We propose the first generalization of the famous Non-Interactive\nZero-Knowledge (NIZK) proofs to quantum languages (NIZKoQS) and we provide a\nprotocol to prove advanced properties on a received quantum state\nnon-destructively and non-interactively (a single message being sent from the\nprover to the verifier).\n In our second orthogonal contribution, we improve the costly Remote State\nPreparation protocols [CCKW18,CCKW19,GV19] that can classically fake a quantum\nchannel (this is at the heart of our NIZKoQS protocol) by showing how to create\na multi-qubits state from a single superposition.\n Finally, we generalize these results to a multi-party setting and prove that\nmultiple parties can anonymously distribute a GHZ state in such a way that only\nparticipants knowing a secret credential can share this state, which could have\napplications to quantum anonymous transmission, quantum secret sharing, quantum\nonion routing and more.\n
Non-interactive zero-knowledge (NIZK) proofs for chosen-ciphertext security are generally considered to give an impractical construction. An interesting recent work by Seo, Abdalla, Lee, and Park (Information Sciences, July 2019) proposed an efficient semi-generic conversion method for achieving chosen-ciphertext security based on NIZK proofs in the random oracle model. The recent work by Seo et al. demonstrated that the semi-generic conversion method transforms a one-way (OW)-secure key encapsulation mechanism (KEM) into a chosen-ciphertext secure KEM while preserving tight security reduction. This paper shows that the security analysis of the semi-generic conversion method has a flaw, which comes from the OW security condition of the underlying KEM. Without changing the conversion method, this paper presents a revised security proof under the changed conditions that (1) the underlying KEM must be chosen-plaintext secure in terms of indistinguishability and (2) an NIZK proof derived from the underlying KEM via the Fiat–Shamir transform must have the properties of zero-knowledge and simulation soundness. This work extended the security proof strategy to the case of identity-based KEM (IBKEM) and also revise the security proof for IBKEM of previous method by Seo et al. Finally, this work gives a corrected security proof by applying the new proofs to several existing (IB)KEMs.
In addition to their usefulness in proving one’s identity electronically, identification protocols based on zero-knowledge proofs allow designing secure cryptographic signature schemes by means of the Fiat–Shamir transform or other similar constructs. This approach has been followed by many cryptographers during the NIST (National Institute of Standards and Technology) standardization process for quantum-resistant signature schemes. NIST candidates include solutions in different settings, such as lattices and multivariate and multiparty computation. While error-correcting codes may also be used, they do not provide very practical parameters, with a few exceptions. In this manuscript, we explored the possibility of using the error-correcting codes proposed by Stakhov in 2006 to design an identification protocol based on zero-knowledge proofs. We showed that this type of code offers a valid alternative in the error-correcting code setting to build such protocols and, consequently, quantum-resistant signature schemes.
Financial Regulation is a form of compliance system that subjects financial institutions to certain requirements and restrictions. Investment Compliance is an example that involves investment restrictions and monitoring on behalf of investors. Hedge Funds differ from other traditional funds such as mutual funds because of their ability to employ complex investment and hedging techniques. These are private entities with few public disclosure requirements. This is useful in a way as the strategies used are confidential which allows financial agents to participate in the financial markets without any fear of information leakage, hence promoting liquidity. However, this is often implied as a lack of transparency. Hedge Funds are expected to produce higher returns, but sometimes investors seek a risk guarantee in addition to higher returns. However, too much transparency rules out the incentives financial entities have by participating in the first place. On the other hand, too much secrecy may give rise to malicious entities that can break the rules due to a lack of compliance. We aim to solve this problem of protecting investors while ensuring the privacy of financial bodies using zero knowledge proofs. Proofs can be visualized as a way of providing enough information to investors while the zero-knowledge property of proofs maintains the privacy of the fund manager’s strategies. We propose a protocol to address this scenario using Zokrates, a framework for verifiable computation using Zk-SNARKs on Ethereum, to encode the constraints and export the verifier. Based on our implementation and analysis, it can be concluded that zero knowledge proofs provide us with a variety of ways to develop compliance systems.
Elliptic curves with a bilinear map, or pairing, have a rich algebraic structure that has been fundamental to develop practical Non-Interactive Zero-Knowledge (NIZK) proofs. On the theoretical side, we explore how efficient can NIZK proofs be under weak complexity assumptions. Specifically, we reduce the cost of proofs of satisfiability of quadratic equations, we define a new commitment scheme that is compatible with other pairing-based NIZK arguments, and we construct a simulation-sound argument that results in a new a signature of knowledge with communication sublinear in the circuit size under standard assumptions. Additionally, we study how to reduce the cost of verification in one of the most widely deployed NIZK arguments in practice.
Zero-knowledge succinct non-interactive argument of knowledge (zkSNARK) allows a party, known as the prover, to convince another party, known as the verifier, that he knows a private value $v$, without revealing it, such that $F(u,v)=y$ for some function $F$ and public values $u$ and $y$. There are various versions of zk-SNARK, among them, Quadratic Arithmetic Program (QAP)-based zk-SNARK has been widely used in practice, specially in Blockchain technology. This is attributed to two desirable features; its fixed-size proof and the very light computation load of the verifier. However, the computation load of the prover in QAP-based zkSNARKs, is very heavy, even-though it is designed to be very efficient. This load can be beyond the prover's computation power to handle, and has to be offloaded to some external servers. In the existing offloading solutions, either (i) the load of computation, offloaded to each sever, is a fraction of the prover's primary computation (e.g., DZIK), however the servers need to be trusted, (ii) the servers are not required to be trusted, but the computation complexity imposed to each one is the same as the prover's primary computation (e.g., Trinocchio). In this paper, we present a scheme, which has the benefits of both solutions. In particular, we propose a secure multi-party proof generation algorithm where the prover can delegate its task to $N $ servers, where (i) even if a group of $T \in \mathbb{N}$ servers, $T\le N$, collude, they cannot gain any information about the secret value $v$, (ii) the computation complexity of each server is less than $1/(N-T)$ of the prover's primary computation. The design is such that we don't lose the efficiency of the prover's algorithm in the process of delegating the tasks to external servers.
