It is secretly stored by the key generation center and used to construct a two-level re-encryption key.

[0093] Meanwhile, during system initialization, the key generation center assigns a unique identifier to each local training node and distributes the list of identifiers to the proxy re-encryption nodes for authentication. Finally, before each round of training, the key generation center generates a set of random masks that satisfy the condition that the weighted sum is zero. The mask is distributed to the corresponding local training end through a secure channel. This mask is not disclosed to the aggregation server, and different masks are used for different training rounds.

[0094] Therefore, it can be seen that the key generation center possesses all the private keys of the local training terminals, which is an inherent key escrow characteristic of the fully trusted key generation center model. From a security perspective, an attack on the key generation center would pose the highest system risk. However, in the federated learning scenario designed in this invention, the mutual trust among the participants is high, and this risk can be mitigated through measures such as log auditing and hardware security modules.

[0095] (2) Local training terminal

[0096] The local training module is responsible for training the model using local data and generating local model parameters. Let the first... The model parameters obtained from training on a local training terminal are: Since the model parameters may contain privacy information related to local data, the local training end does not directly upload the plaintext model parameters, but first uses its own public key to perform Paillier encryption on the model parameters.

[0097] In the fully trusted key generation center model of this invention, the public and private key pairs of each local training terminal are uniformly generated by the key generation center and distributed to the corresponding local training terminals through a secure channel. Let the first... The public-private key pairs obtained by each local training endpoint from the key generation center are: ,in This is the public key for the local training end. This is the private key for the local training end.

[0098] The local training server's private key is stored locally and used for subsequent model parameter decryption. In addition, the local training server is also responsible for generating the re-encryption key and the hash values ​​corresponding to the model parameters, used for subsequent integrity verification and authentication.

[0099] (3) Proxy re-encryption node

[0100] The proxy re-encryption node is responsible for performing the ciphertext conversion operation. Because different local training endpoints use different public keys to encrypt the model parameters, the ciphertexts of the model parameters generated by different local training endpoints are in different key domains, and the aggregation server cannot directly perform homomorphic aggregation on them.

[0101] To address this issue, the proxy re-encryption node uses the first-level re-encryption key uploaded from the local training terminal and the second-level re-encryption key issued by the key generation center to convert the ciphertext of the model parameters to the key field of the aggregation server. The proxy re-encryption node is only responsible for performing the re-encryption operation; it does not possess the private key of the local training terminal and cannot recover the plaintext of the model parameters.

[0102] (4) Aggregation server

[0103] The aggregation server is responsible for receiving the ciphertext of the re-encryption model parameters forwarded by the proxy re-encryption node, and using the additive and scalar multiplication homomorphic properties of the Paillier cryptosystem, performing a weighted summation operation based on the number of samples in the ciphertext state. Then, the aggregation server uses its own private key. The aggregated ciphertext is decrypted to obtain the weighted sum of the model parameters of each local training terminal. Since division cannot be performed directly in the ciphertext state, the aggregation server divides the weighted sum by the total number of samples in the plaintext field to obtain the new global model parameters, which are then sent to each local training terminal to begin the next round of training.

[0104] In this embodiment, it is assumed that the aggregation server is an honest but curious entity, that is, it can correctly perform the aggregation operation according to the protocol, but may try to recover the privacy information of the local training end by analyzing the model parameters. Therefore, the aggregation server cannot directly obtain the plaintext of any single local training end's model parameters during the entire aggregation process.

[0105] Combination Figure 3 As shown, the secure federated learning method proposed in this invention is mainly completed collaboratively by the local training terminal, the proxy re-encryption node, and the aggregation server. Its overall training process includes the following stages:

[0106] The aggregation server initializes the global model and distributes it to each local training client.

[0107] Each local training endpoint uses local data to complete model training and generate local model parameters;

[0108] The local training end will overlay the zero-sum random mask distributed by the key generation center onto the model parameters, perform fixed-point encoding and Paillier encryption, and generate a hash digest containing its own identity identifier.

