IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO.

2, FEBRUARY 2023 1703

Blockchain-Based Federated Learning With

Secure Aggregation in Trusted Execution
Environment for Internet-of-Things
Aditya Pribadi Kalapaaking , Ibrahim Khalil , Mohammad Saidur Rahman ,
Mohammed Atiquzzaman , Senior Member, IEEE, Xun Yi , and Mahathir Almashor

Abstract—This article proposes a blockchain-based fed- care, manufacturing, critical system infrastructure, agriculture,
erated learning (FL) framework with Intel Software Guard and transportation. IoT devices enable the collection of a large
Extension (SGX)-based trusted execution environment volume of data and act autonomously in an intelligent system,
(TEE) to securely aggregate local models in Industrial
Internet-of-Things (IIoTs). In FL, local models can be tam- thanks to machine learning algorithms. The large volume of IoT
pered with by attackers. Hence, a global model generated data plays an essential role in training a machine learning algo-
from the tampered local models can be erroneous. There- rithm system. In general, IoT devices are resource-constrained
fore, the proposed framework leverages a blockchain net- and cannot execute machine learning algorithms independently.
work for secure model aggregation. Each blockchain node Edge computing technology is gaining acceptance at a tremen-
hosts an SGX-enabled processor that securely performs
the FL-based aggregation tasks to generate a global model. dous rate to form intelligent networks in conjunction with IoT
Blockchain nodes can verify the authenticity of the aggre- and machine learning. An edge device (referred to as an edge
gated model, run a blockchain consensus mechanism to server throughout the article) and IoT devices within the network
ensure the integrity of the model, and add it to the dis- form a cluster. In an intelligent system, edge devices can host a
tributed ledger for tamper-proof storage. Each cluster can machine learning algorithm that uses a locallybuilt dataset and
obtain the aggregated model from the blockchain and verify
its integrity before using it. We conducted several experi- produce a trained model. IoT devices generate data and receive
ments with different CNN models and datasets to evaluate control instructions depending on the type of IoT device. Later,
the performance of the proposed framework. the trained model can be used to make an intelligent decision in
Index Terms—Blockchain, deep learning, federated
the system.
learning (FL), Intel Software Guard Extension (SGX), Although an edge and IoT-based system configuration with
Internet-of-Things (IoT), secure aggregation, trusted execu- machine learning capability can manage different system tasks
tion environment (TEE). automatically, the level of accuracy impedes its success. For
example, a trained model produced by an edge server with local
data might not consider many features that could be absent in the
I. INTRODUCTION
local dataset. The accuracy can be improved if the edge device
HE Internet-of-Things (IoT) explosion has made it an
T integral component of various intelligent applications.
Intelligent applications include but are not limited to health
can collaborate with other edge servers that have produced their
trained model based on their local datasets. This learning method
is called distributed collaborative machine learning [1]. Tradi-
tional distributed collaborative machine learning (see Fig. 1)
allows different clusters to send their locally trained model and
Manuscript received 10 January 2022; revised 8 February 2022 and
27 March 2022; accepted 12 April 2022. Date of publication 26 April datasets to a centralized server, such as the cloud. Cloud ag-
2022; date of current version 13 December 2022. This work was sup- gregates all locally trained models using datasets from different
ported by the Australian Research Council Discovery Project under sources and produces an aggregated trained model shared with
Grant DP210102761. Paper no. TII-22-0156. (Corresponding author:
Mohammad Saidur Rahman.) all clusters to improve decision-making accuracy.
Aditya Pribadi Kalapaaking, Ibrahim Khalil, Mohammad Saidur Rah- Distributed collaborative learning suffers from two significant
man, and Xun Yi are with the School of Computing Technolo- issues: privacy and trust [2]. A new form of distributed col-
gies, RMIT University, Melbourne, VIC 3000, Australia (e-mail: aditya.
[email protected]; [email protected]; laborative learning, called federated learning (FL) [3], enables
[email protected]; [email protected]). different clusters to build a trained model with their local data,
Mohammed Atiquzzaman is with the School of Computer Science, called a local model, and to share only the local model with
University of Oklahoma, Norman, OK 73019 USA (e-mail: [email protected]).
Mahathir Almashor is with the CSIRO’s Data61 and Cyber Security other participants for the purpose of aggregation. The aggregated
Cooperative Research Centre, Marsfield, NSW 2122, Australia (e-mail: model is known as a global model. Data privacy is ensured
[email protected]). because the global model is generated without the data being
Color versions of one or more figures in this article are available at
https://doi.org/10.1109/TII.2022.3170348. shared with other participants. Nevertheless, the global model
Digital Object Identifier 10.1109/TII.2022.3170348 cannot be fully trusted as internal or external attackers can

1551-3203 © 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
1704 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 2, FEBRUARY 2023

Fig. 2. Possible threat on collaborative learning architecture.

Fig. 1. Traditional collaborative learning application scenario. 2) We propose the hosting of an SGX processor by a
blockchain node that is responsible for the FL model
aggregation task.
launch several security attacks during the model aggregation
3) A blockchain-powered trustworthy aggregated model
and the dissemination of the global model. Hence, a trustworthy
storage and sharing model is proposed for FL-based
framework is required to ensure the privacy of sensitive data and
learning in IoT applications.
the trustworthiness of the generated global model. Moreover, the
receiver of the global model (e.g., edge server) should verify the
integrity of the global model before using it. B. Organization
The rest of this article is organized as follows. Section II de-
A. Contributions scribe the problem scenario in collaborative learning. Section III
discuss some of the closely related work. The proposed frame-
In this article, we propose a complete framework for FL that
work is described in Section IV. Section V presents the experi-
simultaneously safeguards the privacy of IoT data and ensures
mental results and evaluates various performance aspects of the
security during the generation of aggregated trained models. In
proposed framework. Finally, Section VI concludes this article.
addition, the proposed framework guarantees trustworthy stor-
age and sharing of the outcomes of any training. The proposed
II. PROBLEM SCENARIO
framework comprises a convolutional neural FL architecture
that combines an Intel Software Guard Extension (SGX)-based To demonstrate and discuss the problem that exists with tra-
trusted execution environment (TEE) and blockchain platform. ditional collaborative machine learning, we use an IoT-enabled
We assume that multiple IoT and edge devices clusters produce smart warehouse scenario (see Fig. 2). Assume that several
locally trained models based on their local dataset and send smart warehouses are geographically dispersed. Each warehouse
the local model to the blockchain network for aggregation. In receives multiple prepacked boxes of various garments (for both
this framework, each blockchain node hosts an SGX-enabled men and women), including shirts, trousers, shoes, jackets, and
processor that individually performs the FL-based aggregation bags for storage. Each warehouse uses machine learning and an
tasks to generate an aggregated model. Once SGX-enabled IoT-enabled camera to automatically sort the boxes according
processors of blockchain nodes perform the aggregation, each to the type of garment they contain. The camera scans the
node can verify the authenticity of the aggregated model, run a generic photo of the garment, which is shown on the box.
blockchain consensus mechanism to ensure the integrity of the However, IoT-enabled cameras are resourced-constrained and
model, and add it to a blockchain for tamper-proof storage. An cannot execute the machine learning algorithm. Hence, each
edge server from each cluster can collect the latest aggregated warehouse is equipped with an edge server with access to the
model from the blockchain and verify its integrity before using local dataset and hosts the machine learning algorithm to train a
it. The key contributions of our work are summarized below. model for recognizing garment items based on the local dataset.
1) The proposed framework introduces a new FL architec- Nevertheless, the accuracy of a training model derived from
ture for IoT to ensure secure generation of the aggregated the local dataset may not be good. Therefore, the edge server
model using Intel SGX-powered TEE. of each warehouse participates in a cloud-based collaborative

