# Secure and Efficient Smart Healthcare System Based on Federated Learning

Authors: Wei Liu; Yinghui Zhang; Gang Han; Jin Cao; Hui Cui; Dong Zheng
Journal: International Journal of Intelligent Systems
 (2023)

---

## Abstract

The rapid development of smart healthcare system in the Internet of Things (IoT) has made the early detection of many chronic diseases more convenient, quick, and economical. However, when healthcare organizations collect users’ health data through deployed IoT devices, there are issues of compromising users’ privacy. In view of this situation, this paper introduces federated learning technology to solve the problem of data security. In this paper, we consider the two main problems of federated learning applications in IoT smart healthcare system: (1) how to reduce the time overhead of system running and (2) how to authenticate that the user device uploading data is deployed by the system itself. To solve the above problems, we propose the first federated learning scheme based on full dynamic secret sharing. First, we use a two-mask protocol to keep the user’s local model parameters confidential during federated learning. Then, based on homogeneous linear recursive equation, homomorphic hash function, and elliptic curve cryptosystem, the full dynamic secret sharing and user identity authentication are realized. In addition, our scheme allows users to join or quit during training. Finally, we have carried out simulation test on this scheme. The experimental results show that the efficiency of our scheme is improved by about 60% on average in the case of no user dropping and by about 30% in the case of some users dropping.


---

## Body

## 1. Introduction

Over the past few decades, global health has gradually improved. As society invests more and more in health care, many intractable diseases are slowly being brought under widespread and comprehensive control. With the continuous improvement of medical level, people’s health has been improved, and people’s life expectancy has also been prolonged. However, population aging has become a global trend, gradually attracting the attention of the world. With the aging of the population, the incidence of chronic non-communicable diseases has exploded simultaneously. According to the latest report from the World Health Organization, seven of the top 10 causes of death in 2019 were chronic non-communicable diseases. In 2000, 60.8% of patients died from chronic non-communicable diseases, and in 2019, that proportion rose to 73.6%. At the same time, due to population growth and aging, the number of deaths from chronic diseases increased by 28% in 2019 compared to 2000. Due to the characteristics of chronic diseases, patients need to spend a lot of time and money on frequent medical treatment, which will undoubtedly increase the burden of the patient's family and also occupy a large number of medical resources.Therefore, the use of Internet of Things technology to achieve smart healthcare system is very promising [1, 2], through the deployment of health monitoring sensors in the user’s home environment to collect the user’s health-related data, upload the data to the server for analysis and processing, and finally put forward health suggestions to the user through the user’s data performance [3, 4]. As a remote monitoring technology, the smart healthcare system can enable people to carry out early detection and health monitoring of chronic diseases without leaving home, which is expected to play a key role in the post-COVID-19 era.However, there are still some obstacles to the actual deployment of the IoT smart healthcare system in the real world. The smart healthcare system collects a large amount of users’ health-related data, builds models through machine learning, and then applies the models to disease detection. However, users’ data are likely to be sensitive or contain private information, and users may not be willing to share their health data directly with third-party service providers. At the same time, due to the continuous occurrence of large-scale disclosure of user privacy data in recent years, many countries, regions, and organizations around the world have introduced laws and regulations to protect user privacy, making it more difficult for service providers to directly access user data, and thus the “data island” crisis was born.Federated learning is proposed in such an environment, allowing users to train a machine learning model together without sharing raw private data. Bonawitz et al. [5] first fully proposed a federal learning protocol in 2017, and the problem of “data island” is solved well by the techniques of double mask, Shamir secret sharing, and Diffie–Hellman key negotiation. Subsequently, Yang et al. [6] made a very detailed classification and summary of federal learning. Xu et al. [7] proposed an improved scheme based on the scheme proposed by Bonawitz et al.’s scheme [5] which further improved the security of the scheme by adding bilinear mapping and homomorphic hash function to verify the server. So et al. [8] proposed a lightweight federal learning security aggregation scheme, which uses one-time aggregation mask reconstruction to replace random seeds and has strong practicability.However, as far as we know, there is no existing scheme that can reduce the time spent on mask secret sharing by the user in each round of training. Reducing the time spent on secret sharing without sacrificing user privacy is obviously more complex than well-trained federated learning. In addition, it is a challenge to allow new users to join the workflow and tolerate users exiting for network or device reasons while reducing time overhead and to ensure that all users are deployed within the system and not external users.In this paper, we first propose a federated learning scheme based on full dynamic secret sharing. Firstly, we apply the full dynamic secret sharing technique based on homogeneous linear recursive equation to federated learning to reduce the time cost of secret sharing in each round of training. Then, we use a homomorphic hash function and an improved elliptic curve cryptography signature scheme to verify user identity. Finally, we conduct simulation tests under the assumption of honesty and curiosity, and the experimental results show that our proposed scheme can improve the efficiency under various conditions. The contributions of this paper are summarized as follows:(i)
We first propose a scheme for federated learning based on full dynamic secret sharing, which improves the efficiency of federated learning by assigning secret sharing subkeys to users that can be used repeatedly in multiple rounds of federated learning.(ii)
The proposed federated learning scheme uses a dynamic hash function and an improved elliptic curve signature scheme to authenticate users. It prevents data uploaded by non-system deployed users from affecting the accuracy of the federated learning model.(iii)
Based on the proposed federated learning with fully dynamic secret sharing, a privacy-protected intelligent medical system is designed to improve the availability of the intelligent medical system in practical deployment. Then, we conduct several simulation tests on multiple computers, and the experimental results show that the efficiency of our scheme is improved.The rest of the paper is organized as follows. In Section2, we introduce the related work of this paper. In Section 3, we describe the preparatory knowledge about this paper. In Section 4, we summarize the scheme. Then, in Section 5, we detail our scheme. In Section 6, we discuss the security of the scheme. In Section 7, we carry out the simulation test for all the schemes. Finally, we summarize this paper in Section 8.


