# A TEE-Based Federated Privacy Protection Method: Proposal and Implementation
## 3 Method Introduction
### Introduction of the Privacy Protection Model
of files that are needed to participate in integrity checking from 110,000 to 8000, and significantly reduces the time needed for the final initialization phase. The last set of experiments is a comprehensive test of performance penalty and resource efficiency. Regarding performance loss, when batch \(size=256\), as shown in Figure 7, the two numbers on the abscissa represent the number of computing nodes (Worker) and parameter servers (PS), and the ordinate represents the time consumed (in second). In addition, the table shows that whether or not remote authentication is enabled has little effect on the time consumed, because the communication between Worker and PS or Worker is a long link. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**No.**} & \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Batch Size**} & \multirow{2}{*}{**Epoch**} & \multirow{2}{*}{**Loading Time**} & \multicolumn{2}{c}{**Running Time (avg)**} & \multicolumn{2}{c}{**Mem (G), Threads**} & \multirow{2}{*}{**PF**} \\ \cline{5-8} \cline{7-10}  & & & & & **Enclave (s)** & & **Naive (s)** & & **Enclave & **Native** \\ \hline
1 & w&kd & 256 & 2 & 11 m & 11 m & 4 m & 32, 512 & 5, 360+ & N \\ \hline
2 & w&kd & 256 & 2 & 11 m & 10 m & 4 m & 32, 512 & 5, 360+ & Y \\ \hline
3 & w&kd & 256 & 2 & 21 m & 11 m & 4 m & 64, 512 & 5, 360+ & N \\ \hline
4 & w&kd & 256 & 2 & 14 s & 11 m & 4 m & 64, 512 & 5, 360+ & Y \\ \hline
5 & w&kd & 1024 & 2 & 11 m & 4 m & 2 m & 32, 512 & 5, 360+ & Y \\ \hline
6 & w&kd & 1024 & 2 & 11 m & 4 m & 2 m & 32, 512 & 5, 360+ & N \\ \hline
7 & w&kd & 1024 & 10 & 11 m & 17 m & 7 m & 7 m & 32, 512 & 5, 360+ & Y \\ \hline
8 & w&kd & 1024 & 10 & 4 s & 12 s & 5 s & 32, 512 & 5, 360+ & N \\ \hline
9 & w&kd & 1024 & 10 & 11 m & 16 m & 7 m & 7 m & 32, 512 & 5, 360+ & N \\ \hline
9 & w&kd & 1024 & 10 & 3 s & 55 s & 5 s & 32, 512 & 5, 360+ & N \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Remote authentication and model encryption export test. Figure 7: Time-consuming distribution under different resource packages. Resource utilization is strongly related to batch size, as shown in Figure 8. When the batch size equals to 1024, the utility exceeds 1. ### Privacy Protection Assessment

In this experiment, we analyzed from the feasible hardware penetration, network packet capture, and external storage data decapsulation of three attack methods. Thus, for the evaluation of these methods, we conducted a hardware penetration test, a packet capture test, and an external memory data encryption test. The results are shown in Table 4, all of which have achieved our expectations. ## 5 Conclusions

The method proposed in this study can further improve the privacy protection capability of federated learning without losing the accuracy of the original model, thereby enhancing the appetite for data cross-domain circulation and maximizing data value. We implement the federated learning method proposed in this study through existing popular machine learning frameworks. Moreover, the adaptability and compatibility of the model code are complete. In addition, our method can be widely applied to advertising marketing, financial risk control, precision marketing, and other fields. We can also extend our approach to horizontal federated computing and secure outsourced computing. This study proposes a privacy-preserving enhancement approach for a general federated machine learning framework and has been adopted on an existing framework by using TensorFlow as the trainer. Without losing the generality, our approach can also be adopted by PyTorch-based framework. It means the algorithm engineers can easily implement their algorithm on private datasets from multiple parties without being aware of