Security Architecture

Trust Nothing.
Verify Everything.

Sangrah implements defense-in-depth across every layer of the federated learning pipeline. Here's how we protect your data sovereignty.

01 / Mutual TLS

End-to-End mTLS Authentication

Every connection between participant nodes and the coordinator is authenticated via mutual TLS with X.509 certificates. No anonymous traffic enters the federation.

Mutual TLS
# Certificate verification
sangrah cert verify --node enterprise-a
  Issuer:  Sangrah Federation CA
  Subject: CN=enterprise-a.sangrah.net
  Valid:   2025-01-01 to 2026-01-01
  Status:  ✓ Valid

02 / Model Signing

Ed25519 Model Integrity

Every model artifact is signed with Ed25519 before distribution. Participants verify signatures before accepting model updates, preventing supply-chain attacks on the learning pipeline.

Model Signing
# Model signature verification
sangrah model verify --version 1.2.4
  Algorithm: Ed25519
  Signer:   coordinator@sangrah.net
  Hash:     sha256:a4f2c8...
  Status:   ✓ Signature valid

03 / Differential Privacy

Formal Privacy Guarantees

Configurable (ε, δ)-differential privacy ensures that individual data points cannot be reverse-engineered from shared gradients. Privacy budgets are tracked per-epoch with automatic training halts when thresholds are reached.

Differential Privacy
# Privacy budget status
sangrah privacy status
  Epsilon (ε):  3.2 / 10.0
  Delta (δ):    1e-5
  Mechanism:    Gaussian
  Epochs used:  24 / 50
  Status:       ✓ Within budget

04 / Secure Aggregation

Pairwise Masking Protocol

Gradient updates are protected using a pairwise masking scheme. The coordinator aggregates masked gradients without ever seeing individual contributions — even a compromised coordinator learns nothing about any single participant.

Secure Aggregation
# Aggregation verification
sangrah aggregate verify --epoch 24
  Protocol:     SecAgg (pairwise)
  Participants: 5/5 masks verified
  Dropped:      0 (threshold: 2)
  Status:       ✓ Secure aggregation complete

05 / Byzantine Resilience

Multi-Krum Defense

The Multi-Krum algorithm detects and excludes Byzantine (adversarial or faulty) gradient updates. Malicious participants cannot poison the global model — the aggregation is provably robust to a configurable fraction of corrupted nodes.

Byzantine Resilience
# Byzantine detection log
sangrah audit byzantine --epoch 24
  Algorithm:    Multi-Krum (f=1)
  Scores:
    enterprise-a: 0.12 ✓
    enterprise-b: 0.15 ✓
    enterprise-c: 0.14 ✓
    enterprise-d: 3.82 ✗ EXCLUDED
  Status:       1 node excluded

06 / Zero Trust

Zero-Trust Architecture

No implicit trust between any components. Every API call is authenticated, every model artifact is verified, every gradient is validated. The system assumes breach at every layer and verifies accordingly.

Zero Trust
# Security posture
sangrah security audit
  mTLS:          ✓ Enforced
  Model signing: ✓ Ed25519
  Privacy:       ✓ ε=3.2 (budget ok)
  SecAgg:        ✓ Pairwise masking
  Byzantine:     ✓ Multi-Krum active
  Cert rotation: ✓ 30-day cycle
  Overall:       HARDENED