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
KALAPAAKING et al.: BLOCKCHAIN-BASED FEDERATED LEARNING WITH SECURE AGGREGATION 1705

machine learning platform to share its local dataset and the that a backdoor can compromise the FL and poison the machine
trained model. The cloud-based collaborative machine learning learning model. Our framework will create a secure end-to-end
platform produces an aggregated model based on the received FL process to overcome this problem by securing the machine
local datasets and models. The aggregated model is sent to learning model and the aggregation process.
all edge servers to achieve higher accuracy in recognizing the TEE-based machine learning: Recently, TEE has gained
garment items. popularity in the field of privacy-preserving machine learning.
Although the aforementioned collaborative learning scenario Ohrimenko et al. [11] investigated centralized machine learning
improves overall accuracy, it suffers from the following security processes in an SGX-enabled data center to improve data privacy
risks. and avoid data leaks. In his framework, the server requests the
1) Risks of data privacy: Sending local datasets to the cloud dataset from all the participants and computes it in a centralized
introduces the risk of a privacy breach. For example, a server. Tramer et al. [12] and Juvekar et al. [13] proposed a
dishonest employee from the cloud service provider can secure inference process inside of the TEE. Hynes et al. [14]
act as an internal attacker and collect the warehouse’s and Hunt et al. [15] demonstrated centralized privacy-preserving
sensitive product information and share it with a business machine learning by running all the CNN processes inside the
competitor for financial gain. Hence, there is the need for enclave.
an aggregation model that would not require local datasets The available frameworks use a single deep learning model,
to generate an aggregated model. and none of them performs within the FL setup. The current
2) Risks of generating biased aggregated trained model: The work also shows that the time cost is significantly increased
aggregated model produced by a cloud service provider when the training process is performed in the TEE. Hence, we
can be biased, as a cloud-based platform cannot be trusted. run the aggregation process inside the enclave to maximize the
For instance, an internal attacker can generate a biased performance and reduce time consumption.
aggregated model not using the given local models or Blockchain-based FL: Blockchain was first launched as a
inject a faulty trained model to interrupt the generation cryptocurrency technology. However, it has now been expanded
of aggregated models. Therefore, a secure environment is for data storage across multiple computational nodes in a dis-
required to prevent biased model generation. tributed fashion. Blockchain is structured as a linked list of
3) Risks of receiving alteration or faulty aggregated trained blocks holding a set of transactions. Ali et al. [16] proposed a
model: In the traditional cloud-based collaborative learn- method to ensure the privacy and security of health care systems
ing environment, an internal attacker of the cloud platform using blockchain. Their approach focuses mainly on securing
can interfere with disseminating the aggregated model. patient data from active collision attacks by leveraging novel
For example, an attacker can alter some part of the aggre- smart contracts and encryption algorithms. Nowadays, many
gated model before the cloud sends it to the edge servers. studies are incorporating blockchain into their FL methodologies
The traditional method does not allow a receiver of the because FL is based on a centralized server, which is vulnerable
aggregated model (i.e., edge server) to verify its integrity to attack. Zhao et al. [17] designed a system where each of the
before using it. Hence, a trustworthy platform is required clients will sign the model after the training process and send
for sharing the aggregated model with edge servers. it to the blockchain. However, if this model has many clients,
the computation cost will be very high. In recent works, Qu et
al. [18], Lu et al. [19], and Feng et al. [20] proposed a framework
III. RELATED WORK where the model is stored in the blockchain node, and FL is per-
This section discusses several studies that are closely related formed. However, in their architecture, the model is not totally
to our work. encrypted. Also, the aggregation is performed by an untrusted
Privacy-preserving FL: Several works on privacy-preserving party. Kim et al. [21] proposed a method where they deploy
federated learning have been presented recently. Yin et al. [4] the blockchain on the edge devices. The disadvantage of this
and Liu et al. [5] proposed an FL framework where the training method is that the edge devices will require a lot of computation
is performed on each node and only the model is sent to the power. Kumar et al. [22] proposed a blockchain architecture to
central server to perform the model aggregation. Wei et al. [6] collect the locally trained model weights collaboratively from
and Zhao et al. [7] proposed a framework where data privacy different sources for health care scenarios. However, the local
is improved by means of differential privacy (DP). However, model that is stored in the blockchain is not protected by any
the use of DP will slow down the training process and reduce privacy measure. In this case, other parties can see the model,
accuracy. In [8] the author proposed anonymous FL by adding thereby raising privacy issues.
a proxy layer and DP to the data. However, the proxy layer will Samuel et al. [23] proposed blockchain-based FL for health
add communication overhead, and the result shows that the DP care system. Their proposed framework protects the local model
decreases the ML accuracy. Li et al. [9] leveraged SMPC-based training with DP. The central server aggregates the global model
FL to secure aggregation. Hence, their framework relies on a and stores it in the blockchain. However, the global model
centralized server to arrange the secret sharing. This could be accuracy is lower than the locally trained model. The use of
a problem since all the models can be seen in plaintext after DP in this framework can preserve privacy while sacrificing
the cloud collects the secret share. FL is delicate to an attacker accuracy. Alsamhi et al. [24] and Otoum et al. [25] proposed
that can launch backdoor attacks. Bagdasaryan et al. [10] found an edge intelligence over smart environments with the support