Abstract For the current medical block chain, the access rights of electronic medical records and agent encryption are mainly controlled by permission contract. The way of protecting electronic medical records realizes the sharing of medical data, but neglects the management and protection of user identity. In this paper, this article studies the privacy protection technology of the blockchain, combined with the stealth address and zero-knowledge proof technology, and proposes a plan to weigh anonymity and security to protect the privacy of users in the medical blockchain.
The development of information technology has brought great convenience to our lives, but at the same time, the unfairness and privacy issues brought about by traditional centralized systems cannot be ignored. Blockchain is a peer-to-peer and decentralized ledger technology that has the characteristics of transparency, consistency, traceability and fairness, but it reveals private information in some scenarios. Secure multi-party computation (MPC) guarantees enhanced privacy and correctness, so many researchers have been trying to combine secure MPC with blockchain to deal with privacy and trust issues. In this paper, we used homomorphic encryption, secret sharing and zero-knowledge proofs to construct a publicly verifiable secure MPC protocol consisting of two parts-an on-chain computation phase and an off-chain preprocessing phase-and we integrated the protocol as part of the chaincode in Hyperledger Fabric to protect the privacy of transaction data. Experiments showed that our solution performed well on a permissioned blockchain. Most of the time taken to complete the protocol was spent on communication, so the performance has a great deal of room to grow.
We propose three constructions of classically verifiable non-interactive proofs (CV-NIP) and non-interactive zero-knowledge proofs and arguments (CV-NIZK) for QMA in various preprocessing models.
- We construct an information theoretically sound CV-NIP for QMA in the secret parameter model where a trusted party generates a quantum proving key and classical verification key and gives them to the corresponding parties while keeping it secret from the other party. Alternatively, we can think of the protocol as one in a model where the verifier sends an instance-independent quantum message to the prover as preprocessing.
- We construct a CV-NIZK for QMA in the secret parameter model. It is information theoretically sound and zero-knowledge.
- Assuming the quantum hardness of the leaning with errors problem, we construct a CV-NIZK for QMA in a model where a trusted party generates a CRS and the verifier sends an instance-independent quantum message to the prover as preprocessing. This model is the same as one considered in the recent work by Coladangelo, Vidick, and Zhang (CRYPTO '20). Our construction has the so-called dual-mode property, which means that there are two computationally indistinguishable modes of generating CRS, and we have information theoretical soundness in one mode and information theoretical zero-knowledge property in the other. This answers an open problem left by Coladangelo et al, which is to achieve either of soundness or zero-knowledge information theoretically. To the best of our knowledge, ours is the first dual-mode NIZK for QMA in any kind of model.
We propose three constructions of classically verifiable non-interactive zero-knowledge proofs and arguments (CV-NIZK) for QMA in various preprocessing models. - We construct a CV-NIZK for QMA in the quantum secret parameter model where a trusted setup sends a quantum proving key to the prover and a classical verification key to the verifier. It is information theoretically sound and zero-knowledge. - Assuming the quantum hardness of the learning with errors problem, we construct a CV-NIZK for QMA in a model where a trusted party generates a CRS and the verifier sends an instance-independent quantum message to the prover as preprocessing. This model is the same as one considered in the recent work by Coladangelo, Vidick, and Zhang (CRYPTO '20). Our construction has the so-called dual-mode property, which means that there are two computationally indistinguishable modes of generating CRS, and we have information theoretical soundness in one mode and information theoretical zero-knowledge property in the other. This answers an open problem left by Coladangelo et al, which is to achieve either of soundness or zero-knowledge information theoretically. To the best of our knowledge, ours is the first dual-mode NIZK for QMA in any kind of model. - We construct a CV-NIZK for QMA with quantum preprocessing in the quantum random oracle model. This quantum preprocessing is the one where the verifier sends a random Pauli-basis states to the prover. Our construction uses the Fiat-Shamir transformation. The quantum preprocessing can be replaced with the setup that distributes Bell pairs among the prover and the verifier, and therefore we solve the open problem by Broadbent and Grilo (FOCS '20) about the possibility of NIZK for QMA in the shared Bell pair model via the Fiat-Shamir transformation.
