arXiv CSopen access

CHRONOS: A Hardware-Assisted Phase-Decoupled Framework for Secure Federated Learning in IoT

UNDER REVIEW

CHRONOS: A Hardware-Assisted Phase-Decoupled Framework for Secure Federated Learning in IoT

arXiv:2604.19053v1 [cs.CR] 21 Apr 2026

Hung Dang School of Technology, Van Lang University, Ho Chi Minh City, Vietnam | Correspondence: Hung Dang ([email protected]) Keywords: Federated Learning, Secure Aggregation, IoT, TrustZone, SMPC

ABSTRACT Learning-based systems are increasingly deployed on gateway-class Internet of Things (IoT) devices, where preserving the privacy of distributed sensing data is of paramount importance. While federated learning enables collaborative model training without sharing raw data, the exchanged gradient updates remain susceptible to gradient inversion attacks. Existing defenses based on Secure Multiparty Computation (SMPC) impose prohibitive communication overhead by requiring multiple interactive rounds during the latency-critical training phase, rendering them impractical for IoT deployments with strict per-round energy and latency budgets. We propose CHRONOS, a hardware-assisted framework that decouples the cryptographic setup required for private gradient aggregation from the active training phase. CHRONOS executes a once-per-epoch server-relayed Diffie-Hellman key exchange during a device’s idle window. It generates ephemeral keypairs and derives encryption and PRG keys entirely within an ARM TrustZone enclave, ensuring private keys never exist in Normal World memory. The pairwise Diffie-Hellman shared secrets are sealed in the enclave, and Shamir secret shares of the ephemeral private key are distributed to peers. This enables any 𝑡 surviving peers (where 𝑡 is the reconstruction threshold) to assist the server in recovering the private key of a dropped client to reconstruct its mask. During training, clients mask gradients with a single stream-cipher evaluation and transmit them in one communication round in the common case (one additional round under recovery). A hardware-backed round counter enforces single-use freshness. When 𝑘 ≤ 𝑁 − 𝑡 clients drop out mid-round, the server reconstructs their masks from peer-held Shamir shares with a negligible recovery payload of 𝑘 × 32 bytes per surviving client, preserving correct aggregation without repeating the round. We evaluate CHRONOS on Rock Pi 4 devices using OP-TEE against secure aggregation, secure multiparty computation, and plaintext baselines. We empirically validate privacy against state-of-the-art gradient inversion attacks, demonstrating that CHRONOS reduces reconstruction fidelity to random noise (PSNR ≈8 dB). Our results show that CHRONOS achieves OS-level compromise resistance at modest overhead over plaintext cost, reducing active-phase aggregation latency by up to 74% compared to synchronous secure aggregation for 20 clients. The system maintains a persistent Secure World storage footprint of fewer than 700 bytes per device for our 20-client cohort, independent of model dimension or training horizon, and tolerates up to 𝑁 −𝑡 mid-round dropouts.

1

Introduction

Recent years have witnessed the rapid proliferation of gatewayclass IoT devices across domains as diverse as smart energy management, healthcare monitoring, and industrial automation. A prominent approach for extracting intelligence from the distributed data these devices generate is federated learning (FL) [1], which enables a population of clients to collaboratively train a shared model without transmitting their raw measurements to a

central server. In IoT settings, where data pipelines routinely handle fine-grained personal measurements, this privacy framing is especially attractive for applications ranging from device fingerprinting [2] to healthcare monitoring. Recent systematic reviews highlight the critical role of privacy preservation in such distributed learning environments, identifying cryptographic techniques as a foundational pillar for secure IoT deployments [3, 4].

1 of 18

Nonetheless, privacy-preserving federated learning faces various challenges. Gradient inversion attacks reconstruct training samples with high fidelity from the gradient updates a client transmits to the server. Under an honest-but-curious server model, iterative optimization techniques successfully recover pixel-accurate images from single-sample gradients [5], while adaptive attacks exploit the statistical structure of the gradient distribution to tighten reconstructions further [6]. If the adversary is upgraded to an actively malicious server, language-guided inversion techniques can even recover high-fidelity reconstructions and associated sensitive attributes from a single round of gradient exchange on large models [7]. Plaintext gradient exchange is therefore equivalent, from a privacy standpoint, to direct transmission of training data. To mitigate these threats, Bonawitz et al. presented Secure Aggregation (SecAgg) [8] construction in which a client 𝑖 would apply a pseudorandom mask to their gradients 𝑔𝑖 in such a ∑ way that a central server can recover 𝑖 𝑔𝑖 from the masked gradients without learning any individual 𝑔𝑖 . Standard SecAgg establishes the pairwise seeds via an interactive key-agreement sub-protocol that executes during the active training round, imposing an 𝑂(𝑁 2 ) communication overhead for a population of 𝑁 clients. For IoT devices operating under strict per-round latency and energy budgets, this interactive cost is prohibitive. In fact, a recent survey explicitly identifies synchronous cryptographic communication during the training phase as the primary barrier to Privacy-Preserving Machine Learning (PPML) adoption in resource-constrained edge environments [9, 10]. Whereas existing approaches perform this step synchronously, we observe that the pairwise key establishment in SecAgg is data-independent: it requires no knowledge of the gradient and need not happen during the training round. This observation is especially relevant in IoT deployments. In particular, IoT devices alternate between active sensing windows, which have strict latency budgets, and idle windows (maintenance periods, scheduling gaps, or battery charging intervals) where background computation is less constrained. This temporal structure accommodates a key-agreement phase that runs during the idle window, thereby minimizing communications and computations overhead incurred by the gradient masking in the latency-critical active phase. We propose CHRONOS, a hardware-assisted framework for private federated learning that acts on the aforementioned observation. Specifically, CHRONOS leverages a Trusted Execution Environment (TEE) to ensure OS-level compromise resistance: the system guarantees gradient confidentiality even if the host operating system of the IoT devices is compromised. In the idle phase, each client generates an ephemeral elliptic-curve keypair inside the TrustZone Trusted Application (TA), ensuring that the private key never exists in Normal World memory. The clients then conduct a Diffie-Hellman key exchange to establish pairwise masking seeds, which are sealed inside the TA. In addition, each client distributes Shamir secret shares of its ephemeral private key 𝑠𝑘 𝑖 to its peers to enable dropout recovery. In the active phase, the TA derives the current round’s pseudorandom mask from the stored seeds and a hardware-backed round counter, enabling the client to mask its gradient and transmit in one communication

2 of 18

round in the no-dropout common case. By omitting secondary self-masks, we trade active false-dropout resilience for strict oneround performance, relying on periodic epoch-level key rotation to bound exposure. This architectural choice of "TEE-minimalism," using the hardware enclave only for seed management and freshness enforcement rather than the entire training process, provides three critical systems-level advantages. First, hardware-isolated confidentiality: unlike software-only pre-computation schemes (e.g., our CHRONOS-SW ablation), CHRONOS ensures that an adversary with privileged access to the Normal World of the devices cannot extract pairwise seeds or unmask future gradients. Second, hardware-enforced freshness: the TEE prevents the host OS from rewinding the round counter to reuse masks. Third, minimal persistent TEE memory pressure: by permanently shielding only 632 bytes of key material rather than storing megabytes of model parameters, CHRONOS eliminates the enclave paging overhead inherent to full-TEE FL frameworks such as PPFL [11]. The transient runtime working set scales only with the model dimension and remains well within standard IoT hardware constraints. In summary, we make the following contributions in this paper: ∙ We identify the idle-window structure for IoT device duty cycles and show how it enables a once-per-epoch cryptographic setup phase that eliminates per-round interaction from the latency-critical active phase. ∙ We design and implement CHRONOS, a hardware-assisted framework for private federated learning that features constant-size TEE memory footprint regardless of the number of clients participating in the system. ∙ We conduct extensive experiments on Rock Pi 4 devices to evaluate the performance of our design. The evaluation demonstrates that CHRONOS achieves hardwareisolated resilience against client-side OS compromise at a modest overhead. Furthermore, it provides an activephase aggregation latency reduction of up to 74% for small IoT-representative models compared to traditional, software-only secure aggregation (SecAgg). We provide a rigorous security-gap analysis showing how CHRONOS provides strictly stronger hardware-isolated guarantees than software-only pre-computation solutions (e.g., our CHRONOS-SW ablation) for a modest absolute latency penalty (≈41–99 ms) to gain genuine rollback resistance, while maintaining a persistent Secure World storage footprint of fewer than 700 bytes. The rest of this paper is organised as follows. Section 2 provides background on federated learning, additive masking technique to enhance privacy in federated learning, the idle-window model, and ARM TrustZone. Section 3 reviews prior works. Section 4 presents the CHRONOS architecture. Section 5 provides the security analysis. Section 6 describes the implementation. Section 7 presents the experimental evaluation. Section 8 discusses limitations and future work, before Section 9 concludes our work.

,

2 2.1

Background Federated Learning

Let us consider a federated learning system comprising a single central aggregation server and 𝑁 distributed clients, where each client operates as an Internet of Things (IoT) edge device. Each IoT device 𝑖 ∈ {1, … , 𝑁} collects and maintains its own local, privacy-sensitive dataset 𝐷𝑖 , which typically consists of fine-grained sensor measurements. Under this architecture, the raw local datasets never leave the physical boundaries of their respective devices. Instead, the central server orchestrates the collaborative training process by exchanging only model parameters and locally computed updates over the network. The FederatedAveraging Algorithm (FedAvg) proposed by McMahan et al. [1] is one of the most prominent approach for federated learning. In each training round 𝑟, the central server broadcasts the current global model weights 𝑤 (𝑟) to a subset of participating clients 𝑆𝑟 . Each participating client 𝑖 computes a local model update 𝑔𝑖 by performing stochastic gradient descent on its own local dataset 𝐷𝑖 using 𝑤 (𝑟) as the initial weight. The clients then send their computed local updates to the server, which aggregate them into a new global model 𝑤 (𝑟+1) : 𝑤 (𝑟+1) = 𝑤 (𝑟) − 𝜂

∑ 𝑖∈𝑆𝑟

∑

|𝐷𝑖 | 𝑔𝑖 |𝐷𝑗 | 𝑗∈𝑆

(1)

𝑟

in which 𝜂 is the learning rate. For simplicity of exposition, the rest of this paper will refer to this local update interchangeably as the local gradient 𝑔𝑖 . Nonetheless, various works have shown that an adversary observing 𝑔𝑖 in plaintext is able to derive certain information about its corresponding local dataset 𝐷𝑖 . Gradient inversion attacks could establish pixel-accurate image reconstructions from singlesample gradients via iterative optimisation [5]. This threat has since advanced significantly; adaptive attacks exploit the statistical structure of the gradient distribution to tighten reconstructions further under an honest-but-curious threat model [6]. Furthermore, if the adversary is upgraded to an actively malicious server capable of crafting malicious global models, languageguided inversion techniques can recover high-fidelity reconstructions and associated sensitive attributes from a single round of gradient exchange [7]. In IoT settings, where clients transmit gradients trained on fine-grained ambient measurements (occupancy profiles, physiological signals, energy consumption traces), the consequences of a successful inversion are severe.

2.2

Additive Masking

A standard approach to concealing individual gradients from the aggregation server while preserving the aggregate is additive masking with pairwise cancellation. Each client 𝑖 adds a pseudorandom mask 𝑚𝑖 to its gradient before transmission, where the masks are constructed so that they cancel in the sum: 𝑁 ∑ 𝑖=1

𝑚𝑖 = 𝟎 (mod 𝑝)

where 𝑝 is a quantization modulus chosen to be sufficiently large ∑ ∑ to prevent overflow during aggregation. Since 𝑖 (𝑔𝑖 +𝑚𝑖 ) = 𝑖 𝑔𝑖 , the server recovers the correct aggregate gradient without learning any information about individual 𝑔𝑖 , for each masked value (𝑔𝑖 + 𝑚𝑖 ) is pseudorandom from the server’s perspective. Pairwise PRG construction. The standard realisation of this scheme [8] assigns a shared pseudorandom generator (PRG) seed 𝑠𝑖𝑗 = 𝑠𝑗𝑖 to each pair of clients (𝑖, 𝑗) with 𝑖 ≠ 𝑗, established via Diffie-Hellman key agreement. Client 𝑖’s mask for round 𝑟 is: 𝑚𝑖 (𝑟) =

∑ 𝑗>𝑖

PRG(𝑠𝑖𝑗 , 𝑟) −

∑ 𝑗<𝑖

PRG(𝑠𝑗𝑖 , 𝑟)

(mod 𝑝)

(2)

where PRG(𝑠, 𝑟) ∈ 𝔽𝑑𝑝 denotes the output of a pseudorandom generator seeded with 𝑠 and indexed by round counter 𝑟, and 𝑑 is the dimension (number of parameters) of the global model. ∑ By construction, 𝑖 𝑚𝑖 (𝑟) = 0 for all 𝑟, for each PRG output PRG(𝑠𝑖𝑗 , 𝑟) appears with a positive sign in 𝑚𝑖 and a negative sign in 𝑚𝑗 . Phase-decoupled structure. The computation of 𝑚𝑖 (𝑟) requires only the seeds {𝑠𝑖𝑗 }𝑗≠𝑖 and the round index 𝑟; it is dataindependent and does not require knowledge of the local dataset 𝐷𝑖 or the gradient 𝑔𝑖 . The key establishment step (the DH key exchange that produces {𝑠𝑖𝑗 }) is therefore separable from the active training phase. In particular, this separation is the structural insight that CHRONOS exploits: key establishment is a once-perepoch cost that can be executed during any resource-abundant idle period, leaving the active phase as a single masked-gradient exchange requiring only 𝑂(𝑑) work per client.

2.3

IoT Device Constraints

The class of devices targeted by CHRONOS comprises ARM Cortex-A class single-board computers and edge gateways, such as the Rock Pi 4, NVIDIA Jetson Nano, and similar platforms, that aggregate data from local sensor networks in IoT deployments. These gateway-class devices are characterised by intermittent network connectivity, strict per-round latency and energy budgets during active sensing, and periods of reduced activity during which heavier background tasks can be scheduled. We define the idle-window model as a two-state abstraction: ∙ Idle state. The device is not actively sensing or participating in a training round. Computational and network resources are comparatively abundant. For battery-operated devices, the idle state often coincides with a charging window; for mains-powered devices (smart meters, industrial gateways), it corresponds to a scheduled off-peak maintenance window. The idle state is the natural site for the once-per-epoch DH key establishment. ∙ Active state. The device is sampling sensors, computing gradients, and participating in a federated training round. Latency and energy budgets are strict; background cryptographic tasks must not interfere with the real-time sensing pipeline. This abstraction is more general than a battery-charging model: it applies to any device that alternates between high-demand

3 of 18

and low-demand operational periods, regardless of power source. Specifically, the key insight of CHRONOS is that the DH key establishment phase requires 𝑂(𝑁) cryptographic operations and network exchanges per client. While this is prohibitively expensive during a latency-critical active sensing phase, it easily fits within the resource budget of a typical idle window. By shifting this burden to the idle state, CHRONOS completely eliminates cryptographic interaction from the active phase.

2.4

ARM TrustZone and OP-TEE

ARM TrustZone is a hardware-based security architecture that partitions the processor into two execution environments: the Normal World for the host OS and applications, and the Secure World for trusted services [12]. This isolation is enforced at the hardware level, with a dedicated bit in the system bus (the NS bit) indicating the security state of every memory and peripheral access. The Secure World maintains its own isolated memory regions and secure peripherals, which are inaccessible to the Normal World even if the host OS is compromised. We use OP-TEE (Open Portable Trusted Execution Environment) [13], an open-source Trusted OS for ARM Cortex-A processors. The CHRONOS Trusted Application (TA) runs within OP-TEE, leveraging GlobalPlatform TEE APIs to manage cryptographic keys and perform high-performance mask generation. It implements the GlobalPlatform TEE Internal Core API, enabling Trusted Applications (TAs) written in C to execute exclusively in the Secure World. In CHRONOS, TrustZone serves two roles. First, it provides seed secrecy: the pairwise DH seeds {𝑠𝑖𝑗 } stored in Secure World are inaccessible to any Normal World process, including a compromised operating system. An adversary who fully owns the Normal World software stack still cannot extract the seeds and reconstruct the individual masks 𝑚𝑖 (𝑟). Second, it provides round-counter integrity: the per-client round counter 𝐶, which indexes the PRG and prevents mask reuse, is maintained entirely in the Secure World and cannot be forged, rewound, or duplicated by a Normal World attacker. We scope CHRONOS’s implementation and evaluation to CortexA devices with OP-TEE. For Cortex-M microcontrollers, the equivalent framework is Trusted Firmware-M (TF-M), which provides analogous GlobalPlatform TEE APIs. Because the perdevice pairwise seed storage in CHRONOS scales linearly as 𝑂(𝑁) (amounting to only a few kilobytes for typical IoT network sizes (Section 4.3)), the design easily fits within the strict secure memory limits of MCUs and is directly portable to TF-M with minor API adaptations. We discuss the MCU portability constraint further in Section 8.

3

Related Work

The integration of Privacy-Preserving Machine Learning (PPML) into IoT environments requires navigating strict computational, network, and security constraints. We analyze the existing literature by isolating the specific architectural bottlenecks that prior frameworks fail to overcome, thereby positioning CHRONOS

4 of 18

within the structural gap of hardware-isolated, phase-decoupled aggregation. The Synchronous Cryptographic Bottleneck Homomorphic Encryption (HE) and Secure Multiparty Computation (SMPC) represent the foundational approaches to cryptographic PPML. SecureML [14] combines HE and garbled circuits, yet HE operations remain prohibitively slow for IoT batch sizes [10]. SecureNN [15] improves throughput using arithmetic secret sharing but demands continuous synchronous connectivity, a requirement incompatible with intermittent IoT deployments. For federated learning specifically, SecAgg [8] protects gradients using a pairwise PRG masking construction identical to the core primitive in CHRONOS. However, SecAgg requires synchronous Shamir-share distribution every round, imposing an 𝑂(𝑁 2 ) server communication overhead, presenting a severe bottleneck for latency-critical IoT sensing phases. MicroSecAgg [16] reduces round complexity via a single-server model but retains the synchronous key establishment requirement. The SPDZ family (MASCOT [17], MP-SPDZ [18]) introduced the two-phase cryptographic paradigm via precomputed Beaver triples. However, because FL gradient aggregation is strictly additive, generating multiplication triples is unnecessary and computationally wasteful. CHRONOS replaces OT-based triple generation with a streamlined, once-per-epoch DH key exchange scheduled explicitly during device idle windows. The TEE Memory Bottleneck in Edge Environments Trusted Execution Environments (TEEs) offer hardwareenforced privacy guarantees. Early frameworks such as PPFL [11] utilize ARM TrustZone on the client and Intel SGX on the server, employing greedy layer-wise training to mitigate TEE memory limits. However, even with layer-wise training, processing large parameter chunks inside the typically 16 to 32 MB Secure World of IoT platforms triggers significant paging overheads. GradSec [19] attempts to reduce the trusted computing base by shielding only gradient tensors during the backward pass; nevertheless, it still processes these large structures within the TEE, incurring unacceptable memory pressure. ARM TrustZone has also been explored for secure data processing and shadow-stack protection in low-end embedded systems [20, 21, 22], alongside high-performance file sharing and privacy-preserving crowdsensing [23, 24]. CHRONOS distinguishes itself from full-TEE designs by adopting a principle of TEE-minimalism. It restricts TEE usage exclusively to sealing pairwise DH seeds and enforcing a monotonic round counter. This architectural constraint limits the persistent Secure World footprint to fewer than 700 bytes, entirely independent of model dimension and training horizon, eliminating memory paging overhead for edge gateways. Software-Based Precomputation and Compromise Resistance To mitigate synchronous communication costs, One-Shot Secure Aggregation (Hyb-Agg) [25] combines MK-CKKS homomorphic encryption with ECDH-based additive masking. HybAgg achieves one-shot aggregation but does not target client-side TEE isolation or rollback protection; furthermore, it lacks explicit

,

mechanisms to recover aggregated data if clients drop out midround without repeating the phase. To evaluate the baseline performance of software-only decoupled architectures, we construct an ablation (CHRONOS-SW) that isolates the phase-decoupled nature of CHRONOS but operates entirely in software, storing seeds and round counters in the Normal World filesystem. We employ CHRONOS-SW as an empirical proxy to quantify the performance parity and security gap of such software-only designs, which provide no protection against a compromised host operating system. CHRONOS bridges this gap by combining phase decoupling with hardware-isolated confidentiality. By generating the ephemeral private keys inside the TrustZone Trusted Application and sealing the resulting shared secrets, CHRONOS achieves OS-level compromise resistance. An adversary with root access to the Normal World cannot extract the seeds to decrypt future gradients, nor rewind the hardware-backed round counter to reuse masks.

4 4.1

CHRONOS Design System and Threat Model

System model and notation. Let 𝑁 be the number of federated learning clients, 𝐷 the model dimension, 𝑝 a prime defining the field 𝔽𝑝 , 𝑡 the Shamir reconstruction threshold (1 ≤ 𝑡 ≤ 𝑁 − 1), and 𝒫 = {(𝑖, 𝑗) ∶ 1 ≤ 𝑖 < 𝑗 ≤ 𝑁} the set of ordered client pairs. All field arithmetic is performed modulo 𝑝. The system comprises these 𝑁 IoT sensing devices (clients) and a central aggregation server. Each client device features a hardware-partitioned architecture consisting of a Normal World and a Secure World (e.g., ARM TrustZone). The Normal World runs the host operating system, manages the network stack, computes local gradients, and handles general application logic. The Secure World hosts a Trusted Application (TA) with hardwareisolated memory and execution, responsible exclusively for cryptographic setup, key sealing, and mask generation. The server coordinates the training rounds and computes the aggregate of the received masked gradients to update the global model. Adversary model. The primary adversary is an honest-butcurious server: the server executes the aggregation protocol faithfully, does not maliciously simulate dropouts to harvest keys, but attempts to infer private information from the masked gradients it receives. We also consider a passive network eavesdropper who observes all client-server communication. We assume that up to 𝑡 − 1 clients may collude with the server. This threshold preserves both the confidentiality of the ephemeral private keys (as 𝑡 shares are required for Shamir reconstruction) and the secrecy of the training data (as 𝑡 ≤ 𝑁 − 1 ensures every honest client shares a masking seed with at least one honest peer). Because the server acts as a central relay for client communication, it must be prevented from executing Man-in-the-Middle (MITM) attacks during key exchange. We assume the network operator has provisioned each device with a trusted root Certificate Authority (CA) public key during first-time enrollment in the IoT network. Finally, we assume the TrustZone Secure World is tamper-resistant: the adversary cannot compromise the Secure

World on any client device, even if the Normal World is fully controlled by the adversary. Security goals. CHRONOS targets four primary properties: 1. Data Confidentiality. The server learns the aggregate gra∑ dient 𝑖 𝑔𝑖 but cannot reconstruct any individual client gradient 𝑔𝑖 . A passive eavesdropper observing the active-phase traffic learns nothing about any 𝑔𝑖 . 2. OS-Level Compromise Resistance. The cryptographic guarantees of the system (confidentiality and freshness) must hold even against an adversary who has achieved full root-level compromise of the client’s Normal World execution environment. 3. Execution Freshness. Each mask value 𝑚𝑖 (𝑟) is consumed exactly once. The system must prevent a compromised Normal World OS from reusing a mask for two distinct rounds, which would otherwise allow the server to calculate the difference between two gradients (𝑔𝑖 − 𝑔𝑖′ ) and potentially leak private data. 4. Functional Correctness and Robustness. The global model update produced by the server must be identical to the update that would result from aggregating unmasked gradients. Additionally, the system must degrade gracefully: if a client has not completed key establishment, it drops out of the current round rather than transmitting an unprotected gradient.

4.2

Overview

CHRONOS separates the life cycle of a secure federated learning client into two temporally isolated phases, each mapped to a distinct operational state of the device. Idle-Phase (key establishment and share distribution). Since the device is not engaged in active sensing, computational resources are abundant. During this phase, the CHRONOS idle daemon activates and orchestrates a server-relayed DiffieHellman key exchange with every other client in the federation. Critically, the ephemeral keypair is generated inside the TrustZone Trusted Application (TA), so the private key 𝑠𝑘 𝑖 never exists in Normal World memory. Specifically, the TA computes all pairwise shared secrets, seals them under a device-unique key, and generates Shamir secret shares of the ephemeral private key 𝑠𝑘 𝑖 for distribution to peers; from these shares, any 𝑡 surviving peers can help the server recover 𝑠𝑘 𝑖 and thereby reconstruct the missing client’s mask. The shares (but never the seeds themselves) are exported to the Normal World for relay through the server. This phase runs exactly once per federation membership change or key-rotation epoch. Active-Phase (Mask Generation and Gradient Aggregation). The device is operating within a federated training round. The CHRONOS active-phase wrapper invokes the TA to derive the round-specific mask, applies it to the local gradient, and transmits the masked gradient in a single communication round (two rounds under recovery). If a client drops mid-round, the server

5 of 18

Transmit 𝑔̃𝑖 Aggregation Server

𝐶1

𝐶2

(1) Export 𝑝𝑘𝑖

(2) Receive {𝑝𝑘𝑗 }

𝐶3

…

𝐶𝑁

Normal World Host OS

Secure World TrustZone Enclave

Idle Daemon

Trusted App (TA)

Training Wrapper

Monotonic Counter 𝐶

IoT Device Cohort (𝑁) F I G U R E 1 | System model of CHRONOS. (Left) Overview of central aggregation server and a 𝑁-client cohort. (Right) Illustration of hardware architecture of a single client. The diagram maps the temporal phases of the protocol onto the hardware-isolated worlds of ARM TrustZone: the Secure World handles the once-per-epoch cryptographic setup (during Idle Phase, depicted in blue lines), while the Normal World manages the latency-critical gradient transmission (during Active Phase, depicted in purple line) using enclave-derived masks. The vertical red dashed line depicts the hardware isolation between the two worlds.

requests seed-reconstruction shares from surviving clients, reconstructs the missing client’s mask directly, and corrects the aggregate without repeating the round. The following subsections formalise each component.

Idle-Phase: Key Establishment, Seed Sealing, 4.3 and Share Distribution TEE-internal key generation. CHRONOS generates the ephemeral Diffie-Hellman keypair inside the TA via a dedicated GlobalPlatform TEE command (KEYGEN). The TA invokes the TEE’s built-in elliptic-curve key generation routine, exports only the public key 𝑝𝑘𝑖 to the Normal World, and retains the private key 𝑠𝑘𝑖 in Secure World memory. Because 𝑠𝑘𝑖 is generated within and never leaves the hardware boundary, a compromised host OS cannot extract it, mitigating private-key exposure even if the OS intercepts the TEE API call. Authenticated Key Exchange (AKE). The central server acts as a common bulletin board to facilitate peer discovery. To mitigate the Man-in-the-Middle (MITM) risk inherent in unauthenticated Diffie-Hellman, where the server could substitute its own public keys, CHRONOS enforces an Authenticated Key Exchange. During the idle phase, the Normal World daemon sends 𝑝𝑘𝑖 , which is cryptographically signed by the TA using the device’s enrolled certificate, to the server. The server collects these signed public keys and pushes the peer set {𝑝𝑘 𝑗 ∶ 𝑗 ≠ 𝑖} to each client. The client daemon passes this set to the TA via a second command (COMPUTE_SEEDS). The TA verifies each peer’s signature against the trusted root CA. For verified peers, the TA computes the raw Diffie-Hellman secret and applies an HMAC-based Key Derivation Function (HKDF): 𝑠𝑖𝑗 = DH(𝑠𝑘𝑖 , 𝑝𝑘𝑗 )

6 of 18

prg

𝑘𝑖𝑗enc , 𝑘𝑖𝑗 = HKDF(𝑠𝑖𝑗 ) where 𝑘𝑖𝑗enc is a 128-bit key for share encryption (with freshly genprg erated IV for each encryption) and 𝑘𝑖𝑗 is a 256-bit key for PRG masking. Distinct info strings are used to derive the two keys from HKDF(𝑠𝑖𝑗 ). The symmetry DH(𝑠𝑘𝑖 , 𝑝𝑘𝑗 ) = DH(𝑠𝑘 𝑗 , 𝑝𝑘 𝑖 ) ensures these derived keys are identical for both peers. Once all keys are computed, 𝑠𝑘 𝑖 is retained in Secure World memory until the subsequent SEAL call. Atomic TEE Sealing and Share Generation. The TA completes the idle phase via the SEAL(𝑡) command, which performs four actions with TA-level atomicity to ensure consistency: 1. Shamir Share Generation: The TA generates 𝑡-of-(𝑁−1) secret shares of the ephemeral private key 𝑠𝑘 𝑖 over byte-wise GF(28 ). It produces 𝑁 − 1 shares {𝜎𝑖→𝑗 }𝑗≠𝑖 . To prevent server interception, the TA encrypts each share using the corresponding derived encryption key 𝑘𝑖𝑗enc with AES-128-GCM to produce a 60-byte ciphertext 𝐸𝑘𝑖𝑗enc (𝜎𝑖→𝑗 ) (including a 12byte IV and 16-byte authentication tag) before writing the ciphertexts to a Normal World buffer for relay to peers. 2. Seed Sealing: The TA encrypts the raw Diffie-Hellman shared secret set 𝒮𝑖 = {𝑠𝑖𝑗 }𝑗≠𝑖 under AES-256-GCM using a key derived from the device Hardware Unique Key (HUK). The resulting ciphertext and authentication tag are written to OP-TEE Secure Storage. 3. Counter Initialisation: The TA initialises the hardwarebacked round counter 𝐶 ← 0. 4. Key Erasure: The TA securely erases 𝑠𝑘𝑖 from Secure World memory. We note that the atomicity holds for the four TA-local actions; idle-phase completion at the daemon level additionally requires acknowledged delivery of all 𝑁 − 1 share ciphertexts to peers. This ensures that if any step fails, the device remains in a pre-establishment state with no leaked shares or uninitialized

,

counters. Because 𝑠𝑘 𝑖 is erased immediately and its shares distributed, the device relies exclusively on the sealed seeds for mask generation, while any 𝑡 peers can assist the server in mask reconstruction if the device drops. Share distribution. The Normal World daemon then distributes the ciphertext 𝐸𝑘𝑖𝑗enc (𝜎𝑖→𝑗 ) to peer 𝑗 for all 𝑗 ≠ 𝑖, relayed by the server. Each client 𝑘 stores the received ciphertext in ordinary (non-TEE) local storage for all 𝑗 ≠ 𝑘. The 𝑡-of-(𝑁−1) security guarantee, combined with channel encryption, ensures that any coalition of 𝑡 − 1 or fewer clients (along with the server) learns nothing about 𝑠𝑘𝑖 from the shares they hold.

client can seamlessly rejoin in a later round without counter de-synchronization, while the monotonic progression prevents mask reuse. While a malicious Normal World could intentionally advance 𝑟 to its maximum value to cause a local Denial of Service (DoS), this affects only availability and cannot compromise gradient confidentiality. Client 𝑖 computes: 𝑔̃𝑖 = 𝑔𝑖 + 𝑚𝑖 (𝑟) (mod 𝑝) and transmits 𝑔̃𝑖 to the server in a single message. Server-side aggregation (full participation). When all 𝑁 clients respond, the server computes:

Storage footprint. The TEE stores only the sealed seed set and the round counter:

𝐺̃ =

TEE storage = (𝑁 − 1) × 32 + 16tag + 4counter bytes. For 𝑁 = 20, the theoretical footprint is 628 bytes; the measured value is 632 bytes, reflecting 4 bytes of OP-TEE session-context overhead not captured in the formula. Both values are independent of model dimension 𝐷 and training horizon 𝑅. The Normal World additionally stores 𝑁−1 received shares, each 32 bytes (one per peer): (𝑁−1) × 32 bytes of non-sensitive recovery material.

4.4 Active-Phase: Mask Generation and Gradient Aggregation TA mask generation command. The TA exposes two commands during the active phase: ∙ PEEK_COUNTER: returns the current value of 𝐶 read-only. ∙ GENERATE_MASK(𝐷, 𝑟): atomically reads 𝒮𝑖 from Secure Storage, derives the PRG keys via HKDF, validates 𝑟 > 𝐶, evaluates Equation (2), updates 𝐶 ← 𝑟, and returns the mask to the Normal World via shared memory. If key establishment has not been completed, the command returns ERR_NOT_READY. Active-phase masking. When a training round 𝑟 begins, client 𝑖 computes its local gradient 𝑔𝑖 ∈ 𝔽𝐷𝑝 . It invokes GenerateMask(𝐷, 𝑟), which evaluates: 𝑚𝑖 (𝑟) =

∑ 𝑗>𝑖

prg

PRG(𝑘𝑖𝑗 , 𝑟) −

∑ 𝑗<𝑖

prg

PRG(𝑘𝑗𝑖 , 𝑟)

(mod 𝑝).

Here, PRG(𝑘prg , 𝑟) ∈ 𝔽𝐷𝑝 is an AES-128-CTR stream cipher keyed on 𝑘prg . The 128-bit Initialization Vector (IV) is constructed by concatenating the 96-bit round index 𝑟 (padded) with a 32bit block counter that increments for each 16-byte keystream block. Because CHRONOS assumes an honest-but-curious aggregation server (Section 4.1), we safely omit the active-adversary self-masking step present in full SecAgg, thereby reducing local computation. Critically, to enforce execution freshness while accommodating clients that may have skipped previous rounds, the TA accepts the global round index 𝑟 from the untrusted Normal World but strictly enforces the invariant 𝑟 > 𝐶. Upon validation, the TA updates its hardware-backed monotonic counter 𝐶 ← 𝑟 and derives the mask. This ensures that a dropped

𝑁 ∑ 𝑖=1

𝑔̃𝑖 =

𝑁 ∑ 𝑖=1

𝑔𝑖 +

𝑁 ∑ 𝑖=1

𝑚𝑖 (𝑟) = 𝐺.

⏟⎴⏟⎴⏟ =𝟎

The mask sum is zero by the telescoping cancellation property of Equation (2), requiring no de-masking step. Communication cost. The active-phase cost per client per round is 𝐷 ⋅ ⌈log2 𝑝⌉∕8 bytes, which is identical to plaintext FedAvg. There is no per-round key-agreement traffic.

4.5

Dropout Recovery via Shamir Reconstruction

Mid-round dropout. Suppose 𝑘 clients drop out after the training round begins, failing to transmit their masked gradients. To ensure successful recovery, the number of surviving clients must be sufficient to meet the Shamir reconstruction threshold (𝑁 − 𝑘 ≥ 𝑡). Let 𝒟 ⊂ [𝑁] be the set of dropped clients and 𝒜 = [𝑁] ⧵ 𝒟 the set of survivors. The server receives {𝑔̃𝑗 }𝑗∈𝒜 and must recover ∑ the aggregate 𝐺 = 𝑖 𝑔𝑖 . It observes: ∑

𝑗∈𝒜

𝑔̃𝑗 =

∑

𝑗∈𝒜

𝑔𝑗 +

∑

𝑗∈𝒜

𝑚𝑗 (𝑟) =

∑

𝑗∈𝒜

𝑔𝑗 −

∑

𝑖∈𝒟

𝑚𝑖 (𝑟),

where the last equality follows from the full cancellation identity ∑ ∑𝑁 𝑚𝑖 (𝑟) = 𝟎. The server must recover 𝑖∈𝒟 𝑚𝑖 (𝑟) to correct 𝑖=1 the aggregate. Recovery protocol. For each dropped client 𝑖 ∈ 𝒟, the server broadcasts a recovery request. Each surviving client 𝑗 ∈ 𝒜 invokes its TA via DecryptShare(𝑖, 𝐸𝑘𝑗𝑖enc (𝜎𝑖→𝑗 )) to decrypt the ciphertext received from client 𝑖 during the idle phase, and responds with the plaintext share 𝜎𝑖→𝑗 . Once 𝑡 shares are collected, the server applies Shamir reconstruction to recover 𝑠𝑘 𝑖 , re-derives the pairwise keys via HKDF using the peer public keys already known from the idle phase, and evaluates: 𝑚𝑖 (𝑟) =

∑ 𝑗>𝑖

prg

PRG(𝑘𝑖𝑗 , 𝑟) −

∑ 𝑗<𝑖

prg

PRG(𝑘𝑗𝑖 , 𝑟)

(mod 𝑝).

Here, the server uses the global training round index 𝑟 as the PRG nonce, which directly mirrors the dropped client’s intended hardware counter value. It repeats this for every 𝑖 ∈ 𝒟 and corrects

7 of 18

the aggregate: 𝐺̂ =

∑ 𝑗∈𝒜

𝑔̃𝑗 +

∑ 𝑖∈𝒟

𝑚𝑖 (𝑟) =

∑ 𝑗∈𝒜

𝑔𝑗 .

The result 𝐺̂ is the correct aggregate over the surviving clients’ gradients. FedAvg weighting is then applied using the participating clients’ sample counts. Recovery payload. Each share 𝜎𝑖→𝑗 is a 32-byte element in bytewise GF(28 ). Each surviving client transmits 𝑘 × 32 bytes (one share per dropped client). Thus, the aggregate recovery communication across all 𝑁 −𝑘 survivors for 𝑘 dropouts is (𝑁 −𝑘)×𝑘×32 bytes, which is negligible relative to any gradient vector. Threshold and security. The recovery protocol reveals 𝑠𝑘𝑖 to the server, allowing it to derive 𝒮𝑖 . This is an explicit operational trade-off acceptable under our honest-but-curious threat model, as the server already coordinates the aggregation. Once 𝑠𝑘 𝑖 is reconstructed, the server can compute any mask 𝑚𝑖 (𝑟′ ) generated by that specific client for the current epoch. To strictly limit this exposure window, CHRONOS enforces periodic key rotation (e.g., at the start of each training epoch), ensuring that recovering a key for round 𝑟 does not compromise gradient confidentiality from previous epochs. The 𝑡-of-(𝑁−1) Shamir guarantee ensures that any 𝑡 − 1 or fewer clients colluding with the server learn nothing about 𝑠𝑘 𝑖 . Conversely, the system tolerates at most 𝑡 − 1 colluding clients; beyond this threshold (i.e., any 𝑡 clients colluding with the server), the adversary can unilaterally recover any client’s ephemeral private key regardless of dropout status. The threshold parameter 𝑡 is set at deployment time to balance dropout robustness against collusion resistance. A higher 𝑡 increases the number of colluding clients the system can withstand, while a lower 𝑡 increases the number of midround dropouts (𝑁 − 𝑡) the system can successfully recover from. Deployments with different robustness/security trade-offs can tune 𝑡 accordingly. Pre-establishment dropout. If a client has not completed idlephase key establishment, it possesses no seeds and peers hold no recovery shares for it. Such a client is excluded from the cohort until it completes the idle phase. The server defers the start of a training epoch until a sufficient quorum of established clients is available. This is a once-per-epoch initialisation cost, not a perround overhead.

5

Security Analysis

In this section, we analyse CHRONOS against the four goals stated in Section 4.1. All results hold under the honest-butcurious server model with up to 𝑡 colluding clients.

5.1

OS-Level Compromise Resistance

A central security differentiator of CHRONOS is its resilience against a compromised operating system on the IoT device itself.

8 of 18

We define an adversary 𝒜𝑆𝑊 with full root access to the client device’s Normal World (Rich Execution Environment). In a purely software-based secure aggregation framework, 𝒜𝑆𝑊 can inspect prg all memory regions, extracting the pairwise derived keys 𝒦𝑖 and the ephemeral private key 𝑠𝑘𝑖 . Once extracted, the adversary can de-mask all future gradient updates from that client, completely breaking confidentiality. In contrast, CHRONOS enforces a hardware-mediated separation of concerns. The ephemeral private key 𝑠𝑘𝑖 is generated and erased entirely within the Secure World, and the resulting Diffie-Hellman shared secrets 𝒮𝑖 are sealed in Secure Storage under the device’s Hardware Unique Key (HUK). Under the standard TrustZone isolation assumption, 𝒜𝑆𝑊 is physically barred from accessing Secure World memory or Secure Storage. For instance, rather than using a standard interconnect-level TrustZone Address Space Controller (TZASC), the Rockchip RK3399 SoC enforces secure-DRAM partitioning via its proprietary Secure General Register Files (SGRF) acting as a register-based DDR region controller [26, 27]. Consequently, provided the hardware isolation holds, even a compromised OS cannot extract the keys required to de-mask gradients, preserving computational confidentiality across all training rounds.

5.2

Replay-Resilient Freshness

To prevent mask reuse and replay attacks, CHRONOS enforces execution freshness via a hardware-backed round counter 𝐶. The mask 𝑚𝑖 (𝑟) is deterministically generated from the derived PRG prg keys 𝒦𝑖 and the round index 𝑟, which the TA binds to its hardware counter 𝐶. In software-only implementations, 𝒜𝑆𝑊 can rewind the round counter to a previous value 𝑟′ , forcing the client to reuse mask 𝑚𝑖 (𝑟′ ). If the same mask is applied to two different gradients 𝑔𝑖 (𝑟) and 𝑔𝑖 (𝑟′ ), the adversary can compute: 𝑔̃𝑖 (𝑟) − 𝑔̃𝑖 (𝑟′ ) = (𝑔𝑖 (𝑟) + 𝑚𝑖 (𝑟′ )) − (𝑔𝑖 (𝑟′ ) + 𝑚𝑖 (𝑟′ )) = 𝑔𝑖 (𝑟) − 𝑔𝑖 (𝑟′ ), leaking the change in local gradients between rounds. The architectural guarantee of execution freshness fundamentally relies on a hardware-backed monotonic counter (e.g., Replay Protected Memory Block or eFuse registers) to prevent storage rollbacks. Our Rock Pi 4 evaluation testbed utilizes an eMMC-backed Replay Protected Memory Block (RPMB) to physically enforce this monotonic invariant. To guarantee absolute, unconditional freshness, the GenerateMask command synchronously flushes the incremented counter 𝐶 to persistent RPMB storage before returning the mask to the Normal World. Because 𝐶 is maintained exclusively within the TrustZone Secure World and backed by the eMMC controller’s internal monotonic hardware, 𝒜𝑆𝑊 cannot rewind 𝐶 via software means, nor can they bypass the increment via unexpected power-cycles or kernel panics. Because OP-TEE routes RPMB requests through the Normal World tee-supplicant, a root-compromised OS could refuse to proxy the write. However, this only results in a local Denial of Service (DoS) by blocking mask generation; it cannot forge a successful RPMB HMAC or rollback the counter. Thus, whenever a mask is

,

successfully generated, it is guaranteed fresh, fully satisfying the confidentiality requirement even under root compromise.

5.3

Functional Correctness and Dropout Recovery

The primary functional goal is that the server accurately recovers the sum of the unmasked gradients. By construction (Equation 2), each mask 𝑚𝑖 (𝑟) is a sum of PRG outputs with alternating signs across all ordered pairs (𝑖, 𝑗). Summing over all clients yields: 𝑁 ∑ 𝑖=1

𝑚𝑖 (𝑟) =

∑ (𝑖,𝑗)∈𝒫

prg

PRG(𝑘𝑖𝑗 , 𝑟)−

∑

(𝑖,𝑗)∈𝒫

prg

PRG(𝑘𝑖𝑗 , 𝑟) = 𝟎 (mod 𝑝).

Thus, when all clients participate, the masked gradients sum ∑𝑁 ∑𝑁 exactly to the plaintext aggregate: 𝑖=1 𝑔̃𝑖 = 𝑖=1 𝑔𝑖 + 𝟎 = 𝐺. When 𝑘 clients drop out (where 𝑘 ≤ 𝑁 −𝑡), the zero-sum property of the masks is broken. However, the server can request Shamir shares from the surviving clients. With 𝑡 shares, the server reconstructs the dropped client’s ephemeral private key 𝑠𝑘𝑖 , re-derives their pairwise keys via HKDF using the public keys, and computes the missing mask 𝑚𝑖 (𝑟) using the target round index 𝑟 as the PRG nonce. By adding the dropped masks to the sum of the received masked gradients, the server perfectly reconstructs the aggregate of the surviving clients’ gradients without requiring a new training round. Scope note on intra-epoch recovery leakage. The dropoutrecovery protocol reveals 𝑠𝑘𝑖 to the server for the remainder of the current epoch. If client 𝑖 drops in round 𝑟 and later attempts to rejoin in round 𝑟′ > 𝑟 within the same epoch, the server, having already reconstructed 𝑠𝑘 𝑖 , could theoretically unmask 𝑔𝑖 (𝑟′ ). To prevent this, CHRONOS enforces a strict protocol rule: the server discards any message arriving from a client after its sender has been declared dropped within the same epoch. The client is explicitly excluded from participation until the next epochboundary key rotation establishes fresh ephemeral keys. This rule is enforceable under our honest-but-curious threat model, as the server executes the protocol faithfully.

5.4

False-Dropout Attack

A known vulnerability in secure aggregation protocols arises if the server falsely declares a client 𝑖 as dropped or if a delayed message arrives out of band. If the server recovers 𝑠𝑘𝑖 through the dropout protocol, it can de-mask a late-arriving gradient 𝑔𝑖 . Standard SecAgg mitigates this by including a secondary "self-mask" derived from an independent secret seed 𝑏𝑖 . Reconstructing 𝑠𝑘𝑖 does not reveal 𝑏𝑖 , preserving privacy during late arrivals. CHRONOS explicitly omits this self-mask, which constitutes a deliberate architectural trade-off. Re-introducing the self-mask would require a secondary interactive round during the active phase to negotiate its cancellation among surviving clients. This multi-round synchronisation would destroy the single-message latency advantage that makes CHRONOS viable for strict IoT sensing budgets. Under our honest-but-curious model, the server executes the protocol faithfully and does not maliciously simulate

dropouts. As formally established above, for genuine network delays or late-arriving gradients, the server adheres to the protocol requirement and discards the late gradient without attempting unmasking. Thus, CHRONOS trades protection against an actively malicious false-dropout vector for a strict one-round active phase, optimizing for performance under the assumed threat model.

5.5

Side-Channel Resilience

While ARM TrustZone provides strong architectural isolation between the Normal and Secure Worlds, recent research has demonstrated vulnerabilities that exploit shared microarchitectural resources. Specifically, attacks such as CLKscrew [28] and VoltJockey [29] leverage the shared Dynamic Voltage and Frequency Scaling (DVFS) and power management interfaces to induce faults or observe timing variations in Secure World execution. CHRONOS is designed with three inherent mitigations against such side-channel and fault-injection threats. First, the system minimizes the window of vulnerability: unlike TEE-based FL frameworks that repeatedly load large parameter chunks into the enclave during training [11, 19], CHRONOS restricts Secure World execution exclusively to a single mask generation call per round. As shown in Section 7.5, this execution window is extremely short (e.g., 44.5 ms for the small CNN), significantly increasing the difficulty for an adversary to synchronize and mount high-resolution side-channel attacks. Second, CHRONOS relies on constant-time cryptographic primitives. The TA leverages ARMv8 Crypto Extensions for hardwareaccelerated AES-GCM operations (used in sealing), while the AES-128-CTR hardware instructions used for mask generation are inherently constant-time. This ensures the TEE’s core timing profile is independent of secret seed values. While the subsequent rejection sampling step required for field reduction exhibits data-dependent timing, this variation reveals only statistical properties of a pseudorandom output and does not provide a practical extraction path for the underlying PRG seeds. Finally, the integrity of the sealed keys is protected via AES-256GCM. Any attempt by an adversary to induce bit-flips in Secure Storage through voltage manipulation (e.g., undervolting during a memory write) will be detected as an authentication failure during the subsequent unsealing process. This combination of a minimal TEE footprint and authenticated sealing substantially raises the bar against DVFS-based fault injection. We declare a formal physical side-channel and fault-injection evaluation out of scope for this architectural paper.

5.6

Defense-in-Depth and Mitigation Strategy

If a device has not completed the idle-phase key establishment, it possesses no derived keys and cannot generate masks. In this case, CHRONOS degrades gracefully: the client is excluded from the current training epoch rather than transmitting an unprotected gradient. This resilience ensures that devices only participate when cryptographic protections are fully established.

9 of 18

Finally, while CHRONOS protects against gradient inversion, it does not inherently prevent membership inference attacks against the aggregated model. Furthermore, we assume an honest-but-curious server that computes the aggregate faithfully. A fully malicious server could attempt to exclude updates or return corrupted models. As discussed in Section 4.3, MITM attacks during key exchange are already mitigated via certificate-based Authenticated Key Exchange during device provisioning. To defend the active phase against malicious aggregation, future work might extend the system with zero-knowledge proofs. Ultimately, this combination of hardware isolation, monotonic counters, and authenticated provisioning provides a robust defense-in-depth architecture suitable for high-stakes IoT federated learning.

6

Implementation

CHRONOS is implemented in two components: a Trusted Application (TA) that executes in the ARM TrustZone Secure World, and a host-side suite of Normal World programs that drive the idle-phase key establishment and the active-phase gradient masking.

6.1

Trusted Application

Specifically, the TA is written in C using the OP-TEE SDK and compiled for the ARM Cortex-A72 Rockchip RK3399 SoC (2× Cortex-A72 + 4× Cortex-A53 big.LITTLE) of the Rock Pi 4, targeting OP-TEE 4.4.0. It implements six GlobalPlatform TEE Internal Core API commands: ∙ KEYGEN: invokes the GlobalPlatform TEE_GenerateKey API for the elliptic curve, retains the private key 𝑠𝑘𝑖 in a Secure World object handle, and writes only the public key 𝑝𝑘𝑖 (32 bytes) to a Normal World shared memory buffer. Since 𝑠𝑘 𝑖 never leaves the Secure World, a compromised host OS cannot extract it irrespective of timing. ∙ COMPUTE_SEEDS: accepts a shared memory buffer containing 𝑁 − 1 peer public keys {𝑝𝑘𝑗 }𝑗≠𝑖 , invokes TEE_DeriveKey (using the TEE_ALG_X25519 identifier, requiring CFG_CRYPTO_X25519=y) for each peer using the retained 𝑠𝑘𝑖 , computes the raw Diffie-Hellman shared secrets, applies HKDF to derive the immediate encryption keys for share distribution, stores the 𝑁 − 1 raw secrets in a Secure World memory buffer, and retains 𝑠𝑘 𝑖 in the key object handle for use in the subsequent SEAL command. Both the derived keys and 𝑠𝑘𝑖 exist only within the Secure World at this point. ∙ SEAL(𝑡): performs four actions atomically. First, it generates Shamir secret shares of the ephemeral private key 𝑠𝑘𝑖 using a 𝑡-of-(𝑁−1) scheme over byte-wise GF(28 ). It encrypts each share 𝜎𝑖→𝑗 (32 bytes) under the corresponding derived encryption key 𝑘𝑖𝑗enc using AES-128-GCM and freshly generated IV and writes the ciphertexts to a Normal World shared memory buffer for distribution to peers. Second, it encrypts the raw Diffie-Hellman shared secret set 𝒮𝑖 under AES-256GCM with a key derived from the device Hardware Unique

10 of 18

Key (HUK), and writes the ciphertext and 16-byte authentication tag to OP-TEE Secure Storage atomically. Third, it initialises the round counter 𝐶 ← 0. Fourth, 𝑠𝑘𝑖 is securely erased from Secure World memory. Total Secure Storage usage: (𝑁 − 1) × 32 + 16tag + 4counter bytes; for 𝑁 = 20, the theoretical total is 628 bytes (632 bytes as measured). ∙ GENERATE_MASK(𝐷, 𝑟): decrypts and authenticates the shared secret set from Secure Storage, derives the PRG keys via HKDF, validates 𝑟 > 𝐶, evaluates Equation (2) prg using AES-128-CTR as the PRG (seeded with 𝑘𝑖𝑗 , nonce = 𝑟), atomically updates 𝐶 ← 𝑟 in Secure RAM (synchronously flushing to the eMMC RPMB), and returns the 𝐷-dimensional mask vector to the Normal World via a shared memory buffer. Returns ERR_NOT_READY if no key set has been sealed. ∙ DECRYPT_SHARE(𝑖, 𝑐𝑡): accepts a ciphertext of a Shamir share from dropped client 𝑖, decrypts the shared secret set from Secure Storage, derives the appropriate encryption key 𝑘𝑗𝑖enc via HKDF, decrypts the share using AES-128-GCM, and returns the plaintext share 𝜎𝑖→𝑗 to the Normal World. ∙ PEEK_COUNTER: returns the current value of 𝐶 without modifying any state, enabling the Normal World daemon to verify round synchronisation. We employ AES-128-CTR as the PRG. By utilizing the RK3399’s ARMv8 Crypto Extensions through the mbedTLS ARMv8-CE path configured in OP-TEE 4.4.0, the TA achieves hardwareaccelerated throughput exceeding 1.5 GB/s. This extreme throughput is critical because generating 𝑁 − 1 separate PRG streams of length 𝐷 with rejection sampling creates substantial memory pressure, and hardware AES minimizes the TEE time attributable to mask generation. The TA binary size is 48 KB (compiled with -Os). The Secure World runtime memory footprint (stack, heap, session context) is 18 KB.

6.2

Idle-Phase Daemon

The idle-phase daemon is a Python program (approximately 280 lines of code) that monitors device operational state and orchestrates the once-per-epoch key establishment and share distribution. When the device transitions to the idle state, the daemon executes the following steps: 1. Invokes KEYGEN to generate the ephemeral keypair entirely inside the TA, receiving only 𝑝𝑘𝑖 . 2. Sends 𝑝𝑘𝑖 to the server and receives the peer public keys {𝑝𝑘𝑗 ∶ 𝑗 ≠ 𝑖} relayed by the server. 3. Invokes COMPUTE_SEEDS with the received peer keys; the TA computes all DH secrets and retains 𝑠𝑘𝑖 in Secure World memory for use in the subsequent SEAL command. 4. Invokes SEAL(𝑡), receiving the 𝑁 − 1 ciphertexts {𝐸𝑘𝑖𝑗enc (𝜎𝑖→𝑗 )}𝑗≠𝑖 in return; the shared secrets are now sealed in Secure Storage. 5. Distributes the ciphertext 𝐸𝑘𝑖𝑗enc (𝜎𝑖→𝑗 ) to peer 𝑗 for each 𝑗 ≠ 𝑖, relayed by the server. 6. Receives and stores the ciphertext 𝐸𝑘𝑗𝑖enc (𝜎𝑗→𝑖 ) from each peer 𝑗 ≠ 𝑖 in local (non-TEE) storage.

,

The once-per-epoch idle-phase cost is dominated by the 𝑁 − 1 Curve25519 DH operations and the key relay round trip. On Rock Pi 4 hardware, the 19 DH operations take approximately 180 ms of local compute. While hand-optimized AArch64 X25519 assembly can execute in microseconds, this duration reflects OP-TEE’s default C-based mbedTLS implementation, the sequential TEE boundary crossings, and the subsequent HKDF derivations. Including network round-trips for public-key and share relay, the end-to-end idle-phase time is ≈ 250 ms. Once complete, the idle daemon has no further work until the next key-rotation epoch.

6.3

Active-Phase Training Wrapper

The active-phase training wrapper (approximately 180 lines of Python code) subclasses the Flower NumPyClient class, overriding fit to inject the masking step. When fit is called, the wrapper: 1. Invokes PEEK_COUNTER to confirm key establishment is complete. 2. If ERR_NOT_READY is returned, raises a DropoutException and skips the round. 3. Computes the local gradient 𝑔𝑖 via PyTorch as a vector of 32bit floating-point values (FP32). 4. Gradient Quantization: To perform cryptographic masking over a finite field, the wrapper scales the FP32 gradients by a fixed factor 𝑆 = 216 and rounds them to integers. These integers are mapped to positive elements in 𝔽𝑝 by shifting the representation domain to [0, 𝑝 − 1]. We use 𝑝 = 231 − 1 (Mersenne prime), which accommodates aggregates up to 𝑁 × 𝑆 × max ‖𝑔𝑖 ‖∞ ≈ 20 × 216 × 210 ≈ 1.34 × 109 without aliasing (wraparound) in 𝔽𝑝 for the evaluated 𝑁 and 𝐷. The constant domain shift is deterministically subtracted by the server during aggregation. We empirically verified max ‖𝑔𝑖 ‖∞ < 210 across all training runs; gradients exceeding this bound would be clipped to maintain field-arithmetic correctness. 5. Invokes GENERATE_MASK(𝐷, 𝑟) in a single TEE call, receiving the pseudo-random mask vector 𝑚𝑖 (𝑟) ∈ 𝔽𝐷𝑝 . The TA generates this vector by extracting 32-bit chunks from the AES-128-CTR keystream and reducing them modulo 𝑝. 6. Computes 𝑔̃𝑖 = (𝑔𝑖 + 𝑚𝑖 (𝑟)) (mod 𝑝) element-wise via NumPy. 7. Returns 𝑔̃𝑖 to the Flower communication layer. The single TEE call per round crosses the Normal-World/SecureWorld boundary exactly once regardless of model dimension. Upon receiving the masked gradients, the server sums them modulo 𝑝, recovers the integer aggregate, maps it back to the signed domain, and scales by 𝑆 −1 to restore the FP32 aggregate gradient.

