# GSFedSec: Group Signature-Based Secure Aggregation for Privacy Preservation in Federated Learning
## 3 GSFedSec: GS-Based SA for Privacy Preservation in FL
### System Setup  
Let \(G_{1}\) and \(G_{2}\) be two multiplicative cyclic groups of prime order \(p\) with \(g_{1}\) and \(g_{2}\) as their generators, respectively. These groups are isomorphic. Suppose that \(\hat{e}\) is a bilinear map, where \(\hat{e}:G_{1}\times G_{2}\to G_{T}\) and the principles of bilinearity and non-degeneracy are adhered to:  
* Bilinearity: \(\hat{e}(u^{a},v^{b})=\hat{e}(u,v)^{a,b}\), \(\forall\ u\in G_{1},v\in G_{2}\), and \(a,b\in Z_{p}^{*}\).
* Non-degeneracy: \(\hat{e}(g_{1},g_{2})=g\
eq 1_{G_{T}}\).  
Furthermore, we assume that our protocol obeys the following assumptions:  
Figure 2: (**a**) Traditional secure aggregation vs. (**b**) Group signature-based secure aggregation.  
1. Strong Diffie-Hellman Assumption: For an unknown \(x\) and \(y\), the adversary has no advantage in learning \(g^{xy}\), if \(g\), \(g^{x}\), and \(g^{y}\) are given (where \(g\) is the generator of the cyclic multiplicative group).
2. Decisional Diffie-Hellman (DDH) Problem: For an unknown \(x\), \(y\), and \(z\in Z_{q}\), and given \(g^{x}\), \(g^{y}\), and \(g^{z}\), decide whether \(xy=zmodq\). This problem is not hard and can be solved in polynomial time.
3. Bilinear Diffie-Hellman Assumption: For an unknown \(x\), \(y\), and \(z\in Z_{q}\), and given \(g^{x}\), \(g^{y}\), and \(g^{z}\), the adversary has no advantage in learning \(\xi(g,g)^{x,y,z}\in G_{T}\).
4. Decision Linear (DLIN) Assumption: Given \(u,v,h,u^{x},v^{y},h^{z}\in G\), where \(x\), \(y\), and \(z\) are random elements, an adversary cannot distinguish between \(h^{xy}\) and a random element in polynomial time. The DLIN assumption is useful where the DDH assumption does not hold, especially in pairing-based cryptography.
5. Linear Encryption: This is an application of the DLIN assumption in which public keys are a triple of generators \(u\), \(v\), and \(h\in G\), and private keys are the set of exponents of \(x,y\in Z_{p}\) such that \(u^{x}=v^{y}=h\)[26]. For encryption, we choose a and b randomly from \(Z_{p}\). The encrypted cipher text set is \((u^{a},v^{b},ml^{a+b})\). This can be denoted as \((c_{1},c_{2},c_{3})\). To recover the message from encryption, the user computes \(c_{3}/(c_{1}^{x}c_{2}^{y})\).  
Our protocol is designed for dynamic client management. The FL server can choose any client it wants to participate. Client selection is dynamic, which means that for each iteration, the server can choose different clients from a group. Threshold-based cryptography can be used to maintain the dynamic participation of the clients in a group. The group keys are generated based on the number of clients in a group and a threshold value '\(\
u\)[27]. Admin generates the group key and a separate private key (\(A_{i}\) for each client \(i\)) for all group members. When any member joins or leaves the group, the group keys and threshold need to be modified accordingly. Admin distributes the keys to all members whenever there is a change in the group keys.  
The messages in basic SA are padded with part of secret keys, which are later canceled out after aggregation. The time graph of this scheme is shown in Figure 3. Our algorithm adopts this feature but adds a group signature to avoid large computation costs, which has been shown in Figure 4. The step-by-step algorithm is defined as follows: