This paper focuses on the research of auditing data privacy protection mechanism under blockchain technology and constructs an efficient computational model. The model is based on the distributed ledger characteristic of blockchain, and ensures the data tampering and traceability by optimizing the consensus mechanism. In the proposed model, the consensus mechanism is optimized by utilizing the tamper proof properties of blockchain. By building a multi node collaborative framework that supports batch auditing, this model improves data synchronization efficiency. The focus of optimization is to reduce the consensus reaching time and thus improve the overall performance and scalability of the blockchain network. At the same time, smart contracts are utilized to realize automated data sharing and auditing processes to improve auditing efficiency. In terms of data encryption algorithm design, a chaotic system based on RSA algorithm encryption is designed by combining the randomness and complexity of chaos theory to further strengthen the security of data. The results show that the model in this paper can make the ciphertext image uncorrelated in all directions and improve the encryption strength of the image. The method of this paper can make the audit data information on the degree of privacy protection and the complexity of the ciphertext image increase up to about 50% and 45% than the comparison method; the encryption and decryption time of the data is reduced by about 20 s. In addition, the running time of the stages of this paper’s algorithm increases with the increase in the number of concurrent requests and this paper’s system can support concurrency of 500 users at the same time and make its throughput up to 583.49/s.
Blind signatures have become a cornerstone for privacy-sensitive applications such as digital cash, anonymous credentials, and electronic voting. The elliptic curve variant of the Digital Signature Algorithm (ECDSA) is widely adopted due to its efficiency in resource-constrained environments, such as mobile devices and blockchain systems. Building blind ECDSA is hence a natural goal. One presents the first such construction relying solely on the ECDSA assumption. Despite the inherent complexities in integrating blindness with ECDSA, we design a protocol that ensures both unforgeability and blindness without introducing new computational assumptions and ensuring concurrent security. It involves zero-knowledge proofs based on the MPC-in-the-head paradigm for complex statements combining relations on encrypted elliptic curve points, their coordinates, and discrete logarithms.
Russell W. F. Lai, Monisha Swarnakar, Ivy K. Y. Woo
The Learning with Errors (LWE) problem asks to distinguish noisy samples s^T A + e^T mod q from uniformly random values given the random matrix A. In this work, we show that a variant called Leaky LWE, where the distinguisher receives additionally noisy leakages (s^T, e^T) L + f^T of the LWE secret s and error e for low-norm matrix L chosen adaptively by the distinguisher after seeing A, is not easier than the standard LWE of the same dimensions up to polynomial losses in the noise level and the modulus. More generally, we show that the Leaky LWE problem is hard even if the public matrix A is structured and/or hinted and if the non-leaky parts of the secret and error do not follow Gaussian distributions, as long as the corresponding LWE problem without leakage is hard. Our reduction from LWE to Leaky LWE unifies and extends prior results on the Error-Leakage LWE problem [Döttling-Kolonelos-Lai-Lin-Malavolta-Rahimi, EUROCRYPT'23], where L only acts on the error e and the Hint-MLWE problem [Kim-Lee-Seo-Song, CRYPTO'23], where L is restricted to concatenations of random Gaussian scalar matrices not controlled by the distinguisher. Previously, the Hint-MLWE and Error-Leakage LWE assumptions were used as computational replacements of the statistical noise flooding technique in security proofs which led to improved parameters in lattice-based cryptographic constructions such as zero-knowledge proofs, threshold signatures and registration-based encryption. We provide lemmas which abstract out such computational arguments based on Leaky LWE.
