WO2023077627A1

WO2023077627A1 - Blockchain-based privacy protection scheme aggregation method and apparatus

Info

Publication number: WO2023077627A1
Application number: PCT/CN2021/139191
Authority: WO
Inventors: 苗银宾; 刘紫腾; 童秋云; 郑玮; 范瑞彬; 张开翔; 李辉忠; 李成博
Original assignee: 深圳前海微众银行股份有限公司; 西安电子科技大学
Priority date: 2021-11-03
Filing date: 2021-12-17
Publication date: 2023-05-11
Also published as: CN114143311B; CN114143311A

Abstract

Provided in the embodiments of the present application are a blockchain-based privacy protection scheme aggregation method and apparatus. The method comprises: a blockchain system receiving local scheme gradient ciphertext uploaded by each client; the blockchain system issuing an aggregation task to an aggregation server and a verification server by means of a smart contract, wherein the aggregation task is used for aggregating the local scheme gradient ciphertext of each client by means of an aggregation rule, so as to acquire global scheme gradient ciphertext; the blockchain system determining the global scheme gradient ciphertext on the basis of aggregation results of the aggregation server and the verification server executing the aggregation task; and the blockchain system issuing the global scheme gradient ciphertext to each client, wherein after being decrypted, the global scheme gradient ciphertext is used by the client to train a local scheme. The method is used for reducing the calculation overheads of a blockchain node, and improving the accuracy of a global scheme gradient.

Description

A blockchain-based privacy protection scheme aggregation method and device

Cross References to Related Applications

This application claims the priority of the Chinese patent application submitted to the China Patent Office on November 03, 2021, with the application number 202111297395.2 and the application name "A Method and Device for Aggregating Privacy Protection Schemes Based on Blockchain", the entire content of which Incorporated in this application by reference.

technical field

The present application relates to the field of network technology, and in particular to a blockchain-based privacy protection scheme aggregation method and device.

Background technique

In recent years, with the development of computer technology, more and more technologies are applied in the financial field, and the traditional financial industry is gradually transforming into Fintech. However, due to the security and real-time requirements of the financial industry, there are also requirements higher requirement. Due to the cryptography technology and decentralization idea on which the blockchain is based, the historical information on the chain cannot be tampered with, and the blockchain technology is also widely used in the financial industry.

In the existing privacy protection scheme: each client uses the local data set to train the local scheme, and obtains the local scheme gradient after training, and can aggregate the local scheme gradients of each client to obtain the optimized global scheme gradient, and each client according to the global scheme gradient Train local programs to improve the effect of local program training. Among them, in order to avoid the single-point failure problem, the aggregation process of the solution gradient is set in the blockchain, and the blockchain receives the local solution gradients uploaded by each client, and aggregates the local solution gradients uploaded by each client to obtain the global Program gradient. The blockchain node sends the global solution gradient to each client, so that each client can further optimize the local solution according to the global solution gradient. Although this process applies blockchain cryptography technology and decentralization ideas so that the scheme gradient information will not be leaked or tampered with, it also greatly increases the computational pressure on blockchain nodes.

Therefore, there is an urgent need for a blockchain-based privacy protection scheme aggregation method and device to reduce the computational overhead of blockchain nodes and improve the accuracy of the global scheme gradient.

Contents of the invention

Embodiments of the present application provide a blockchain-based privacy protection scheme aggregation method and device, which are used to reduce the computational overhead of blockchain nodes and improve the accuracy of global scheme gradients.

In the first aspect, the embodiment of the present application provides a blockchain-based privacy protection scheme aggregation method, the method comprising:

The blockchain system receives the local scheme gradient ciphertext uploaded by each client; the blockchain system sends the aggregation task to the aggregation server and the verification server through the smart contract, and the aggregation task is used to aggregate all The local scheme gradient ciphertext of each client is aggregated to obtain the global scheme gradient ciphertext; the blockchain system determines the global scheme gradient based on the aggregation result of the aggregation task performed by the aggregation server and the verification server Ciphertext: the block chain system sends the gradient ciphertext of the global scheme to each client, and the gradient ciphertext of the global scheme is decrypted and used for the client to train the local scheme.

In the above method, the blockchain system sends the aggregation task to the aggregation server and the verification server, obtains the aggregation results uploaded by the aggregation server and the verification server respectively, and verifies the aggregation results uploaded by the aggregation server and the verification server , determine the correct global scheme gradient ciphertext, and send the correct global scheme gradient ciphertext to each client, so that the client can train the local scheme through the correct global scheme gradient ciphertext. In this way, compared to the aggregation in the blockchain in the prior art. This application can reduce the computing overhead of the blockchain. The correct global solution gradient can also be obtained by verifying the aggregation results of the aggregation server and the verification server, so as to improve the accuracy of the global solution gradient calculation. Optionally, sending the aggregation task to the aggregation server and the verification server through a smart contract includes: sending the aggregation task to the aggregation server by the blockchain system through the smart contract; The block chain system receives the first aggregation task result of executing the aggregation task uploaded by the aggregation server; the first task aggregation result contains the first global scheme gradient ciphertext; the block chain system passes The smart contract publicly audits the gradient ciphertext of the first global scheme; the blockchain system receives the verification request from the verification server, and sends the aggregation task to the verification server through the smart contract .

In the above method, the blockchain system sends the aggregation task to the aggregation server through the smart contract, and after receiving the first aggregation task result uploaded by the aggregation server, encrypts the gradient of the first global scheme in the first aggregation task result. If the verification server challenges the aggregation task, the blockchain system will send the aggregation task to the verification server through the smart contract, and obtain the second global scheme gradient encryption in the second aggregation task result of the verification server. arts. In this way, the correct global scheme gradient ciphertext is determined according to the first global scheme gradient ciphertext of the aggregation server and the second global scheme gradient ciphertext of the verification server, that is, the challenge verification mechanism of the global scheme gradient ciphertext is added to obtain multiple Global scheme gradient ciphertext, select the most reliable global scheme gradient ciphertext from the multiple global scheme gradient ciphertexts and send it to each client, improve the accuracy of the global scheme gradient ciphertext, and improve the performance of the client's local scheme training accuracy.

Optionally, the blockchain system determines the gradient ciphertext of the global scheme based on the aggregation result of the aggregation task performed by the aggregation server and the verification server, including: if the blockchain system does not receive To the second aggregation task result of executing the aggregation task uploaded by the verification server, the first global scheme gradient ciphertext is determined as the global scheme gradient ciphertext; if the blockchain system receives The second aggregation task result determines the global scheme gradient ciphertext according to the first aggregation task result and the second aggregation task result.

In the above method, if the verification server does not initiate a verification challenge, the first global scheme gradient ciphertext in the first aggregation task result of the aggregation server is used as the global scheme gradient ciphertext.

Optionally, the blockchain system determines the global scheme gradient ciphertext based on the aggregation result of the aggregation task performed by the aggregation server and the verification server, including: the blockchain system uses the The smart contract compares whether the gradient ciphertext of the first global scheme and the gradient ciphertext of the second global scheme are the same, and the gradient ciphertext of the first global scheme is included in the first aggregation task result obtained by the aggregation server executing the aggregation task , the second global scheme gradient ciphertext is included in the second aggregation task result obtained by the verification server executing the aggregation task; if different, the blockchain system obtains a divergent instruction, and the divergent instruction is all In the state corresponding to each instruction in the second aggregation task result, an instruction that diverges from the state corresponding to each instruction in the first aggregation task result; the blockchain system forwards the divergent instruction through the smart contract The state corresponding to an instruction is used as the initial state, execute the divergent instruction, and obtain the corresponding state of the divergent instruction in the blockchain system; if the corresponding state of the divergent instruction in the blockchain system is the same as the If the states corresponding to the divergence instructions in the second aggregation task result are the same, then it is determined that the second global scheme gradient ciphertext is the global scheme gradient ciphertext.