## 2. Related Work

### 2.1. Smart Healthcare in the Internet of Things

In recent years, investment in the application of the IoT has accelerated the pace of the medical industry towards intelligence. The smart healthcare of the IoT is to collect users’ health data through sensors and other IoT devices and then send the data to the server for processing and analysis. After the industry has entered the 4.0 era, it has been clear from the technical aspect that smart healthcare needs to rely on artificial intelligence and big data technology. These techniques can effectively mine the hidden information in the data, discover the hidden connections between various diseases, and predict the trend of epidemics. The development of smart healthcare will help improve people's quality of life and enhance the level of medical services [9]. In the face of many chronic non-communicable diseases, the IoT smart healthcare system has the advantages of being simple to use and inexpensive compared to traditional screening measures and neuropsychological assessment, as well as remote treatment, which is crucial in the post-COVID-19 era.The concept of “e-health” dates back to 1999 [10].With the advent of the information age, medical treatment has gradually reduced manual participation from the original manual operation and manual recording to information equipment detection and automatic recording. In recent years, researchers have focused on using wearable devices to monitor users’ health data in real time and give early warning of possible heart disease. Li et al. [11] collected users’ audio data through IoT devices and detected whether users might have Alzheimer’s disease by analyzing the audio data. However, in the current smart medical products of the IoT, there is no in-depth consideration of data security, and many even directly send users’ private information to the public cloud for statistical analysis, which has a very big security risk. For the privacy and security of information transmission, Masud et al. [12] proposed a lightweight anonymous user authentication protocol for IoT healthcare. However, the protocol cannot effectively resist privileged insider attack and stolen authentication attack and has some shortcomings in security. Chen et al. [13] proposed a new protocol based on Masud et al.’s protocol, which solved the problems and deleted some redundant parameters to make the protocol more efficient and secure.El Kafhali et al. [14] added fog-computing technology to the smart healthcare system consisting of IoT and cloud computing and proposed an IoT-fog-cloud architecture model. Meanwhile, El Kafhali et al. [15] proposed a queuing model in IoT-fog-cloud architecture to reduce the cost of computing resources while ensuring performance. El Kafhali et al. verified the feasibility of the proposed scheme by modeling it, which further improved the possibility of the actual deployment of the smart medical system. To address the security challenges brought by the rapid development of medical IoT, Pelekoudas-Oikonomou et al. [16] proposed a solution to integrate blockchain technology into medical IoT. Pelekoudas-Oikonomou et al. reviewed the state-of-the-art blockchain-based security mechanisms in order to provide a foundation for organizing research efforts towards the design and development of reliable blockchain-based countermeasures, addressing the pressing security challenges of smart healthcare systems in an effective and efficient manner. Fathi et al. [17] proposed a novel electrocardiograph signal compression algorithm to address the energy consumption of wearable devices for detecting heart diseases in smart healthcare systems. The proposed scheme not only improves the computational efficiency but also reduces the energy consumption, which makes the practical deployment of wearable devices a step forward.


### 2.2. Federated Learning

Traditional machine learning is centered on a server, which trains the machine learning model by collecting large amounts of user data and then returns the model to the user for use. Considering the risk of privacy data leakage when users directly transfer private data to the server, the researchers improved the scheme so that users could transfer training parameters of the local model to protect data security instead of directly transferring private data to the server. However, it turns out that passing only local model parameters can still expose users’ private information [18].As mentioned earlier, there is a threat of privacy leakage whether users directly pass local data or model parameters. Therefore, different from traditional machine learning, the federated learning scheme proposed by Bonawit et al. [5] encrypts and protects users’ local model parameters with a double mask that can be eliminated and at the same time protects the integrity and security of users’ private data. Grivet Sébert et al. [19] used differential privacy and homomorphic encryption technology to solve the data security problem in the federated learning process and proposed a complete scheme that could deal with a wide range of threats. Ryffel et al. [20] proposed a practical framework combining admissibility training and functional encryption to perform partial encryption and privacy protection prediction, significantly improving the security of private data without compromising model accuracy. Liu et al. [21] applied attribute-based encryption technology to federated learning, realizing fine-grained data sharing on the premise of privacy protection. By seamlessly integrating federation learning into mobile crowdsensing, Zhao et al. [22] proposed CROWDFL, a privacy-preserving MCS system, and designed a secure aggregation algorithm. The system protects the privacy of participants and fully exploits the computing power of participants.


### 2.3. Secret Sharing

Secret sharing is an important method to realize information security and data privacy and also an important research direction in cryptography. Shamir [23] and Blakley [24] proposed t,n threshold secret sharing scheme based on Lagrange interpolation and linear projective geometry, respectively, in 1979. The secret sharing scheme allows the user to divide a secret S into n shares, so that any set of shares greater than or equal to t can be used to reconstruct S, but any set of shares less than t provides no information about S. Subsequently, Xu and Xiao [25] proposed a t,n threshold multiple secret sharing scheme based on RSA digital signature. The security of the scheme depends on the security of RSA digital signature, that is, the difficulty of large number decomposition.In recent years, due to different application scenarios and increasing demands, researchers have proposed dynamic secret sharing schemes to reduce the occupancy of storage space and improve communication efficiency. Liu et al. [26] analyzed several multi-secret sharing schemes and proposed two improved verifiable multi-secret sharing schemes based on them. Yuan and Li [27] proposed a fully dynamic secret sharing scheme, which improves the performance of key management and distributed systems.


### 2.4. Cryptosystem Based on Elliptic Curve

Elliptic curves have been studied for many years in algebra and geometry, and there are rich and profound theoretical studies available in the literature. Elliptic curve cryptosystems, namely, various public key cryptosystems based on the elliptic curve discrete logarithm problem, were first proposed independently by Miller [28] and Koblitz [29] in 1985, which made a major breakthrough in the research of public key cryptosystems. This is the elliptic curve cryptosystem (ECC). Compared with the traditional public key system, ECC has higher security, smaller space, lower bandwidth requirements, and better flexibility.Johnson et al. [30] proposed the elliptic curve digital signature (ECDSA) algorithm based on ECC in 2001, and Brown [31] provided the proof of the unforgeability of the ECDSA scheme in 2005. Xiao et al. [32] designed a relatively efficient scheme based on ECDSA but did not provide formal security proof. Based on the scheme proposed by Xiao et al., Qiu et al. [33] extended the mutual signature protocol to multiple parties and realized a special type of group signature scheme.