[0109] The local training node uploads the encrypted model parameters and integrity verification information to the proxy re-encryption node;

[0110] The proxy re-encryption node performs integrity verification and identity authentication on the model parameters, and completes the ciphertext conversion using the two-level re-encryption key;

[0111] The aggregation server performs homomorphic scalar multiplication and homomorphic multiplication aggregation on the re-encrypted model parameter ciphertext to complete the ciphertext summation weighted by the number of samples;

[0112] The aggregation server decrypts the aggregation result, performs division in the plaintext field, and generates a new global model.

[0113] The aggregation server then distributes the updated global model back to each local training client, initiating the next round of federated learning training.

[0114] Throughout the training process, the original data of the local training end is always stored locally. The aggregation server cannot directly obtain the plaintext model parameters of any local training end, and the proxy re-encryption node cannot recover the model parameter content. This ensures that the model can be aggregated and updated while improving the confidentiality and security of the training process.

[0115] In one feasible embodiment, step S100 is described in detail as follows:

[0116] Step S100 mainly involves system initialization and key generation:

[0117] The key generation center randomly selects two large prime numbers based on security parameters. and ,calculate And select generator Thus, the system common parameters required to construct the Paillier cryptosystem are constructed. The public parameter is then distributed to all participating entities for subsequent encryption and homomorphic operations.

[0118] The key generation center generates public and private key pairs for each local training terminal. Generate public-private key pairs for the aggregation server. The corresponding private key is distributed to each entity via a secure channel. Each entity stores its private key locally. Meanwhile, the key generation center assigns a unique identifier to each local training terminal. It also distributes the complete list of identity identifiers from all local training nodes to the proxy re-encryption nodes.

[0119] To achieve proxy re-encryption, the key generation center generates its own additional pair of public and private keys for re-encryption based on the system's public parameters. ,in The public key indicating the key generation center is publicly available. This indicates that the private key of the key generation center is kept secret by the key generation center.

[0120] Before each round of federated learning training begins, the key generation center also needs to generate a set of random masks to mask the local model parameters. The key generation center generates integer random masks based on the number of local training endpoints participating in the training and the number of samples per local training endpoint. These masks satisfy a weighted zero constraint.

[0121] ;

[0122] in, Indicates the number of local training endpoints participating in the training; This indicates the number of samples per local training endpoint; This indicates the local training node's index.

[0123] In one feasible embodiment, step S200 is described in detail as follows:

[0124] At the start of each training round, the aggregation server sends the current training data to each local training client. Round global model parameters Each local training endpoint receives the global model and performs several rounds of local training using its local dataset to obtain the local model parameters. .

[0125] The local training module overlays the random mask obtained from the key generation center in this round onto the local model parameters:

[0126] ;

[0127] in, This represents the result of adding a random mask to the local model parameters; Indicates local model parameters; This represents a random mask.

[0128] If the model parameters are floating-point numbers, they are first mapped to integers by amplification using fixed-point numbers, and then the above addition operation is performed.

[0129] The local training end uses its own public key The masked model parameters are then Paillier encrypted to obtain the ciphertext of the model parameters:

[0130] ;

[0131] in, This represents the encrypted model parameters; This represents the public key of the local training end; This represents the result of adding a random mask to the local model parameters; This represents the Paillier encryption algorithm function.

[0132] The local training terminal will identify itself. encrypted with model parameters Concatenate the data and calculate the hash digest:

[0133] ;

[0134] Among them, hash function The Secure Hash Algorithm 256 (SHA-256) is selected. Its output length is 256 bits, which has high security and is suitable for verifying the integrity of model parameters. Indicates a serialization operation; Represents a hash digest; This represents the identity identifier of the local training terminal; This represents the encrypted model parameters.

[0135] The local training end will use the binary pair Upload to the proxy re-encryption node. During this process, the original data from the local training end is always stored on the local device; only the encrypted model parameters are uploaded.

[0136] Since the model parameters may contain sensitive information related to local data, the local training end does not directly upload the model parameters in plaintext. Instead, it first performs fixed-point encoding on the model parameters and then uses the Paillier encryption method to encrypt the model parameters.

