# Secure Data Sharing in Federated Learning through Blockchain-Based Aggregation
## 3 EIFFeL Framework and Security Analysis
### Scheme Architecture and Workflow
All clients honestly generate \(pp\gets KA.gen(k)\), and the server, \(\mathcal{S}\), initializes the malicious client list, \(\mathcal{C}^{*}=\emptyset\), and lists \(Flag[i]=\emptyset\) for clients that have flagged the client, \(\mathcal{C}_{i}\), as malicious. Figure 3: Setup of EIFFeL scheme. Figure 2: System Architecture of the EIFFeL Scheme. 1. **Local model training:** Each client \(\mathcal{C}_{i}\): - Generates its key pair \((pk_{i},sk_{i})\xrightarrow{\mathcal{S}}KA,gen(pp)\) and announces the public key on the public bulletin board \(\mathcal{B}\). Server \(\mathcal{S}\): - Publishes the validation predicate \(Valid(\cdot)\) on the public bulletin board \(\mathcal{B}\). 2. **Model parameter sharing**: The following steps are performed: 1. Each client, \(\mathcal{C}_{i}\), generates its protected parameters as follows: 1. Establishes \(n-1\) common secret keys \(sk_{i,j}\gets KA.aggre(pk_{j},sk_{i})\) with each of the other clients. 2. Generates a proof \(\pi_{i}=(h_{i},(a_{i},b_{i},c_{i})),h_{i}\in\mathbb{F}[X],(a_{i},b_{i},c_{i}) \in\mathbb{F}^{3},a_{i}\cdot b_{i}=c_{i}\) for the computation \(Valid(a_{i})=1\), where \(\mathbf{u}_{i}\in\mathbb{F}^{3}\) is its local update with \(d\) dimensions. 3. Creates shares of its update \(\mathbf{u}_{i}\) for all clients, denoted as \(\{(1,\mathbf{u}_{i,1}],\cdots,(n,\mathbf{u}_{i,n}),\mathbf{\Psi}_{\mathbf{u}_{i}}\}\gets SS.share(u,\)\([n],m+1)\). 4. Creates shares of its proof \(\pi_{i}\) for other clients: \(\{(1,\mathbf{u}_{i,1}],\cdots,(n,\mathbf{u}_{i,n}),\mathbf{\Psi}_{\mathbf{u}_{i}}\}\gets SS.share(\mathbf{u}_{i},[n]\setminus i,m+1)\), \(\{(1,\mathbf{u}_{i,1}],\cdots,(n,\mathbf{u}_{i,n}),\mathbf{\Psi}_{\mathbf{u}_{i}}\}\gets SS.share(\mathbf{u}_{i},[n]\setminus i,m+1)\), \(\{(1,\mathbf{u}_{i,1}],\cdots,(n,\mathbf{u}_{i,n}),\mathbf{\Psi}_{\mathbf{u}_{i}}\}\leftarrow SS.share(\mathbf{u}_{i},[n]\setminus i,m+1)\), \(\{(1,\mathbf{u}_{i,1}],\cdots,(n,\mathbf{u}_{i,n}),\mathbf{\Psi}_{\mathbf{u}_{i}}\}\leftarrow SS.share(\mathbf{u}_{i},[n]\setminus i,m+1)\). 5. Publishes the encrypted proof strings, \(\forall\forall\mathcal{C}_{i}\in\{\cup_{i}(\overline{\mathbf{u}}_{i,1}]|(|i,\overline {\mathbf{u}}_{i,1})\}\gets AE.enc_{\mathbf{u}_{i,1}}((i,\mathbf{u}_{i,1})|(|i,\overline {\mathbf{u}}_{i,1}))\), \(\pi_{ij}=h_{i,j}||\mathbf{u}_{i,j}||\mathbf{u}_{i,j}||c_{i}\) on the public bulletin board \(\mathcal{B}\) with its check strings \(\{\mathbf{\Psi}_{\mathbf{u}_{i}},\overline{\mathbf{\Psi}}_{\mathbf{u}_{i}}\}\). 6. The protected parameters are verified as follows: 1. [label=()] 2. Verifying validity of secret shares: 3. [label=()] Each client \(\mathcal{C}_{i}\): - Retrieves and decrypts the shares pertaining to it \((i,\mathbf{u}_{ij})||(i,\mathbf{u}_{j})\gets AE.dec_{\mathbf{\mu}_{ij}}(\overline{(i, \mathbf{u}_{j})})\) 4. Verifies the shares \(\mathbf{u}_{i,1}(\mathbf{\pi}_{ij})\) using check string \(\mathbf{\Psi}_{\mathbf{u}_{i}}(\overline{\mathbf{\Psi}}_{\mathbf{u}_{i}})\). 5. If any share fails to be decrypted or verified, flag its creator on \(\mathcal{B}\). Server \(\mathcal{S}\): 1. Upon receiving a report (e.g., \(\mathcal{C}_{i}\) flags \(\mathcal{C}_{i}\)), updates \(Flag[i]=Flag[i]\cup\mathcal{C}_{i}\). 2. Updates \(\mathcal{C}^{*}\) as follows: 1. If \(Flag[i]=>m\), \(\mathcal{C}_{i}\) is marked as malicious: \(\mathcal{C}^{*}=\mathcal{C}^{*}\cup\mathcal{C}_{i}\). 2. If any client \(\mathcal{C}_{i}\) reported more than \(\mathcal{C}_{i}\), is considered as malicious: \(\mathcal{C}^{*}=\mathcal{C}^{*}\cup\mathcal{C}_{i}\). 3. For a client \(\mathcal{C}_{i}\) that has been reported, but with \(Flag[i]\leq m\), server \(\mathcal{S}\) intervenes for further verification.