The ideal medical data management scheme should meet the following basic requirements, namely security and privacy protection [11], data access [12], access control and unified standards [13]. Therefore, the scheme proposed in this paper should meet the following requirements.

Security and privacy protection: no one may illegally use medical data. The program should be able to ensure that the data resists illegal attacks.

The powerful, robust, flexible and secure functions of FL data cognition is helpful to solve the problem of the reliability, security, privacy protection of CB data management and optimize the storage data cost of blockchain data sharing.

Providing a trusted mechanism for all participants of FL through blockchain. The parameters of the FL model can be stored in the blockchain to ensure its security and reliability. FL has the characteristics of distributed intelligence and data privacy protection. It combines with the CB to complement each other’s advantages and improve the overall security of the system.

Some researchers use blockchain as a secure distributed ledger, which provides a potential solution for cross system management of medical information. Li et al. [14] constructed a privacy data storage protocol based on elliptic curve using ring signature to ensure data security and user identity privacy in blockchain applications. Omar et al. [15] proposed a patient-centered medical data management system medical chain, which realized privacy protection based on blockchain. Liu et al. [16] proposed a privacy protection electronic medical records management scheme based on blockchain. The original data is stored in the cloud environment, and the data index is retained in the CB to reduce the risk of disclosure [17]. However, the above scheme is not suitable for the confidentiality and constantly updated data requirements in our system.

In the process of FL model training, the user’s local data information may still be deduced from the updated model parameters by reasoning attack, and may also be subject to poisoning attack, and attack of GAN and other types of attacks. At the same time, FL does not detect and verify the participants. Malicious participants may attack and destroy the FL training process by providing false model parameters, resulting in training failure. Therefore, the privacy protection ability of important data in FL is insufficient.

In the medical network community, data security is the premise of medical big data management. FL’s common privacy protection technologies, such as secure multi-party computing and differential privacy, are not enough to ensure data security [18,19]. At the same time, if privacy data was leaked, it would cause serious harm to patients. However, the development trend of medical big data is sharing and opening. Therefore, we should strengthen the ability of privacy protection in FL on the premise of ensuring the effective sharing of training data among participants, so as to give full play to the value of data management.

In order to make up for the lack of privacy protection of important data in FL, a zero-knowledge proof scheme suitable for lightweight devices is constructed to realize medical data management. In NIZK scheme, CCA anonymous dynamic group signature mechanism [20] is more secure and efficient in computing and communication cost. The signature mechanism can be used in the CB to provide unlinkability and anonymity, so as to improve the ability of data management and privacy protection in the medical CB. At the same time, in order to consider the security of private data, a smart contract system for the safe sharing of medical data is constructed based on the KH-PKE scheme to realize that the medical data hidden and stored in medical institutions and research institutions are stored on the CB for automatic data sharing operation to meet the needs of more High privacy requirements.

Consortium Blockchain network: as a part of the blockchain [21], the CB has more advantages in efficiency and flexibility than the public blockchain, and can provide better privacy protection. It uses the distributed and tamper proof characteristics of blockchain to realize the secure storage and sharing of medical and health data and reduce the management cost. as shown in Fig. 1.

Federated learning network: providing a trusted mechanism for all participants of federated learning through CB. On an artificial neural network predictive model (ANN) [22], use weight parameters and biases to train medical data and upload the trained data to a smart contract for data sharing. Keeping medical data on the blockchain throughout the data sharing environment. At the same time, the global model is stored and shared using the blockchain, thus avoiding a potential single point of failure on a central server.

Entity: including research institutions and medical institutions. The mechanism of KH-PKE scheme is used to directly store ciphertext and perform some calculations on the FL and blockchain. There is no need to make any change to the FL and CB itself, so as to provide confidentiality and privacy protection in the process of data management between research institutions and medical institutions.

NIZK parameters have certifier A and verifier B. Suppose the plaintext space is(0,2L), where L=u×l. First introduce the CCA anonymous dynamic group signature mechanism, and set the algorithms Setup and Partylnitial respectively:

Setup. Generate a bilinear group [25] (p,G,GT,e,g)←Gbp(1n). Randomly select h←$ G. From Zp∗ randomly select γ,α1,α2, calculate Ω=gγ,g1=gα1,g2=gα2. Set gT=e(g,g), where g→1=(g1,1,g)∈G3, g→2=(1,g2,g)∈G3 and g→3=(g3,1,g3,2,g3,3)∈g→1∘g→2∈G3, where ξ1,ξ2∈RZn∗; select (u1,u2,w)∈G3, a hash function H:{0,1}∗→{0,1}n, then{cpk,ik,ok}:=n,G,GT,e,h,g,g1,g2,g→1,g→2,g→3,Ω,u1,u2,w,H,γ,(α1,α2).