Homomorphic Encryption and Zero Knowledge Proofs are two trending concepts that are widely popular as data privacy preservation techniques in a wide variety of applications, especially in those associated with the newly evolved block chain technology which are immutable, distributed and secure. Zero knowledge proof is a cryptographic technique can provide proof that a certain statement is correct, without revealing any details about the statement, while homomorphic encryption allows to perform computations on encrypted data without decrypting it. This article explores the significance of the data privacy aspect provided by both ZKP and Homomorphic Encryption and how it can be effectively used to improvise the privacy of blockchain applications in various domains.\n\n
This work is concerned with the study of the extreme rays of the convex cone of $3\times 3$ quasiconvex quadratic forms (denoted by ${\cal C}_3$). We characterize quadratic forms $f\in {\cal C}_3,$ the determinant of the acoustic tensor of which is an extremal polynomial, and conjecture/discuss about other cases. We prove that in the case when the determinant of the acoustic tensor of a form $f\in {\cal C}_3$ is an extremal polynomial other than a perfect square, then the form must itself be an extreme ray of ${\cal C}_3;$ when the determinant is a perfect square, then the form is either an extreme ray of ${\cal C}_3$ or polyconvex; and finally, when the determinant is identically zero, then the form $f$ must be polyconvex. The zero determinant case plays an important role in the proofs of the other two cases. We also make a conjecture on the extreme rays of ${\cal C}_3,$ and discuss about weak and strong etremals of ${\cal C}_d$ for $d\geq 3.$ where it turns out that several properties of ${\cal C}_3$ do not hold for ${\cal C}_d$ for $d>3,$ and thus case $d=3$ is special. These results recover all previously known results (to our best knowledge) on examples of extreme points of ${\cal C}_3$ that were proved to be such. Our results also improve the ones proven by the first author and Milton [20].
The bicuspid aortic valve (BAV) still hides many challenging issues including definition and classification. Michelena et al. [1] present an interesting new, very comprehensive, partially complex BAV classification and beyond in written English, avoiding numbers and letters for a universal, audience. Included are 3 basic types: the fused BAV, the 2-sinuses BAV and the partial-fusion BAV (form fruste), and also aspects like fusion versus raphe, indeterminate fusion, fusion orientation, cusp symmetry and aortopathy. For everyday clinical purposes, this classification appears a little impractical compared to other classifications (see Table 1 in [1]) including that, published by our group, Sievers and Schmidtke [2]. From clinical experience, we defined a congenital aortic valve anomaly as a BAV when it presents with a fishmouth like, bifoliate, functionally biscupid systolic valve opening, validated at surgery in adults, independent of empryological considerations. Three basically different phenotypes were observed: the genuine BAV with 2 sinuses and 2 cusps but no raphe (BAV type 0, whereby a raphe was defined as a fibrous or calcified ridge extending from the wall to the free edge of the cusps), followed by phenotypes (similar to tricuspid valves), with 3 sinuses and 3 cusps, 2 of which are conjoined in 1 raphe (BAV type 1), and consequently a phenotype with also a bifoliate opening, 3 sinuses, 3 cusps but 2 raphes (BAV type 2). Although not yet observed in mice or hamsters it may surface as a member in the spectrum of endocardial cushion defects, typical for BAV’s, underlined by an earlier report, describing it as a unicuspid valve with 2 raphes ‘representing abortive commissures’, which is not the original unicuspid valve [3]. Lack of finding this entity in animals is not necessarily proof that it does not exist in human beings. As the main category, the number of raphes allowed for classifying the 3 groups with short, practical and memorable expressions (BAV type 0, BAV type 1 and BAV type 2), the essence of clinical classifications (e.g. Stanford A/B, de Bakey I, II, III). The subcategory includes letters for orientation e.g. L: left-, R: right-, N: non-coronary sinus. Thus, the numbers of the BAV types correspond to concrete BAV typical structures—the raphes—facilitating identification and clinical connotations. For example, BAV type 0: the Ross operation and even the implantation of conventional substitutes could be less straightforward, because of only 2 commissures. Repair is facilitated. The most frequent BAV type 1, L-R: how to manage the discrepancy between the more downstream displaced smaller left and right cusps and the more upstream located larger non-coronary cusp during the Ross operation, repair, remodelling, reimplantation or even replacement with conventional prostheses preventing leaflet prolapse or tilt? Since cusp symmetry seems favourable for repair, the question comes up how to achieve the ideal length of the cusps, 1.6 times the diameter is necessary (1.1 in tricuspid valves) to warrant a stenosis free valve opening without prolapse (commissural elongation, or windmill excessive cusps tissue?) BAV type 2: the nadirs of the 3 sinuses are at 1 plane facilitating valve replacement but rendering repair more complex. Furthermore, considering the complex BAV pathology and the excellent long-term results with surgery, warranting secure fixation of the prosthesis and concomitant aortic surgery, transcatheter aortic valve replacement may be applied carefully and benefit from BAV-specific management or even design innovations. Also, BAV development is complex, probably not single gene related, influenced by epigenetics such as embryonic blood flow and sometimes including also the myocardium, the ascending aorta and the mitral valve [4, 5]. Basically, endocardial cushions seem to be involved. As a novel mechanism of BAV development, displaced aortic intercalated valve swellings in human embryos were reported recently [6], possible correlating with our observation (see above) of displaced left and right coronary cusps in BAV type 1, L-R. BAV-associated aortopathy (AoP) also emerges with many questions, e.g. how is it best defined, and optimally treated? Fact is, AoP rarely presents with symptoms except when catastrophic aortic dissection occurs. This renders AoP surgery more prophylactic. Because it is predominantly performed at BAV surgery, indication and surgery are challenging since the dilatation of the aorta ascending often tapers into the arch [7]. The association of AoP and BAV seems overall weak [7]. Including haemodynamics in the analysis reveals ascending AoP more associated with stenotic BAVs, probably shear stress-related. Insufficient BAVs are associated with more extensive AoP [7], obviously more gene related inducing surgical implications for adequate reinforcement and replacement. Latest after Rylski et al. [8] reported a mean ascending aorta diameter of only 40 mm, measured within 2 years prior to dissection, other parameters in addition to size surface significant for decision-making, such as age, z-score, particularly history, growth rate, intraoperative tissue quality, haemodynamics, BAV type, and in the future potentially genes, blood pressure at rest and exercise, etc. First clinical results with this more individualized concept for treatment of the ascending aorta at BAV surgery are promising [9]. In this respect, calculation of the place value of each single variable and at the end the total personal risk, optimized by computational biology, may assist decision-making [10]. Also, surgical risk reduction to near zero; flexible, individually shaped prostheses; intraoperative histological analysis; automatical anastomoses, etc, are desirable goals. Proper communication is necessary, preferably accompanied either by novel classifications or evolving already used classifications with new knowledge or speciality requirements, e.g. adding the angle between the fused and non-fused cusps in degree indicating symmetry for repair purposes (BAV type 1, L-R, 150°), or the extend of fusion in %, a tissue quality score or a calcification score for transcatheter aortic valve replacement. However, in the clinical setting, more extended, complex classifications are less user friendly, potentially causing confusion. Often only short, concise, practical, partially idealized, but memorable expressions with speciality and clinical relevance and connotations are advantageous. Paying attention to these facts has probably made our classification [2], particulary the BAV type 0 and the BAV type 1, the so-called Sievers classification [1] popular and widely used. Anyway, progress in decrypting the BAV mystery, may profit from fruitful discussions including different definitions and classifications, their supposed limitations and benefits. (Babel also positive?) Only audience and time will tell.