In the above method, when the first global scheme gradient ciphertext is the same as the second global scheme gradient ciphertext, it can be considered that the global scheme gradient ciphertext obtained by the aggregation server and the verification server is accurate; when the first global scheme gradient When the ciphertext is different from the second global scheme gradient ciphertext, there is an incorrect global scheme gradient ciphertext in the aggregation result of the aggregation server/verification server. Verify the aggregation results of the aggregation server and the verification server: the first aggregation task result uploaded by the aggregation server includes the status corresponding to each instruction, and the second aggregation task result uploaded by the verification server includes the status corresponding to each instruction, Then the blockchain system can determine the instruction that diverges from the states corresponding to the instructions in the second aggregation task result through the smart contract, that is, the divergence instruction, and use the divergence The state corresponding to the previous instruction of the instruction is taken as the initial state, execute the divergent instruction, obtain the corresponding state of the divergent instruction in the blockchain system, compare the corresponding state of the divergent instruction in the blockchain system with the verification service of the divergent instruction Whether the corresponding state in the end is consistent, if they are consistent, it is considered that the result of the second aggregation task uploaded by the verification server is correct, that is, the gradient ciphertext of the second global scheme is correct, and the gradient of the first global scheme uploaded by the aggregation server is correct. Ciphertext is less accurate. In this way, the multi-party execution of the global scheme gradient ciphertext and the mechanism of multi-result comparison and verification are added to improve the accuracy of the global scheme gradient ciphertext.

Optionally, the aggregation task also includes a standard scheme; the aggregation task is used to aggregate the local scheme gradient ciphertext of each client through aggregation rules to obtain the global scheme gradient ciphertext, including:

According to the standard scheme and the standard data set, the gradient ciphertext of the standard scheme is obtained;

For the local scheme gradient ciphertext of any client, determine the cosine similarity between the local scheme gradient ciphertext of the client and the standard scheme gradient ciphertext; when the cosine similarity satisfies the set condition, according to the client The gradient ciphertext of the local scheme of the client and the cosine similarity, determine the aggregation sub-item of the client, and update the accumulated results of the aggregated clients based on the aggregation sub-item of the client, until the aggregation of each client ends; through the The client calculates the cumulative result to obtain the gradient ciphertext of the global scheme.

In the above method, the standard data set can be obtained by the aggregation server in a professional authority, and the standard solution can be determined based on the type and characteristics of the client's local solution. Then the standard scheme gradient ciphertext obtained according to the standard scheme and the standard data set is a representative positive (accurate) scheme gradient ciphertext with the local scheme of the client. Then, according to the cosine similarity between the gradient ciphertext of the local scheme of the client and the gradient ciphertext of the standard scheme, it is determined whether the gradient ciphertext of the local scheme of the client is aggregated, which can improve the accuracy of the aggregation result. In other words, if the client is attacked and the local scheme is tampered with, the cosine similarity between the gradient ciphertext of the local scheme uploaded by the client and the gradient ciphertext of the standard scheme will not meet the set conditions. The aggregation of the gradient ciphertext of the local scheme can prevent the inaccuracy of the gradient ciphertext of the global scheme caused by malicious poisoning attacks on the client.

Optionally, determining the cosine similarity between the gradient ciphertext of the local scheme of the client and the gradient ciphertext of the standard scheme includes: making the gradient ciphertext of the local scheme of the client and the gradient ciphertext of the standard scheme according to the same Fragmentation rules for fragmentation, respectively

gradient components, n is the scheme gradient length, k is the gradient component length; for

The vth component at the same component position in the first gradient component determines the sub-cosine similarity between the vth component of the client's local scheme gradient ciphertext and the vth component of the standard scheme gradient ciphertext;

sub-cosine similarity of each gradient component to obtain the cosine similarity between the gradient ciphertext of the client's local scheme and the gradient ciphertext of the standard scheme.

In the above method, if the length of the scheme gradient is too long to be encrypted at one time, the scheme gradient can be obtained by fragmentation according to the encryption capability k of the encryption algorithm

a gradient component. In this way, the normal execution of encryption is guaranteed. Correspondingly, when calculating the cosine similarity, the components of the gradient ciphertext of the local scheme and the corresponding components of the gradient ciphertext of the standard scheme can be calculated for the cosine similarity of the ciphertext, and the sub-cosine similarity corresponding to the position component can be obtained, and the

The sub-cosine similarity of each gradient component is summed to obtain the cosine similarity between the gradient ciphertext of the client's local scheme and the gradient ciphertext of the standard scheme.

Optionally, the cosine similarity satisfies a set condition, including: performing deformation based on the cosine similarity to obtain the first constant and the second constant, and according to the ciphertext comparison rule and the first constant and the second constant Determining a first variable and a second variable, the ciphertext comparison rule is used to obtain a plaintext comparison result of the ciphertext under ciphertext; and according to the ciphertext comparison rule, determine A comparison result of two variables; determining that the comparison result is not equal to the second constant.

In the above method, since the cosine similarity is the difference between the gradient ciphertext of the client's local scheme and the gradient ciphertext of the standard scheme. Therefore, in order to obtain the comparison result of the cosine similarity between the gradient plaintext of the client’s local scheme and the gradient cipher plaintext of the standard scheme, and the set conditions, the cosine similarity of the ciphertext under the plaintext condition is obtained through the above ciphertext comparison rules. The comparison result of the condition, under the ciphertext condition, ensures the accuracy of the plaintext calculation result.

Optionally, according to the client's local scheme gradient ciphertext and the cosine similarity, determine the aggregation sub-item of the client, and update the accumulated result of the aggregated client based on the client's aggregation sub-item, including: The product of the local scheme gradient ciphertext of the client and the cosine similarity corresponding to the client is used as a first aggregation subitem; the cosine similarity corresponding to the client is used as a second aggregation subitem; the accumulating the first aggregation sub-item with the first accumulation result, and updating the first accumulation result; adding the second aggregation sub-item with the second accumulation result, and updating the second accumulation result;

The cumulative result is calculated by the client to obtain the global scheme gradient ciphertext, including:

determining a first random vector and a second random vector, obtaining a first product of a product of the first random vector and the first cumulative result, and obtaining a first product of a product of the second random vector and the second cumulative result double product;

sending the first product and the second product to the client;

Based on the private key of the client, decrypt the first product to obtain a first decryption result, and decrypt the second product to obtain a second decryption result, and calculate the first decryption result/the first decryption result Two decryption results to obtain calculation results;

Encrypting the calculation result based on the public key of the client to obtain an encrypted calculation result;

A global scheme gradient ciphertext is obtained according to the product of the second random vector/first random vector and the encryption calculation result.