That is, Setup(1n)→(cpk,ik,ok). Where gpk is the group signature public key, ik and okare the issuer’s and initiator’s keys respectively, and gpk is the group signature public key, ik and ok are the issuer’s and initiator’s keys respectively.

Run (gsk=x,gvk=gx) to generate group M membership certificate K1 and K2. If K1,Ω,K2=e(g,h)e(g,gpk), group signature private key csk:=(gsk,gpk,K1,K2). Message m signature value θ4=g1/(x+H(m)), where x is its private key gsk;ri,si,ti∈Zp∗ where i=1,⋯,4. At the same time, calculate the commitment values c→i=ι(θi)∘g→1ri∘g→2si∘g→3ti and π→1,π→2. Select z1,z2∈RZp∗, using CCApublic key encryption algorithm to encrypt θ1. Each equation has NIZK ϕ, expressed by ϕ→1,ϕ→2, ϕ→3 separately. At the same time, calculate the commitment value d→1,d→2,d→3 of (r¯,s¯,t¯). Finally, the hash value H~ is calculated and the encrypted value v1,v2 is generated. Thus, we can get the group signature value:

(2)σ=(c→1,c→2,c→3,c→4,d→1,d→2,d→3,e1,e2,e3,π→1,π→2,ϕ→1,ϕ→2,ϕ→3,ϑ,v1,v2)

That is GSig(gpk,gsk[i],m)→σ.

Therefore, the integer signature value (σ0,σ1,⋯,σ2u−1) between 0 and 2u−1 can be obtained in the above way and the following bilinear mapping:

(3)T=(T0,T1,⋯,T2u−1)=(e(σ0,g),e(σ1,g),⋯,e(σ2u−1,g))

After receiving the group signature, the verifier returns gvk=GVf(cpk,m,σ). Finally, output the common parameterPP=(p,G,GT,e,g,h,gT,gvk,σ,T).

Partylnitial. For example, when the medical data tA of a medical institution needs to be shared with the data of a research institution, the system is triggered. First, we use the key homomorphism technique described in Definition 1 to initialize the patient data information to be shared:

According to the rules of sharing smart contract of medical data security, in the data sharing scenario, we explain how to construct a data sharing sentence x in which medical institutions send t patients’ data to research institutions. Firstly, the certifier obtains the ciphertext of tA, C~=(C~1,C~2,C~3)=(XA1y~1,XA2y~2,gy~1+y~2⋅htA), from the medical CB, and decrypts it to obtain tA. Using randomness y1,y2←$Zp, the prover encrypts the shared data t with its public key and the verifier:

(4)C=(C1,C2,C3)=(XA1y1,XA2y2,gy1+y2⋅ht);C^=(C^1,C^2,C^3=C3)=(XB1y1,XB2y2,gy1+y2⋅ht)

Assume that P and V are the prover and verifier, respectively. Fiat-Shamir heuristic [26] converts the Σ-protocol into NIZK parameters: After calculating a from P, the challenge c = H(a) is obtained. Among them, H is a random oracle. Finally, calculate z and send the proof (a,c,z) to V.

The proof language L defining the P is as follows:

The data sharing sentence x=(C,C^,gpkA,gpkB,C~)∈L and the corresponding verifier w=(gskA=(xA1,xA2),y1,y2,tA,t), and then

Ci=Xiyi,fori=1,2;

Proof generation by P.