Biometric verification has been widely deployed in current authentication solutions as it proves the physical presence of individuals. To protect the sensitive biometric data in such systems, several solutions have been developed that provide security against honest-but-curious (semi-honest) attackers. However, in practice attackers typically do not act honestly and multiple studies have shown drastic biometric information leakage in such honest-but-curious solutions when considering dishonest, malicious attackers. In this paper, we propose a provably secure biometric verification protocol to withstand malicious attackers and prevent biometric data from any sort of leakage. The proposed protocol is based on a homomorphically encrypted log likelihood-ratio-based (HELR) classifier that supports any biometric modality (e.g. face, fingerprint, dynamic signature, etc.) encoded as a fixed-length real-valued feature vector and performs an accurate and fast biometric recognition. Our protocol, that is secure against malicious adversaries, is designed from a protocol secure against semi-honest adversaries enhanced by zero-knowledge proofs. We evaluate both protocols for various security levels and record a sub-second speed (between $0.37$s and $0.88$s) for the protocol against semi-honest adversaries and between $0.95$s and $2.50$s for the protocol secure against malicious adversaries.
This personal reaction is written from multiple perspectives. First and foremost, as the corresponding author of the original FAIR article. Second as the chair of the first High Level Expert Group (HLEG) of European Open Science Cloud (EOSC) (which is how I met Jean-Claude) and third from my current GO FAIR and CODATA perspective. None of what I write below is to be seen as a formal position of any of the organisations I am associated with.Let me start by stating that, after some periods silent of hope and of deep despair, I now strongly feel that, with the governance of the EOSC Association in place, EOSC will become a success after all. It will still be critical that the Association involves the member states (MSs) and actual researchers in an agile and non-bureaucratic manner, for which we need bottom-up mechanisms such as operated by the Research Data Alliance (RDA) and GO FAIR. But a balancing formal entity operating along the formalised Strategic Research and Innovation Agenda [1] and the Partnership proposal as well as the various “declarations” including the recent one under the German presidency [2] are an excellent guiding roadmap to a successful EOSC, obviously in global context.That said, at the risk of sounding like broken record, this reaction should also look at the points where it went “almost” wrong, as we should try and learn from our mistakes. I may make some enemies—or strengthen the opinion of existing ones—in the process, but then, a wise old friend, who also wrote one of the reactions once told me: “Barend, unless you made some enemies you probably lived in vain.” So I will speak my mind (“what's new'?). I also like to say that ”EOSC“ brought me some real new friends for life!First of all, the fact that quickly after its inception FAIR became a hype term①, which was probably partly even accelerated by the prominent role it played in early EOSC discussions with EC's Director General, also has its downsides. Like for the term “AI”, everyone co-opts the term and some start watering the concept down to a bloodless caricature from what it originally meant. In the case of FAIR this includes removing the central notion of machine actionability, mis-characterising it as a standard, conflating it with “open”, only linking it to data sensu stricto, ignoring software, algorithms and more. In general terms, people that sometimes seem to have never read the original article [3], the most flagrant abuse of the term I have heard (obviously not from an active researcher) is this: “If data are Findable, Accessible and Interoperable it is ”automatically' Reusable.“ This is of course ”swearing in FAIR church“ as the R (principles R1–3) [3] clearly state that rich provenance and reuse conditions are critical and in particular the provenance. The decision whether (even high quality) data are fit for purpose (reuse in a particular study) is a critical step and is imho (in my humble opinion) at the basis of the reproducibility problem we currently face. Therefore, I would like to re-emphaisize here my current one liner to summarise the aim of the FAIR guiding principles: ”The Machine Knows what I mean“. Those who feel that FAIR is too ambitious and for instance promote that ”achieving F and A is enough for now“ in my humble opinion fail to see the disruptive character of the solutions we need to make EOSC and its sister around the globe a real paradigm shift towards Open Science (OS). Or they are just trying to preserve the status quo and move incrementally at a pace they can follow.This nicely bridges to the first observation on EOSC as such. I indeed think that the first “Communication” that needed 126 iterations mentioned by Jean-Claude, which happened in the same time frame as our “HLEG-1” period, was symptomatic for a basic flaw in the discussions, which haunts us still today. Conflating the “ICT”/HPC (or basic e-infrastructure) with the data and end user applications for analytics, has caused an enormous hurdle. In the entire journey of the HLEG we had to carefully navigate around this cliff and it is still a highly controversial issue today. This part was the “Dunning Kruger effect” [4] pur sang: The “other side is easy” (because I am not hindered by any knowledge about it) and is “more or less already done” (because I do not understand the complexity). This is not only true for the active researchers who cannot use the current e-infrastructure efficiently (and naturally that is “entirely the fault of the nerds who build things I do not understand or cannot operate”), but also for e-infrastructure engineers who know everything about ICT and “thus” (?) also about data (because “that is just ones and zeros”) as Jean- Claude also noted. I also believe however, that it is a mistake to completely separate e-infrastructure for the data and services layer, as the e-infrastructure should route (and understand at least at middleware level) what processes are needed on the data and how the FAIR services “run”. Nowadays (after many iterations) I use the diagram below (Figure 1) to explain that all three basic elements of the “Internet of FAIR Data and Services” are needed. Each of them should be adorned with FAIR (machine actionable) metadata to seamlessly form a Web of FAIR Data and Services on top of the current, proven Internet backbones, thus forming the “Internet of FAIR Data and Services”, eventually creating an “Internet for Social Machines” [5] where people and machines can both efficiently use all services, independently and in collaboration.This does absolutely not mean that the foundation (e-infrastructure) of the triangle is “trivial” or “can be reused as is”. Not only middleware, but also the crucial and fundamental concept of FDOs needs to be developed in close collaboration between data and computer experts and is largely domain-agnostic.The seamless combination will become the principle “package” of information that machines (and also people) can understand and act upon. Major infrastructure builders should actually co-lead this, while domain scientists need to decide on which data formats and metadata schemes (i.e. FAIR Implementation Profiles [9]) should be built on this basic schema.Together with the Dunning Kruger effect, too many overlapping and redundant projects supporting the talking/meeting/landscaping, re-landscaping and re-re landscaping' has resulted in what I became to call the “EOSC is a bigger Me syndrome”. On the one hand, countless people voluntarily invested (and still invest) their time in the development of the EOSC, but others seem to only see EOSC as “yet another way to collect EC funding for their current solutions that are in my opinion not future- and OS proof. This misbalance between people investing their own time and effort based on intrinsic motivation and vision and on the other hand the ”reliance on EC subsidy“ caused a dichotomy during the scoping years of EOSC between disruptive and ”preservative“ approaches. The heavy reliance on EC subsidy also largely ignored the subsidiarity principle [10] and the fact that 90% of the eventual infrastructures and services that we need for EOSC will be paid by the MSs. Also data and research intensive industry was largely kept out of the loop, which was another mistake I have frequently pointed out. This helped to create and sustain the ”Brussels Bubble“ that Jean-Claude described. The Association will hopefully reverse that trend.Finally, the influence on the HLEG report of the then-commissioner was rather profound. The report was not only delayed almost 6 months after its proposed publication version, but there is also a nice additional “untold story” here: The originally proposed title of the report was: “A Cloud on the 2020 Horizon”. In my original foreword I explained the slightly “glooming” connotation of that title. When the report was finally approved, it appeared that the title had been unilaterally changed into “Realising A European Open Science Cloud [11]”. Not only did I have to hastily change my foreword (because it made no sense anymore) but also, my notorious statement that the “result” should neither be “European” (only), nor Open (only) nor (only) for Science and certainly not (just) a “Cloud” was entirely ignored in changing that title. But it again emphasises the “This is an EC thing” context, with the associated risk for confiscation of the concept by the “usual suspects” in EC subsidy land. However, I feel after three years of intensive deliberations, which may be considered lightning fast on the geological time scale, see George's reaction, we can conclude that most of the original HLEG recommendations are well-represented in the basic guiding documents of the EOSC Association, which makes me a happy man at the end of this crazy year.That leads me to the final observation: As a result of the (quote from Jean-Claude): “non-paper seen as the political turning point in support of EOSC” [12], GO FAIR (Global Open FAIR) [13] was started, originally by Germany and The Netherlands and soon joined by France as a temporary “kick-start”, bottom-up approach to accelerate EOSC (see also recommendation I-2.1. in the HLEG report, annex 1).Soon, GO FAIR became really global and the agile modus operandi of practical Implementation Networks yielded a number of crucial approaches to speed up the adoption of the FAIR guiding principles and the hourglass approach [14]. Now, late 2020, when the EOSC Association is a fact, GO FAIR (1.0) has achieved its goals (early implementation steps) and we need to reflect on its future. Next to the intrinsic value of the active GO FAIR IN community [15] as such, several particular assets that I need to mention here are the development of the FAIR Implementation Profile and Metadata4Machines approach, the development of easy to install FAIR data points for open, FAIR metadata publication and indexing, and last but not least the international effort (involving many players, also outside the direct GO FAIR initiative) to develop the minimal specs of the FDO framework [7] in a more specified form than when coined in the FAIR expert group report [5]. These assets (all open source and open access) can be carried over, not only to EOSC, but will have much wider, international, impact most likely leading to a continuation of GO FAIR (2.0) beyond its original time scope, namely three years, the predicted time it would take to complete the international policy and bureaucracy process to reach the status of a formal association as we have today. I hope the leaders of the Association will optimally learn from the successes and failures and near-road-accidents of the last three years and see EOSC as the European contribution to a “Global Open Science Commons”, also known as the Internet of FAIR Data and Services, in full, open collaboration with the international organisations that are now joining forces in the Data Together initiative [16]. After all, the major challenges we face are global, so is the research needed to face them and so are the solutions we hope to fiend. I fully trust the current leadership of the association to make that vision reality.Policy recommendationsGovernance recommendationsImplementation recommendations