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
1706 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 2, FEBRUARY 2023

TABLE I TABLE II
SUMMARY OF RELATED WORKS NOTATIONS

As a result, IoT cameras and the edge server form a cluster

Ci (1 ≤ i ≤ p). Initially, the edge server trains a model based
on the local dataset and generates a trained model called a
local model, denoted as ML . However, if the size of the local
dataset is small, the accuracy of ML might not be high. Hence,
the edge server of a cluster Ci joins in FL involving multiple
clusters of similar warehouses by sending its ML to generate
an aggregated model known as a global model, denoted as
MG . In our proposed scenario, we adopt federated averaging
(FedAVG) [27] algorithm for generating the global model, which
will be discussed in Section IV-C.
A typical FL approach involves three steps: initialization,
of FL and blockchain. Their proposed architectures leverage
aggregation, and update. Unlike the traditional FL approach
drones as an edge intelligence to perform the aggregation in FL.
where ML are aggregated in a centralized server (e.g., a cloud
The aggregation process on a drone is vulnerable to tampering
server), our proposed framework uses a blockchain platform
attacks and poisoning attacks. Since drones are deployed on the
for the aggregation of ML . Multiple nodes form a blockchain
field and open networks, hardware security such as TEE can
network, and each node receives all ML and individually aggre-
secure the aggregation process.
gates ML to produce their own copy of a MG . We assume that
In Table I, we summarize some of the works to identify their
each blockchain node has a TEE host. To ensure the security
research gaps and discuss how our proposed method differs from
during the aggregation process, each blockchain node performs
them. As shown in the table, existing works are mostly unse-
the aggregation in its TEE host and produces a MG . Blockchain
cured, inefficient, and have low accuracy. Hence, we deploy the
nodes execute a consensus mechanism to ensure that all nodes
blockchain on the server-side to reduce training model storage
have identical MG . Once the consensus has been reached, each
costs and leverage TEE to ensure secure and trustworthy model
blockchain node stores the MG in its respective blockchain. Fi-
aggregation before sending it to the blockchain.
nally, the blockchain network sends MG to all edge servers. Edge
servers validate MG once received and update their initial model
IV. PROPOSED FRAMEWORK with MG . Edge servers use the MG for product recognition in
In this section, we present the proposed blockchain-based the warehouse.
FL with TEE-powered secure aggregation framework. First, we Fig. 3 gives an overview of the proposed framework, which
present an overview of the system architecture. Next, we discuss consists of three main phases: local model generation, secure
in detail the various components of our proposed framework. TEE-enabled aggregation, and blockchain-based global model
The summary of notations used in the methodology can be seen storage. The following subsections describe each phase in detail.
on Table II.
B. Local Model Generation
A. System Architecture The local model generation (LMG) phase is performed in
We consider an FL-based collaborative learning model in each cluster to generate a locally trained model similar to the
this system that leverages TEE for secure aggregation and initialization phase of the original FL. An overview of the LMG
blockchain for tamper-proof data sharing and storage. phase is given in Fig. 4. In the proposed system, we assume
We assume that there are p warehouses equipped with several that the edge servers of different clusters train models using
IoT cameras to scan product photos and recognize the type of convolutional neural network (CNN)-based image classification
products. Because IoT cameras are resource-constrained when in which model parameters are retrieved from the global model
running machine learning algorithms, each warehouse uses an stored in the tamper-proof storage. Example of the CNN models
edge server to host and execute a machine learning algorithm. are AlexNet [28], LeNet [29], and VGG16 [30].

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
KALAPAAKING et al.: BLOCKCHAIN-BASED FEDERATED LEARNING WITH SECURE AGGREGATION 1707

the ML model using its dataset in every FL round r as follows:

r+1 r r
MLi = MG − η∇F (MG , Di ) (1)
r+1 r
where MLi denotes the updated local model of client i, MG is
the current global model, η is the local learning rate, ∇ is used
to refer to the derivative with respect to every parameter, and
r+1
F is the loss function. Later, Ei send MLi to the blockchain
network and aggregated iteratively into a joint global model MG .
To ensure the security of the local model, Ei leverages
symmetric key encryption algorithm, such as advanced encryp-
tion standard (AES), to encrypt MLi before sending it to the
blockchain nodes. We assume that the AES secret key between
Ei and the blockchain network is established using a secure
key establishment mechanism, such as Diffie–Hellman key ex-
change mechanism. We do not discuss this process in detail as
we leverage the state-of-the-art mechanism for encrypting the
local model.

Fig. 3. Overview of the proposed framework. C. TEE-Enabled Secure Model Aggregation

Once different local models are received by a blockchain
node, a TEE is used to securely aggregate all models. For TEE,
we use Intel SGX [31] in this framework. SGX is a set of CPU
extensions, which can provide isolated execution environments,
named enclaves, to protect the confidentiality and integrity of
the data against all other software, even a compromised OS,
on the platform. When a platform is equipped with an SGX-
enabled CPU (such as a blockchain node in our framework),
as an enclave, the memory, BIOS, I/O, and even power are
treated as potentially untrustworthy. First, the encrypted data are
transmitted into an enclave for decryption. Then the decrypted
data will be the input of function f . Finally, the output of f will
be encrypted and then sent to the outside of the enclave.
Using the same principle, FL’s local model aggregation task
is performed in the SGX-enabled CPU. We assume that there
are b blockchain nodes in the blockchain network, and each
blockchain node Bi (1 ≤ i ≤ b) in the blockchain network is
equipped with an SGX-enabled CPU Si . A blockchain node Bi
cannot access the code and data within its SGX-enabled CPU
Fig. 4. Local model generation. Si .
Assume that a blockchain node Bi receives the set ML of
local models from all clusters which can be denoted as ML =
In general, CNN image classification takes an input image, {ML1 , ML2 , . . . , MLp }. Bi sends MLi (1 ≤ i ≤ Ci ) to Si . The
processes it and classifies it under certain categories of t objects. secure aggregation tasks of all local models in ML is done using
An edge server Ei of cluster Ci has a local image dataset Di . multiple operations which are discussed below.
The edge server sees an input image as an array of pixels, and it 1) Generation of Encrypted Local Models: The SGX enclave
depends on the image resolution. Based on the image resolution, receives only encrypted data to ensure security. Hence, Bi needs
it will see h × w × d (h = height, w = width, d = dimension). to encrypt MLi before sending it to Si . Let, E(., K) be a
For example, an image of 6 × 6 × 3 array of a matrix of RGB symmetric encryption (SE) algorithm E(., Ki ) with a secret key
(3 refers to RGB values) and an image of 4 × 4 × 1 array of a Ki that is shared between Bi and its Si . The shared secret key
matrix of a grayscale image. Technically, the deep learning CNN Ki is established by leveraging a secure key exchange protocol
model works via different layers to train and test a local model. such as Diffie–Hellman key exchange protocol.
The layers are convolution layers with filters (kernels), pooling, Bi generates an encrypted local model E(MLi , Ki ). Bi sends
and fully connected (FC) layers. In the end, CNN applies the E(MLi , Ki ) to Si .
SoftMax function to classify an object according to probabilistic 2) Remote Attestation: The remote attestation allows the
values between 0 and 1. In each edge server, Ei locally trained verification of the integrity of the aggregated model (i.e., global
the machine learning model MLi . An edge server Ei updates model) generated by the SGX enclave. In this framework, the