Certifier A takes PP as the public input and generates the NIZK proof of the above statement using private input (gskA,y1,y2,tA,t), as follows:

Proof of formula (A-F) through Σ-protocols. Formula (E) can be proved by the value range in [27,28]. Randomly select samples r1,r2,l,k←$Zp. Calculate i∈{1,2}:Ri=XAiri;R^i=XBiri; For j∈[0,l), randomly select samples vj,vj′,sj,wj,qj,mj←$Zp, and then calculate:Vj=σtjvj,Vj′=σtj′vj′;D1=∏j=0l−1(h(2u)j⋅sj)⋅g1r1+r2;D2=∏j=0l−1(h(2u)j⋅wj)⋅C~1l⋅C~2k⋅g1−r1−r2;aj=Ttj−sj⋅vj⋅gTqj,aj′=Ttj′−wj⋅vj′⋅gTmj; Randomly select c^←$Zp,z^←$Zp, set α=gz^/hc^, and use α to represent (R1,R2,R^1,R^2,{Vj,Vj′}j=0l−1,D1,D2,{aj,aj′}j=0l−1,α). The challenge is obtained through calculation: c~=H(a);c=c~+c^; After that, the secure hash function instance H. Calculation (on modulus p):

(5)z1=r1−c⋅y1;z2=r2−c⋅y2;

(6)zvj=qj−c⋅vj;zvj′=mj−c⋅vj′;

(7)ztj=sj−c⋅sj;ztj′=wj−c⋅tj′;

(8)zl=l−cxA1;zk=k−cxA2;

Finally, A sends proof π=(a,c,z) to B, where z=(z1,z2,{zvj,zvj′}j=0l−1,{ztj,ztj′}j=0l−1,zl,zk,z^).

The verifier V calculates c after receiving the proof π. Using the public input PP,∀i=1,2;j∈[0,l), the verifier checks the following conditions:

(9)Ri=Cic⋅XAizi;

(10)R^i=C^ic⋅XBizi;

(11)D1=∏j=0l−1(h(2u)j⋅ztj)⋅C3c⋅gz1+z2;

(12)D2=∏j=0l−1(h(2u)j⋅ztj′)⋅(C~3C3)c⋅g1z1+z2;

(13)aj=e(Vj,gvk)c⋅e(Vj,g)−ztj′⋅gTzvj′;

(14)aj′=e(Vj′,gvk)c⋅e(Vj′,g)−ztj′⋅gTzvj′;

(15)gz^=α⋅hc^;

Theorem 1. Assuming DLIN, q-Strong Diffie-Hellman(q-SDH) assumptions, Σ-protocols is a NIZK demonstration with perfect completeness, perfect zero knowledge and computational reliability in oracle model. In addition, complete zero knowledge is established in the standard common random stringmodel.

Proof. The following describes our proof conclusion.

Perfect Completeness. This property can be directly verified.

Soundness. It is assumed that the CCA anonymous dynamic group signature based on q-SDH assumptions is unforgeable, and its reliability is proved under the random oracle model. If the PUSH-PULL traffic(PPT) certifierP∗ is an invalid sentence, generate the acceptance parameter π=(a,c,z), where a=(R1,R2,R^1,R^2,{Vj,Vj′}j=0l−1,D1,D2,{aj,aj′}j=0l−1,α) and z=(z1,z2,{zvj,zvj′}j=0l−1,{ztj,ztj′}j=0l−1,zl,zk,z^).

Then, construct the extractor Ext: P∗ back to return c = H(a). Modify the random oracle so that c' = H(a) and c ≠ c'. Use c' = H(a) to execute P∗. Finally, another valid parameter can appear:

(16)π′=(a,c′,z′=(z1′,z2′,{zvj′,zvj′′}j=0l−1,{ztj′,ztj′′}j=02,zl′,zk′,z^′)).

Verifier information can be extracted by calculation (for i=0,1;j∈[0,l)):

(17)yi=zi−zi′c′−c,tj=ztj−ztj′c′−c,tj′=ztj′−ztj′′c′−c,xA1=c′−czl−zl′,xA2=c′−cZk−zk′.

Under the condition of extracting the prover, if t∉[0,2L) or t′∉[0,2L), you can crack the CCA anonymous dynamic group signature weak selection message attack model with P∗ subroutine.

Perfect zero knowledge. Construct a simulated Sim to prove the proposition h=gw, thereby proving perfect zero-knowledge. See Fig. 3.

The parameters are divided into 3 parts:

(18)π=(a=(R1,R2,R^1,R^2,{Vj,Vj′}j=0l−1,D1,D2,{aj,aj′}j=0l−1,α),c,z=(z1,z2,{zvj,zvj′}j=0l−1,{ztj,ztj′}j=0l−1,zl,zk,z^)).