In the area of cloud computing, data deduplication enables the cloud server to store a single copy of data by eliminating redundant files to improve storage and network efficiency. Proof-of-ownership (PoW) is a cryptographic function that verifies the user who really owns the data. Most of the existing schemes have tried to solve the deduplication problem by providing the same encryption key for identical data. However, these schemes suffer from dynamic changes in ownership management. In this paper, we propose an in-line block matching (IBM) protocol based on zero-knowledge proof for deduplication with dynamic ownership management, which eliminates the unauthorized access of sensitive data. In this proposed work, for a new file, the uploader randomly chooses a file encryption key and encrypts the file. The user also computes a unique proof for the uploaded file by dividing the file into number of blocks and stores this proof to the cloud server. The cloud server computes the group key for the ciphertext and re-encrypts it using this group key. The cloud server also does the proof verification against the subsequent uploader for an existing file. The cloud server is honest-but-curious, so the proposed scheme confirms that the cloud server does not know any information about file encryption key even though it plays a proxy role. The result shows that our proposed scheme protects the data from both cloud server and adversaries. Also, the computational cost is comparatively less than other existing schemes.
Electronic voting systems have several necessarily requirements, such as anonymity that others cannot link voters with votes, the fairness that votes should not be leaked before the tally, and the accuracy that eligible voters' votes should be counted correctly. There have been proposed various methods to realize the requirements. Some of them require anonymous communication paths as necessary elements to satisfy the anonymity requirement for a practical electronic voting system. Cruz et al. proposed an electronic voting system that does not need anonymous communication paths, using Bitcoin, a cryptographic currency, as a distributed database. However, Bitcoin is a system in which all data are disclosed, and anyone can check what exchanges a person of a certain ID (Bitcoin address) has done. It is possible to reveal which voter made what vote, and hence(anonymity is not satisfied. In this paper, we propose a method to solve the above problem by using Bitcoin mixing. We propose an electronic voting system using Zerocoin, a variant of Bitcoin, as a database, in which zero knowledge proof is used instead of blind signature for mixing.
The types of political and policy knowledge required to guide rapid transition to low-carbon economies remain largely disconnected in the fields of political science, psychology, and sociology. The composition and key features of the main actors involved, and their relationships have also not been systematically described. This paper attempts to address these knowledge gaps by proposing a new, integrative typology of actors involved in climate change mitigation policy in the United Kingdom (UK) and a method for mapping these actors and selecting their typological descriptors onto a 2D space. The mapping method enables stakeholders to visualise and evaluate the strength of support for the UK government’s net-zero-by-2050 “green growth” strategy and the tensions, challenges, and strategic opportunities potentially facing more radical alternatives. The methodology could be replicated for climate actors in other countries and, in principle, for any geographical scale or level of governance.
Single- or multi-layer perceptrons, commonly known as neural networks, are universal approximators that can approximate any continuous functions arbitrarily well when the number of perceptrons is allowed to grow indefinitely. When prior knowledge about the target function is available, constraints can be imposed on the neural network to improve approximation accuracy. As an example, it is well known that convolutional neural networks (CNN) \cite{lecun1990handwritten} yield good performance on image classification. And its parameter-sharing scheme can also reduce the risk of overfitting. One of the key properties of image classification is that it is invariant to translation of input image. The translation invariance in CNN is achieved with two steps. On the one hand, the convolutional layer gives a translation equivariance as it is a linear time invariant system. The translation of the input image will be kept as a transformation of the output. On the other hand, the pooling layer will introduce local invariance. The stack of convolutional layers and pooling layers will then reach a receptive field the same size as input and also enforces global invariance. Inspired by the success of CNN on image related tasks, plenty of CNN generalizations \cite{gens2014deep, henaff2015deep, simonovsky2017dynamic, cohen2018spherical,chidester2018rotation} have been studied in other tasks. \emph{Domain invariance}, which refers to the property that the output is invariant to certain transformation of the input features is a crucial property which can help to generalize CNN to other machine learning applications. The works which introduce domain invariance fall into two categories. One of the categories introduces the invariance by injecting invariant constrains. The other category builds the equivariant network layer then achieves invariance by applying the pooling or normalization layer. In the equivariant network layer, the input is transformed by some group transformation the output is transformed correspondingly. As in the CNN example, the invariance can be achieved by first using equivariant layers then apply the pooling layer. In this dissertation, we will focus on the invariance and equivariance of neural networks and analyze the neural network architecture which can achieve invariance or equivariance. The main works can be summarized as following. \noindent\textbf{The Connections Between Convolutional Architecture and Equivariant Property} Convolutional neural networks have achieved great success in speech, image, and video signal processing tasks in recent years. There have been several attempts to justify the convolutional architecture and to generalize the convolution operation for treatment of other data types such as graphs and manifolds. Based on group representation theory and noncommutative harmonic analysis, it