## 2.1. Smart Healthcare in the Internet of Things

In recent years, investment in the application of the IoT has accelerated the pace of the medical industry towards intelligence. The smart healthcare of the IoT is to collect users’ health data through sensors and other IoT devices and then send the data to the server for processing and analysis. After the industry has entered the 4.0 era, it has been clear from the technical aspect that smart healthcare needs to rely on artificial intelligence and big data technology. These techniques can effectively mine the hidden information in the data, discover the hidden connections between various diseases, and predict the trend of epidemics. The development of smart healthcare will help improve people's quality of life and enhance the level of medical services [9]. In the face of many chronic non-communicable diseases, the IoT smart healthcare system has the advantages of being simple to use and inexpensive compared to traditional screening measures and neuropsychological assessment, as well as remote treatment, which is crucial in the post-COVID-19 era.The concept of “e-health” dates back to 1999 [10].With the advent of the information age, medical treatment has gradually reduced manual participation from the original manual operation and manual recording to information equipment detection and automatic recording. In recent years, researchers have focused on using wearable devices to monitor users’ health data in real time and give early warning of possible heart disease. Li et al. [11] collected users’ audio data through IoT devices and detected whether users might have Alzheimer’s disease by analyzing the audio data. However, in the current smart medical products of the IoT, there is no in-depth consideration of data security, and many even directly send users’ private information to the public cloud for statistical analysis, which has a very big security risk. For the privacy and security of information transmission, Masud et al. [12] proposed a lightweight anonymous user authentication protocol for IoT healthcare. However, the protocol cannot effectively resist privileged insider attack and stolen authentication attack and has some shortcomings in security. Chen et al. [13] proposed a new protocol based on Masud et al.’s protocol, which solved the problems and deleted some redundant parameters to make the protocol more efficient and secure.El Kafhali et al. [14] added fog-computing technology to the smart healthcare system consisting of IoT and cloud computing and proposed an IoT-fog-cloud architecture model. Meanwhile, El Kafhali et al. [15] proposed a queuing model in IoT-fog-cloud architecture to reduce the cost of computing resources while ensuring performance. El Kafhali et al. verified the feasibility of the proposed scheme by modeling it, which further improved the possibility of the actual deployment of the smart medical system. To address the security challenges brought by the rapid development of medical IoT, Pelekoudas-Oikonomou et al. [16] proposed a solution to integrate blockchain technology into medical IoT. Pelekoudas-Oikonomou et al. reviewed the state-of-the-art blockchain-based security mechanisms in order to provide a foundation for organizing research efforts towards the design and development of reliable blockchain-based countermeasures, addressing the pressing security challenges of smart healthcare systems in an effective and efficient manner. Fathi et al. [17] proposed a novel electrocardiograph signal compression algorithm to address the energy consumption of wearable devices for detecting heart diseases in smart healthcare systems. The proposed scheme not only improves the computational efficiency but also reduces the energy consumption, which makes the practical deployment of wearable devices a step forward.


## 2.2. Federated Learning

Traditional machine learning is centered on a server, which trains the machine learning model by collecting large amounts of user data and then returns the model to the user for use. Considering the risk of privacy data leakage when users directly transfer private data to the server, the researchers improved the scheme so that users could transfer training parameters of the local model to protect data security instead of directly transferring private data to the server. However, it turns out that passing only local model parameters can still expose users’ private information [18].As mentioned earlier, there is a threat of privacy leakage whether users directly pass local data or model parameters. Therefore, different from traditional machine learning, the federated learning scheme proposed by Bonawit et al. [5] encrypts and protects users’ local model parameters with a double mask that can be eliminated and at the same time protects the integrity and security of users’ private data. Grivet Sébert et al. [19] used differential privacy and homomorphic encryption technology to solve the data security problem in the federated learning process and proposed a complete scheme that could deal with a wide range of threats. Ryffel et al. [20] proposed a practical framework combining admissibility training and functional encryption to perform partial encryption and privacy protection prediction, significantly improving the security of private data without compromising model accuracy. Liu et al. [21] applied attribute-based encryption technology to federated learning, realizing fine-grained data sharing on the premise of privacy protection. By seamlessly integrating federation learning into mobile crowdsensing, Zhao et al. [22] proposed CROWDFL, a privacy-preserving MCS system, and designed a secure aggregation algorithm. The system protects the privacy of participants and fully exploits the computing power of participants.


## 2.3. Secret Sharing

Secret sharing is an important method to realize information security and data privacy and also an important research direction in cryptography. Shamir [23] and Blakley [24] proposed t,n threshold secret sharing scheme based on Lagrange interpolation and linear projective geometry, respectively, in 1979. The secret sharing scheme allows the user to divide a secret S into n shares, so that any set of shares greater than or equal to t can be used to reconstruct S, but any set of shares less than t provides no information about S. Subsequently, Xu and Xiao [25] proposed a t,n threshold multiple secret sharing scheme based on RSA digital signature. The security of the scheme depends on the security of RSA digital signature, that is, the difficulty of large number decomposition.In recent years, due to different application scenarios and increasing demands, researchers have proposed dynamic secret sharing schemes to reduce the occupancy of storage space and improve communication efficiency. Liu et al. [26] analyzed several multi-secret sharing schemes and proposed two improved verifiable multi-secret sharing schemes based on them. Yuan and Li [27] proposed a fully dynamic secret sharing scheme, which improves the performance of key management and distributed systems.


## 2.4. Cryptosystem Based on Elliptic Curve

Elliptic curves have been studied for many years in algebra and geometry, and there are rich and profound theoretical studies available in the literature. Elliptic curve cryptosystems, namely, various public key cryptosystems based on the elliptic curve discrete logarithm problem, were first proposed independently by Miller [28] and Koblitz [29] in 1985, which made a major breakthrough in the research of public key cryptosystems. This is the elliptic curve cryptosystem (ECC). Compared with the traditional public key system, ECC has higher security, smaller space, lower bandwidth requirements, and better flexibility.Johnson et al. [30] proposed the elliptic curve digital signature (ECDSA) algorithm based on ECC in 2001, and Brown [31] provided the proof of the unforgeability of the ECDSA scheme in 2005. Xiao et al. [32] designed a relatively efficient scheme based on ECDSA but did not provide formal security proof. Based on the scheme proposed by Xiao et al., Qiu et al. [33] extended the mutual signature protocol to multiple parties and realized a special type of group signature scheme.