[0137] Subsequently, the local training endpoint concatenates its own identifier with the encrypted model parameters and calculates a hash digest. Throughout this process, the original data of the local training endpoint remains stored on the local device; only the encrypted model parameters are uploaded, thereby reducing the risk of plaintext model parameters being leaked.

[0138] In one feasible embodiment, step S300 is described in detail as follows:

[0139] Step S300 mainly involves hash integrity verification and identity authentication based on identity identifiers:

[0140] During the transmission of model parameters, attackers may tamper with the encrypted model parameters or forge malicious model updates, thereby affecting the overall model training results.

[0141] Therefore, this invention combines a hash function with a unique identifier on the local training end to perform integrity verification and identity authentication of model parameters.

[0142] The proxy re-encryption node obtains a complete list of identity identifiers for all local training terminals from the key generation center.

[0143] The proxy re-encryption node received the tuple Then, search the list of identity identifiers for the local training terminal. Combine it with the received ciphertext Recalculate the hash value after concatenation:

[0144] ;

[0145] in, Indicates a serialization operation; This represents the recalculated hash value; This represents the identity identifier of the local training terminal; This represents the encrypted model parameters; This represents a hash function.

[0146] Proxy re-encryption node comparison and If the two are equal, it means that the encrypted model parameters have not been tampered with during transmission and the sender's identity is legitimate. The encrypted data is allowed to participate in the subsequent re-encryption and aggregation process. If the two are not equal, the encrypted data is discarded and a retransmission is requested from the corresponding local training end.

[0147] Since the identity identifier is known only to the key generation center and the corresponding local training terminal, even if an attacker intercepts the ciphertext, they cannot forge a valid hash digest. Therefore, a single hash operation can simultaneously achieve integrity verification of model parameters and lightweight identity authentication.

[0148] After successful verification, a two-level re-encryption operation is executed. In order to ensure that the ciphertext of model parameters under different key domains can be uniformly converted to the key domain of the aggregation server, and to avoid any single entity holding the original ciphertext and the corresponding decryption private key at the same time, this invention adopts a two-level re-encryption key generation mechanism.

[0149] The first-level re-encryption key is generated locally by the local training device. A local training endpoint uses its own private key and the public key of the key generation center Generate the first-level re-encryption key according to the Paillier proxy re-encryption scheme:

[0150] ;

[0151] in, This represents the first-level re-encryption key; This represents the proxy re-encryption key generation function; Indicates the first The private key of a local training device; This represents the public key of the key generation center; The modulus representing the Paillier cryptosystem; This indicates the local training node's index.

[0152] This key allows the proxy re-encryption node to... Encrypted ciphertext converted to Encrypted ciphertext. Generated on the local training end. Send to the proxy re-encryption node.

[0153] The second-level re-encryption key is generated by a key generation center. The key generation center uses its own private key. and the public key of the aggregation server Generate the second-level re-encryption key:

[0154] ;

[0155] in, This represents the second-level re-encryption key; This represents the proxy re-encryption key generation function; This represents the private key of the key generation center; This represents the public key of the aggregation server; This represents the modulus of the Paillier cryptosystem.

[0156] This key can Encrypted ciphertext converted to Encrypted ciphertext. The key generation center will... Send to the proxy re-encryption node.

[0157] After the proxy re-encryption node holds the two re-encryption keys mentioned above, their combined effect is equivalent to obtaining the public key from the local training node. Directly convert to the aggregation server public key The re-encryption operation.

[0158] Since the first-level re-encryption key is generated locally by the local training end using its own private key, and the proxy re-encryption algorithm guarantees that the private key cannot be deduced from the re-encryption key, the proxy re-encryption node cannot obtain the private key of any local training end. At the same time, this mechanism ensures that no single entity can simultaneously hold the decryption private key corresponding to the original ciphertext, thereby resisting collusion attacks.

[0159] Under the fully trusted KGC model, although the key generation center has all the private keys of the local training end (because it generates and distributes them uniformly), the re-encryption key is generated locally by the local training end using its own private key, and the proxy re-encryption algorithm ensures that the private key cannot be deduced from the re-encryption key.

