# A TEE-Based Federated Privacy Protection Method: Proposal and Implementation
## 3 Method Introduction
### Introduction of the Privacy Protection Model
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Attack Method** & **Test Method and Results** & **Expected Outcome** \\ \hline \multirow{2}{*}{Hardware penetration attack} & Printing the content of the Enclave address through GDB, an illegal memory access error occurs & Enclave memory illegal access, as expected \\ \hline \multirow{2}{*}{Man-in-the-middle attack} & Capturing packets to steal cipher text, unable to obtain the private key of the certificate, and thus unable to decrypt & Unable to decrypt, as expected \\ \hline \multirow{2}{*}{External data access} & By reading the model parameter information from the model checkpoint file, the cipher text is obtained and cannot be viewed & The cipher text cannot be viewed, as expected \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Attack defense test results. Figure 8: Resource efficiency distribution under different resource packages. the privacy-preserving technology or adapt their existing single-party models to multiple parties with only a few modifications. ## 6 Limitations

There are several limitations to the wide implementation of Intel SGX as TEE. Our approach is built on Intel SGX V2 and can use up to 1T RAM for its trusted execution environment (enclave). However, the SGX V1 only offers 256M enclave memory, and is not able to execute the LibOS. Another overhead is the loading time/latency needed for model training. From our observation, if the Enclave has more than 10,000 files to be loaded as the trusted files, it takes about 6-10 min. This is due to two aspects: calculating the checksum of each file and allocating the enclave's memory space from the host. Hence, we should introduce the Enclave Dynamic Memory Management (EDMM) mechanism to allocate the enclave memory more efficiently; it reduces the loading time and spending memory. The engineers from Intel are making efforts to enable the EDMM feature in the near future. A frequent complaint about the Intel SGX is its susceptibility to side-channel attack. This attack may leak the model weights from the Enclave memory. To solve this problem, we strongly suggest that users obtain and apply the latest microcode or firmware updates from Intel. Furthermore, our approach can also work with differential privacy to mitigate the effects of a zero-day attack. Working with differential privacy does not change the framework, but only adds the noise from the active party. Methodology, L.Z., B.D. and X.C. ; Implementation, L.Z. and B.D. ; Validation, J.L. and Z.M. ; Writing--original draft preparation, L.Z. and B.D. ; Writing--review and editing, X.C. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. Data availability Statement: Data is contained within the article. The authors declare no conflict of interest. ## References

* (1) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20 th International Conference on Artificial Intelligence and Statistics, Fort Lauderdale, FL, USA, 20-22 April 2017; pp. 1273-1282. * (2) [PERSON]; [PERSON]; [PERSON]; [PERSON] Federated machine learning: Concept and applications. _ACM Trans. Intell. Syst. Technol. (TIST)_**2019**, _10_, 1-19. [CrossRef]
* (3) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; et al. Advances and open problems in federated learning. _Found. Trends Mach. Learn._**2021**, _14_, 1-210. [CrossRef]
* (4) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A survey on security and privacy of federated learning. _Future Gener. Comput. Syst._**2021**, _115_, 619-640. [CrossRef]
* (5) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON]; [PERSON] Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing. In Proceedings of the USENIX Security Symposium, San Diego, CA, USA, 20-22 August 2014; pp. 17-32.