has recently been shown that the so-called group equivariance requirement of a feed-forward neural network necessitates the convolutional architectures. In our work, based on the familiar concepts of linear time-invariant systems, we develop an elementary proof of the same result. The nonlinear activation function, being a necessary components of practical deep neural networks, has been glossed over in previous analyses of the connection between equivariance and convolution. We identify sufficient conditions for the non-linear activation functions to preserve equivariance, and hence the necessity of the group convolution structure. Our analysis method is simple and intuitive, and holds the potential to be applied to more challenging scenarios such as non-transitive domains and multiple simultaneous equivariances. \noindent\textbf{Characteristics of Generalized Convolutional Neural Networks} Based on the analysis method above, a theoretical support for details of network architecture design is then provided in our work. We first analyze the necessary and sufficient condition for a neural network to be group equivariant when the group acts on the sub-domain of input/output. This part gives a theoretical support for how should we combine channels in a neural network layer. Meanwhile, it also gives guidelines for designing neural networks with partial equivariance/invariance. To further investigate the characteristics of generalized convolutional neural networks, we then analyze the multiple equivariance case. The result shows the connection between model parameter sharing and equivariant property. In particular, we find that a model will have more parameter sharing if more equivariances are required. Meanwhile, we establish a universality result for shallow and deep generalized group convolutional neural networks as approximators of continuous group-equivariant functions. After choosing the network architecture, one common question we need to answer is that how many neurons do we want in our hidden layer? We show that the generalized convolution mapping to a quotient space is a projection of the image of a generalized convolution which maps to the maximum quotient space. This can be used to obtain guidelines for choosing the feature size of hidden layer. \noindent\textbf{Neural Networks with Invariant Properties} In the traditional convolutional neural networks, the spatial invariant properties are introduced by adding a global pooling layer after the convolutional layers. For some specific applications, there are still some potential for us to further reduce the model complexity by introduce invariant property in earlier layers. An partial permutation invariant model for learning graph node embedding is introduced based on the classical invariant theory. In the image processing application, an affine equivariant preprocessing method is proposed to build neural networks invariant to affine transformation. \noindent\textbf{Partially Permutation Invariant Graph Node Embedding Model} Graph node embedding aims at learning a vector representation for all nodes given a graph. It is a central problem in many machine learning tasks (e.g., node classification, recommendation, community detection). The key problem in graph node embedding lies in how to define the dependence to neighbors. Existing approaches specify (either explicitly or implicitly) certain dependencies on neighbors, which may lead to loss of subtle but important structural information within the graph and other dependencies among neighbors. This intrigues us to ask the question: can we design a model to give the maximal flexibility of dependencies to each node's neighborhood. In our recent work, we propose a novel graph node embedding method (named \textbf{\OM}) via a novel notion of \textit{partial permutation invariant set function}, to capture any possible dependence. The partial permutation invariant set function is designed based on the set of \textit{invariant basis} with respect to permutation group. Our method 1) can learn an \textit{arbitrary} form of the representation function from the neighborhood, without losing any potential dependence structures, and 2) is applicable to both homogeneous and heterogeneous graph embedding, the latter of which is challenged by the diversity of node types. Furthermore, we provide theoretical guarantee for the representation capability of our method for general homogeneous and heterogeneous graphs. Empirical evaluation results on benchmark data sets show that our proposed {\OM} method outperforms the state-of-the-art approaches on producing node vectors for various learning tasks of both homogeneous and heterogeneous graphs. \noindent\textbf{Learning Models Invariant to Affine Transformations for Image Processing} The way designing invariant/partial invariant neural networks with invariant basis is difficult to extend to groups other than permutation group. Because the invariant basis is expensive to calculate. Even if we get the set of invariant basis, it will be very large and is not helpful to reduce model complexity. An alternative which can introduce invariant property to neural network is adding an equivariant transformer as a pre-processing layer. This equivariant transformer will revert all the affine transformations happens in the input. Thus the model will be invariant to affine transformations. Invariance to affine transformations is desirable property for many computer vision tasks like image classification and motion tracking. Enforcing and taking advantage of such affine invariance property is an essential part for building efficient models for machine learning. However, it has been challenging to build models that are provably affine invariant. Previous works have achieved partial invariance, such as invariance to shifting and to rotation. We propose to build an affine-invariant model in two steps. First, we apply image normalization, which renders the density function represented by the image to have zero mean and identity covariance matrix. The resulting normalized image is then processed by a second stage neural network that is either an equivariant transformer network (ETN) or group convolution networks. We provide proof of invariance and demonstrate the performance improvement of such neural networks in processing images that have been affine transformed.