In the above method, the aggregation server determines the first random vector and the second random vector, and multiplies the first random vector and the second random vector by the first cumulative result and the second cumulative result respectively to obtain the first product and the second product . The aggregation server sends the first product and the second product to the client, and based on the client's private key, the client decrypts the first product and the second product to obtain the first decryption result and the second decryption result. In this way, the first decryption result of the plaintext (but actually still the product of the first accumulation result of the plaintext and the first random vector) and the second decryption result (but actually still the product of the second accumulation result of the plaintext and the second random vector) product), the client further divides the first decryption result and the second decryption result to obtain the global scheme gradient * (first random vector/second random vector). The client encrypts the global scheme gradient * (first random vector/second random vector) according to the public key, and sends the result to the aggregation server, and the aggregation server sends the encrypted global scheme gradient * (first random vector/second random vector) Two random vectors) multiplied by (second random vector/first random vector) to obtain the global scheme gradient ciphertext. In this way, the global scheme gradient can be obtained through the division rule calculation on the client side, and the security of information transmission between the aggregation server and the client can be guaranteed, that is, the global scheme gradient ciphertext transmitted between the aggregation server and the client can be guaranteed security. In addition, by setting the first random vector and the second random vector to be multiplied by the first cumulative result and the second cumulative result respectively, even if the client decrypts the first cumulative result and the second cumulative result, the global scheme gradient cannot be obtained The plaintext of , further guarantees the security and confidentiality of the global scheme gradient.

Optionally, the scheme gradient ciphertext is obtained by encrypting the scheme gradient through the CKKS homomorphic encryption algorithm.

In the above method, the CKKS homomorphic encryption algorithm can guarantee the data privacy of the program gradient transmission between the client, the server and the blockchain system, and the calculation amount is small, and the obtained ciphertext is small, which can save encryption resources and ciphertext transmission resources .

In the second aspect, the embodiment of the present application provides a blockchain-based privacy protection scheme aggregation device, which includes:

The transceiver module is used to receive the gradient ciphertext of the local scheme uploaded by each client;

The transceiver module is also used to send the aggregation task to the aggregation server and the verification server through the smart contract, and the aggregation task is used to aggregate the local scheme gradient ciphertext of each client through the aggregation rule to obtain the global scheme Gradient ciphertext;

A processing module, configured to determine the gradient ciphertext of the global scheme based on the aggregation result of the aggregation task performed by the aggregation server and the verification server;

The transceiver module is further configured to deliver the gradient ciphertext of the global scheme to each client, and the gradient ciphertext of the global scheme is decrypted and used by the client to train the local scheme.

In the third aspect, the embodiment of the present application also provides a computing device, including: a memory for storing programs; a processor for invoking the programs stored in the memory, and executing various methods according to the first aspect according to the obtained programs. methods described in Possible Designs.

In the fourth aspect, the embodiment of the present application also provides a computer-readable non-volatile storage medium, including a computer-readable program, and when the computer reads and executes the computer-readable program, the computer executes the computer-readable program according to the first aspect. Various possible designs are described in the method.

These implementation manners or other implementation manners of the present application will be more concise and understandable in the description of the following embodiments.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For Those skilled in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a schematic diagram of the architecture of a blockchain-based privacy protection scheme aggregation provided by an embodiment of the present application;

FIG. 2 is a schematic flow diagram of a blockchain-based privacy protection scheme aggregation method provided by an embodiment of the present application;

FIG. 3 is a schematic flowchart of a cosine similarity calculation method provided in an embodiment of the present application;

FIG. 4 is a schematic flow diagram of a blockchain-based privacy protection scheme aggregation method provided by an embodiment of the present application;

Fig. 5 is a schematic flow diagram of a block chain-based privacy protection scheme aggregation method provided by the embodiment of the application;

FIG. 6 is a schematic diagram of a block chain-based privacy protection scheme aggregation device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the application clearer, the application will be further described in detail below in conjunction with the accompanying drawings. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

Fig. 1 is the system architecture of a blockchain-based privacy protection scheme aggregation provided by the embodiment of the present application. Multiple clients (Z is a positive integer greater than 0) 101 upload the local scheme gradient ciphertext to the blockchain system 102. The blockchain system 102 generates an aggregation task according to the gradient ciphertext of the local scheme uploaded by multiple clients 101, and sends it to the aggregation server 103. The aggregation server 103 aggregates the local scheme gradient ciphertext uploaded by multiple clients 101 according to the aggregation task to obtain the aggregation task result, and uploads the aggregation task result to the blockchain system 102 . The blockchain system 102 conducts a public review of the aggregation task result, receives the verification request from the verification server 104, and sends the aggregation task to the verification server 104. The verification server 104 aggregates the local scheme gradient ciphertext uploaded by multiple clients 101 according to the aggregation task to obtain the aggregation task result, and uploads the aggregation task result to the blockchain system 102 . Here, the blockchain system 102 may also send the aggregation task to the aggregation server 103 and the verification server 104 respectively, and obtain the first aggregation task result uploaded by the aggregation server 103 and the second aggregation task result uploaded by the verification server 104 . At this time, the block chain system 102 includes the aggregation task result of the aggregation server 103 and the aggregation task result of the verification server 104. The aggregation task result contains the gradient ciphertext of the global scheme. The aggregation task result and the aggregation task result of the verification server 104 are verified, and the correct global scheme gradient ciphertext is obtained, and the correct global scheme gradient ciphertext is sent to multiple clients 101 respectively, so that multiple clients 101 The global scheme gradient ciphertext is trained on the local scheme.

Based on this, the embodiment of this application provides a flow of a blockchain-based privacy protection scheme aggregation method, as shown in Figure 2, including:

Step 201, the blockchain system receives the local scheme gradient ciphertext uploaded by each client;

Here, the gradient ciphertext of the local scheme uploaded by the client is encrypted according to the gradient of the local scheme of the client, and the gradient of the local scheme is obtained through training of the local scheme.

In one example, the client node computes the i-th round local solution gradient:

in,

Indicates the i-th round local solution gradient of the l-th client node,

Indicates the derivation operation, L( ) indicates the loss function, and D _l indicates the local data of the lth client node. The client local scheme training method here is just an example, and the client local scheme training may also be a training method of a neural network image binary classification scheme, etc., which are not specifically limited.

Step 202, the blockchain system sends the aggregation task to the aggregation server and the verification server through the smart contract, and the aggregation task is used to aggregate the local scheme gradient ciphertext of each client through the aggregation rule to obtain the global Scheme gradient ciphertext;

Step 203, the blockchain system determines the global scheme gradient ciphertext based on the aggregation results of the aggregation task performed by the aggregation server and the verification server;

Step 204, the blockchain system sends the global scheme gradient ciphertext to each client, and the global scheme gradient ciphertext is decrypted and used by the client to train the local scheme.

In the above method, the blockchain system sends the aggregation task to the aggregation server and the verification server, obtains the aggregation results uploaded by the aggregation server and the verification server respectively, and verifies the aggregation results uploaded by the aggregation server and the verification server , determine the correct global scheme gradient ciphertext, and send the correct global scheme gradient ciphertext to each client, so that the client can train the local scheme through the correct global scheme gradient ciphertext. In this way, compared to the aggregation in the blockchain in the prior art. This application can reduce the computing overhead of the blockchain. The correct global solution gradient can also be obtained by verifying the aggregation results of the aggregation server and the verification server, so as to improve the accuracy of the global solution gradient calculation.