An anonymous credential (AC) system with partial disclosure allows users to prove possession of a credential issued by an issuer while selectively disclosing a subset of their attributes to a verifier in a privacy-preserving manner. In keyed-verification AC (KVAC) systems, the issuer and verifier share a secret key. Existing KVAC schemes rely on computationally expensive zero-knowledge proofs during credential presentation, with the presentation size growing linearly with the number of attributes. In this work, we propose two highly efficient KVAC constructions that eliminate the need for zero-knowledge proofs during the credential presentation and achieve constant-size presentations. Our first construction adapts the approach of Fuchsbauer, Hanser and Slamanig (JoC'19), which achieved constant-size credential presentation in a publicly verifiable setting using their proposed structure-preserving signatures on equivalence classes (SPS-EQ) and set commitment schemes, to the KVAC setting. We introduce structure-preserving message authentication codes on equivalence classes (SP-MAC-EQ) and designated-verifier set commitments (DVSC), resulting in a KVAC system with constant-size credentials (2 group elements) and presentations (5 group elements). To avoid the bilinear groups and pairing operations required by SP-MAC-EQ, our second construction uses a homomorphic MAC with a simplified DVSC. While this sacrifices constant-size credentials (n+2 group elements, where n is the number of attributes), it retains constant-size presentations (2 group elements) in a pairingless setting. We formally prove the security of both constructions and provide open-source implementation results demonstrating their practicality. We extensively benchmarked our KVAC protocols and, additionally, bechmarked the efficiency of our SP-MAC-EQ scheme against the original SPS-EQ scheme, showcasing significant performance improvements.
In this paper, we show for the first time it is practical to privately delegate proof generation of zkSNARKs to a single server for computations of up to 2^20 R1CS constraints. We achieve this by computing zkSNARK proof generation over homomorphic ciphertexts, an approach we call blind zkSNARKs. We formalize the concept of blind proofs, analyze their cryptographic properties and show that the resulting blind zkSNARKs remain sound when compiled using BCS compilation. Our work follows the framework proposed by Garg et al. (Crypto'24) and improves the instantiation presented by Aranha et al. (Asiacrypt'24), which implements only the FRI subprotocol. By delegating proof generation, we are able to reduce client computation time from 10 minutes to mere seconds, while server computation time remains limited to 20 minutes. We also propose a practical construction for vCOED supporting constraint sizes four orders of magnitude larger than the current state-of-the-art verifiable FHE-based approaches. These results are achieved by optimizing Fractal for the GBFV homomorphic encryption scheme, including a novel method for making homomorphic NTT evaluation packing-friendly by computing it in two dimensions. Furthermore, we make the proofs publicly verifiable by appending a zero-knowledge Proof of Decryption (PoD). We propose a new construction for PoDs optimized for low proof generation time, exploiting modulus and ring switching in GBFV and using the Schwartz-Zippel lemma for proof batching; these techniques might be of independent interest. Finally, we implement the latter protocol in C and report on execution time and proof sizes.
Bitcoin is one of the famous cryptocurrencies in the world. It is a permissionless blockchain, and all transactions are stored in a public decentralized ledger. In its security design, Bitcoin utilizes various cryptographic primitives, such as hash functions and signature schemes. In the current version of Bitcoin, the Elliptic Curve Digital Signature Algorithm (ECDSA) is employed, which is not considered post-quantum secure due to the Shor's algorithm. Since December 2016, the National Institute of Standards and Technology (NIST) initiated a process to standardize certain post-quantum cryptographic primitives, including key encapsulation mechanisms (KEMs), public key encryption (PKE), and digital signature schemes. Dilithium, a lattice-based digital signature scheme, emerged as one of the winners of this competition and is recently standardized as ML-DSA (FIPS 204). In this work, we analyze the potential replacement of the ECDSA signature, the current signature in Bitcoin, with Dilithium, which is a post-quantum digital signature. This replacement will have a significant impact on many protocols within the Bitcoin ecosystem. The ECDSA algorithms are not only utilized for transaction signing and verification but also in wallet management. Bitcoin operates on a pseudonymous system rather than complete anonymity. To enhance privacy protection, the Bitcoin community has adopted a special type of (hierarchical) deterministic wallet as outlined in Bitcoin Improvement Proposal 32 (BIP32). We have constructed deterministic wallets by first designing DilithiumRK, a signature scheme with rerandomizable keys from Dilithium. Subsequently, we conducted a thorough security analysis and successful implementation of DilithiumRK.