## 3. Preliminaries

### 3.1. Homogeneous Linear Recursion

In this section, we briefly introduce homogeneous linear recursion, whose detailed description can be found in Discrete Mathematics [34].Definition 1.
Lett be a positive integer and c1,c2,…,ct,a1,a2,…,at be real numbers. Define t degree homogeneous linear recursion using the following equation:(1)HLRu0=c1,u1=c2,…,ut−1=ctui+t+a1ui+t−1+…+atui=0i≥0,where c1,c2,…,ct,a1,a2,…,at are constants.Definition 2.
We define HLR auxiliary equation for(2)xt+a1xt−1+…+at=0.
When we calculate in the complex fieldC, we can assume that the auxiliary equation has t roots. However, t roots do not have to be distinct. We assume that the distinct values are α1,α2,…,αl and the degrees are m1,m2,…,ml, respectively. In other words, the auxiliary equation can be represented as(3)x−α1m1x−α2m2⋯x−αlml=0,where m1+m2+…+ml=t.Lemma 1.
Assume that sequenceui is defined by HLR; auxiliary equation has roots α1,α2,…,αl with degree m1+m2+…+ml=t.(4)ui=p1iα1i+p2iα2i+…+pliαli,where j=1,2,…,l and pji is a polynomial function of i with degree at most mj−1.


### 3.2. Diffie–Hellman Problem

Let the cyclic additive groupG=<g>, where g is the generator, and the order of G is a prime number q. Discrete logarithm problem (DLP): given g,ga,∀a∈Zq, compute the value of a. Computational Diffie–Hellman problem (CDHP): given g,ga,gb,∀a,b∈Zq, we compute the value of gab. Decision Diffie–Hellman problem (DDHP):given g,ga,gb,gc,∀a,b,c∈Zq, we decide whether gab=gc.


### 3.3. Two-Parameter One-Way Function

Givenr and w, the function fr,w denotes a two-parameter one-way function, which is easy to be computed. However, it is difficult to be computed in the following case:(1)
Givenw and fr,w, it is difficult to compute r. Similarly, given r and fr,w, it is difficult to compute w.(2)
Without knowingw, it is difficult to compute fr,w by taking any r.(3)
Givenw, it is difficult to find two different values r1, r2, such that fr1,w=fr2,w.


## 3.1. Homogeneous Linear Recursion

In this section, we briefly introduce homogeneous linear recursion, whose detailed description can be found in Discrete Mathematics [34].Definition 1.
Lett be a positive integer and c1,c2,…,ct,a1,a2,…,at be real numbers. Define t degree homogeneous linear recursion using the following equation:(1)HLRu0=c1,u1=c2,…,ut−1=ctui+t+a1ui+t−1+…+atui=0i≥0,where c1,c2,…,ct,a1,a2,…,at are constants.Definition 2.
We define HLR auxiliary equation for(2)xt+a1xt−1+…+at=0.
When we calculate in the complex fieldC, we can assume that the auxiliary equation has t roots. However, t roots do not have to be distinct. We assume that the distinct values are α1,α2,…,αl and the degrees are m1,m2,…,ml, respectively. In other words, the auxiliary equation can be represented as(3)x−α1m1x−α2m2⋯x−αlml=0,where m1+m2+…+ml=t.Lemma 1.
Assume that sequenceui is defined by HLR; auxiliary equation has roots α1,α2,…,αl with degree m1+m2+…+ml=t.(4)ui=p1iα1i+p2iα2i+…+pliαli,where j=1,2,…,l and pji is a polynomial function of i with degree at most mj−1.


## 3.2. Diffie–Hellman Problem

Let the cyclic additive groupG=<g>, where g is the generator, and the order of G is a prime number q. Discrete logarithm problem (DLP): given g,ga,∀a∈Zq, compute the value of a. Computational Diffie–Hellman problem (CDHP): given g,ga,gb,∀a,b∈Zq, we compute the value of gab. Decision Diffie–Hellman problem (DDHP):given g,ga,gb,gc,∀a,b,c∈Zq, we decide whether gab=gc.


## 3.3. Two-Parameter One-Way Function

Givenr and w, the function fr,w denotes a two-parameter one-way function, which is easy to be computed. However, it is difficult to be computed in the following case:(1)
Givenw and fr,w, it is difficult to compute r. Similarly, given r and fr,w, it is difficult to compute w.(2)
Without knowingw, it is difficult to compute fr,w by taking any r.(3)
Givenw, it is difficult to find two different values r1, r2, such that fr1,w=fr2,w.


## 4. System Structure and Scheme Overview

As shown in Figure1, in order to improve privacy security and efficiency, the scheme is designed as a three-tier architecture, which is divided into user layer, server layer, and cloud server layer. At the user layer, healthcare devices deployed in the IoT in the user’s home environment collect user health data for local training and upload the local model parameters to the server to which the device belongs. At the server layer, the server will collect the local model parameters of its deployed IoT devices and then perform global aggregation to get the optimal parameters and return them to users. At the cloud server layer, servers with good reputation, high level, and high-quality model parameters are encouraged to upload the encrypted model parameters and aggregate them again through the blockchain incentive mechanism and finally return the optimal parameters to the server.Figure 1
System architecture.Between users and servers, we propose a federated learning scheme based on full dynamic secret sharing, which runs between one server andn users. The entire federated learning scheme consists of multiple epochs. The first epoch has six rounds, including three rounds of initialization and three rounds of operation. After the completion of the first epoch, subsequent epochs do not need to be initialized again, and only three rounds of operation are required. In other words, the process of the federated learning scheme is to run an epoch with three rounds of initialization and three rounds of operations once and then repeat the epoch with three rounds of operations. In the three initialization rounds, each user generates a reusable subkey. In the next three operation rounds, the server gets the correct user data as long as at least t users survive to the end.