The embodiment of the present application provides a block chain-based privacy protection scheme aggregation method, which sends the aggregation task to the aggregation server and the verification server through the smart contract, including: the block chain system uses the smart The contract sends the aggregation task to the aggregation server; the blockchain system receives the first aggregation task result uploaded by the aggregation server to execute the aggregation task; the aggregation result of the first task includes The gradient ciphertext of the first global scheme; the blockchain system publicly audits the gradient ciphertext of the first global scheme through the smart contract; the blockchain system receives the verification request from the verification server, and passes the The smart contract sends the aggregation task to the verification server. That is to say, when the blockchain system delivers the aggregation task, it can also send the aggregation task to the aggregation server first, and after the aggregation server returns the aggregation task result, the aggregation task result will be publicly audited. If there is a verification request from the verification server, the global scheme gradient ciphertext in the aggregation task result of the aggregation server will be sent to each client. If a verification request from the verification server is received, the aggregation task will be sent to the verification server. Get the aggregation task result of the verification server.

In addition, here is a method for determining the aggregation server: when the blockchain system aggregates the privacy protection scheme in the first round, it first initializes an empty set for the aggregation server as a collection of aggregation servers that can perform aggregation tasks. The aggregation server judges the calculation consumption of executing the aggregation task and the reward for completing the aggregation task. If an aggregation server determines that the calculation consumption is less than the reward, it will add the aggregation server to the aggregation server set. If the calculation consumption is greater than or equal to the reward, then Ignore the aggregation server, and finally obtain the aggregation server set containing at least one aggregation server. Subsequently, when the blockchain system aggregates the privacy protection scheme in the i-th round, it can directly select an aggregation server from the aggregation server set to perform the aggregation task.

The embodiment of the present application provides a blockchain-based aggregation method for privacy protection schemes. The blockchain system determines the global scheme based on the aggregation results of the aggregation tasks performed by the aggregation server and the verification server. Gradient ciphertext, including: if the block chain system does not receive the second aggregation task result of executing the aggregation task uploaded by the verification server, then determine the gradient ciphertext of the first global scheme as the Global scheme gradient ciphertext; if the blockchain system receives the second aggregation task result, it determines the global scheme gradient ciphertext according to the first aggregation task result and the second aggregation task result. That is to say, if the blockchain system does not receive the second aggregation task result uploaded by the verification server to execute the aggregation task, it will use the gradient ciphertext of the first global scheme in the first aggregation task result uploaded by the aggregation server as the global Scheme gradient ciphertext, if the blockchain system receives the second aggregation task result, arbitrate the global scheme gradient ciphertext from the first aggregation task result and the second aggregation task result.

An embodiment of the present application provides an arbitration method for a blockchain system, wherein the blockchain system determines the gradient ciphertext of the global scheme based on the aggregation results of the aggregation task performed by the aggregation server and the verification server, Including: the blockchain system compares whether the gradient ciphertext of the first global scheme and the gradient ciphertext of the second global scheme are the same through the smart contract, and the gradient ciphertext of the first global scheme is included in the aggregation server execution In the first aggregation task result obtained by the aggregation task, the second global scheme gradient ciphertext is included in the second aggregation task result obtained by the verification server executing the aggregation task; if different, the blockchain The system obtains a divergent instruction, and the divergent instruction is an instruction that diverges from the state corresponding to each instruction in the first aggregation task result among the states corresponding to the instructions in the second aggregation task result; the blockchain system Through the smart contract, the state corresponding to the previous instruction of the divergent instruction is used as the initial state, and the divergent instruction is executed to obtain the corresponding state of the divergent instruction in the blockchain system; if the divergent instruction is in the If the corresponding state in the blockchain system is the same as the corresponding state of the divergent instruction in the second aggregation task result, then it is determined that the second global scheme gradient ciphertext is the global scheme gradient ciphertext. That is to say, the blockchain system determines the divergent instruction by comparing the corresponding state of each instruction in the result of the first aggregation task with the corresponding state of each instruction in the result of the second aggregation task, and takes the state corresponding to the previous instruction of the divergent instruction as the initial state, To execute the divergent instruction, the blockchain system obtains the corresponding state of the divergent instruction under the execution of the blockchain system, and compares whether the corresponding state of the divergent instruction in the server and the corresponding state of the instruction in the blockchain system are the same, if they are the same , then it is determined that the global scheme gradient ciphertext corresponding to the divergent instruction of the server is the correct global gradient ciphertext sent to each client.

The embodiment of the present application provides a blockchain-based privacy protection scheme aggregation method, the aggregation task also includes a standard scheme; the aggregation task is used to aggregate the local scheme gradient ciphertext of each client through aggregation rules Thereby obtaining the gradient ciphertext of the global scheme includes: obtaining the gradient ciphertext of the standard scheme according to the standard scheme and the standard data set; The cosine similarity of the gradient ciphertext of the standard scheme; when the cosine similarity satisfies the set condition, determine the aggregation subitem of the client according to the gradient ciphertext of the local scheme of the client and the cosine similarity, and Updating the accumulated results of the aggregated clients based on the aggregated sub-items of the clients until the aggregation of each client is completed; calculating the accumulated results by the clients to obtain the global scheme gradient ciphertext.

That is to say, after the aggregation server or verification server receives the aggregation task, the aggregation task includes the standard scheme, the aggregation rules and the gradient ciphertext of each client's local scheme. The aggregation server or the verification server is based on the standard scheme (determined based on the local scheme of the client, which can be the same type of scheme as the local scheme) and the standard data set (which can be obtained by the aggregation server or the verification server from a professional authoritative database. The representative data can also be representative forward (correct, untampered data) obtained by other data acquisition channels to obtain the standard scheme gradient ciphertext. In this way, the local scheme gradient ciphertext of each client to be aggregated can be screened according to the standard scheme gradient ciphertext, that is, the cosine similarity between the standard scheme gradient ciphertext and the local scheme gradient ciphertext of each client is calculated, if the cosine similarity If the set conditions are not met, it is considered that the difference between the gradient ciphertext of the client’s local scheme corresponding to the cosine similarity and the gradient ciphertext of the standard scheme is too large, and the client is likely to be tampered with. Not aggregated, as such, prevents client tampering attacks from affecting all clients' local schemes.

Among them, the local scheme gradient ciphertext of each client whose cosine similarity satisfies the set conditions is aggregated, and the local scheme gradient ciphertext of each client corresponds to an aggregation sub-item. During the aggregation process, the aggregation sub-items of each client Items are accumulated until each client is aggregated to obtain the cumulative result; the cumulative result is calculated by the client to obtain the global scheme gradient ciphertext.

In an example, the set condition that the cosine similarity satisfies may be greater than 0, which is only an example here and does not limit the specific implementation of the solution. For example, if the standard scheme and the local scheme of the client are more suitable for other similarity calculation methods, the aggregated gradient ciphertext of the local scheme of the client can be screened through other similarities. Correspondingly, the setting condition of similarity is suitable change.