6.4

Server Aggregation and Dropout Recovery

The server aggregation component (approximately 500 lines of Python code) subclasses the Flower Strategy class and overrides aggregate_fit. Normal-round aggregation. When all 𝑁 clients respond, the ∑ server computes 𝐺̃ = 𝑖 𝑔̃𝑖 = 𝐺 as explained in Section 5.3. No

de-masking step is required; the pairwise cancellation is exact by construction. Dropout recovery. When the server detects that 𝑘 ≤ 𝑁 − 𝑡 clients have failed to respond within a timeout, it executes the recovery protocol of Section 4.5. For each dropped client 𝑖 ∈ 𝒟, the server broadcasts a RecoveryRequest(𝑖) message to all surviving clients. Each surviving client 𝑗 ∈ 𝒜 invokes DECRYPT_SHARE to decrypt their locally stored ciphertext and responds with the plaintext share 𝜎𝑖→𝑗 (32 bytes) via the Flower evaluate channel. The server collects 𝑡 shares, applies Lagrange interpolation over byte-wise GF(28 ) to reconstruct 𝑠𝑘 𝑖 , re-derives the pairwise keys via HKDF from the peer public keys already known from the idle phase, evaluates 𝑚𝑖 (𝑟), and adds it to the partial sum. FedAvg weighting is applied using the sample counts of the participating clients in 𝒜, and the updated global model 𝑤 (𝑟+1) is broadcast as usual.

7

Evaluation

We conduct an extensive evaluation of CHRONOS to answer six research questions: ∙ RQ1 (Active-Phase Latency and Energy): Does CHRONOS reduce per-round active-phase aggregation latency and energy consumption compared to SecAgg and other baselines? ∙ RQ2 (Storage Overhead): What is the Secure World storage footprint of CHRONOS, and how does it scale with model dimension and training horizon? ∙ RQ3 (Scalability): How does CHRONOS’s per-round latency scale as the number of participating clients 𝑁 increases? ∙ RQ4 (Dropout Recovery): Does CHRONOS’s Shamirbased recovery preserve correct aggregate computation under systematic client dropout, and what is the recovery communication overhead? ∙ RQ5 (TEE Overhead): What fraction of active-phase round time is attributable to the TrustZone context-switch for GENERATE_MASK? ∙ RQ6 (Empirical Privacy): Does CHRONOS successfully thwart state-of-the-art optimization-based gradient inversion attacks compared to plaintext FL? Let us first present our experimental setup, before reporting the evaluations results for the six research questions mentioned earlier. Hardware. We use 20 Rock Pi 4 devices (Model B; 4 GB RAM, RK3399 SoC with Cortex-A72 at 1.8 GHz) as FL clients. Each device is equipped with a 16GB eMMC 5.1 module to enable RPMB secure storage. We use the plain RK3399 variant, which is software-compatible with the OP1-based config documented in the OP-TEE build guide, differing only in the A72 clock ceiling (1.8 GHz vs. 2.0 GHz), each running OP-TEE 4.4.0 built with CFG_TZDRAM_SIZE=32M (Secure World memory allocation) and CFG_WITH_VFP=y (enabling ARMv8 Crypto Extensions in the TA, used by our AES-128-CTR hardware acceleration, see Section 6.1). The aggregation server is a Google Cloud Platform

11 of 18

c2-standard-8 instance (8 vCPUs, 32 GB RAM). Clients communicate over a local area network (<1 ms round-trip). Energy measurement. Per-round protocol-phase energy is estimated analytically based on active latency. Because the active phase duration (75–450 ms) is shorter than the reliable integration window of standard 10 Hz USB-C power monitors, empirical integration over a single round yields insufficient samples. Instead, we compute the active-phase energy footprint by multiplying the measured active power draw of the Rock Pi during federated training (6.5 W, recorded via inline monitor during continuous execution) by the per-round active-phase aggregation latency. We acknowledge that this methodology assumes constant power draw and excludes secondary dynamic effects such as thermal throttling that may occur during prolonged full training runs; however, it reliably isolates the energy overhead introduced by the cryptographic protocol’s latency footprint. We report estimates only for the small CNN, as the medium CNN’s energy consumption is dominated by transmission overhead identically across all systems. Datasets. We evaluate on CIFAR-10 (50,000 training images, 10 classes) with Dirichlet non-IID partitioning (𝛼 = 0.5), FEMNIST, and the UCI Human Activity Recognition (HAR) dataset. To accommodate the cohort size (𝑁 = 20) while maintaining meaningful intra-client datasets, we filter FEMNIST to the 10 digit classes and partition it naturally by writer identity. We acknowledge this is a non-standard filtering that affects direct comparability of raw accuracy numbers with prior work evaluating on the full 62-class FEMNIST, but it preserves the non-IID characteristics necessary for evaluating dropout robustness. For UCI-HAR, which contains 561 pre-extracted features from smartphone accelerometer and gyroscope sensors across 6 activities, we partition the data naturally by assigning 1-2 subjects per client, a configuration highly representative of realistic IoT sensing data distributions. Models. For the vision tasks, we use a small CNN with approximately 50,000 parameters (𝐷 = 50,000) and a medium CNN with approximately 1,000,000 parameters (𝐷 = 1,000,000). For the UCI-HAR task, we employ a lightweight 1D-CNN standard for the domain, scaling the architecture to yield a comparable parameter footprint (𝐷 ≈ 50,000). Because the gradient dimensionality matches the vision small CNN, we report latency, energy, and storage overheads for the vision tasks; the HAR IoT footprint is definitionally identical to the small CNN footprint. Federated learning protocol. All systems use FedAvg with 50 global rounds (with epoch-boundary key rotation performed every 10 rounds), full client participation (𝑁 = 20), 5 local epochs per round, and learning rate 𝜂 = 0.01. All measurements are repeated over 5 independent random seeds; we report the empirical mean and 95% confidence intervals. Confidence intervals are computed assuming a normal distribution across the seeds; we acknowledge that physical I/O and OS scheduler jitter may introduce some non-normal variance not captured by the

12 of 18

smoothed point estimates. Baselines. ∙ B1 (Plaintext FedAvg): Standard FedAvg with no privacy protection. Lower bound on latency and energy; upper bound on privacy leakage. ∙ B2 (SecAgg): Bonawitz et al. secure aggregation [8] with synchronous key agreement. This is the most direct baseline: CHRONOS uses the same cryptographic primitive as SecAgg but moves the key exchange to a pre-computation phase. While MicroSecAgg [16] represents a newer singleserver variant with similar 𝑂(𝑁 2 ) key-establishment cost, we treat B2 as representative of the synchronous key-agreement paradigm. ∙ B3 (SMPC-FL): Generic Secure Multiparty Computation (SMPC) via the MP-SPDZ framework. As discussed in Section 3, this baseline is included to empirically demonstrate the prohibitive computational penalty of using heavy, Oblivious Transfer (OT)-based protocols for simple additive aggregation tasks. ∙ B4 (CHRONOS-SW): A software-only ablation in which DH keys and counters are stored in the Normal World (filesystem) rather than the TEE. This baseline isolates the latency and energy contribution of the "idle-window" scheduling decision from the hardware-isolation security contribution of the TEE, similar in architecture to prior software-only pre-computation designs [25].

RQ1: Active-Phase Latency and Energy Con7.1 sumption Figure 2 reports per-round active-phase aggregation latency (ms) for each system. Active-phase aggregation latency is measured strictly as the client-side round-trip time: from the completion of local gradient computation in round 𝑟 (when cryptographic masking begins), to the receipt of the updated global model 𝑤 (𝑟+1) for the subsequent round. Because the local PyTorch training time (tens of seconds for 5 epochs) is identical across all baselines, isolating the aggregation phase allows us to accurately quantify the precise network and cryptographic overhead introduced by the privacy protocols. For CHRONOS, the once-per-epoch idle-phase key establishment is excluded, as it occurs outside the active training loop. Our evaluation demonstrates that CHRONOS recovers nearplaintext latency while providing OS-level compromise resistance. As shown in Figure 2, CHRONOS’s active-phase aggregation latency (119 ms and 579 ms for the small and medium CNNs, respectively) introduces a small, constant overhead over the plaintext baseline B1 (75 ms and 440 ms). The absolute overhead of the cryptographic protection is approximately 44 ms and 139 ms for the small and medium CNNs respectively, attributable solely to the TEE context-switch, mask derivation, and the RPMB flush. Compared to the synchronous SecAgg baseline B2, CHRONOS achieves a 74% reduction in active-phase aggregation latency for the small CNN (𝐷 = 50K). Crucially, the comparison with B4 (CHRONOS-SW) shows that the latency cost of TrustZone is modest (≈41–99 ms). While

,

Latency (ms) [Log Scale]

B1 (Plaintext)

B2 (SecAgg)

B3 (SMPC-FL)

104

104

102

102 Small CNN Med. CNN CIFAR-10

B4 (CHRONOS-SW)

CHRONOS

Small CNN Med. CNN FEMNIST

F I G U R E 2 | Per-round active-phase aggregation latency (log scale) for CIFAR-10 and FEMNIST across evaluated systems.

CHRONOS-SW achieves slightly lower latency by avoiding the TEE context switch and RPMB flush, it offers no protection against a root-compromised host OS, as seeds and counters are stored in software. CHRONOS therefore achieves the "security parity" of TEE-based designs at the "performance parity" of software-only decoupled schemes, incurring only a 53% latency penalty (41 ms) for the small CNN and a 21% penalty (99 ms) for the medium CNN to gain unconditional hardware-isolated security. For the medium CNN (𝐷 = 1M), the relative reduction drops to ∼36% because gradient transmission over the IoT network interface begins to dominate the per-round duration, yet CHRONOS remains significantly faster than SecAgg by eliminating the synchronous key-exchange rounds. B3 is the slowest system by one to two orders of magnitude, confirming that OT-based input masking is an unnecessary overhead for linear gradient aggregation. Idle-phase amortised cost. The idle-phase key establishment is a once-per-epoch cost. On Rock Pi 4, the end-to-end idle-phase setup requires approximately 250 ms. For our evaluated small CNN, CHRONOS saves ≈331 ms of active-phase latency per round compared to SecAgg (450 ms vs. 119 ms). With an epoch length of 10 rounds, the 250 ms idle-phase investment yields over 3.3 seconds of active-phase savings, representing an amortised setup overhead of less than 8% of the active-phase time saved per epoch. Energy Footprint. Table 1 reports the estimated per-round active-phase energy (mJ) during the active phase, derived linearly from the active-phase aggregation latency using the Rock Pi’s measured 6.5 W active power baseline for the small CNN on CIFAR-10. Because the active phase duration is shorter than the integration window of standard USB power monitors, we report energy as a derived metric strictly proportional to latency. We report derived energy for B1, B2, B4, and CHRONOS only; B3’s energy footprint is omitted as it is three orders of magnitude higher and provides no additional insight. Table 1 demonstrates that CHRONOS reduces estimated perround active-phase energy by 3.8× compared to B2 (SecAgg). Because the computation and network interfaces operate under roughly constant load during these short bursts, the energy

T A B L E 1 | Estimated per-round active-phase energy (mJ, mean ± 95% CI, 5 seeds). Lower is better. Energy is computed as 𝑃 × 𝑡 where 𝑃 = 6.5 W. System B1 (Plaintext) B2 (SecAgg) B4 (CHRONOS-SW) CHRONOS

Estimated active-phase energy (mJ)

Reduction vs. B2

487 ± 15 2925 ± 25 507 ± 15 774 ± 15

– 1× 5.8× 3.8×

improvement is definitionally derived from the latency improvement. The energy gap between CHRONOS (774 mJ) and B1 (plaintext, 487 mJ) is small (≈287 mJ) and attributable solely to the TEE context-switch and RPMB flush overhead. We emphasize that these are algebraically derived values based on activestate power measurements; however, they consistently demonstrate that the phase-decoupling approach isolates the cryptographic overhead from the energy-critical training rounds.