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
1708 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 2, FEBRUARY 2023

Fig. 5. Remote attestation of local model.

SGX enclave acts as the attestator, and the software module

of a blockchain node Bi that is responsible for interfacing
between SGX enclave and the blockchain network plays the
role of a verifier of the attestation. First, the SGX enclave
Si receives the set MLE of p encrypted local models which
can be denoted as MLE = {E(ML1 , K1 ), . . . , E(MLp , Kp )}. Si
decrypts each E(MLi , Ki )(1 ≤ i ≤ p) with the shared secret
key ki to retrieve the plaintext set of local learning models
MLi . Second, Si performs the aggregation using the federated
averaging (FedAVG) [27] algorithm to generate the global model
MG as follows:
n
 n

r+1 |Di | r+1
MGi = MLi ,N = |Di | (2)
i=1
N i=1

r+1
where MGi denotes the updated global model, n is a number
of clients on the FL round r, |Di | is the number of data items
r+1
(images) owned by Ei to train local model MLi , and N the
total number of data used to train all of the local models. MG is
r+1
final updated global model MGi .
Third, Si generates a remote attestation, called report Ri =
Sign(MGi , AKi ). Here, Sign(., AKi ) is a signature function
and AKi is the attestation key of Si . The generated report
enables a verifier (i.e., blockchain node) to verify the MGi . The
pseudocode of the overall aggregation and remote attestation
is illustrated in Algorithm 1. The algorithm takes encrypted
trained models as input and outputs aggregated global models,
and its remote attestation report All tasks of Algorithm 1 are Fig. 6. Blockchain-based global model storage.
executed under a running enclave of the SGX. SGX uses a
quoting enclave to verify reports produced by the application
enclave and signs as a quote. The quoting enclave is used to
all remote attestations are verified, and the majority hashes of
determine the trustworthiness of the platform. Later, the quote
corresponding models are the same, the blockchain nodes in the
is sent to another party for verification. In our scenario, each
blockchain network add the global model MG as a block in the
Bi will have one Si and works as an aggregator and verifier
blockchain. Also, the global model is sent to all edge servers as
of attestation reports. Fig. 5 shows the details of the quoting
the update operation FL. An overview of this step is given in
enclave process.
Fig. 6.
1) Verifying Attestation Reports by a Blockchain Node:
D. Blockchain-Based Tamperproof Global Model Assume that each blockchain node is equipped with a quoting
Storage and Distribution
enclave and has an attestation key AKj to sign a remote
In this phase, the blockchain network receives all remote attestation report Ri produced by Si . Ri is signed with Akj to
attestations produced by SGX enclaves and runs a consensus generate a quote Qi . A quote contains the identity of the attesting
mechanism. The consensus mechanism verifies the remote at- enclave Si , execution mode details (e.g., security version
testations of a global model produced by the SGX enclaves. If number level Si ), and additional metadata. The function that is

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
KALAPAAKING et al.: BLOCKCHAIN-BASED FEDERATED LEARNING WITH SECURE AGGREGATION 1709

used to generate Qi can be shown as: Qi = Sign(Ri , AKj ).

Qi is encrypted using the public key P KIAS of Intel attestation
service (IAS) and generates E(Qi , P KIAS ). P KIAS is
embedded in the quoting enclave of all SGX-enabled
processors. Each Si shares its E(Qi , P KIAS ) to other
SGX-enabled processors of the blockchain network. Once all
encrypted quotes are received from SGX-enabled processors
of all n blockchain nodes, Bi creates a collection of
Encrypted Quotes received from all which is denoted by
QE ={E(Q1 , P KIAS ), E(Q2 , P KIAS ), . . . , E(Qn , P KIAS )}.
A blockchain node Bi verifies each encrypted quote with the
Fig. 7. Overview of the consensus mechanism.
help of IAS and determines if the quote is correct and the corre-
sponding remote attestation enclave has created it. The verifica-
tion is done using a function verif y(E(Qi , P KIAS ), P RIAS ),
where P RIAS is the private key of IAS. Once the quotation is
verified, Q is broadcast to the blockchain network to obtain
a consensus for the global model. Algorithm 2 provides an
overview of this step.
2) Consensus by Blockchain Network: The consensus
mechanism has several steps. First, a blockchain node Bi checks
the validity of each quote and the authenticity of the quote-
generating enclave. Second, the global model is extracted from
each quote, and their hashes are verified. If the hashes of all
global models are the same, the consensus is achieved. If all Fig. 8. Data structure of the global model blockchain.
hashes are not the same, the blockchain node Bi determines
the global model MGk that has maximum matched hash values,
where k ≤ p. Third, Bi proposes MGk to the blockchain net- A. Experimental Setup
work to add in the blockchain. Finally, if MGk is the same for the
In our experiments, both the server and participant applica-
majority of the node’s global model, the consensus is achieved
tions were run on an Azure Cloud. We used the DCsv2 series VM
and added to the blockchain. Algorithm 3 shows the pseudocode
with 4 vCPU and 16 GB memory. This DC series from Azure
and Fig. 7 provide an overview of of consensus mechanism. The
provides confidentiality and integrity of the data and code while
blockchain data structure of global models is illustrated in Fig. 8.
they are being processed in the public cloud. DCsv2-series using
Intel Software Guard Extensions was used, which enables the
V. RESULTS AND DISCUSSION end-user to use secure enclaves for protection. These machines
In this section, we report on several experiments conducted to are backed by 3.7 GHz Intel Xeon E-2288 G (Coffee Lake) with
evaluate the performance of our proposed framework. Experi- SGX [31] technology. We built our FL application based on
mental setup, and dataset and model are discussed in Sections V- PyTorch [32] and PySyft [33]. To run the PyTorch application
A and V-B, respectively. Section V-C shows experimental results in the SGX environment, we build our application on Graphe-
and evaluates the performance. neOS [34].