For clarity and convenience, we express the simulation parameters as

(19)π=(a=(R1,R2,R^1,R^2,{Vj,Vj′}j=0l−1,D1,D2,{aj,aj′}j=0l−1,α),c,z=(z1,z2,{zvj,zvj′}j=0l−1,{ztj,ztj′}j=0l−1,zl,zk,z^)).

c^←$Zp is observed to be independent of a, c=H(a)+c^ is uniformly distributed in Zp, and c is also randomly selected from Zp in the simulation. Therefore, the distribution {c} is the same as {c}:{c}≡{c}.

Set f={c}={c}. Under the condition of: {c}≡{c}, c¯∈f is given for each ρ∈Zp because z^,r1,r2,l,k,qj,mj,sj,wj,vj,vj′←$Zp, where j∈[0,l), and for any element z~ in z, we have

(20)Pr[z~=ρ|c=c¯]=1p

In the argument of simulation, under the same conditions, the given value z1,z2,zl,zk,zvj,zvj′,ztj,ztj′,μ←$Zp. For all elements z~ in z, we have

(21)Pr[z~=ρ|c=c¯]=1p.

The Fiat-Shamir heuristic algorithm is applied to the Σ-protocols to build NIZK, so as to achieve perfect zero-knowledge. At the same time, the reliability of the construction is proven in the model.

Set the set of J=z1,z2,{zj3,zj4}j=0l−1,{zj5,zj6}j=0l−1,z7,z8,z9:zi←$Zp,i∈[10]. Given c¯←$f, for each z¯∈J,

(22)Pr[z=z¯|c=c¯]=Pr[z=z¯|c=c¯].

Under the condition of Pr[z=z¯|c=c¯]=Pr[z=z¯|c=c¯], given c¯∈f,z¯∈J, from the verification strategy, message R1,R2,D1,D2,aj,aj′,αinπ is deterministic, where j∈[0,l). For {Vj,Vj′}, we have

(23)Pr[Vj=g|c=c¯,z=z¯]=Pr[σtjvj=g|c=c¯,z=z¯]=1p.

(24)Pr[Vj′=g|c=c¯,z=z¯]=Pr[σtj′vj′=g|c=c¯,z=z¯]=1p.where g←$G, start from vj, vj′←$Zp.

Set A={a1,a2,{aj3,aj4}j=0l−1,a5,a6,{aj7,aj8}j=0l−1,a9:a1,a2,a3,a4,a5,aj6,aj7,a9←$G,aj7,aj8←$GT}. Therefore, given c¯∈f,z¯∈J, for any a¯∈A,

(25)Pr[a=a¯|c=c¯,z=z¯]=Pr[a=a¯|c=c¯,z=z¯].

Combining (22) and (25), We conclude that for any inconsistent PPT adversary A=(A1,A2),

(26)Pr[(x,w)←A1(1n)(a,c,z)←P(x,w,PP):(x,w)∈RA2(a,c,z)=1]=Pr[(x,w)←A1(1n)(x,c,z)←Sim(x):(x,w)∈RA2(a,c,z)=1]

(perfect) get zero knowledge property. The next step is to verify the correctness of NIZK scheme. Instead of verifying

(27)aj=e(Vj,gvk)c⋅e(Vj,g)−ztj′⋅gTzvj′;

(28)aj′=e(Vj′,gvk)c⋅e(Vj′,g)−ztj′⋅gTzvj′;by calculating 4l pairing calculation. V from Zp, randomly select 2l elements {dj}j=0l−1,{dj′}j=0l−1, and check whether the following formula is valid:

(29)∏j=0l−1ajdj⋅∏j=0l−1(aj′)dj′=e(∏j=0l−1Vjcdj⋅∏j=0l−1(Vj′)cdj′,gvk)⋅e(∏j=0l−1Vj−ztjdj⋅∏j=0l−1(Vj′)−ztj′dj′,g2)⋅gT∑j=0l−1zvjdj+∑j=0l−1zvj′dj′.

In the formula above, only two pairing calculations are calculated, which is more efficient than ((1),(2)). Meanwhile, ((1),(2))⇒ (29): after replacing all values {aj}j=0l−1,{aj′}j=0l−1 in ((1),(2)) , Eq. (29) is obtained.

(29)⇒ ((1),(2)): Consider formula (29):

(30)Right_Side=∏j=0l−1((e(Vj,gvk)c⋅e(Vj,g)−ztj⋅gTzvj)dj⋅(e(Vj′,gvk)c⋅e(Vj′,g)−ztj′⋅gTzvj′)dj′);

(31)LiftSide=∏j=0l−1((aj)dj(aj′)dj′).