We introduce zkMaP (Zero-Knowledge Succinct Non-Interactive Matrix Multiplication Proofs), a novel non-interactive zero-knowledge proof system for verifying matrix multiplication with significant improvements in efficiency and scalability. Our protocol leverages KZG polynomial commitments and an innovative inner-product reduction technique to reduce the verification of n x n matrix multiplication to a single pairing equation, thereby enabling constant-time verification independent of the matrix size. In particular, zkMaP requires only two pairing operations and produces proofs as small as 320 bytes, yielding a 96 percent reduction in proof size compared to prior schemes. Furthermore, the prover's computational complexity follows the state-of-the-art at O(n^2), with experimental results demonstrating that proofs for 1024 x 1024 matrices can be generated in approximately 12.21 seconds, offering a 16.14x speedup over previous methods. Our implementation also exhibits better memory efficiency, using only 24.58 MB of prover-side RAM for 1024 x 1024 matrices, and supports scalable batch processing, achieving per-proof generation times of 46.79 milliseconds for 1024 instances while maintaining a constant verification time of 3.6 ms.
Blockchain has become a critical enabler of secure data sharing in domains such as healthcare, finance, and digital identity. However, its reliance on classical cryptographic schemes (e.g., RSA, ECDSA, SHA-256) makes current systems vulnerable to emerging quantum computing attacks, raising risks to data confidentiality, integrity, and long-term trust. This paper addresses this challenge by proposing a modular hybrid framework that integrates post-quantum cryptographic (PQC) techniques into blockchain-based personal data sharing. The framework combines lattice-based encryption for protecting off-chain data, hash-based signatures for smart contract authentication, and quantum-safe zero-knowledge proofs and trusted execution environments (TEEs) for privacy-preserving verification and secure key management. To ground this design, we conducted a systematic literature review of 35 studies published between 2018 and 2025, analyzing security, scalability, interoperability, regulatory alignment, and user autonomy. Findings reveal that only 5 out of 35 studies (14%) explicitly addressed quantum threats, with over 80% focusing on theoretical resilience without testing implementation constraints. Furthermore, 90% of proposals neglected smart contract compatibility, and only 8% (3/35) incorporated TEEs, underscoring implementation barriers in contract execution, secure key management, and performance integration. Prototype evaluation demonstrated that the framework sustained 1,500 TPS on Hyperledger Fabric, achieved a 75% reduction in storage bloat using IPFS, and supported GDPR-aligned workflows with 99.98% audit log completion and 95% successful erasure requests. Privacy was further strengthened through zk-STARK proofs, which reduced unauthorized access by 40%, while TEEs improved key management efficiency by ~28%. Although PQC introduced 5–12 seconds of latency, consent revocation was processed in under 2.1 seconds, highlighting both the feasibility and trade-offs of practical post-quantum deployment. This work demonstrates a clear pathway toward quantum-resilient blockchain infrastructures that safeguard personal data, comply with regulatory standards, and maintain user trust in the quantum era.
The industrial internet of things (IIoT) expanded fast as physical devices and systems were connected to the internet. However, this interconnectedness made IIoT systems vulnerable to hackers. Intrusion detection systems (IDSs) were put in place to detect and prevent such assaults. Nonetheless, attackers might circumvent IDSs by forging identities or interfering with recorded data. The article intended to improve IIoT security by achieving system confidentiality, integrity, availability, scalability, performance, and security. For IIoT security, the article developed a secure federated learning access control framework (SecureFLACF) linked with a blockchain-based IDS. SecureFLACF used blockchain to secure data collected by IDS, AES-256 encryption to secure stored data, zero-knowledge proof (ZKP) to validate user identities and manage data access, and a federated learning access control framework (FLACF) to train a machine learning model for intrusion detection. SecureFLACF developed as a viable solution for improving IIoT security, providing strong assurances for IDS data and access control using blockchain’s tamper-proof structure and AES-256 encryption. Furthermore, FLACF’s design allows private machine learning model training, ensuring data privacy as well as model fidelity. The framework’s usefulness was highlighted by its application in real-world circumstances, making it a cost-effective option for organisations of all sizes. This method not only strengthened IIoT systems against a wide range of cyber threats, but also stressed their dependability as a safeguard. SecureFLACF exhibited considerable promise for improving IIoT security across several dimensions by encapsulating practicability, cost-effectiveness, and dependability.