## 5. Federated Learning Based on Full Dynamic Secret Sharing

As mentioned above, in federated learning, the user submits local model parameters to the server, and the server performs global aggregation and returns the optimal parameters to the user. However, there are three problems to consider in this process. First, the user’s local model parameters need to be protected because Chai et al. [18] have shown that only the user’s local model parameters can recover some sensitive user information. Second, in the federated learning process, the secret sharing operation will occupy a large amount of time in each complete data aggregation. Third, in real-world scenarios, user disconnection is very common and cannot be ignored. In this section, we present a scheme that we can use to solve these problems.As in our scheme, we divide the parties into two classes: a single serverS that aggregates inputs from n users. Each user holds a private parameter xu. The goal of the protocol is to compute ∑x∈Uxu in a secure fashion. In other words, we guarantee that the server only knows a sum of the users’ inputs containing contributions and that the users know nothing.To simplify the presentation, we assume that each useru is assigned a unique logical identity as an integer between 1 and n, so that no two honest and curious users can share the same index. Meanwhile, we use u to denote the current user and v to denote the remaining users in our scheme.When we say that the server “collects messages from at leastt users,” we mean that the server receives messages from all users who were not disconnected in that round. If the amount of user information received is less than t, the execution of the epoch in the schema is aborted. In our actual tests, we set the wait time for the server, and if the wait time is exceeded and not enough messages are collected, the round of epoch will be terminated.In Figure2, we briefly describe the flow of our scheme.Figure 2
A brief view of the scheme.The following is a detailed description of federated learning based on full dynamic secret sharing:(i)
Initialization phase round 0:Server:(a)
The server constructor function(5)fx=α+β1x+β2x2+…+βt−1xt−1,computesαi=fimodp, where p is a large prime number and α,β1,…,βt−1∈Zp∗.(b)
Generategs based on ECC, and then generate public and private key pairs si∈Zλ,Pi=sigs for each user ui signature.(c)
The server transmitsαi,si to the user over the secure channel and broadcasts gs,Pi.(ii)
Initialization phase round 1:Useru:(a)
The constructor(6)x−ϕt=xt+δ1xt−1+δ2xt−2+⋯+δt=0,whereδ1…δt is a constant, ϕ>0.(b)
Pick a large prime numberε>δt,1≤i≤t.(c)
Generategu based on ECC, where the parameter of ECC is μ.(d)
Sendμ,gu,ϕ,ε to the server.Server:(a)
Collect messages from at leastt users from the previous round, otherwise abort.(b)
Broadcast to all users theμ,gu,ϕ,ε and move to next round.(iii)
Initialization phase round 2:Useru:(a)
The user selectssu,v∈Zμ∗ and computes(7)Qu,v=su,vgv.(b)
SendQu,v to the server.Server:(a)
CollectQu,v from at least t users from the previous round, otherwise abort.(b)
Generateg based on ECC, where the parameter of ECC is ι. After the first epoch, the server generates and broadcasts both ι and g when broadcasting the global parameters.(c)
Broadcasts to all users theQu,v,ι,g.(iv)
Run phase round 0:Useru:(a)
The user selects selectsu′∈Zι∗ and computes(8)Ru=su′g.(b)
The user selects the integerr, su∈Zμ∗ and computes(9)Wu,v=suQv,u=susv,ugu,Iu,v=fr,Wu,v,where1≤v≤n, f is a two-parameter one-way function.(c)
Calculate(10)m0=Iu,1,m1=Iu,2,…,mt−1=Iu,t−1mi+t+δ1mi+t−1+⋯+δtmi=0modεi≥0.(d)
Computemv, where t≤v≤n−1.(e)
Compute(11)yv=Iu,v−mv−1,wheret<v≤n.(f)
Compute(12)T=su′−mn−1.(g)
Similarly, the integerr′ can be used to calculate Iu,v′, yv′ and T′=bu−mn−1′, where bu is the mask generated by the user using a pseudorandom generator.(h)
SendRu,yv,yv′,r,r′,T,T′ to the server.Server:(a)
CollectRu,yv,yv′,r,r′,T,T′ from at least t users from the previous round (denote with U0 this set of users), otherwise abort.(b)
Send to each userRu,yv,yv′,r,r′,T,T′ and move to the next round.(v)
Run phase round 1:Useru:(a)
ReceiveRv broadcast by the server.(b)
Calculate(13)zu,v=su′Rv,ρ=xu+∆u,vzu,v+bu,where∆u,v=1,u>v,∆u,v=−1,u<v.(c)
Compute(14)k=ηsi+θ,kgs=x1,y1,φ=x1modλ.(d)
Compute(15)e=HG,whereH is hash function and G is the global model parameter of the last epoch. In the first epoch, G is the server initialization parameter.(e)
Calculate(16)f=θ+sieφmodλ,HFσiαi,whereσi=∏j=1,j≠it−j∏j=1,j≠iti−j,(f)
SendGHFσiαif,η,φρ to the server.Server:(a)
Collect messages from at leastt users from the previous round (denote with U1 this set of users), otherwise abort.(b)
Receive and verify(17)∏i=1tGHFσiαi=GHF∑i=1tσiαi=GHFα.(c)
If the authentication fails, authenticate a single user.(d)
Calculatee=HG,(18)fgs+η−eφPi=x2,y2,ψ=x2modλ.(e)
Verifyφ=?ψ. If all users are successfully verified, calculate ∑uρ,u∈U1.(f)
The server broadcasts dropped users listU0/U1.(vi)
Run phase round 2:Useru:(a)
Calculate(19)mv−1=Iu,v,1≤v≤t,Iu,v−yv,1≤v≤t,for the dropped user.(b)
Sendmv−1 to the server.Server:(a)
Collect responses from at leastt users (denote with U2 this set of users).(b)
Receivemv−1 uploaded by the user.(c)
Construct thet−1 degree polynomial px from i−1,mv−1/ϕv−1.(d)
Calculate(20)px=∑i∈U0/U1mv−1ϕv−1∏j∈U0/U1j≠ix−j+1i−jmodε.(e)
Compute(21)mi=piϕi,to findmv−1 for the dropped user.(f)
Compute(22)su′=T+mv−1,and then compute(23)bu=T′+mv−1′,online.(g)
The maskzv,u of the dropped user can be obtained by using Rv.(h)
Finally calculate and output(24)∑u∈U1xu=∑u∈U1ρ−∑u∈U1bu+∑u∈U1,v∈U0/U1zv,u.We consider the operation of adding or removing users as an additional phase of the proposed scheme. This additional phase is run at the end of each epoch if users need to be added or removed. It is important to note that the number of users added or removed that we are talking about here is small and does not have an impact on the thresholdt. If the server needs to add or remove a large number of users, it simply starts a new federated learning scheme once.To add a user, we perform the following operations: the server assignsαi=fimodp and si,Pi to the new user and broadcasts the public key Pi. The new user constructs the secret sharing auxiliary function and broadcasts the parameters to other users through the server. Meanwhile, the server sends the public parameters of other users to the new user. The new user generates su,v based on the parameters of other users and sends Qu,v to the server. The server broadcasts the public key Qu,v of the new user to other users.To delete a user, we perform the following operations: the server deletesαi and si for this user. The remaining clients delete Pi, Qu,v, and the arguments of auxiliary function of the corresponding user.