An embodiment of the present application provides a method for calculating cosine similarity of ciphertexts. Determining the cosine similarity between the gradient ciphertext of the client's local scheme and the gradient ciphertext of the standard scheme includes: calculating the gradient of the local scheme of the client The ciphertext and the gradient ciphertext of the standard scheme are fragmented according to the same fragmentation rules, and respectively obtained

sub-cosine similarity of each gradient component to obtain the cosine similarity between the gradient ciphertext of the client's local scheme and the gradient ciphertext of the standard scheme. That is to say, the calculation of the cosine similarity between the gradient ciphertext of the client's local scheme and the gradient ciphertext of the standard scheme can be obtained according to the sub-cosine similarity between the gradient ciphertext components of the client's local scheme and the corresponding gradient ciphertext components of the standard scheme . Specifically, a calculation method of cosine similarity is provided here: the i-th round scheme gradient ciphertext is the normalized

The gradient components of the i-th round of schemes are obtained after encryption respectively, and the

The i-th round scheme gradient component is obtained by segmenting the i-th round scheme gradient with a length of n in length k; the standardized formula satisfies:

Among them, g ⁱ represents the program gradient of the i-th round,

Indicates the standardized scheme gradient, |·| indicates the vector modulus; the cosine similarity calculation rule between the i-th round local scheme gradient ciphertext component and the i-th standard scheme gradient ciphertext component satisfies the following method:

in,

Represents the i-th round local scheme gradient ciphertext component,

Represents the gradient ciphertext component of the i-th round of the standard scheme, Enc

Indicates the cosine similarity between the i-th round local scheme gradient ciphertext component and the i-th round standard scheme gradient ciphertext component, m is the length of the scheme gradient component;

The calculation rules of the cosine similarity between the i-th round local scheme gradient ciphertext and the i-th standard scheme gradient ciphertext satisfy the following method:

Wherein, the CS ⁱ represents the i-th round cosine similarity between the i-th round of local scheme gradient ciphertext and the i-th round of standard scheme gradient ciphertext of the client.

Based on the above method, the embodiment of the present application provides a cosine similarity calculation method flow, as shown in Figure 3, including:

Step 301, assign 1 to v, assign Enc(0,PK _l ) to y;

Here, l represents the l-th client among the clients.

Step 302. Calculate the i-th round of local scheme gradient ciphertext components

and the i-th round standard gradient ciphertext component

The product of , and the result of the product is used as the first intermediate ciphertext, where,

Indicates the i-th round of local scheme gradient ciphertext for client l

The vth component of ;

In the above formula,

Represents the i-th round local scheme gradient ciphertext component,

Indicates the i-th round standard scheme gradient ciphertext component.

Step 303, assigning 1 to u, performing a circular left shift operation on the first intermediate ciphertext, and obtaining the ciphertext in which each item of the plaintext corresponding to the first intermediate ciphertext is cyclically shifted to the left by one bit, as the second intermediate ciphertext;

Step 304, adding the first intermediate ciphertext and the second intermediate ciphertext, and assigning the value to the first intermediate ciphertext;

Step 305, cyclically shifting the second intermediate ciphertext to the left, and assigning it to the second intermediate ciphertext;

Step 306, determine whether u is less than m, if so, assign u+1 to u, and execute step 304 (so, for each client's local scheme gradient ciphertext component, it is equivalent to circularly shifting m-1 times to the left,

and the final first intermediate ciphertext

Multiply the final first intermediate ciphertext with Enc(1, PK _l ), and assign it to the first intermediate ciphertext (equivalent to

), add the first intermediate ciphertext to y, and assign it to y (equivalent to

), execute step 307;

Step 307, judging whether v is less than

If so, assign v+1 to v, execute the second step, otherwise, execute step 308;

Step 308, return y(CS ⁱ ).

The embodiment of the present application provides a method for comparing cosine similarity of ciphertext, the cosine similarity meets the set conditions, including: performing deformation based on the cosine similarity to obtain the first constant and the second constant, comparing the ciphertext The rule and the first constant and the second constant determine the first variable and the second variable, and the ciphertext comparison rule is used to obtain the plaintext comparison result of the ciphertext under the ciphertext; and according to the ciphertext A comparison rule determination is based on a comparison result of the first variable and the second variable; determining that the comparison result is not equal to the second constant. That is to say, since the cosine similarity is the cosine similarity of the scheme gradient ciphertext, the comparison result of the cosine similarity corresponding to the scheme gradient plaintext of the scheme gradient ciphertext can be obtained through the ciphertext comparison rule.

Specifically, in an example, the cosine similarity comparison method of ciphertexts includes: whether the cosine similarity between the gradient ciphertext of the local scheme of each client and the gradient ciphertext of the standard scheme is greater than 0 and satisfies the following judgment methods, including:

a=[CS ⁱ +Enc(1,PK)]×Enc(1/2,PK),

b=Enc(1/2,PK);

x=(a+b)/2, y=(ab)/2, a ₀ =y, b ₀ =y-1

Wherein, x represents the first variable, y represents the second variable, a ₀ represents the third variable, b ₀ represents the fourth variable, and PK is the public key of the client; according to the following formula, for the third variable and the The fourth variable to iterate over:

Among them, q represents the number of iterations, the value range is [0,d-1], d represents a positive integer, the larger d is, the more accurate the result is; whether xa _d is equal to Enc(1/2,PK _l ), if so, cosine The similarity is less than 0, if not, the cosine similarity is greater than or equal to 0. That is to say, because the value range of the cosine similarity is [-1,1], in order to meet the conditions of the cosine similarity comparison method, by performing [CS ⁱ +Enc(1,PK)]×Enc( 1/2, PK) calculation, so that the value of the cosine similarity is [0,1]. If [CS ⁱ +Enc(1,PK)]×Enc(1/2,PK)<Enc(1/2,PK), the cosine similarity is less than 0, and the cosine similarity less than 0 corresponds to the If the local scheme is tampered with, and the gradient ciphertext of the local scheme of the client is tampered with accordingly, the gradient ciphertext of the local scheme of the client will not be aggregated.

The embodiment of the present application provides a blockchain-based privacy protection scheme aggregation method, which determines the aggregation sub-items of the client according to the client's local scheme gradient ciphertext and the cosine similarity, and based on the client Aggregation subkeys on the client side update the aggregated results of the client side, including:

The product of the local scheme gradient ciphertext of the client and the cosine similarity is used as a first aggregation subitem; the cosine similarity corresponding to the client is used as a second aggregation subitem; the first aggregation accumulating subitems with the first cumulative result, and updating the first cumulative result; adding the second aggregation subitem with the second cumulative result, updating the second cumulative result; calculating the cumulative result through the client Obtaining the gradient ciphertext of the global scheme includes: determining a first random vector and a second random vector, obtaining the first product of the product of the first random vector and the first accumulation result, obtaining the second random vector and the the second product of the product of the second accumulation result; send the first product and the second product to the client; based on the private key of the client, decrypt the first product to obtain the second product a decryption result, and decrypt the second product to obtain a second decryption result, and obtain a calculation result by combining the first decryption result/the second decryption result; based on the public key of the client, the calculation result Encrypt to obtain an encrypted calculation result; obtain a global scheme gradient ciphertext according to the product of the second random vector/first random vector and the encrypted calculation result. That is to say, the first accumulation result is the accumulation sum of the products of the local scheme gradient ciphertext of each client and the corresponding cosine similarity, and the second accumulation result is the accumulation sum of the corresponding cosine similarity of each client. The aggregation server determines the first random vector and the second random vector, respectively multiplies the first random vector with the first cumulative result to obtain the first product, multiplies the second random vector with the second cumulative result to obtain the second product, and The first product and the second product are sent to the client. The client decrypts the first product and the second product according to the private key to obtain the corresponding first decryption result and the second decryption result, and calculates the value of the first decryption result/second decryption result, which is the global solution gradient* (the first random vector/the second random vector), further the client encrypts the global scheme gradient*(the first random vector/the second random vector) with the public key, obtains the encrypted result, and returns the result to aggregate server. The aggregation server multiplies the encrypted global scheme gradient*(first random vector/second random vector) by (second random vector/first random vector) to obtain the global scheme gradient ciphertext.