Current systems for exchanging medical records struggle with efficiency and privacy issues. While establishing the Electronic Medical Record Exchange Center (EEC) in 2012 was intended to alleviate these issues, its centralized structure has brought about new attack vectors, such as performance bottlenecks, single points of failure, and an absence of patient consent over their data. Methods: This paper describes a novel EMR Gateway system that uses blockchain technology to exchange electronic medical records electronically, overcome the limitations of current centralized systems for sharing EMR, and leverage decentralization to enhance resilience, data privacy, and patient autonomy. Our proposed system is built on two interconnected blockchains: a Decentralized Identity Blockchain (DID-Chain) based on Ethereum for managing user identities via smart contracts, and an Electronic Medical Record Blockchain (EMR-Chain) implemented on Hyperledger Fabric to handle medical record indexes and fine-grained access control. To address the dual requirements of cross-platform data exchange and patient privacy, the system was developed based on the Fast Healthcare Interoperability Resources (FHIR) standard, incorporating stringent de-identification protocols. Our system is built using the FHIR standard. Think of it as a common language that lets different healthcare systems talk to each other without confusion. Plus, we are very serious about patient privacy and remove all personal details from the data to keep it confidential. When we tested its performance, the system handled things well. It can take in about 40 transactions every second and pull out data faster, at around 49 per second. To give you some perspective, this is far more than what the average hospital in Taiwan dealt with back in 2018. This shows our system is very solid and more than ready to handle even bigger workloads in the future.
Existing regulatory frameworks for decentralized anonymous payments help combat illicit activities such as money laundering and terrorism financing. However, With the development of the European Union's General Data Protection Regulation (GDPR) and data sovereignty, Existing frameworks struggle to balance privacy with regulatory compliance, often compromising user autonomy and data sovereignty. To address this, we propose the Linkable Distributed Regulatory Tag (LDRT) scheme, which enables traceability without altering transaction structure by leveraging Paillier homomorphic encryption and secret sharing. Building upon this, we introduce Decentralized Anonymous Payment with Data Sovereignty(DAPDS), the first regulatory framework for decentralized anonymous payments that complies with data sovereignty. DAPDS supports both UTXO and account-based models and employs a distributed regulator group with incentives to prevent dishonest behavior. We define and analyze the security properties of both LDRT and DAPDS, proving anonymity, linkability, traceability, collusion resistance, data sovereignty, distributed regulation, and fairness of incentive mechanism. Our work provides a valuable reference for future regulatory framework paradigms for anonymous privacy-preserving traceable blockchain. Experimental results show that DAPDS only incurs an additional 34ms of time cost over ETH in transacation phase and an average of only 2.66s per tracing request in tracing phase.
Umna Iftikhar, Hafiz Muhammad Attaullah, Inam Ullah Khan, Muhammad Mansoor Alam · 6 authors
Verification of a qualification, achievement, quality, or aspect of a person’s background is one of the biggest problems nowadays as we have seen many platforms where students can get fake credentials. Every organization must select professional and academically qualified employees to give quality service. As a result, corporations rely on academic certifications to confirm and measure their prospective employees’ academic qualifications. On the other hand, these employers lack a standardized process for confirming the legitimacy of academic certificates or degrees. Because the present procedures for verifying educational certifications are time-consuming, exhausting, and costly, just a few employers verify certificates for prospective employees. This research examines the issues that are related to the smart verification of someone’s credentials. To make the process of verifying digital credentials quicker, simpler, and more cost-effective, we suggest decentralized architecture. We present the prototype, design, and implementation of the proposed framework.