7.2

RQ2: Storage Overhead

Unlike approaches that precompute and store round-specific cryptographic material, the CHRONOS TEE permanently stores only the 𝑁 − 1 raw Diffie-Hellman shared secrets and a 4-byte round counter. This persistent storage footprint is therefore independent of the training horizon 𝑅 and independent of the model dimension 𝐷. (As analyzed in Section 7.5, dynamic runtime memory requires an additional transient buffer proportional to 𝐷 during the active phase, but this memory is freed immediately). Table 2 reports the measured persistent Secure World storage for varying 𝑁, with the theoretical bound (𝑁 − 1) × 32 + 4 bytes. This contrasts sharply with approaches that precompute roundspecific material. A Beaver-triple-based approach storing 𝑅 = 50 rounds of material for the small CNN (𝐷 = 50,000) with a 32bit field would require 50 × 50,000 × 8 = 20 MB of Secure World storage, exceeding the default TrustZone allocation on many platforms. CHRONOS’s 632-byte measured footprint for 𝑁 = 20 is six orders of magnitude smaller and fits trivially on any TEE-capable platform.

13 of 18

T A B L E 2 | In-memory Secure World session footprint (bytes) vs. number of clients 𝑁 (excludes OP-TEE Secure Storage filesystem encryption overhead). Storage is independent of model dimension 𝐷 and training horizon 𝑅. The total footprint includes a constant 4-byte round counter and a 16-byte AES-GCM tag. Clients (𝑁) 20 50

DH Secrets

Total (measured)

19 × 32 = 608 B 49 × 32 = 1,568 B

632 B 1592 B

Active-Phase Latency (ms)

B1 (Plaintext) B2 (SecAgg) CHRONOS

2,000 1,000 0

20

25 35 Number of Clients (𝑁)

65

F I G U R E 3 | Scalability: Per-round active-phase aggregation latency (ms) vs. cohort size 𝑁 (small CNN on CIFAR-10). 𝑁 = 20 results are from physical devices; 𝑁 > 20 are simulated.

7.3

RQ3: Scalability

We analyse how per-round active-phase aggregation latency scales with cohort size 𝑁 for the small CNN on CIFAR-10. As clients beyond the 20 physical Rock Pi 4 devices are unavailable, we simulate additional clients as separate processes on the aggregation server’s hardware (GCP c2-standard-8) based on the performance characteristic of the physical Rock Pi 4 devices observed in our evaluation. While this simulation excludes the physical I/O and TEE context-switch overhead for the additional simulated clients, it faithfully captures the 𝑂(𝑁 2 ) communication bottleneck of SecAgg’s key-exchange phase and the 𝑂(𝑁) aggregation overhead at the server. Because clients perform their local TEE mask generation concurrently, the TrustZone contextswitch overhead does not theoretically compound with 𝑁. We explicitly acknowledge that this GCP-based simulation does not perfectly emulate physical edge latency at scale, as the x86 server utilizes AES-NI acceleration and a datacenter network stack fundamentally different from the ARM-based Rock Pi 4. Rather than predicting absolute physical latency, this simulation serves specifically to isolate and demonstrate the asymptotic communication scaling behavior. Figure 3 demonstrates that CHRONOS’s latency tracks B1 (Plaintext) linearly as 𝑁 grows, reflecting its 𝑂(𝑁𝐷) communication complexity. In contrast, B2 (SecAgg) exhibits quadratic growth due to its 𝑂(𝑁 2 ) synchronous key-agreement phase. At 𝑁 = 65, CHRONOS models an active-phase aggregation latency of ≤ 150 ms (a simulated lower bound), whereas SecAgg exceeds 1,700 ms. Rather than focusing on a concrete multiplier, this

14 of 18

Dropped Clients (𝑘)

0

1

3

5

7

Active-Phase Latency (ms)

119

228

231

235

240

widening absolute latency gap highlights the fundamental asymptotic advantage: CHRONOS achieves 𝑂(𝑁) active-phase scaling by shifting the 𝑂(𝑁 2 ) key-agreement bottleneck to the idle window, a necessity for scaling secure federated learning to larger IoT cohorts. We note that the once-per-epoch idle-phase cost involves 𝑂(𝑁) local DH operations and 𝑂(𝑁 2 ) bytes relayed through the server, an important second-order scalability factor not captured in the active-phase graph.

4,000 3,000

T A B L E 3 | End-to-end active-phase latency under 𝑘 mid-round dropouts (𝑁 = 20, Small CNN, CIFAR-10). The latency overhead for recovery (𝑘 > 0) is 𝑂(1) with respect to 𝑘, dominated entirely by the server’s static ∼100 ms network timeout threshold and a single ∼12–18 ms communication round to collect the 32-byte Shamir shares from surviving clients.

7.4

RQ4: Dropout Recovery

We evaluate CHRONOS’s Shamir-based dropout recovery mechanism under a systematic dropout scenario: 𝑘 ∈ {0, 1, 3, 5, 7} specific clients are designated as permanently absent, simulating devices that completed idle-phase key establishment but are subsequently unavailable due to power or connectivity constraints, causing them to drop every round throughout the 50-round training. The threshold is set to 𝑡 = 13, so the server can recover the masks of up to 𝑁 − 𝑡 = 7 dropped clients per round. Table 3 reports the end-to-end active-phase recovery latency for the small CNN. The result confirms the computational efficiency and 𝑂(1) scaling behavior of the phase-decoupled recovery mechanism. For 𝑘 = 0 (no dropouts), the round completes in ≈119 ms. For all 𝑘 > 0, the recovery overhead incurs a near-constant jump to ≈228–240 ms. Because the server-side Lagrange interpolation over byte-wise GF(28 ) and AES-GCM share decryption are microsecond-level operations, the overhead is dominated almost entirely by network factors: the server’s static ∼100 ms timeout threshold to detect the dropout, followed by a single ∼12–18 ms communication round-trip to collect the 32-byte plaintext shares from the surviving clients. This confirms that CHRONOS handles multi-client dropouts without introducing quadratic cryptographic scaling or repeating the energy-intensive training round. Handling maliciously corrupted recovery shares returned by surviving clients falls outside our honest-but-curious threat model. While such malicious behavior would corrupt the reconstructed 𝑠𝑘 𝑖 and the resulting mask (leading to an invalid aggregate update), future deployments could enforce robustness against active participants by replacing standard Shamir Secret Sharing with Verifiable Secret Sharing (VSS). This would add a one-time cryptographic verification step to the active phase, guaranteeing the integrity of the recovered key. Recovery communication overhead. As established in Section 4.5, the additional communication incurred by dropout recovery scales as (𝑁 − 𝑘) × 𝑘 × 32 bytes. For our 𝑁 = 20 evaluation cohort, recovering 𝑘 = 3 clients requires only 1,632 bytes

,

T A B L E 4 | Microbenchmark decomposition of TEE call latency for GENERATE_MASK.

Total (measured)

7.5

0.6 15

∼47 𝜇s

∼47 𝜇s

∼22 𝜇s

∼22 𝜇s

∼5088 𝜇s

∼98341 𝜇s

5

∼39320 𝜇s

∼39320 𝜇s

0

44477 𝜇s

137730 𝜇s

RQ5: TrustZone Context-Switch Overhead

Table 4 reports the isolated latency of a single GENERATE_MASK(𝐷, 𝑟) call, benchmarked with no other workload. The CHRONOS TA generates the entire mask in a single TEE call, crossing the Normal-World/Secure-World boundary once per round regardless of 𝐷. The measured total latencies (44.5 ms and 137.7 ms) confirm that the hardware-assisted mask generation is highly efficient. Notably, the introduction of a synchronous eMMC RPMB flush ensures absolute hardware-backed execution freshness (see Section 5.2) at a fixed ≈39 ms cost, yet the TEE call still accounts for less than 25% of the total active-phase round time for the 1M-parameter model. For the medium CNN, the 137.7 ms TEE call time includes the fixed 39 ms RPMB flush, leaving ≈98.4 ms for cryptographic generation and memory transfer. Specifically, the mask in Equation (2) requires 𝑁 − 1 = 19 separate PRG evaluations. With 𝑝 = 231 − 1 and 32-bit chunks drawn from AES-128-CTR, the rejection rate is ≈ 50%. Thus, to retain 106 field elements (4 MB), the TA must generate approximately 19 × 8 MB = 152 MB of total keystream. By utilizing the RK3399’s hardware-accelerated ARMv8 Crypto Extensions, the TA achieves a highly optimized AES-128-CTR throughput of over 1.55 GB/s. This raw generation mathematically accounts for the ≈98 ms measured, perfectly aligning with the total TEE round time.

RQ6: Empirical Privacy Against Gradient In7.6 version To empirically validate the security of CHRONOS beyond the theoretical bounds provided in Section 5, we subject the system to an optimization-based gradient inversion attack proposed by Geiping et al. [30]. In particular, the attack is carried out on the small CNN with respect to the CIFAR-10 dataset. The attack seeks to reconstruct the private input image 𝑥 ∈ ℝ𝑛 directly from the shared

Global

20

Med. CNN (𝐷=1M)

of total network traffic, and recovering the maximum evaluated 𝑘 = 7 clients requires 2,912 bytes. These values are negligible relative to the transmission of any realistic gradient vector. Section 8 discusses the selection-bias implications of systematic dropout.

CHRONOS

SSIM

Empty TEE call (context switch) AES-GCM key set decrypt (632 B) AES-128-CTR mask gen + 𝔽𝑝 rejection sampling Synchronous eMMC RPMB hardware flush

Small CNN (𝐷=50K)

PSNR (dB)

Component

B1

10

0.4 0.2 0

BS=1

BS=8

BS=1

BS=8

F I G U R E 4 | Image reconstruction fidelity under Geiping gradient inversion attack (CIFAR-10, Small CNN). Lower PSNR and SSIM values indicate robust privacy against optimization-based inversion attacks. BS label in the x-axis is short for Batch Size.

gradient vector ∇𝜃 ℒ by utilizing the Adam optimizer to minimize a cosine similarity loss function augmented with total variation (TV) regularization. We evaluate the Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index Measure (SSIM) of the reconstructed images against the original private training batch under three conditions: (a) attacking the plaintext gradient 𝑔𝑖 (B1 baseline), (b) attacking the CHRONOS-masked gradient 𝑔̃𝑖 , and (c) attacking the recovered global aggregate 𝐺 over 𝑁 = 20 clients. We report the mean PSNR and SSIM over the first 100 validation images. As shown in Figure 4, attacking the plaintext FedAvg gradient (Condition a) yields a reconstruction with a PSNR of 18.5 dB. While lower than the ≈29 dB typical of single-step gradient inversions [30] (expected because our 5 local epochs naturally average the gradient signal), this still produces a visually recognizable image. In contrast, the CHRONOS-masked gradient (Condition b) completely thwarts the inversion. Geiping’s attack inherently relies on the high-dimensional direction (angle) of the parameter gradient to iteratively guide the Adam optimizer toward a visually semantic reconstruction. To provide the attack with FP32 gradients it expects, we map the transmitted integer vector 𝑔̃𝑖 ∈ 𝔽𝑝 back to the signed floating-point domain via the inverse scaling factor 𝑆 −1 before passing it to the adversary. Because the CHRONOS AES-128-CTR pseudorandom mask is drawn uniformly from the finite field 𝔽𝑝 , the resulting pseudo-gradient vector exhibits zero angular correlation with the true gradient 𝑔𝑖 . This perfectly decorrelates the cosine similarity objective, forcing the optimizer into a flat, random loss landscape. The resulting reconstruction collapses to pure noise, yielding a PSNR of ≈8.1 dB and an SSIM of 0.02, which mathematically matches the baseline MSE expected between two independent, uniformly random images. Finally, Condition (c) highlights the inherent dilution provided by the FedAvg aggregate: the superimposition of 𝑁 = 20 client gradients drops the PSNR to 9.8 dB, which borders on unrecognizability. The CHRONOS mask (Condition b) further reduces this to the 8.1 dB noise floor. Crucially, the primary contribution of the mask is not merely this 1.7 dB drop, but rather to restrict the adversary’s point of observation: by masking the individual updates, CHRONOS prevents the server from inspecting the

15 of 18

vulnerable 18.5 dB plaintext gradients, forcing them to operate exclusively on the secure 9.8 dB aggregate.