Based on the above method, the embodiment of this application provides a block chain-based privacy protection scheme aggregation method flow, as shown in Figure 4, including:

Step 401, the server generates two random real numbers S, C, and assigns 0 to S, C;.

Step 402, assign 1 to l;.

Step 403, using the ciphertext cosine similarity calculation rules (such as the method flow in the above-mentioned figure 3), calculate the gradient ciphertext of the i-th client node in the i-th round of the local scheme

and the gradient ciphertext of the i-th round standard scheme

The i-th cosine similarity of

Step 404, using the ciphertext comparison rule (such as the cosine similarity comparison method of the above-mentioned ciphertext), compare the i-th round cosine similarity of the lth client

and Enc(0,PK _l ), judge whether the comparison result is equal to the i-th round cosine similarity of the l-th client

If yes, execute step 405 , otherwise, execute step 412 .

Step 405, calculate the i-th round cosine similarity of the l-th client

and the gradient ciphertext of the i-th round of the local scheme of the l-th client

The product of , add the result of the product to S, and assign the sum to S;.

Step 406, the i-th round cosine similarity of the l-th client

Add to C, and assign the sum to C;.

Step 407 , judge whether l is less than or equal to f, if so, assign l+1 to l, and execute step 403 , otherwise, execute step 408 .

Here, f is the number of clients participating in scheme gradient aggregation.

Step 408, the server multiplies S (the first cumulative result) and C (the second cumulative result) by the first random vector h ₁ and the second random vector h ₂ respectively to obtain S′=S×Enc(h ₁ ,PK _l′ )(first product) and C′=C×Enc(h ₂ ,PK _l′ )(second product), randomly select a client l′, and send it to client l′ as S′ and C′ . PK _l' is the public key of client l'.

Step 409, the client l' runs the ciphertext division rule and uses the private key SK _l' to decrypt S' and C' to obtain d ₁ and d ₂ , and the client l' uses the public key PK _l' to encrypt d ₁ /d ₂ to obtain r, send r to the server.

Step 410, the server calculates the i-th round global scheme gradient ciphertext c ⁱ =r×Enc(h ₂ /h ₁ , PK _l′ ).

Step 411, the server uploads the i-th round of global scheme gradient ciphertext c ⁱ to the blockchain system.

Step 412, the server discards the i-th round of local scheme gradient ciphertext

Cosine similarity with the corresponding i-th round

Based on the above method flow, the embodiment of the present application provides a blockchain-based privacy protection scheme aggregation method flow, as shown in Figure 5, including:

Step 501, privacy protection scheme aggregation system initialization:

Construct the CKKS encryption system to generate the public key PK _l and private key SK _l for the lth client node for gradient encryption of their respective local schemes, where the value range of l is [1, f], and f represents the client node total. Among them, the CKKS encryption system can be set in the additional encryption server based on the system architecture shown in Figure 1, or it can be set in the client, or in the smart contract of the blockchain system, etc. Here, the CKKS encryption system is specifically The setting position is not limited. Each client node initializes a local scheme, and the smart contract initializes a standard scheme.

Step 502, the client trains the local scheme, and obtains the i-th round of local scheme gradients.

Here, in an example, the client node executes the stochastic gradient descent method to train the local solution to generate the local solution gradient; for example, the client node calculates the i-th round of the local solution gradient:

in,

Indicates the i-th round local solution gradient of the l-th client node,

Indicates the derivation operation, L( ) indicates the loss function, and D _l indicates the local data of the lth client node.

Step 503, the client encrypts the i-th round of local scheme gradient to obtain the i-th round of local scheme gradient ciphertext.

Here, in an example, the client node sends the i-th round of local scheme gradients to the CKKS (homomorphic encryption algorithm) encryption system for encryption. It should be noted that, in order to facilitate the calculation of the ciphertext cosine similarity in subsequent process steps, the i-th round of the local scheme gradient of the client is standardized here:

in,

Indicates the i-th round of local solution gradient after normalization of the l-th client node, and |·| represents the vector modulo operation.

Based on the properties of the CKKS homomorphic encryption algorithm, that is, the length of the encrypted data is k, and the i-th round of local scheme gradient is segmented, the lth client node will normalize the i-th round of local scheme gradient

Divided into

fragments

Use the CKKS encryption algorithm to encrypt the results of each fragment to obtain the i-th round of local scheme gradient ciphertext

in,

Indicates the upward rounding operation, Enc(·) indicates the CKKS encryption algorithm,

Indicates a round down operation.

Step 504, the client uploads the i-th round of local scheme gradient ciphertext to the blockchain system.

Step 505. The blockchain system receives the i-th round of local scheme gradient ciphertext uploaded by each client, and uses the smart contract to perform the i-th round of local scheme gradient ciphertext, standard scheme, aggregation rules, and aggregation tasks uploaded by each client. Mortgage incentive value, reward incentive value for completing the aggregation task, smart contract address generation aggregation task.

Step 506, the blockchain system sends the aggregation task to the aggregation server through the smart contract, and the aggregation server gives the mortgage incentive value for executing the aggregation task.

Here, by setting the incentive mechanism of staking incentive value and reward incentive value for the server to perform the aggregation task, it can not only improve the enthusiasm of the server to execute the aggregation task, but also improve the accuracy of the result obtained by the server to execute the aggregation task.

In addition, if the gradient ciphertext of the first round of the local scheme is aggregated, the blockchain system can initialize an empty set through the smart contract, and add the aggregation server whose calculation consumption is less than the reward incentive value to the empty set to obtain an executable aggregation task A collection of aggregation servers. The blockchain system sends the aggregation task to an aggregation server in the aggregation server set through the smart contract.

Step 507: The aggregation server collects the standard data set according to the aggregation task, calculates the gradient of the i-th round of the standard scheme according to the standard scheme in the aggregation task, and encrypts the gradient of the i-th round of the standard scheme through the CKKS encryption system to obtain the gradient of the i-th round of the standard scheme ciphertext.

Here, in an example, the aggregation server calculates the i-th round of standard solutions:

in,

Indicates the standard scheme of the i-th round, and α represents the learning rate of the scheme; use the stochastic gradient descent formula to calculate the gradient of the i-th round of the standard scheme

Further use the CKKS encryption algorithm to convert the i-th round standard scheme gradient

Encrypted to the i-th round standard scheme gradient ciphertext

Step 508, the aggregation server aggregates the local scheme gradient ciphertext of each client according to the local scheme gradient ciphertext of each client in the aggregation task and the aggregation rules, as shown in the process steps in Figure 4 to obtain the global scheme gradient ciphertext, the aggregation server according to The global scheme gradient ciphertext c ⁱ (the first global scheme gradient ciphertext) and the state corresponding to each instruction in the aggregation process generate the first aggregation task result, and upload the first aggregation task result to the blockchain system.

Step 509, the blockchain system conducts a public audit of the first aggregation task result obtained by the aggregation server.

Step 510, the blockchain system receives the verification request and the mortgage incentive value from the verification server.

Step 511, the blockchain system sends the aggregation task to the verification server.

Step 512, verify that the server collects the standard data set according to the aggregation task, calculates the i-th round of the standard solution gradient according to the standard solution in the aggregation task, and encrypts the i-th round of the standard solution gradient through the CKKS encryption system to obtain the i-th round of the standard solution gradient ciphertext.