[0160] Therefore, the proxy re-encryption node cannot obtain any local training terminal private key, and the key generation center's control over the private key is an inherent characteristic of the fully trusted KGC model and does not depend on the transmission of the re-encryption key.

[0161] The core of the two-level re-encryption mechanism lies in separating key management responsibilities: the key generation center only controls the intermediate conversion key, and the proxy re-encryption node is only responsible for the ciphertext re-encryption operation.

[0162] From a mathematical perspective, the combined re-encryption effect satisfies the following: for any ciphertext encrypted with the local training terminal's public key, after two re-encryptions at the first and second levels, the ciphertext that can be decrypted using the aggregation server's private key can be obtained. This process avoids any single entity simultaneously holding the original ciphertext and the corresponding decryption private key, thereby resisting collusion attacks.

[0163] Furthermore, the randomness of the Paillier encryption scheme ensures that the ciphertexts generated by encrypting the same plaintext multiple times are different, but the re-encryption operation still maintains the additive homomorphic property, which provides a basis for subsequent aggregation calculations of the ciphertext field.

[0164] The proxy re-encryption node uses the first-level re-encryption key to convert the ciphertext of the model parameters from the local training end into intermediate ciphertext:

[0165] ;

[0166] in, Indicates the ciphertext in the middle; Indicates the proxy re-encryption algorithm; This represents the first-level re-encryption key; This represents the encrypted model parameters.

[0167] Use the second-level re-encryption key to convert the intermediate ciphertext into the final ciphertext:

[0168] ;

[0169] in, This indicates the final ciphertext; Indicates the proxy re-encryption algorithm; This represents the second-level re-encryption key; Indicates the middle ciphertext

[0170] After the two conversions described above, the ciphertext of the model parameters, originally located in different local training endpoint key domains, is uniformly converted to the aggregation server key domain, thus enabling unified homomorphic aggregation. Throughout the process, the proxy re-encryption node only performs the ciphertext conversion operation; it does not possess any local training endpoint private key or the aggregation server private key, and therefore cannot recover the plaintext of the model parameters.

[0171] In one feasible embodiment, step S400 is described in detail as follows:

[0172] Step S400 mainly includes sub-step S401: ciphertext aggregation and decryption and sub-step S402: global model update and distribution.

[0173] Sub-step S401: The specific execution steps for ciphertext aggregation and decryption are as follows:

[0174] After receiving the re-encrypted model parameter ciphertext, the aggregation server uses the homomorphic property of the Paillier cryptosystem to complete the weighted summation part of the model averaging calculation in the ciphertext state.

[0175] Homomorphic scalar multiplication. The aggregation server performs a modular exponentiation on each re-encrypted ciphertext, using the number of samples from the local training end as the exponent:

[0176] ;

[0177] in, This represents the ciphertext after a scalar multiplication operation. This represents the ciphertext of the re-encrypted model parameters; Indicates the first The number of local training samples held by each local training endpoint; This represents the modulus of the Paillier cryptosystem.

[0178] According to the scalar multiplication homomorphism property of the Paillier cryptosystem, we have That is, the modular exponentiation operation in the ciphertext field is equivalent to the constant multiplication in the plaintext field, thus realizing weighting according to the number of samples in the ciphertext state.

[0179] Homomorphic multiplication aggregation. The aggregation server aggregates all local training data. Perform ciphertext multiplication to obtain aggregated ciphertext:

[0180] ;

[0181] in, This represents the result of homomorphic multiplication; Indicates the number of local training endpoints participating in the training; This indicates the local training node's index.

[0182] According to the additive homomorphic property of the Paillier cryptosystem, ciphertext multiplication is equivalent to plaintext addition, thus completing the weighted summation in the ciphertext state.

[0183] The aggregation server uses its own private key Decrypt the aggregated ciphertext, where, This represents the first component of the aggregate server's private key. , and This indicates that the key generation center randomly selects two independent large prime numbers according to security parameters. Represents the least common multiple operation; This represents the second component of the aggregate server's private key. , This represents the generator of the Paillier cryptosystem; The modulus representing the Paillier cryptosystem; This represents the auxiliary functions used in Paillier's decryption process, defined as follows: , Indicates the input variables of the function.