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
1710 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 2, FEBRUARY 2023

Fig. 9. Processing time of secure aggregation process with and with-

out SGX using various machine learning models and datasets con-
TABLE III sidering batch size = 128. (a) LeNet - Fashion MNIST. (b) VGG16 -
DATASETS SPECIFICATIONS CIFAR-10. (c) AlexNet - CIFAR 10. (d) LeNet - MNIST.

for stability and efficient training. AlexNet is suitable for testing

on the CIFAR-10 datasets. Finally, the VGG16 [30] model is
used that has 16 layers and about 138 million parameters. This
machine learning model is also suitable for CIFAR 10 datasets.
B. Datasets and Model
For the experiments, we selected three datasets popularly C. Experimental Results and Performance Evaluation
used for the machine learning process: Fashion MNIST [35], First, we evaluate the performance of our framework for the
CIFAR-10 [36], and MNIST [37]. These datasets are commonly global model aggregation process(see Fig. 9). This experiment
used for benchmarking in the machine learning framework. shows the time cost difference when performing the secure
Therefore, we have used them to evaluate the performance of our aggregation process with enclaves and without enclaves with
proposed approach. The dataset is used to train and test the local various numbers of edge devices ranging from 2 to 40. Results
model on the client-side in the proposed FL-based approach. For show the aggregation times required by LeNet, AlexNet, and
all our experiments, we split the training and testing sets. Based VGG16 for a batch size of 128. In Fig. 9(a) and (d), we show
on the number of participants, we evenly distribute the training the LeNet model with Fashion MNIST and MNIST dataset,
and test sets among all participants. Fashion MNIST [35] is a respectively. The experimental results show that the LeNet
collection of datasets containing fashion images. The training model exhibits a similar trend when used on Fashion MNIST
set comprised 60 000, and 10 000 images were used as a test set. and MNIST datasets. The time is consistently stable when it
Each image had a 28 × 28-pixel grayscale, and nine different has 20 edge devices, and the time cost rises a little bit when it
classes were represented (trousers, dress, bag, etc.). MNIST [37] reaches 30 edge devices during the aggregation in the TEE. The
is a dataset consisting of handwritten digits (60 000 images in average additional time cost is 1.2 s. Fig. 9(b) and (c) shows
the training set and 10 000 in the test set). Each image is a 28 × the results of AlexNet and VGG-16 models with CIFAR-10
28-pixel image of a handwritten digit. CIFAR-10 [36] consists dataset. When we perform the VGG-16 model with 40 edge
of 50 000 images in the training set and 10 000 in the test set. It devices, the aggregation process without SGX requires 19.1 s.
comprises ten different classes (such as cars, dogs, planes), and The aggregation process is higher with SGX, which is 21.8 s.
there are 6000 images in each class, where each image contains The required time to aggregate local training models of VGG-16
32 × 32-colored pixels. Table III shows the overview of the is the highest due to the involvement of 16 layers. Nevertheless,
dataset used in the experiments. it is only 2.7 s slower than the time cost of aggregation without
We consider three models for our experiment. First, the LeNet SGX. Fig. 9 shows that the aggregation time cost is 1.3 s higher
model was used, which was proposed by LeCun et al. [29]. The on an average in SGX due to the paging mechanism and memory
model contains two convolutional layers and two fully connected limitation of SGX.
layers. This model is suitable for running experiments using the In Fig. 10, we test the performance of our framework using
Fashion MNIST and MNIST datasets. Second, the AlexNet [28] different machine learning models and datasets. The experiment
model is used with five convolutional layers and three fully- is conducted within and outside the enclave with different batch
connected layers. This model can use batch normalization layers sizes (1, 8, 16, and 20), and the time costs of the training

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
KALAPAAKING et al.: BLOCKCHAIN-BASED FEDERATED LEARNING WITH SECURE AGGREGATION 1711

TABLE IV
COMPARISON OF MACHINE LEARNING MODEL ACCURACY IN FEDERATED
LEARNING PROCESS WHEN USING NORMAL CPU AND SGX

cost increases gradually for the FL process with and without

SGX-based aggregation. When comparing the results of normal
CPU and SGX based approach, the time differs about 70 ms
with 10 edge servers and 91 ms with 40 edge servers.
Fig. 11(b) shows the time required to execute both the veri-
fication and deployment of the global model in our blockchain
Fig. 10. Processing time of training process with and without SGX for
network. In this experiment, the TEE aggregates all the mod-
different number of batch size using various machine learning models els from the edge server to form a global model. The global
and datasets. (a) LeNet - Fashion MNIST. (b) VGG16 - CIFAR-10. model is then verified and deployed in the blockchain network.
(c) AlexNet - CIFAR 10. (d) LeNet - MNIST.
Our simulation tested the performance using several blockchain
nodes ranging from 5 to 20. The deployment phase requires
roughly 100 ms (with 5 blockchain nodes) to 230 ms (with
20 blockchain nodes). The verification phase is faster than
the deployment phase and requires 60 ms and 180 ms with
5 and 20 blockchain nodes, respectively. The processing times of
both phases increase linearly with the increment of blockchain
nodes.
Table IV shows the results of testing our framework to see the
effect when we apply the machine learning model in a federated
way inside the enclave and standard CPU. In this experiment,
Fig. 11. Processing time (a) for the federated learning process using all the datasets have 28 × 28 pixels and 128 batch size. We
LeNet model [29] with Fashion MNIST datasets [35] with different num- ran the experiment with 50 training iterations. The experimental
ber of nodes, and (b) for adding the global model to the blockchain with
different number of blockchain nodes.
results show that the differences in the accuracy of the proposed
methodology and two benchmark methods proposed in [14]
and [15]. Initially, we record the accuracies of our proposed
method with and without SGX. The accuracies of the aforemen-
processes are shown in Fig. 10(a). The time cost of the LeNet tioned methods are obtained by applying various CNN models
machine learning model with Fashion MNIST datasets running on different datasets. According to the results, the accuracies
outside the enclave starts from 7.2 s for one batch size. The are reduced by 2.2% to 2.9% when SGX is used. Later, we
time cost increases linearly to 8.7 s for 16 batch size. Fig. 10(b) measure the accuracies of Myelin [14] and Chiron [15] with
shows the time costs of VGG-16 with CIFAR 10 datasets. The and without SGX. Results show that accuracies of the Myelin
time cost is 1.1 s for batch size is 1 and 2.2 s for batch size and Chiron are lower than our proposed method. Moreover, the
16. The time costs increase slightly, keeping the same linear accuracies of Myelin and Chiron are reduced around 5.1% and
characteristics when the experiments are performed inside the 7.4% with SGX, respectively. Hence, our method has better
enclave with the same settings. The LeNet model requires 8.1 to accuracy compared to Myelin and Chiron.
9.4 s, while VGG-16 requires 1.5–2.9 s. The experiment results
show that the time cost increases for both inside and outside
enclave training when all the machine learning models use 20 D. Discussion
batch sizes. The time costs also increase if the number of images In this section, we summarize the performance of our pro-
in a batch increases. posed method. As discussed in Section V-C, we conducted a
Fig. 11(a) shows the required time for the FL process with dif- series of experiments to evaluate the efficacy of our proposed
ferent numbers of edge servers. In this experiment, we performed method. Based on the empirical results, the following conclu-
multiple FL processes that use normal aggregation and SGX- sions can be drawn.
based secure aggregation. We used pre-processed the Fashion 1) Privacy of local dataset: FL allows computational parties
MNIST dataset and the LeNet machine learning model with 128 to collaboratively learn a shared model while preserving
batch sizes for the experiment. We consider different number of all training data locally, separating the machine learning
edge servers ranging from 2 to 40. Results indicate that the time process from the storage of data in the central server.

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
1712 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 2, FEBRUARY 2023

The method is unlike traditional centralized machine VI. CONCLUSION

learning where local datasets are stored in one central
In this article, a blockchain and TEE-enabled FL framework
server. Therefore, FL can ensure the privacy of the client’s
was proposed for IoT. The main objective of this framework was
sensitive data.
to ensure the trustworthy aggregation of local models to obtain a
2) Privacy of local training model: In our framework, the
global model. The aggregation was done within the blockchain
local training model is encrypted using a shared key
network. The proposed framework leveraged the Intel SGX-
before it is sent to the blockchain node. The shared key is
based TEE to ensure secure aggregation where each blockchain
established using a secure key-exchange protocol. Later,
node executed the aggregation task. In this framework, each
the local training model will be decrypted inside the
blockchain node was equipped with an SGX-enabled processor
enclave for secure aggregation. As the local model is
that securely generates a global model to ensure trustworthi-
encrypted, model inversion attacks [39], and parameter
ness. Later, the global model was verified by the blockchain
stealing [40] cannot be performed on a local model by an
network via a consensus mechanism before it was added to the
adversary.
blockchain, thereby maintaining tamperproof storage. Users of
3) TEE-based secure aggregation: In FL, aggregation is
the global model could access it and verified its integrity only
typically performed on a normal server. Several re-
through the blockchain network. We used different CNN-based
searchers [6], [7] have proposed a differential privacy
algorithms with several benchmark datasets to generate local
(DP) method to secure the model during the aggrega-
models and aggregate them under FL settings. We conducted
tion process. However, DP will significantly reduce the
several experiments that showed that our proposed framework’s
accuracy of the global model. Table IV shows that the
processing time was almost similar to that of the original FL
use of secure TEE-based aggregation can overcome this
model. In addition, our framework had only around 2% less
problem while maintaining the privacy of the model. As
accuracy compared to the original FL model. It was essential
the aggregation is performed in the TEE, adversaries
to mention that this framework had leveraged a hash-based
cannot tamper with or steal the model parameters during
consensus mechanism to ensure the model’s integrity. In the
the aggregation process. As blockchain technology is
future, we intend to develop an efficient consensus mechanism
being used with emerging technologies, such as drones
for the proposed TEE and blockchain-based FL framework in
[41]–[43], the proposed blockchain and TEE-based
order to make it more practical. In this article, we assumed
model aggregation in FL would enhance the trust in
that all participants performed homogeneous tasks and used
applications where drones are used as edge intelligence
same approach to generate their respective local models. Each
in FL [24], [25].
participant used their own private dataset and the FL architecture
4) Resilience of the global model: Blockchain is a decen-
to obtain a global model. However, we plan to extend our current
tralized technology that can maintain data integrity by
work in the future to support heterogeneous tasks in blockchain-
means of an extensive network that can withstand se-
based federated learning with TEE-based secure aggregation.
curity breaches from untrusted parties. In the proposed
framework, we use blockchain to store the global model
after the aggregation process in the TEE. This decentral-
ization makes it almost impossible for an adversary to REFERENCES
compromise the network. Moreover, model updates are [1] M. Alazab, S. P. RM, M. Parimala, P. K. R. Maddikunta, T. R. Gadekallu,
protected by digital signatures and hashes. Hence, the and Q.-V. Pham, “Federated learning for cybersecurity: Concepts, chal-
adversary cannot tamper with or contaminate the global lenges and future directions,” IEEE Trans. Ind. Inform., vol. 18, no. 5,
pp. 3501–3509, May 2022.
model since this will change the hash value. [2] L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov, “Exploiting
5) Model performance: Although our proposed method can unintended feature feakage in collaborative learning,” in Proc. IEEE Symp.
ensure the privacy of the model and the security of the Secur. Privacy, 2019, pp. 691–706.
[3] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated learning:
aggregation process, performance is still a crucial metric Challenges, methods, and future directions,” IEEE Signal Process. Mag.,
for measuring the quality of the framework. The experi- vol. 37, no. 3, pp. 50–60, May 2020.
mental results show that the performance of the proposed [4] L. Yin, J. Feng, H. Xun, Z. Sun, and X. Cheng, “A privacy-preserving
federated learning for multiparty data sharing in social IoTs,” IEEE Trans.
framework is better than that of the baseline model. Our Netw. Sci. Eng., vol. 8, no. 3, pp. 2706–2718, Jul.–Sep. 2021.
proposed framework is different from Tramer et al.[12], [5] Y. Liu, J. Nie, X. Li, S. H. Ahmed, W. Y. B. Lim, and C. Miao, “Federated
Juvekar et al. [13], Hynes et al. [14], and Hunt et al. learning in the sky: Aerial-ground air quality sensing framework with
UAV swarms,” IEEE Internet Things J., vol. 8, no. 12, pp. 9827–9837,
[15] where the whole training process occurs inside the Jun. 2021.
enclave for a single deep-learning model. On the other [6] K. Wei et al., “Federated learning with differential privacy: Algorithms
hand, our framework uses an FL setup, and only the aggre- and performance analysis,” IEEE Trans. Inf. Forensics Secur., vol. 15,
pp. 3454–3469, 2020.
gation is performed inside the enclave. We also examine [7] Y. Zhao et al., “Local differential privacy-based federated learning for
the reduction of our model’s accuracy when we leverage Internet of Things,” IEEE Internet Things J., vol. 8, no. 11, pp. 8836–8853,
TEE. Our proposed method has only up to 3% accuracy Jun. 2021.
[8] B. Zhao, K. Fan, K. Yang, Z. Wang, H. Li, and Y. Yang, “Anonymous
reduction compared to Myelin [14], and Chiron [15] that and privacy-preserving federated learning with industrial Big Data,” IEEE
have more than 5% and 7% accuracy reduction, respec- Trans. Ind. Inform., vol. 17, no. 9, pp. 6314–6323, Sep. 2021.
tively. In other words, our proposed framework achieves [9] Y. Li, Y. Zhou, A. Jolfaei, D. Yu, G. Xu, and X. Zheng, “Privacy-preserving
federated learning framework based on chained secure multiparty comput-
a good balance between privacy and model performance. ing,” IEEE Internet Things J., vol. 8, no. 8, pp. 6178–6186, Apr. 2021.
Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
KALAPAAKING et al.: BLOCKCHAIN-BASED FEDERATED LEARNING WITH SECURE AGGREGATION 1713

[10] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to [36] A. Krizhevsky and G. Hinton, “Convolutional deep belief networks on
backdoor federated learning,” in Proc. Int. Conf. Artif. Intell. Statist., 2020, CIFAR-10,” Unpublished Manuscript, vol. 40, no. 7, pp. 1–9, 2010.
pp. 2938–2948. [37] L. Deng, “The MNIST database of handwritten digit images for machine
[11] O. Ohrimenko et al., “Oblivious multi-party machine learning on trusted learning research [Best of the Web],” IEEE Signal Process. Mag., vol. 29,
processors,” in Proc. 25th {USENIX} Secur. Symp., 2016, pp. 619–636. no. 6, pp. 141–142, Nov. 2012.
[12] F. Tramer and D. Boneh, “Slalom: Fast, verifiable and private execution of [38] C. Szegedy, S. Ioffe, V. Vanhoucke, and A. A. Alemi, “Inception-v4,
neural networks in trusted hardware,” in Int. Conf. Learn. Representations, inception-resnet and the impact of residual connections on learning,” in
2019. Proc. 31st AAAI Conf. Artif. Intell., 2017, pp. 4278–4284.
[13] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan, “{GAZELLE}: A [39] M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that
low latency framework for secure neural network inference,” in Proc. 27th exploit confidence information and basic countermeasures,” in Proc. 22nd
{USENIX} Secur. Symp., 2018, pp. 1651–1669. ACM SIGSAC Conf. Comput. Commun. Secur., 2015, pp. 1322–1333.
[14] N. Hynes, R. Cheng, and D. Song, “Efficient deep learning on multi-source [40] B. Wang and N. Z. Gong, “Stealing hyperparameters in machine learning,”
private data,” 2018, arXiv:1807.06689. in Proc. IEEE Symp. Secur. Privacy, 2018, pp. 36–52.
[15] T. Hunt, C. Song, R. Shokri, V. Shmatikov, and E. Witchel, [41] M. S. Rahman, I. Khalil, and M. Atiquzzaman, “Blockchain-powered
“Chiron: Privacy-preserving machine learning as a service,” 2018, policy enforcement for ensuring flight compliance in drone-based service
arXiv:1803.05961. systems,” IEEE Netw., vol. 35, no. 1, pp. 116–123, Jan./Feb. 2021.
[16] A. Ali et al., “Security, Privacy, and reliability in digital healthcare systems [42] S. H. Alsamhi, O. Ma, M. S. Ansari, and F. A. Almalki, “Survey on
using blockchain,” Electronics, vol. 10, no. 16, 2021, Art. no. 2034. collaborative smart drones and Internet of Things for improving smartness
[17] Y. Zhao et al., “Privacy-preserving blockchain-based federated learning of smart cities,” IEEE Access, vol. 7, pp. 128125–128152, 2019.
for IoT devices,” IEEE Internet Things J., vol. 8, no. 3, pp. 1817–1829, [43] M. S. Rahman, I. Khalil, and M. Atiquzzaman, “Blockchain-enabled SLA
Feb. 2021. compliance for crowdsourced edge-based network function virtualiza-
[18] Y. Qu, S. R. Pokhrel, S. Garg, L. Gao, and Y. Xiang, “A blockchained tion,” IEEE Netw., vol. 35, no. 5, pp. 58–65, Sep./Oct. 2021.
federated learning framework for cognitive computing in Industry 4.0
networks,” IEEE Trans. Ind. Inform., vol. 17, no. 4, pp. 2964–2973,
Apr. 2021.
[19] Y. Lu, X. Huang, K. Zhang, S. Maharjan, and Y. Zhang, “Communication- Aditya Pribadi Kalapaaking received the
efficient federated learning and permissioned blockchain for digital twin bachelor’s degree in computer science (Hons.)
edge networks,” IEEE Internet Things J., vol. 8, no. 4, pp. 2276–2288, in 2020 from RMIT University, Melbourne,
Feb. 2021. Australia, where he.is currently working toward
[20] L. Feng, Y. Zhao, S. Guo, X. Qiu, W. Li, and P. Yu, “Blockchain-based the Ph.D. degree in computer science with the
asynchronous federated learning for Internet of Things,” IEEE Trans. School of Computing Technologies.
Comput., vol. 71, no. 5, pp. 1092–1103, May 2022. His research interests include machine learn-
[21] H. Kim, J. Park, M. Bennis, and S.-L. Kim, “Blockchained on-device ing, privacy-preserving techniques, cybersecu-
federated learning,” IEEE Commun. Lett., vol. 24, no. 6, pp. 1279–1283, rity, edge computing, distributed system, and
Jun. 2020. blockchain.
[22] R. Kumar et al., “Blockchain-federated-learning and deep learning models
for COVID-19 detection using CT imaging,” IEEE Sensors J., vol. 21,
no. 14, pp. 16301–16314, Jul. 2021.
[23] O. Samuel et al., “IoMT: A COVID-19 healthcare system driven by
federated learning and blockchain,” IEEE J. Biomed. Health Inform., to Ibrahim Khalil received the Ph.D. degree in
be published, doi: 10.1109/JBHI.2022.3143576. computer science from the University of Berne,
[24] S. H. Alsamhi et al., “Drones’ edge intelligence over smart environments Berne, Switzerland, in 2003.
in B5G: Blockchain and federated learning synergy,” IEEE Trans. Green He is currently a Professor with the School of
Commun. Netw., vol. 6, no. 1, pp. 295–312, Mar. 2022. Computing Technologies, RMIT University, Mel-
[25] S. Otoum, I. A. Ridhawi, and H. Mouftah, “A federated learning bourne, VIC, Australia. He has several years
and blockchain-enabled sustainable energy-trade at the edge: A frame- of experience in Silicon Valley, California-based
work for industry 4.0,” IEEE Internet Things J., to be published, networking companies, as a Software Engineer
doi: 10.1109/JIOT.2022.3140430. working on secure network protocols and smart
[26] Y. Qu et al., “Decentralized privacy using blockchain-enabled federated network provisioning. He was also with EPFL
learning in fog computing,” IEEE Internet Things J., vol. 7, no. 6, and the University of Berne and Osaka Uni-
pp. 5171–5183, Jun. 2020. versity, Osaka, Japan, before joining RMIT University. In the past, he
[27] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, also worked on distributed systems, e-health, wireless and body sensor
“Communication-efficient learning of deep networks from decentralized networks, biomedical signal processing, network security. His research
data,” in Proc. Artif. Intell. Statist., 2017, pp. 1273–1282. interests include privacy, blockchain, secure AI, and data analytics.
[28] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “ImageNet classification Dr. Ibrahim is the Chief Investigators of a few prestigious ARC discov-
with deep convolutional neural networks,” Commun. ACM, vol. 60, no. 6, ery and linkage grants on blockchain and privacy awarded in Australia
pp. 84–90, 2017. between 2017 and 2021. He was the recipient of international European
[29] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learn- grants, industry grants, and QNRF grant from Qatar.
ing applied to document recognition,” Proc. IEEE, vol. 86, no. 11,
pp. 2278–2324, Nov. 1998.
[30] K. Simonyan and A. Zisserman, “Very deep convolutional networks for
large-scale image recognition,” in Proc. 3rd Int. Conf. Learn. Representa-
tions, Y. Bengio and Y. LeCun, Eds., San Diego, CA, USA, 2015. Mohammad Saidur Rahman received the
[31] V. Costan and S. Devadas, “Intel SGX Explained,” IACR Cryptology ePrint B.Sc. degree in computer engineering and the
Arch., vol. 2016, no. 86, pp. 1–118, 2016. M.Sc. degree in computer science from the
[32] A. Paszke et al., “Pytorch: An imperative style, high-performance deep American International University-Bangladesh
learning library,” Adv. Neural Inf. Process. Syst., vol. 32, pp. 8026–8037, (AIUB) of Dhaka, Dhaka, Bangladesh, in 2007
2019. and 2009, respectively, and the Ph.D. degree in
[33] A. Ziller et al., “PySyft: A library for easy federated learning,” in Federated computer science from the School of Science,
Learning Systems. Berlin, Germany: Springer, 2021, pp. 111–139. RMIT University, Melbourne, VIC, Australia, in
[34] C.-C. Tsai, D. E. Porter, and M. Vij, “Graphene-SGX: A practical library 2020.
{OS } for unmodified applications on {SGX},” in Proc. {USENIX} Annu. He is currently a Research Associate with the
Tech. Conf., 2017, pp. 645–658. School of Computing Technologies, RMIT Uni-
[35] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-MNIST: A novel im- versity. He was a Faculty Member with AIUB before starting his Ph.D.
age dataset for benchmarking machine learning algorithms,” 2017, His current research interests include blockchain, data privacy, lossless
arXiv:1708.07747. data hiding, Internet of Things (IoT), and service computing.

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.
1714 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 2, FEBRUARY 2023

Mohammed Atiquzzaman (Senior Member) Mahathir Almashor received the Ph.D. degree
received the M.S. and Ph.D. degrees in electri- in computer science from RMIT University, Mel-
cal engineering and electronics from the Univer- bourne, VIC, Australia, in 2013.
sity of Manchester, Manchester, U.K., in 1984 He is a Senior Research Scientist with
and 1987, respectively. CSIRO’s Data61 and Cyber Security Cooper-
He currently holds the Edith Kinney Gay- ative Research Centre, Black Mountain, ACT,
lord Presidential Professorship with the School Australia, with a background in software engi-
of Computer Science, University of Oklahoma, neering research and data science. After his
Norman, OK, USA. His research interests in- Ph.D., his talents have afforded him opportu-
clude communications switching, transport pro- nities at industry leaders such as Seeing Ma-
tocols, wireless and mobile networks, satellite chines and IBM Research. Prior work includes
networks, and optical communications. traffic simulators, machine-vision, distributed systems, and antiphishing
Dr. Atiquzzaman is the Editor-in-Chief of the Journal of Networks and techniques. Recent focus has been on the capture, analysis and visu-
Computer Applications, Founding Editor-in-Chief of Vehicular Commu- alization of billions of records within distributed Python and DB frame-
nications, and has served/serving on the editorial boards of various works. He is currently with the Smart Shield antiphishing project, which
IEEE journals and cochaired numerous IEEE international conferences is jointly supported by Data61, Cyber Security Cooperative Research
including IEEE Globecom. Centre, and the West Australian Government.

Xun Yi received the Ph.D. degree in engineer-

ing from Xidian University, Xi’an, China, in 1995.
He is currently a Full Professor of Cyber-
security with the School of Computing Tech-
nologies and with the School of Science, RMIT
University, Melbourne, VIC, Australia. He has
authored or coauthored more than 200 research
papers in international journals and conference
proceedings. His research interests include
applied cryptography, computer and network se-
curity, mobile and wireless communication se-
curity, and data privacy protection.
Prof. Yi has served as program committee members for more than
30 international conferences. Recently, he has led some Australia Re-
search Council Discovery Projects in Data Privacy Protection. From
2014 to 2018, he was an Associate Editor for IEEE TRANSACTIONS ON
DEPENDABLE AND SECURE COMPUTING.

Authorized licensed use limited to: The University of British Columbia Library. Downloaded on June 06,2023 at 19:00:25 UTC from IEEE Xplore. Restrictions apply.