8

Discussion

8.1

Hardware Scope and Portability

CHRONOS currently targets gateway-class IoT devices (e.g., Rock Pi 4, Jetson Nano) equipped with ARM Cortex-A processors and OP-TEE. While standard Cortex-M microcontrollers lack the memory management required by OP-TEE, portability is architecturally feasible. Trusted Firmware-M (TF-M) [31] provides a compatible TEE framework for Cortex-M33/M55 devices. Because CHRONOS maintains a minimal Secure World footprint (632 bytes for 𝑁 = 20), it sits well within the storage budgets of TF-M profiles. We identify porting the Trusted Application to Cortex-M as a primary extension for future hardware coverage.

8.4

The current design mitigates Man-in-the-Middle (MITM) attacks during the idle phase via server-mediated Authenticated Key Exchange (AKE), where clients sign their public keys using hardware-enrolled certificates verified by the TA. While this ensures the integrity of the derived keys, CHRONOS assumes an honest-but-curious server that computes the final aggregate faithfully. Resilience against a fully malicious server, which might return corrupted global models or attempt to exclude valid client updates, could be added via commit-and-prove techniques. Clients would commit to their masked gradients, and the server would provide a zero-knowledge proof of correct aggregation. Such extensions would add a verification step to the active phase but maintain the core benefit of interaction-free masking established by CHRONOS.

8.5

8.2

Hardware-Isolated Masking

Our empirical validation (Section 7.6) demonstrates that CHRONOS thwarts state-of-the-art gradient inversion attacks, reducing reconstruction fidelity to random noise (PSNR ≈8 dB). This robustness stems from the computational barrier provided by cryptographic masking. Under the standard PRF security assumption, the masked gradient is computationally indistinguishable from uniform over 𝔽𝐷𝑝 . Because the server only observes 𝑔̃𝑖 = 𝑔𝑖 + 𝑚𝑖 and the mask 𝑚𝑖 is computationally independent of the gradient 𝑔𝑖 , the true signal is securely obscured. The primary contribution of the CHRONOS mask is to restrict the adversary’s point of observation. In plaintext FL, a curious server can inspect individual updates before summation (18.5 dB PSNR), whereas CHRONOS forces the adversary to view only the masked aggregate. By anchoring this mechanism in TrustZone, CHRONOS ensures that gradient confidentiality is maintained regardless of the client’s Normal World state, effectively enforcing the theoretical privacy bounds of secure aggregation.

8.3

Dropout, Selection Bias, and Recovery

Non-IID federated learning is susceptible to selection bias when clients with unique data distributions consistently drop out due to resource constraints. CHRONOS addresses this via its Shamirbased recovery mechanism. By reconstructing the missing mask of a dropped client from peer-held shares, the server correctly demasks the surviving aggregate without requiring a new training round. Because the Shamir-based recovery mechanism perfectly reconstructs the missing masks (Section 5.3), the server mathematically recovers the exact plaintext aggregate of the surviving clients. This by-construction correctness ensures that the cryptographic protocol introduces no additional bias beyond what plaintext aggregation-with-dropouts would introduce.

16 of 18

Security Scope and Future Hardening

Applicability Beyond Federated Learning

The phase-decoupled architecture of CHRONOS is a general systems primitive for resource-constrained secure computation. Any application employing additive masking, such as private set intersection for proximity sensing, secure multi-sensor fusion for anomaly detection, or privacy-preserving record linkage, can benefit from shifting cryptographic setup to idle windows. In each case, the TEE provides key secrecy and round-counter freshness, while the idle-window model enables privacy-preserving computation within the strict latency budgets of real-time IoT environments. reserving computation within the strict latency budgets of real-time IoT environments.

9

Conclusion

The deployment of cryptographic privacy protections on IoT devices has historically been hindered by the prohibitive synchronous overhead of secure multiparty computation. CHRONOS resolves this tension by leveraging the inherent duty cycle of IoT devices: the alternation between resource-abundant idle periods and latency-critical active sensing. By decoupling the cryptographic setup from the training phase and anchoring it in hardware, CHRONOS enables privacy-preserving federated learning that approaches the performance of plaintext exchange. Our hardware-assisted design generates ephemeral keypairs and seals derived PRG keys entirely within ARM TrustZone. This ensures OS-level compromise resistance with a negligible 632byte persistent Secure World memory footprint. During active training rounds, the system reduces the client cryptographic workload to a single stream-cipher evaluation and one transmission round. Evaluation on Rock Pi 4 devices demonstrates up to a 74% reduction in active-phase aggregation latency compared to synchronous secure aggregation for 20 clients, while successfully thwarting state-of-the-art gradient inversion attacks (PSNR ≈8 dB). By shifting multi-party interaction to the idle window and enforcing security goals through a TEE-internal key lifecycle,

,

CHRONOS provides a practical template for secure computation in resource-constrained environments. Future work includes extending peer authentication via hardware-backed certificates and porting the framework to microcontroller-class devices via Trusted Firmware-M. Ultimately, the phase-decoupled architecture of CHRONOS demonstrates that robust, TEE-grade privacy is viable for the next generation of intelligent IoT deployments.

12.

13. 14.

Acknowledgments This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors.

15.

Conflicts of Interest The author declares no conflict of interest.

16.

Data Availability Statement The data that support the findings of this study are available in the public repository at https://github.com/dkhme/CHRONOS.

17.

References

18.

1. McMahan, B., Moore, E., Ramage, D., Hampson, S., Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS) (2017) 2. Wang, H., Eklund, D., Oprea, A., Raza, S.: FL4IoT: IoT device fingerprinting and identification using federated learning. ACM Transactions on Internet of Things 4(3) (2023) 3. Sum, A.S.I., Pritee, Z.T., Saha, A.K., Mahmud, M.A., Nur, K.: A systematic review on privacy preservation in federated learning. International Journal of Information Security 25(2) (2026) https://doi.org/10.1007/s10207-026-01229-x 4. Uprety, A., Rawat, D.B., Sadler, B.: Human immune system inspired security for federated learning-empowered internet of things. ACM Transactions on Internet of Things 6(2) (2025) 5. Zhu, L., Liu, Z., Han, S.: Deep leakage from gradients. Advances in Neural Information Processing Systems (NeurIPS) 32 (2019) 6. Wu, Z., Dong, J., Zhong, W., Xu, J., Liu, M., Wang, Y.: Learning to invert: Simple adaptive attacks for gradient inversion in federated learning. In: Proceedings of the 39th Conference on Uncertainty in Artificial Intelligence (UAI 2023), pp. 2293–2303 (2023) 7. Shan, J., Zhao, Z., Lu, J., Zhang, R., Yiu, S.M., Chow, K.-H.: Geminio: Language-guided gradient inversion attacks in federated learning. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV 2025) (2025) 8. Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H.B., Patel, S., Ramage, D., Segal, A., Seth, K.: Practical secure aggregation for privacy-preserving machine learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS 2017), pp. 1175–1191 (2017). https://doi.org/10.1145/3133956.3133982 9. Li, T., Sahu, A.K., Talwalkar, A., Smith, V.: Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine 37(3), 50–60 (2020) 10. Gamiz, I., Regueiro, C., Lage, O., Jacob, E., Astorga, J.: Challenges and future research directions in secure multi-party computation for resource-constrained devices and large-scale computations. International Journal of Information Security (2024) https://doi.org/10.1007/s10207-024-00939-4 11. Mo, F., Haddadi, H., Katevas, K., Marin, E., Perino, D., Kourtellis, N.: PPFL: Privacy-preserving federated learning with trusted

19.

20.

21.

22.

23.

24. 25.

26.

27. 28.

29.

execution environments. In: Proceedings of the 19th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys 2021) (2021) Pinto, S., Santos, N.: Demystifying arm trustzone: A comprehensive survey. ACM Comput. Surv. 51(6) (2019) https://doi.org/10.1145/3291047 OP-TEE: Open Portable Trusted Execution Environment. https://optee.readthedocs.io/ (Accessed: April 2026) Mohassel, P., Zhang, Y.: Secureml: A system for scalable privacypreserving machine learning. In: Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), pp. 19–38 (2017). https://doi.org/10.1109/SP.2017.12 Wagh, S., Gupta, D., Chandran, N.: Securenn: 3-party secure computation for neural network training. Proceedings on Privacy Enhancing Technologies (PoPETs) 2019(3), 26–49 (2019) Guo, Y., Polychroniadou, A., Shi, E., Byrd, D., Balch, T.: MicroSecAgg: Streamlined single-server secure aggregation. Proceedings on Privacy Enhancing Technologies (PoPETs) 2024(3), 77–96 (2024) Keller, M., Orsini, E., Scholl, P.: MASCOT: Faster malicious arithmetic secure computation with oblivious transfer. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS 2016), pp. 830–842 (2016). https://doi.org/10.1145/2976749.2978347 Keller, M.: MP-SPDZ: A versatile framework for multi-party computation. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS 2020), pp. 1575–1590 (2020). https://doi.org/10.1145/3372297.3417872 Ait Messaoud, A., Ben Mokhtar, S., Nitu, V., Schiavoni, V.: Shielding federated learning systems against inference attacks with ARM TrustZone. In: Proceedings of the 23rd International Middleware Conference, pp. 293–305. ACM, ??? (2022). https://doi.org/10.1145/3528535.3565255 Yehuda, R.B., Zaidenberg, N.J.: Protection against reverse engineering in ARM. International Journal of Information Security 19, 39–51 (2020) https://doi.org/10.1007/s10207-019-00442-x Fernandez, E.B., Muñoz, A.: A cluster of patterns for trusted computing. International Journal of Information Security 24(1) (2025) https://doi.org/10.1007/s10207-024-00972-3 Grisafi, M., Ammar, M., Roveri, M., Crispo, B.: FLAShadow: A flash-based shadow stack for low-end embedded systems. ACM Transactions on Internet of Things 5(3) (2024) He, Y., Jia, X., Zhang, S., Chitkushev, L.: SeFS: A secure and efficient file sharing framework based on the trusted execution environment. EAI Endorsed Transactions on Security and Safety 9(1) (2025) https://doi.org/10.4108/eetss.v9i1.2854 Wang, H., et al.: Integrating IoT-sensing and crowdsensing with privacy. ACM Transactions on Internet of Things 3(4) (2022) Emmaka, I., Phuong, T.V.X.: One-shot secure aggregation: A hybrid cryptographic approach for federated learning. arXiv preprint arXiv:2511.23252 (2025) Trusted Firmware-A: TF-A Source Code: plat/rockchip/rk3399/drivers/secure/secure.c. https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/tree/plat/rockch (Accessed: April 2026) Rockchip Electronics Co., Ltd.: RK3399 Technical Reference Manual. (2017). Rockchip Electronics Co., Ltd. Tang, A., Sethumadhavan, S., Stolfo, S.J.: CLKscrew: Exposing the perils of security-oblivious energy management. In: Proceedings of the 26th USENIX Security Symposium (USENIX Security 17), pp. 1057–1074 (2017) Qiu, P., Wang, D., Lyu, Y., Qu, G.: VoltJockey: Breaching TrustZone by software-controlled voltage manipulation over multicore platforms. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS 19), pp. 195–209 (2019)

17 of 18

30. Geiping, J., Bauermeister, H., Dröge, H., Moeller, M.: Inverting gradients — how easy is it to break privacy in federated learning? In: Advances in Neural Information Processing Systems (NeurIPS 2020), vol. 33, pp. 16937–16947 (2020) 31. TF-M: Trusted Firmware for Arm Cortex-M. https://www.trustedfirmware.org/projects/tf-m/ (Accessed: April 2026)

18 of 18

,