Here, in an example, the verification server calculates the i-th round of the standard scheme:

in,

Encrypted to the i-th round standard scheme gradient ciphertext

Step 513, verify that the server aggregates the local scheme gradient ciphertext of each client according to the local scheme gradient ciphertext of each client in the aggregation task and the aggregation rules, as shown in the process steps in Figure 4 to obtain the global scheme gradient ciphertext, and verify that the server according to The global scheme gradient ciphertext c ⁱ (the second global scheme gradient ciphertext) and the state corresponding to each instruction in the aggregation process generate a second aggregation task result, and upload the second aggregation task result to the blockchain system.

Step 514, the blockchain system determines the global scheme gradient ciphertext from the first aggregation task result and the second aggregation task result through the smart contract.

Here, the blockchain system obtains the gradient ciphertext of the first global scheme in the result of the first aggregation task and the gradient ciphertext of the second global scheme in the result of the second aggregation task, and compares the gradient ciphertext of the first global scheme through the smart contract. Whether the text and the gradient ciphertext of the second global scheme are the same.

If they are different, the blockchain system determines from the state corresponding to each instruction in the second aggregation task result the instruction (difference instruction) that diverges from the state corresponding to each instruction in the first aggregation task result through the smart contract, and through the smart contract Take the state corresponding to the previous instruction of the divergent instruction as the initial state, execute the divergent instruction, and obtain the corresponding state of the divergent instruction in the blockchain system, if the corresponding state of the divergent instruction in the blockchain system is the same as the divergent instruction If the corresponding states in the task results are the same, it is determined that the second global scheme gradient ciphertext is the global scheme gradient ciphertext. If the corresponding state of the divergent instruction in the blockchain system is different from the corresponding state of the divergent instruction in the second aggregation task result, it is determined that the first global scheme gradient ciphertext is the global scheme gradient ciphertext.

Step 515: If it is determined that the second global scheme gradient ciphertext is the global scheme gradient ciphertext, give the verification server a reward incentive value, and give the aggregation server a deduction mortgage incentive value. If it is determined that the first global scheme gradient ciphertext is the global scheme gradient ciphertext, the aggregation server will be rewarded with an incentive value, and the verification server will be given a deduction of mortgage incentive value.

Step 516, the blockchain system sends the gradient ciphertext of the global scheme to each client.

Step 517, the client receives the gradient ciphertext of the global scheme, and trains the local scheme according to the gradient ciphertext of the global scheme.

The client node calculates the i+1th round of local solutions:

in,

Represents the i+1 round local scheme of the lth client node, α represents the scheme learning rate, g ⁱ represents the i-th round global scheme gradient; using the stochastic gradient descent formula, the client node performs local training on the i-th round global scheme gradient , get the gradient of the corresponding client node's i+1 local scheme; calculate the difference between each client node's i+1 local scheme and the corresponding i-th local scheme, and judge whether the difference of the calculation results corresponding to all client nodes is are less than a given threshold, if so, the training ends, otherwise, assign i+1 to i, and repeat steps 503-517.

It should be noted that the process steps of the above method are not unique. For example, step 506 and step 511 can be executed at the same time. Correspondingly, step 507 and step 508 can be executed simultaneously with step 512 and step 513, or can be executed successively. Step 512 And step 513 may be executed before step 507 and step 508, and step 509 and step 510 may not be executed.

Based on the same idea, the embodiment of the present application provides a blockchain-based privacy protection scheme aggregation device, and FIG. 6 is a schematic diagram of a blockchain-based privacy protection scheme aggregation device provided in the embodiment of the application, as shown in FIG. 6 ,include:

The transceiver module 601 is configured to receive the local scheme gradient ciphertext uploaded by each client;

The transceiver module 601 is also used to send the aggregation task to the aggregation server and the verification server through the smart contract, and the aggregation task is used to aggregate the gradient ciphertexts of the local schemes of the clients through aggregation rules to obtain the global Scheme gradient ciphertext;

A processing module 602, configured to determine the gradient ciphertext of the global scheme based on the aggregation result of the aggregation task performed by the aggregation server and the verification server;

The transceiving module 601 is further configured to deliver the gradient ciphertext of the global scheme to each client, and the gradient ciphertext of the global scheme is decrypted and used by the client to train the local scheme.

Optionally, the transceiver module 601 is specifically configured to deliver the aggregation task to the aggregation server through the smart contract; receive the first aggregation task uploaded by the aggregation server to perform the aggregation task Result; the first task aggregation result contains the first global scheme gradient ciphertext; through the smart contract, the first global scheme gradient ciphertext is publicly audited; receiving the verification server verification request, through the smart The contract sends the aggregation task to the verification server.

Optionally, the processing module 602 is specifically configured to, if the second aggregation task result uploaded by the verification server for executing the aggregation task is not received, determine the first global scheme gradient ciphertext as the The global scheme gradient ciphertext; if the second aggregation task result is received, determine the global scheme gradient ciphertext according to the first aggregation task result and the second aggregation task result.

Optionally, the processing module 602 is specifically configured to compare whether the gradient ciphertext of the first global scheme and the gradient ciphertext of the second global scheme are the same through the smart contract, and the gradient ciphertext of the first global scheme is included in the In the first aggregation task result obtained by the aggregation server executing the aggregation task, the second global scheme gradient ciphertext is included in the second aggregation task result obtained by the verification server executing the aggregation task; if different, The blockchain system acquires a divergent instruction, and the divergent instruction is an instruction that diverges from the states corresponding to the instructions in the first aggregation task result among the states corresponding to the instructions in the second aggregation task result; The smart contract takes the state corresponding to the previous instruction of the divergent instruction as the initial state, executes the divergent instruction, and obtains the corresponding state of the divergent instruction in the blockchain system; if the divergent instruction is in the If the corresponding state in the blockchain system is the same as the corresponding state of the divergent instruction in the second aggregation task result, then it is determined that the second global scheme gradient ciphertext is the global scheme gradient ciphertext.

Optionally, the processing module 602 is specifically configured to obtain the standard scheme gradient ciphertext according to the standard scheme and the standard data set; for any client's local scheme gradient ciphertext, determine the local scheme gradient ciphertext of the client. The cosine similarity between the text and the standard scheme gradient ciphertext; when the cosine similarity satisfies the set condition, determine the client's aggregater according to the client's local scheme gradient ciphertext and the cosine similarity item, and update the accumulated results of the aggregated clients based on the aggregated sub-items of the client until the aggregation of each client ends; calculate the accumulated results by any client to obtain the global scheme gradient ciphertext.

Optionally, the processing module 602 is specifically configured to include: fragmenting the gradient ciphertext of the local scheme of the client and the gradient ciphertext of the standard scheme according to the same fragmentation rule, and obtaining

Optionally, the processing module 602 is specifically configured to satisfy the set condition for the cosine similarity, including: performing deformation based on the cosine similarity to obtain the first constant and the second constant, according to the ciphertext comparison rule and the The first constant and the second constant determine the first variable and the second variable, and the ciphertext comparison rule is used to obtain the plaintext comparison result of the ciphertext under ciphertext; and determine based on the ciphertext comparison rule A comparison result of the first variable and the second variable; determining that the comparison result is not equal to the second constant.

