## 1 Introduction  
Federated learning (FL) is an innovative approach where multiple organizations can collaboratively develop machine learning models while maintaining data confidentiality. In FL, data is processed locally at each client's site and only model updates, not the raw data, are shared with the server. This method not only enhances privacy but also allows for the pooling of knowledge across different entities, significantly improving model accuracy and utility. For example, in healthcare, FL enables institutions to collaborate on refining disease diagnosis models without exposing individual patient data, ensuring privacy and compliance with regulations [1, 2]. Similarly, in consumer technology, companies like Google LLC and Apple Inc. employ FL to improve user experiences in keyboard prediction and voice recognition without compromising user privacy [3]. Despite its potential in enhancing data privacy, federated learning faces significant security challenges in practical applications, as evidenced by multiple data breach incidents in 2023 [4]. These unauthorized accesses involved not only personal information but also crucial federated learning data such as model parameters and gradients during client-server (C/S) data transmission. The compromised data ranged from hundreds of GBs to several TBs, affecting various industries including education, finance, and technology. These unauthorized accesses directly threaten the security of data and the reliability of the learning process, particularly in industries relying on precise data exchanges. To safeguard data transmission in FL, the AKA protocols [5; 6; 7; 8; 9] are proposed to authenticate legitimate users and safeguard training data. However, existing AKA protocols for client-server (C/S) architecture show security deficiencies. These vulnerabilities include inadequate protection for user anonymity and traceability [6; 8], potentially allowing attackers to identify and track user activities through data interactions [7]. Furthermore, these protocols [6; 7; 8] are susceptible to replay attacks, where attackers resend valid packets to deceive the authentication system, leading to unauthorized data access. Additionally, they are prone to Denial-of-Service (DoS) attacks, which can drain the system by overwhelming it with excessive requests, thereby denying service to legitimate users, among other potential security flaws. Therefore, it is crucial to design a secure and efficient authentication protocol to protect data transmission in FL. In this paper, we propose a robust 2 FAKA-C/S protocol based on ECC and Hash-chain technology that resists attacks from the extended Canetti-Krawczyk (eCK) adversary model [9]. In this enhanced security protocol, ECC leverages the complexity of the discrete logarithm problem to generate a strong yet compact encryption key, reducing computational demands and significantly enhancing the overall security, while also ensuring the forward secrecy. Additionally, the introduction of Hash-chain technology provides further reinforcement to the system's security. By generating unique Hash-chain's hash values for each session, this technique effectively prevents replay attacks, safeguarding the uniqueness and security of every session. The integration of these techniques significantly boosts the security and efficiency of the authentication and key agreement process, rendering the protocol highly suitable for C/S data transmission in FL. Our contributions are summarized below:  
1. 2 FAKA-C/S Protocol Design: Based on the technology of Hash-chain and ECC, we present a robust and effective 2 FAKA-C/S protocol, overcoming the limitations of existing AKA methods by enhancing security while maintaining computational efficiency. 2. Security Analysis: In the formal security analysis, we prove the semantic security of the session key using provably secure methods.