[0184] The specific decryption process is as follows:

[0185] Calculate intermediate quantities:

[0186] ;

[0187] in, Indicates intermediate quantity; This represents the result of homomorphic multiplication; The first parameter represents the private key of the aggregation server; This represents the modulus of the Paillier cryptosystem.

[0188] calculate:

[0189] ;

[0190] in, This indicates that the auxiliary function will be used to... Mapped to module space; Indicates intermediate quantity; This represents the modulus of the Paillier cryptosystem.

[0191] Restoring the plaintext weighted sum:

[0192] ;

[0193] in, This represents the weighted sum of the plaintext obtained after decryption; Indicates aggregated ciphertext; Indicates intermediate results; This represents the second component of the aggregate server's private key; This indicates the total number of local training endpoints in the current training round; Indicates the local training node's index; Indicates the first The number of local samples held by each local training endpoint; This represents the result of the operation where a random mask is superimposed onto the local model parameters; Indicates local model parameters; This represents a random mask.

[0194] Since all random masks satisfy the constraint that the weighted sum is zero: ;in, Indicates the number of local training endpoints participating in the training; This indicates the number of samples per local training endpoint; This represents the local training node index. The mask entries automatically cancel each other out during the weighted summation process, therefore the decryption result is:

[0195] ;

[0196] in, Indicates the decryption result; This represents the weighted sum of the plaintext obtained after decryption; Indicates aggregated ciphertext; This indicates the total number of local training endpoints in the current training round; Indicates the local training node's index; Indicates the first The number of local samples held by each local training endpoint; This represents the local model parameters.

[0197] That is, the result obtained after decryption by the aggregation server is exactly the correct weighted sum of the model parameters of each local training end, and the masking mechanism does not introduce any accuracy loss.

[0198] Sub-step S402: The specific execution steps for global model update and distribution are as follows:

[0199] At this point, the aggregation server calculates the global model parameters again using plaintext division:

[0200] ,

[0201] in, Represents global model parameters; Indicates the decryption result; Indicates the total number of samples; This indicates the total number of local training endpoints in the current training round; Indicates the local training node's index; Indicates the first The number of local samples held by each local training endpoint.

[0202] Ultimately, the aggregation server completes the weighted summation in the ciphertext state, achieving the core objective of ciphertext calculation for model averaging.

[0203] If the model parameters are scaled by a fixed number before encryption, the aggregation server needs to divide the decryption result by the total number of samples and then by the scaling factor to restore the actual floating-point global model parameters.

[0204] Since division cannot be performed directly in the encrypted state, this step must be executed in the plaintext field after decryption. However, the weighted sum at this point has already aggregated the contributions of all local training endpoints, making it impossible to distinguish any single local training endpoint. Therefore, this step will not leak the privacy of any local training endpoint.

[0205] In one feasible embodiment, step S500 is described in detail as follows:

[0206] The aggregation server will As the first Round global model The data is distributed to each local training endpoint, which then continues with the next round of local training, thus forming an iterative training process for federated learning. This process is repeated until the model converges or reaches the preset number of training rounds.

[0207] In summary, even if the aggregation server has full decryption capabilities, it can only obtain the values ​​masked by random numbers when decrypting the ciphertext of any local training end. Since the random mask is unknown and random, the aggregation server cannot separate the true model parameters from it.

[0208] Decrypting the aggregated ciphertext only yields the weighted sum of all local training model parameters, without revealing the parameters of any single local training model. This ensures the accuracy of the model's average calculation while protecting the privacy of the local training model parameters.

[0209] In a feasible embodiment, the method provided by the present invention is experimentally analyzed as follows:

[0210] The experiment employed a horizontal federated learning architecture, using MNIST handwritten digit image classification as the task. Three local training endpoints participated in each round of training, with each endpoint randomly selecting 128 samples from the MNIST training set, for a total of 384 training samples. The machine learning model used a linear classifier, with input consisting of 196 pixel values ​​downsampled to 14×14 pixels, and outputting predicted logits for 10 categories.

[0211] The local training process uses the SGD optimizer with a learning rate of 0.01 and a cross-entropy loss function. The number of local training rounds is 1 per communication round, and the number of global communication rounds is 10.

[0212] During the experiment, the plaintext federated learning and the secure federated learning scheme of this invention used the exact same dataset partitioning, model structure, number of local training endpoints, number of local training rounds, number of global communication rounds, batch size, learning rate, and random seed to ensure that the results are reproducible.

[0213] In terms of cryptographic parameters, the Paillier key length is set to 1024 bits, and the hash function used is SHA-256.

[0214] Regarding functional correctness verification, experiments were conducted on Paillier encryption / decryption, homomorphic addition, proxy re-encryption, and hash integrity verification. The encryption / decryption test used three sets of floating-point model parameters, and the decryption results were completely consistent with the original parameters. In the hash verification test, verification passed when the data was not tampered with, but failed when the parameter values ​​were tampered with or the parameter order was altered. These results indicate that all functional modules of the present invention are functioning correctly.

[0215] Regarding model accuracy, the experiment recorded the accuracy changes of the global model on the test set over 10 training rounds. The accuracy of both plaintext federated learning and the present invention showed a stable upward trend, with the final accuracy of the present invention being higher than that of plaintext federated learning. Since the encrypted aggregation of the present invention is mathematically equivalent to the summation and averaging of plaintext data, and no modifications were made to the model update algorithm, theoretically, the accuracy of the present invention should be completely consistent with that of plaintext federated learning. The slightly higher accuracy of the present invention in the experiment may be due to differences in random seeds and model initialization, and does not reflect any accuracy loss in the scheme itself. The accuracy of the present invention steadily increases with each round, indicating that the encrypted aggregation and decryption processes do not disrupt the direction of model updates. Under complete dataset and sufficient training conditions, the accuracy of the present invention should be equal to that of plaintext federated learning. Therefore, the present invention can completely preserve the model training effect while protecting privacy.

[0216] Regarding performance overhead, experiments measured the computational and communication costs of each stage. Encryption was the main performance bottleneck; with 1970 model parameters, each round of encryption took approximately 64.4 seconds. The overhead of proxy re-encryption and hash verification was negligible because each parameter required a modulo exponentiation operation. The ciphertext data inflation was approximately 70.7 times that of the plaintext scheme. This inflation stemmed from the inherent characteristics of Paillier homomorphic encryption, where each ciphertext occupies a fixed 256 bytes.

[0217] Based on the above comparative experiments, this invention achieves confidentiality (homomorphic encryption), transmission integrity (hash verification), and a certain degree of authentication capability for model parameters, while plaintext FL does not have any privacy and security protection capabilities.

[0218] The additional overhead primarily comes from the encryption process. In this experiment, the total time per round for the proposed scheme is approximately 64.5 seconds, with plaintext FL taking approximately 0.078 seconds. The proposed scheme takes approximately 820 times longer than plaintext FL. This is due to the homomorphic encryption of 1970 parameters. In real-world large-scale model scenarios, the absolute value of encryption time will be even greater, but the plaintext aggregation time will also increase, although the multiple may decrease. Re-encryption and hash verification have almost no impact.

[0219] In this experiment, the encrypted data ballooned by approximately 70.7 times. As the model parameter scale increases, the communication ballooning rate gradually approaches the theoretical value of approximately 30 times. This communication overhead is within an acceptable range and is suitable for scenarios with high privacy requirements and good network conditions. Further gradient compression techniques can be combined to reduce the communication burden. There is no loss in model accuracy, and it is completely consistent with the plaintext FL.

[0220] Therefore, this invention improves the security of the federated learning model aggregation process at an acceptable performance cost.