## 6. Security Analysis

### 6.1. Honest but Curious Security

In this section, we analyze the attacks that exist in the proposed scheme. At the same time, we assume that no matter how the parties suspend, our agreement is conducted in an honest but curious setting. We assume that both the server and the user are honest but curious. The adversaries mentioned in this section are all honest but curious users who try to obtain the original data by analyzing the public parameters.


#### 6.1.1. Attack: Adversary Trying to ObtainW from Q

Except for the user who acts as the secret distributor, the subkeys of other users are generated by themselves, and the distributor cannot deceive other users. In this section, we will do some analysis of possible attacks. We believe that directly breaking the encryption used in public verifiable secret sharing (PVSS) schemes means breaking the CDHP problem. Therefore, we have the following lemma.Lemma 2.
Encryption used in PVSS schemes is secure if and only if the CDHP problem holds.Proof.
Assuming that shared encryption is insecure, there exists an algorithmA. Input two random elements ag,bg∈G and algorithm A outputs abg∈G with a non-negligible probability of success ε. Now we show that the opponent should break the CDHP problem with the same non-negligible probability of success ε. The opponent selects W0=s0Q,W1=s1Q from group G, inputs two parameters W0=s0Q,W1=s1Q into algorithm A, and runs algorithm A. The opponent then outputs Z with a non-negligible probability of success of ε. Since algorithm A can break the shared encryption, we can get Z=Wi=sis0g. From the steps of the experiment, we can confirm that the opponent breaks the CDHP. But CDHP is difficult to use in group G.
Therefore, shared encryption is secure.


#### 6.1.2. Attack: Users Less than the Threshold Cooperate to Obtain Shared Secrets

Lemma 3.
If the Diffie–Hellman problem holds, thent−1 users pool their share. But they do not have access to shared secrets.Proof.
The recovery stage of the scheme is based on using Lagrange interpolation polynomials:(25)px=∑i∈U0/U1mv−1ϕv−1∏j∈U0/U1j≠ix−j+1i−jmodε.
By countingmi=piϕi⟶pi, where px is t−1, the number of pairs is less than t. Therefore, users less than the threshold cannot determine the t−1 degree polynomial of px, nor can they obtain any information about the shared secret.


### 6.2. Privacy against Active Adversaries

In this section, we discuss the security of active adversaries. The active adversary is to break the protocol, send incorrect or forged messages to other honest users, and abort or omit messages. We assume that the server is still honest but curious. However, some malicious users try to obtain private data actively. At the same time, there are some strange users who try to upload incorrect or forged data to the server. We refer to these two classes of users as active adversaries.


#### 6.2.1. Attack: Adversary or Malicious Participants Trying to Obtains from Q

Proof.
If the active adversary can gets, then we can say that the scheme is no longer safe. There are two ways an active opponent can get s. The first method is to extract s from Q, but it is difficult to calculate the discrete logarithm problem of elliptic curve (ECDLP) in group G. Therefore, it is impossible to extract s from Q when an active adversary uses this method. Therefore, the active opponent may use the second method to attack our scheme. The second approach is to use the properties of bilinear mapping to reduce the ECDLP problem to DLP problem. The active opponent gets esg,g=eg,gs,0≤i≤n. Since it is also difficult to calculate DLP in group G, the second method still does not pose a threat to the security of our scheme.


#### 6.2.2. Attack: A Non-System Deployed Active Adversary Attempts to Upload Incorrect or Forged Parameter Data

Proof.
In most cases, once the random numbers are the same, a second-order linear equation set can be constructed to solve the user’s private key, resulting in the disclosure of the private key. Therefore, when different messages are signed using the same signature scheme, different random numbers are used. If our scheme uses the same random number to sign different messages, then according to equation set(26)f1=θ+se1φ1modλ,f2=θ+se2φ2modλ,where f,e,φ are known and θ,s are unknown, the expression of the private key can be obtained as(27)s=φ2−φ1−1e2−e1−1s2−s1−1modn.
If the random number of each signature is different, it is impossible to break our scheme through the above attack method. Assumingθ is random, the system becomes(28)f1=θ1+se1φ1modλ,f2=θ2+se2φ2modλ,and the unknown are θ1,θ2,s. The number of unknowns has changed from two to three, and according to the existing algebraic knowledge, it is impossible to find the private key. According to the ECDLP problem, given equations(29)α1−e1φ1Q˜+k1G=x21,y21,α2−e2φ2Q˜+k2G=x22,y22,Q˜ cannot be obtained. Therefore, when the random numbers are different, our scheme can prevent key disclosure, and non-system deployed active adversary trying to upload incorrect or forged parameter data will be identified and rejected, ensuring the security of the scheme.


## 6.1. Honest but Curious Security

In this section, we analyze the attacks that exist in the proposed scheme. At the same time, we assume that no matter how the parties suspend, our agreement is conducted in an honest but curious setting. We assume that both the server and the user are honest but curious. The adversaries mentioned in this section are all honest but curious users who try to obtain the original data by analyzing the public parameters.