Optionally, the processing module 602 is specifically configured to use the product of the client's local scheme gradient ciphertext and the cosine similarity as the first aggregation subitem; use the cosine similarity corresponding to the client As the second aggregation sub-item; add the first aggregation sub-item and the first accumulation result, and update the first accumulation result; add the second aggregation sub-item and the second accumulation result, and update the second aggregation sub-item Cumulative results; the cumulative results are calculated by any client to obtain the gradient ciphertext of the global scheme, including:

sending the first product and the second product to the client;

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

A block chain-based privacy protection scheme aggregation method, characterized in that the method comprises:

The blockchain system receives the local scheme gradient ciphertext uploaded by each client;

The blockchain system sends the aggregation task to the aggregation server and the verification server through the smart contract, and the aggregation task is used to aggregate the local scheme gradient ciphertexts of the clients through the aggregation rules to obtain the global scheme gradient ciphertext. arts;

The blockchain system determines the gradient ciphertext of the global scheme based on the aggregation result of the aggregation task performed by the aggregation server and the verification server;

The blockchain system sends the gradient ciphertext of the global scheme to each client, and the gradient ciphertext of the global scheme is decrypted and used by the client to train the local scheme.
The method according to claim 1, wherein the aggregation task is delivered to the aggregation server and the verification server through a smart contract, including:

The blockchain system sends the aggregation task to the aggregation server through the smart contract;

The block chain system receives the first aggregation task result of executing the aggregation task uploaded by the aggregation server; the first task aggregation result includes the first global scheme gradient ciphertext;

The blockchain system publicly audits the gradient ciphertext of the first global scheme through the smart contract;

The blockchain system receives the verification request from the verification server, and sends the aggregation task to the verification server through the smart contract.
The method according to claim 2, wherein the block chain system determines the gradient ciphertext of the global scheme based on the aggregation result of the aggregation task performed by the aggregation server and the verification server, including :

If the blockchain system does not receive the second aggregation task result uploaded by the verification server for executing the aggregation task, then determine the first global scheme gradient ciphertext as the global scheme gradient ciphertext;

If the blockchain system receives the second aggregation task result, it determines the global scheme gradient ciphertext according to the first aggregation task result and the second aggregation task result.
The method according to claim 1, wherein the block chain system determines the gradient ciphertext of the global scheme based on the aggregation result of the aggregation task performed by the aggregation server and the verification server, including :

The blockchain system compares whether the gradient ciphertext of the first global scheme and the gradient ciphertext of the second global scheme are the same through the smart contract, and the gradient ciphertext of the first global scheme is included in the aggregation server to perform the aggregation In the first aggregation task result obtained by the task, the second global scheme gradient ciphertext is included in the second aggregation task result obtained by the verification server executing the aggregation task;

If they are different, the blockchain system acquires a divergent instruction, and the divergent instruction is the state corresponding to each instruction in the second aggregation task result, which diverges from the state corresponding to each instruction in the first aggregation task result instruction;

The blockchain system uses the state corresponding to the previous instruction of the divergent instruction as the initial state through the smart contract, executes the divergent instruction, and obtains the corresponding state of the divergent instruction in the blockchain system;

If the corresponding state of the divergent instruction in the blockchain system is the same as the corresponding state of the divergent instruction in the second aggregation task result, it is determined that the gradient ciphertext of the second global scheme is the global Scheme gradient ciphertext.
The method according to any one of claims 1 to 4, wherein the aggregation task also includes a standard scheme; the aggregation task is used to aggregate the local scheme gradient ciphertext of each client through an aggregation rule In order to obtain the gradient ciphertext of the global scheme, including:

According to the standard scheme and the standard data set, the gradient ciphertext of the standard scheme is obtained;

For the local scheme gradient ciphertext of any client, determine the cosine similarity between the local scheme gradient ciphertext of the client and the standard scheme gradient ciphertext; when the cosine similarity satisfies the set condition, according to the client The gradient ciphertext of the local scheme of the client and the cosine similarity, determine the aggregation sub-item of the client, and update the cumulative result of the aggregated client based on the aggregation sub-item of the client, until the aggregation of each client ends;

The client calculates the cumulative result to obtain a global scheme gradient ciphertext.
The method according to claim 5, wherein determining the cosine similarity between the gradient ciphertext of the local scheme of the client and the gradient ciphertext of the standard scheme comprises:

Segment the gradient ciphertext of the local scheme of the client and the gradient ciphertext of the standard scheme according to the same fragmentation rule, and obtain
Gradient components, n is the scheme gradient length, k is the gradient component length;

against
The vth component at the same component position in the first gradient component determines the sub-cosine similarity between the vth component of the local scheme gradient ciphertext of the client and the vth component of the standard scheme gradient ciphertext;

according to
sub-cosine similarity of each gradient component to obtain the cosine similarity between the gradient ciphertext of the client's local scheme and the gradient ciphertext of the standard scheme.
The method according to claim 5, wherein the cosine similarity satisfies a set condition, including:

Perform deformation based on the cosine similarity to obtain the first constant and the second constant, and determine the first variable and the second variable according to the ciphertext comparison rule and the first constant and the second constant, and the ciphertext comparison rule uses Obtain the plaintext comparison result of the ciphertext under the ciphertext;

and determining a comparison result based on the first variable and the second variable according to the ciphertext comparison rule;

It is determined that the comparison result is not equal to the second constant.
The method according to claim 5, characterized in that, according to the client's local scheme gradient ciphertext and the corresponding cosine similarity of the client, determine the aggregation sub-item of the client, and based on the client's Aggregation subitems update the cumulative results of aggregated clients, including:

taking the product of the client's local scheme gradient ciphertext and the cosine similarity as the first aggregation sub-item;

using the cosine similarity corresponding to the client as a second aggregation sub-item;

accumulating the first aggregation subitem with a first accumulation result, and updating the first accumulation result;

accumulating the second aggregation subitem with a second accumulation result, and updating the second accumulation result;

The cumulative result is calculated by the client to obtain the global scheme gradient ciphertext, including:

determining a first random vector and a second random vector, obtaining a first product of a product of the first random vector and the first cumulative result, and obtaining a first product of a product of the second random vector and the second cumulative result double product;

sending the first product and the second product to the client;

Based on the private key of the client, decrypt the first product to obtain a first decryption result, and decrypt the second product to obtain a second decryption result, and calculate the first decryption result/the first decryption result Two decryption results to obtain calculation results;

Encrypting the calculation result based on the public key of the client to obtain an encrypted calculation result;

A global scheme gradient ciphertext is obtained according to the product of the second random vector/first random vector and the encryption calculation result.
The method according to any one of claims 1-8, characterized in that the scheme gradient ciphertext is obtained by encrypting the scheme gradient through the CKKS homomorphic encryption algorithm.
A block chain-based privacy protection scheme aggregation device, characterized in that the device comprises:

The transceiver module is used to receive the gradient ciphertext of the local scheme uploaded by each client;

The transceiver module is also used to send the aggregation task to the aggregation server and the verification server through the smart contract, and the aggregation task is used to aggregate the local scheme gradient ciphertext of each client through the aggregation rule to obtain the global scheme Gradient ciphertext;

A processing module, configured to determine the gradient ciphertext of the global scheme based on the aggregation result of the aggregation task performed by the aggregation server and the verification server;

The transceiver module is further configured to deliver the gradient ciphertext of the global scheme to each client, and the gradient ciphertext of the global scheme is decrypted and used by the client to train the local scheme.