[0221] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0222] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A secure federated learning method based on proxy re-encryption and homomorphic encryption, characterized in that, This is achieved through four types of entities: a key generation center, a local training terminal, a proxy re-encryption node, and an aggregation server. Specifically, the steps include: The key generation center generates system public parameters for the Paillier cryptosystem based on security parameters, generates key pairs for each local training terminal and aggregation server, generates its own re-encryption key pair, and assigns a unique identifier to each local training terminal; the key generation center generates a random mask that satisfies the weighted sum of zero before each round of training and secretly distributes it to each local training terminal. The aggregation server initializes and distributes the global model. Each local training terminal receives and uses local data to complete model training and obtain local model parameters. The random mask is superimposed and then Paillier encrypted to obtain the ciphertext of the model parameters. At the same time, a hash digest containing its own identity is generated, and the ciphertext of the model parameters and the hash digest are uploaded to the proxy re-encryption node. The proxy re-encryption node performs integrity verification and identity authentication on the ciphertext of model parameters, and uses the two-level re-encryption key to perform proxy re-encryption, completing the conversion of the ciphertext to the aggregation server key field; The aggregation server receives the re-encrypted model parameter ciphertext, uses the additive homomorphic property of the Paillier cryptosystem to generate aggregate ciphertext, decrypts the aggregate ciphertext using its own private key, performs division in the plaintext field, and generates a new global model. The updated global model is then distributed to each local training end to begin the next round of federated learning training, until the global model converges or reaches the preset number of training rounds.

2. The secure federated learning method based on proxy re-encryption and homomorphic encryption according to claim 1, characterized in that, When the local model parameters are floating-point numbers, each local training end performs fixed-point scaling on the floating-point model parameters according to a preset scaling factor before superimposing the random mask, maps them to integers, and then performs random mask superposition and Paillier encryption. After the aggregation server decrypts the weighted sum and performs division in the plaintext field, it restores the global model parameters using the same scaling factor to recover the actual floating-point global model parameters.

3. The secure federated learning method based on proxy re-encryption and homomorphic encryption according to claim 1, characterized in that, The steps for the proxy re-encryption node to perform integrity verification and identity authentication on the encrypted model parameters are as follows: During the initialization phase, the proxy re-encryption node obtains a complete list of identity identifiers for all local training terminals from the key generation center. After receiving the ciphertext of the model parameters and the hash digest, the proxy re-encryption node searches for the corresponding identity in the identity list, concatenates it with the received ciphertext of the model parameters, and recalculates the hash value. If the recalculated hash value is equal to the hash digest, the verification is successful, indicating that the encrypted model parameters have not been tampered with during transmission and the sender's identity is legitimate. If the calculated hash value is not equal to the hash digest, the verification fails, the proxy re-encryption node discards the ciphertext of the model parameters and requests a re-upload from the corresponding local training end.

4. The secure federated learning method based on proxy re-encryption and homomorphic encryption according to claim 1, characterized in that, The two-level re-encryption key is generated as follows: The first-level re-encryption key is generated locally by the local training terminal. It uses its own private key and the public key of the key generation center to generate the first-level re-encryption key according to the Paillier proxy re-encryption scheme. Its expression is: ； in, This represents the first-level re-encryption key; This represents the proxy re-encryption key generation function; Indicates the first The private key of a local training device; This represents the public key of the key generation center; The modulus representing the Paillier cryptosystem; Indicates the local training node's index; After generating the first-level re-encryption key on the local training end, it is sent to the proxy re-encryption node; The second-level re-encryption key is generated by the key generation center using its own private key and the aggregation server's public key, and its expression is: ； in, This represents the second-level re-encryption key; This represents the proxy re-encryption key generation function; This represents the private key of the key generation center; This represents the public key of the aggregation server; The modulus representing the Paillier cryptosystem; After generating the second-level re-encryption key, the key generation center sends it to the proxy re-encryption node.

5. A secure federated learning method based on proxy re-encryption and homomorphic encryption according to claim 4, characterized in that, The steps for the proxy re-encryption node to receive the first-level re-encryption key and the second-level re-encryption key and perform proxy re-encryption are as follows: The proxy re-encryption node performs two re-encryption operations on the ciphertext of model parameters that have passed integrity verification and identity authentication. First, the first-level re-encryption key is used to convert the ciphertext of model parameters that have passed integrity verification and identity authentication into intermediate ciphertext. The intermediate ciphertext is then converted into the final ciphertext using the second-level re-encryption key; After two proxy re-encryptions, the encrypted model parameters, originally located in the local training key domain, are transferred to the aggregation server key domain.