### 6.1.1. Attack: Adversary Trying to ObtainW from Q

Except for the user who acts as the secret distributor, the subkeys of other users are generated by themselves, and the distributor cannot deceive other users. In this section, we will do some analysis of possible attacks. We believe that directly breaking the encryption used in public verifiable secret sharing (PVSS) schemes means breaking the CDHP problem. Therefore, we have the following lemma.Lemma 2.
Encryption used in PVSS schemes is secure if and only if the CDHP problem holds.Proof.
Assuming that shared encryption is insecure, there exists an algorithmA. Input two random elements ag,bg∈G and algorithm A outputs abg∈G with a non-negligible probability of success ε. Now we show that the opponent should break the CDHP problem with the same non-negligible probability of success ε. The opponent selects W0=s0Q,W1=s1Q from group G, inputs two parameters W0=s0Q,W1=s1Q into algorithm A, and runs algorithm A. The opponent then outputs Z with a non-negligible probability of success of ε. Since algorithm A can break the shared encryption, we can get Z=Wi=sis0g. From the steps of the experiment, we can confirm that the opponent breaks the CDHP. But CDHP is difficult to use in group G.
Therefore, shared encryption is secure.


### 6.1.2. Attack: Users Less than the Threshold Cooperate to Obtain Shared Secrets

Lemma 3.
If the Diffie–Hellman problem holds, thent−1 users pool their share. But they do not have access to shared secrets.Proof.
The recovery stage of the scheme is based on using Lagrange interpolation polynomials:(25)px=∑i∈U0/U1mv−1ϕv−1∏j∈U0/U1j≠ix−j+1i−jmodε.
By countingmi=piϕi⟶pi, where px is t−1, the number of pairs is less than t. Therefore, users less than the threshold cannot determine the t−1 degree polynomial of px, nor can they obtain any information about the shared secret.


## 6.1.1. Attack: Adversary Trying to ObtainW from Q

Except for the user who acts as the secret distributor, the subkeys of other users are generated by themselves, and the distributor cannot deceive other users. In this section, we will do some analysis of possible attacks. We believe that directly breaking the encryption used in public verifiable secret sharing (PVSS) schemes means breaking the CDHP problem. Therefore, we have the following lemma.Lemma 2.
Encryption used in PVSS schemes is secure if and only if the CDHP problem holds.Proof.
Assuming that shared encryption is insecure, there exists an algorithmA. Input two random elements ag,bg∈G and algorithm A outputs abg∈G with a non-negligible probability of success ε. Now we show that the opponent should break the CDHP problem with the same non-negligible probability of success ε. The opponent selects W0=s0Q,W1=s1Q from group G, inputs two parameters W0=s0Q,W1=s1Q into algorithm A, and runs algorithm A. The opponent then outputs Z with a non-negligible probability of success of ε. Since algorithm A can break the shared encryption, we can get Z=Wi=sis0g. From the steps of the experiment, we can confirm that the opponent breaks the CDHP. But CDHP is difficult to use in group G.
Therefore, shared encryption is secure.


## 6.1.2. Attack: Users Less than the Threshold Cooperate to Obtain Shared Secrets

Lemma 3.
If the Diffie–Hellman problem holds, thent−1 users pool their share. But they do not have access to shared secrets.Proof.
The recovery stage of the scheme is based on using Lagrange interpolation polynomials:(25)px=∑i∈U0/U1mv−1ϕv−1∏j∈U0/U1j≠ix−j+1i−jmodε.
By countingmi=piϕi⟶pi, where px is t−1, the number of pairs is less than t. Therefore, users less than the threshold cannot determine the t−1 degree polynomial of px, nor can they obtain any information about the shared secret.


## 6.2. Privacy against Active Adversaries

In this section, we discuss the security of active adversaries. The active adversary is to break the protocol, send incorrect or forged messages to other honest users, and abort or omit messages. We assume that the server is still honest but curious. However, some malicious users try to obtain private data actively. At the same time, there are some strange users who try to upload incorrect or forged data to the server. We refer to these two classes of users as active adversaries.


### 6.2.1. Attack: Adversary or Malicious Participants Trying to Obtains from Q

Proof.
If the active adversary can gets, then we can say that the scheme is no longer safe. There are two ways an active opponent can get s. The first method is to extract s from Q, but it is difficult to calculate the discrete logarithm problem of elliptic curve (ECDLP) in group G. Therefore, it is impossible to extract s from Q when an active adversary uses this method. Therefore, the active opponent may use the second method to attack our scheme. The second approach is to use the properties of bilinear mapping to reduce the ECDLP problem to DLP problem. The active opponent gets esg,g=eg,gs,0≤i≤n. Since it is also difficult to calculate DLP in group G, the second method still does not pose a threat to the security of our scheme.


### 6.2.2. Attack: A Non-System Deployed Active Adversary Attempts to Upload Incorrect or Forged Parameter Data

Proof.
In most cases, once the random numbers are the same, a second-order linear equation set can be constructed to solve the user’s private key, resulting in the disclosure of the private key. Therefore, when different messages are signed using the same signature scheme, different random numbers are used. If our scheme uses the same random number to sign different messages, then according to equation set(26)f1=θ+se1φ1modλ,f2=θ+se2φ2modλ,where f,e,φ are known and θ,s are unknown, the expression of the private key can be obtained as(27)s=φ2−φ1−1e2−e1−1s2−s1−1modn.
If the random number of each signature is different, it is impossible to break our scheme through the above attack method. Assumingθ is random, the system becomes(28)f1=θ1+se1φ1modλ,f2=θ2+se2φ2modλ,and the unknown are θ1,θ2,s. The number of unknowns has changed from two to three, and according to the existing algebraic knowledge, it is impossible to find the private key. According to the ECDLP problem, given equations(29)α1−e1φ1Q˜+k1G=x21,y21,α2−e2φ2Q˜+k2G=x22,y22,Q˜ cannot be obtained. Therefore, when the random numbers are different, our scheme can prevent key disclosure, and non-system deployed active adversary trying to upload incorrect or forged parameter data will be identified and rejected, ensuring the security of the scheme.