In this thesis we are interested in solving a class of quasilinear parabolic partial differential equations (PDEs) for closed differential forms which exhibit a special structure, namely a gradient flow structure, and thus bringing together two major areas of mathematical analysis, the geometric theory of differential forms and the theory of gradient flows. More precisely, for a bounded domain $ \Omega \subset \mathbb{R}^n $, $ n \ge 2 $, with smooth boundary and a time-dependent differential $ k $-form $ \omega (t) \colon \Omega \rightarrow \Lambda ^k ( \mathbb{R}^n ) $ we consider the gradient flow equation $\partial _t \omega \,=\, -\mathop{}\!\mathrm{d} \Big( \nabla c^ \ast \Big[ \mathop{}\!\mathrm{d}^{\ast} \big( \nabla _ \xi F( \, \cdot \, , \omega )\big) \Big] \Big) $ und $ \mathop{}\!\mathrm{d} \omega \,=\, 0 $. Here, $ c \colon \Lambda ^ {k-1}( \mathbb{R}^n ) \rightarrow [0, \infty )$, called the dissipation potential, is a convex function with Legendre-Fenchel dual $ c^ \ast $, whereas $ \nabla _ \xi F $ denotes the derivative of the energy density $ F \colon \Omega \times \Lambda ^k( \mathbb{R}^n ) \rightarrow \mathbb{R} $ with respect to its second argument. This class of PDEs was suggested by Yann Brenier in 2014 as a general framework for dissipative equations and contains for example the $ p $-Hodge Laplace heat equation for closed differential forms $ \partial _t \omega = - \mathop{}\!\mathrm{d} ( | \mathop{}\!\mathrm{d}^{\ast} \omega | ^ {p-2} \, \mathop{}\!\mathrm{d}^{\ast} \omega ) $. The problem of finding weak solutions of the gradient flow equation is challenging not only because of its nonlinearity, but also because of its vectorial character, i.e. it is a system of scalar PDEs. The gradient flow structure appears in the form of a so-called Energy Dissipation Inequality (EDI). Although the latter is equivalent to the gradient flow equation only on a formal level, it nevertheless plays an essential role in establishing the proof of the existence of weak solutions for the PDE. In order the prove the existence of solutions of the corresponding EDI, we use a so-called minimizing movement scheme. This is a time-discrete approximation scheme in which each time-step consists of solving a variational problem. The variational problem involves the perturbation of the energy functional with the so-called dissipation functional which is defined using the dissipation potential $ c $. This dissipation functional is closely related to the norms of the duals of homogeneous Sobolev spaces for differential forms, i.e. negative homogeneous Sobolev spaces, which are introduced here. Hence, these spaces define the natural functional analytic setting for the problems addressed in this thesis. To the best of our knowledge, this concept of negative homogeneous Sobolev spaces for differential forms is new. In the limit where the time discretization parameter, used to define the perturbed energy functional, tends to zero the approximation scheme weakly converges to some limit. Since the EDI has well-suited lower semicontinuity properties with respect to the weak convergence, the limit is indeed a solution of the EDI. The limiting process also benefits from compensated compactness methods such as the Sobolev-Poincaré inequality in combination with a Minty-Browder-type argument. With some extra effort we can also prove a reversed EDI for the limit. As the main result of this thesis we conclude from this the existence of a weak solution of the gradient flow equation. In the second part of the thesis we ask for additional properties of the weak solutions of the gradient flow equation such as uniqueness, a semigroup property of the time evolution, an exponential formula as well as error estimates. These problems are very difficult to solve. Because the concept of the EDI is too weak for these questions, we invoke the stronger concept of the Evolution Variational Inequality (EVI). The latter is formally equivalent to the gradient flow equation as well. However, it is only available in the case $ c( \xi ) = \frac{1}{2}| \xi | ^2 $ in which the dissipation functional becomes, up to a scalar multiple, the negative homogeneous Sobolev norm for the case of Hilbert spaces. As the main results for the second part we prove uniqueness of the limit found before in a class of admissible solutions of the EVI, a contraction property and a semigroup property of the time evolution as well as an exponential formula together with an error estimate. The proof of the exponential formula and the error estimate is given by using two different approaches.
Public blockchains have reached high popularity among technically inclined people, laypersons and researchers alike. Similarly, privacy has gained much attention in the same circles. This attention and high sensitivity of information transmitted in blockchains, lead more and more blockchain-based systems, especially cryptocurrencies, to provide privacy for their users. Popular approaches include ring signatures or zero-knowledge proofs to achieve unlinkable payments within the blockchain. However, these systems solely examine privacy by considering the blockchain and its embedded transactions. The underlying peer-to-peer network of a public blockchain is rarely considered. This leaves the dissemination of transactions open for privacy attacks, as the IP address of the originator of a transaction can be mapped to their real-world identity. In this thesis, we look into the important privacy aspects of broadcasting blockchain transactions. We collect and analyse data of a large blockchain network and construct a privacy-preserving latency estimator. Building on the insights gained from the analysis, we combine dining-cryptographers networks with a secret sharing technique and layer a flood-and-prune broadcast on top, to provide enforced k-anonymity to network participants. To increase the flexibility of this approach, we extend two established privacy protocols. First, we extend a dining-cryptographers based group messaging protocol to transmit arbitrary length messages. Further, we optimize the protocol for common cases, to improve its performance for various environments, especially blockchain transaction dissemination. As a performant intermediate privacy layer, we transform adaptive diffusion from a contact graph protocol to a computer network protocol. We achieve this by changing the underlying network assumptions and the attacker model. We derive optimal forwarding probabilities based on a statistical network model of unstructured peer-to-peer networks. These two sub-protocols are combined in an intertwined layering approach to create 3P3, a flexible privacy-preserving broadcast protocol. Lastly, to manage the groups required for 3P3 and other proposed and common protocols, we propose Pixy. Pixy is a privacy increasing group creation scheme, allowing for filtering and testing of group participants to establish trust. The system allows for smaller group sizes while maintaining privacy guarantees of previous systems, or better privacy for same-sized groups. The software, concepts, data and models in this thesis help researchers and developers of privacy preserving network protocols. Developers can use 3P3, tuning its parameters to the needs of their network. Researchers can build on the data, concepts and models to create novel schemes and generalizations of our insights. This improves privacy for all users of modern and future networks.