6. The secure federated learning method based on proxy re-encryption and homomorphic encryption according to claim 1, characterized in that, The steps for generating the aggregated ciphertext are as follows: The aggregation server receives the re-encrypted model parameter ciphertext and uses the homomorphic property of the Paillier cryptosystem to perform the weighted summation in the model averaging calculation in the ciphertext state. First, homomorphic scalar multiplication is performed. The aggregation server then performs a modular exponentiation operation on each re-encrypted model parameter ciphertext, with the number of samples from that local training end as the exponent. ； in, This represents the ciphertext after a scalar multiplication operation. This represents the ciphertext of the re-encrypted model parameters; Indicates the first The number of local training samples held by each local training endpoint; The modulus representing the Paillier cryptosystem; Based on the scalar multiplication homomorphism property of the Paillier cryptosystem, modular exponentiation in the ciphertext field is equivalent to constant multiplication in the plaintext field, thus completing the weighted summation in the ciphertext state according to the number of samples. After weighting, homomorphic multiplication aggregation is performed. The aggregation server performs ciphertext multiplication on the ciphertexts after scalar multiplication of all local training ends to obtain the aggregated ciphertext. According to the additive homomorphic property of the Paillier cryptosystem, ciphertext multiplication is equivalent to plaintext addition, thus completing the weighted summation in the ciphertext state.

7. A secure federated learning method based on proxy re-encryption and homomorphic encryption according to claim 1, characterized in that, The steps for decrypting the aggregated ciphertext using one's own private key are as follows: The aggregation server uses its own private key to decrypt the aggregated ciphertext, and the aggregation server's private key contains two components. First, the ciphertext is aggregated by performing a modular exponentiation on the first component of the aggregation server's private key to obtain an intermediate result. Then, an auxiliary function is applied to the intermediate result to map it to the modular space, and then it is multiplied by the second component of the aggregation server's private key to obtain the weighted sum of the plaintext. The auxiliary function is defined as follows: ;in, Indicates the input variables of the function; This represents the modulus of the Paillier cryptosystem.

8. A secure federated learning system based on proxy re-encryption and homomorphic encryption for implementing the method of any one of claims 1 to 7, characterized in that, include: The key generation center is used to generate the common system parameters required to construct the Paillier cryptosystem, generate key pairs for each local training terminal, and generate its own re-encryption key pair. Before the start of each round of training, it generates a set of random masks that satisfy the condition that the weighted sum is zero and distributes them to the corresponding local training terminals through a secure channel. Multiple local training endpoints are used to complete model training using local data and generate local model parameters. After superimposing a random mask, the endpoints use their own public key to perform Paillier encryption to obtain the ciphertext of the model parameters. They use their own identity and the ciphertext of the model parameters to generate a hash digest and upload the hash digest and the ciphertext of the model parameters. The proxy re-encryption node is used to perform integrity verification and identity verification on the encrypted model parameters. By performing re-encryption operations, it is uniformly converted to the aggregation server key domain. The aggregation server is responsible for receiving the re-encrypted model parameter ciphertext forwarded by the proxy re-encryption node, and using the homomorphic property of the Paillier cryptosystem, performing a weighted summation operation based on the number of samples in the ciphertext. It decrypts the aggregated ciphertext using its own private key to obtain the weighted sum of the local model parameters. The aggregation server divides the weighted sum by the total number of samples in the plaintext field to obtain the new global model parameters, and then sends them to each local training terminal to enter the next round of training.

9. An electronic device, comprising: The processor, communication interface, memory, and communication bus are connected, with the processor, communication interface, and memory communicating with each other via the communication bus. The feature is that the memory stores a computer program, which, when executed by the processor, causes the processor to perform the secure federated learning method based on proxy re-encryption and homomorphic encryption as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the secure federated learning method based on proxy re-encryption and homomorphic encryption as described in any one of claims 1 to 7.

Images