## 6.2.1. Attack: Adversary or Malicious Participants Trying to Obtains from Q

Proof.
If the active adversary can gets, then we can say that the scheme is no longer safe. There are two ways an active opponent can get s. The first method is to extract s from Q, but it is difficult to calculate the discrete logarithm problem of elliptic curve (ECDLP) in group G. Therefore, it is impossible to extract s from Q when an active adversary uses this method. Therefore, the active opponent may use the second method to attack our scheme. The second approach is to use the properties of bilinear mapping to reduce the ECDLP problem to DLP problem. The active opponent gets esg,g=eg,gs,0≤i≤n. Since it is also difficult to calculate DLP in group G, the second method still does not pose a threat to the security of our scheme.


## 6.2.2. Attack: A Non-System Deployed Active Adversary Attempts to Upload Incorrect or Forged Parameter Data

Proof.
In most cases, once the random numbers are the same, a second-order linear equation set can be constructed to solve the user’s private key, resulting in the disclosure of the private key. Therefore, when different messages are signed using the same signature scheme, different random numbers are used. If our scheme uses the same random number to sign different messages, then according to equation set(26)f1=θ+se1φ1modλ,f2=θ+se2φ2modλ,where f,e,φ are known and θ,s are unknown, the expression of the private key can be obtained as(27)s=φ2−φ1−1e2−e1−1s2−s1−1modn.
If the random number of each signature is different, it is impossible to break our scheme through the above attack method. Assumingθ is random, the system becomes(28)f1=θ1+se1φ1modλ,f2=θ2+se2φ2modλ,and the unknown are θ1,θ2,s. The number of unknowns has changed from two to three, and according to the existing algebraic knowledge, it is impossible to find the private key. According to the ECDLP problem, given equations(29)α1−e1φ1Q˜+k1G=x21,y21,α2−e2φ2Q˜+k2G=x22,y22,Q˜ cannot be obtained. Therefore, when the random numbers are different, our scheme can prevent key disclosure, and non-system deployed active adversary trying to upload incorrect or forged parameter data will be identified and rejected, ensuring the security of the scheme.


## 7. Evaluation

In Table1, we compare the work in our scheme with the work in the existing literature. We chose Bonawitz et al.’s scheme [5] and Xu et al.’s scheme [7] to compare the work with our scheme. As can be seen from the table, our scheme optimizes the existing schemes. We conducted simulation tests on Bonawitz et al.’s scheme Secagg [5] and our scheme EfficiencySecagg. All the calculations below assume one server and n users. We evaluated the scenario based on the honest but curious version, ignoring the cost of all signatures. We note that the costs of including them do not change any asymptotics but only slightly increase the computation and communication costs. In addition, we assume that when users exit, they have already sent their share to all other users, but they have not yet sent the mask to the server. This is actually a worst-case user drop because all the other users already contain the mask of the dropped user, and the server must perform an expensive recovery calculation to remove the mask, or it will have an indelible impact on the calculation results.Table 1
Comparison with existing schemes.
Secagg [5]VerifyNet [7]EfficiencySecaggConfidentiality of users’ local parameter√√√Privacy protection for dropped users√√√Prevent collusion between users√√√Resist the interference of non-system users√×√Fully dynamic secret sharing××√Add or remove users dynamically××√Our simulation environment is Intel (R) Core (TM) 17-12700H CPU@2.30 GHz, 16G memory, and Windows 11 64-bit operating system. The programming language we use is Python.Figures3 and 4 show the test results assuming no user drops. In Figure 3, we only compare the running time of one epoch for the two schemes, where the EfficiencySecagg scheme’s epoch does not include initialization. It can be seen that the running time increases as the number of users increases. The figure shows that the EfficiencySecagg scheme always has less time overhead than the Secagg scheme. At the same time, as the number of users increases, the advantages of the EfficiencySecagg scheme become more obvious. In Figure 4, we test the complete scheme including different number of epochs by simulation. Meanwhile, in the simulation test in Figure 4, the number of users is fixed to 30 for both schemes. It is worth mentioning that what we mean by a complete scheme is one epoch with an initialization phase and multiple epochs without an initialization phase. It can be seen that with the increase of the number of epochs, the EfficiencySecagg scheme has more and more obvious efficiency advantages over Secagg scheme.Figure 3
Only running time overhead when no user is dropped.Figure 4
Total running time overhead when no user is dropped.In Figures5–7, we again only compare the two schemes for one epoch, where the EfficiencySecagg scheme does not include initialization. However, there are different number of user drops in Figures 5–7, respectively. It is obvious that the different number of user drops does not have a very noticeable impact on the Secagg scheme and has some impact on the EfficiencySecagg scheme. However, the EfficiencySecagg scheme is still more efficient than Secagg scheme. Figure 8 illustrates this comparison more intuitively. The simulation test environment in Figure 8 is based on the environment in Figure 4 with 30% user drops added. We can see that the EfficiencySecagg scheme is still better than the Secagg scheme.Figure 5
Only running time overhead when 10% of users are dropped.Figure 6
Only running time overhead when 20% of users are dropped.Figure 7
Only running time overhead when 30% of users are dropped.Figure 8
Total running time overhead when 30% of users are dropped.It can be seen from the above simulation test results that the efficiency of our EfficiencySecagg scheme is always higher than that of Secagg scheme under different conditions.


## 8. Conclusion

We propose a federated learning scheme based on fully dynamic secret sharing in smart healthcare systems. The scheme assigns reusable subkeys to users in the initialization phase and uses the full dynamic secret sharing method in the running phase, which can reduce the time overhead and improve the efficiency of federated learning. In addition, the user authentication method based on elliptic curve cryptosystem was used to ensure that the communication between the user and the server in the public network would not be interfered. Compared with the existing federated learning schemes, our scheme can not only reduce the time cost and improve the efficiency but also dynamically add or delete users, making it easier to be compatible with various scenarios in the real world. Security analysis shows that the scheme is secure in the case of honest but curious and active adversaries. Simulation results also demonstrate the practicability of the proposed scheme.



---

*Source: 8017489-2023-02-27.xml*