Federated learning has emerged as a promising technique for the Internet of Things (IoT) in various domains, including supply chain management. It enables IoT devices to collaboratively learn without exposing their raw data, ensuring data privacy. However, federated learning faces the threats of local data tampering and upload process attacks. This paper proposes an innovative framework that leverages Trusted Execution Environment (TEE) and blockchain technology to address the data security and privacy challenges in federated learning for IoT supply chain management. Our framework achieves the security of local data computation and the tampering resistance of data update uploads using TEE and the blockchain. We adopt Intel Software Guard Extensions (SGXs) as the specific implementation of TEE, which can guarantee the secure execution of local models on SGX-enabled processors. We also use consortium blockchain technology to build a verification network and consensus mechanism, ensuring the security and tamper resistance of the data upload and aggregation process. Finally, each cluster can obtain the aggregated parameters from the blockchain. To evaluate the performance of our proposed framework, we conducted several experiments with different numbers of participants and different datasets and validated the effectiveness of our scheme. We tested the final global model obtained from federated training on a test dataset and found that increasing both the number of iterations and the number of participants improves its accuracy. For instance, it reaches 94% accuracy with one participant and five iterations and 98.5% accuracy with ten participants and thirty iterations.

The existing blockchain technology has provided us with new tools to address the issue of product traceability in supply chain management, allowing for true paperless implementation of specific transaction documents. However, when data exchange occurs between different blockchain networks, the transparency of the blockchain increases the risk of privacy breaches. In order to tackle this problem, this paper proposes a data privacy protection mechanism based on distributed partially homomorphic encryption, leveraging the data invisibility feature of semi-homomorphic encryption. The data is distributedly stored and encrypted to ensure data integrity during cross-chain transmission while maintaining strong privacy protection. To evaluate our solution, we conducted experiments and performed a performance analysis. The experimental results demonstrate that our approach effectively preserves the privacy of cross-chain data and exhibits low computational and communication overhead during data transmission and decryption.