Healthcare data management in cloud environments faces critical challenges in balancing security, privacy, operational efficiency, and regulatory compliance, as traditional access control mechanisms are inadequate for addressing the complex, multi-tenant, and dynamic nature of modern cloud infrastructures handling sensitive Electronic Health Records (EHRs). This paper introduces a novel hybrid framework that integrates Attribute-Based Access Control (ABAC) with Ethereum blockchain technology to establish a comprehensive multi-layered security architecture for cloud-based healthcare systems, combining advanced cryptographic techniques including double encryption using AES and RSA algorithms, Shamir's Secret Sharing for key management, smart contracts for automated policy enforcement, and multi-party computation protocols to ensure privacy preservation without compromising system performance. Extensive experimental evaluation conducted using 4,412 anonymized clinical records with 12 distinct attributes demonstrates exceptional efficiency with average record insertion time of 1.90 ms, retrieval time of 0.14 ms, blockchain mining time of 0.01 seconds, and hybrid architecture throughput of 562.94 records/second with 1.78 ms latency, significantly outperforming traditional centralized systems (337.17 rec/s, 2.97 ms) and pure blockchain implementations (3.37 rec/s, 296.98 ms). Security assessments reveal 100% operational reliability, 97.3% policy violation detection accuracy, 89% reduction in unauthorized access attempts, and comprehensive regulatory compliance with HIPAA (97%), GDPR (92%), ISO 27001 (94%), and SOC 2 (89%) standards, while maintaining optimized system resource utilization with CPU usage at 35.6%, memory at 48.0%, and network I/O at 34.1%. The framework addresses key limitations of existing approaches by providing seamless integration across multiple cloud layers, eliminating single points of failure, ensuring data immutability through distributed consensus mechanisms, maintaining comprehensive audit trails, and offering practical implications for healthcare organizations seeking secure, scalable, and compliant data sharing mechanisms in cloud-native environments, thereby contributing to the advancement of secure healthcare informatics by bridging the gap between theoretical access control models and practical implementation requirements in distributed cloud infrastructures.
Advances in differential equations and control theory are reshaping how secure, efficient medical data-exchange systems are designed. In parallel, blockchain offers decentralized trust, cryptographic integrity, and auditable access control for healthcare networks. Yet the choice of storage and transmission architecture strongly affects scalability, latency, privacy, and cost. This work investigates how mathematical modeling via differential equations and modern control processes can be coupled with blockchain to strengthen security and interoperability across distributed healthcare systems. We comparatively examine three deployment models: (1) on-chain storage, (2) off-chain, cloud-backed storage with blockchain access control, and (3) local institutional storage integrated with federated learning. On-chain designs maximize transparency and tamper-resistance but incur substantial computation and storage overhead. Off-chain approaches improve scalability while retaining verifiable control through the ledger. Local storage with federated learning safeguards patient privacy by keeping raw data within institutions and sharing only encrypted updates or proofs on chain. Persistent challenges include storage bloat, network delays, heterogeneous regulations, and evolving attack surfaces. To address these issues, we outline optimization strategies grounded in system dynamics stability analysis, resource allocation, and control-oriented tuning to balance throughput, privacy, and reliability. The study synthesizes theoretical insights with implementation considerations, offering a unified perspective on building resilient, performant, and privacy-preserving medical data-exchange frameworks that leverage blockchain under mathematically principled control.
Mr. Aditya S. G., Mr. Ram Anil Ainkar, Prof. Ms. Pranalini Joshi
The current Know Your Customer (KYC) ecosystem is largely built on centralized systems, which are vulnerable to data breaches, incur high operational costs, and often require customers to repeat verification steps unnecessarily [1], [2]. Such centralized designs concentrate sensitive data in single repositories, creating “honeypots” that conflict with modern data privacy standards like the General Data Protection Regulation (GDPR) [3], [4]. At the same time, the transparent nature of public Distributed Ledger Technology(DLT) presents challenges for maintaining privacy in financial transactions, giving rise to what is often called the “Blockchain-PrivacyParadox” [5]. This survey explores cutting-edge DLT-based solutions that integrate Self-Sovereign Identity (SSI) and Zero-KnowledgeProof (ZKP) techniques. Key challenges in current approaches include scalability limitations in certain permissioned blockchains [6],inadequate mechanisms to fully support GDPR’s Right to Erasure [3], [4], [7], and the absence of reliable protocols to ensure legal access for Anti-Money Laundering (AML) compliance when users are uncooperative [8], [9].
Privacy-preserving technologies have introduced a paradigm shift that allows for realizable secure computing in real-world systems. The significant barrier to the practical adoption of these primitives is the computational and communication overhead that is incurred when applied at scale. In this paper, we present an overview of our efforts to bridge the gap between this overhead and practicality for privacy-preserving learning systems using multi-party computation (MPC), zero-knowledge proofs (ZKPs), and fully homomorphic encryption (FHE). Through meticulous hardware/software/algorithm co-design, we show progress towards enabling LLM-scale applications in privacy-preserving settings. We demonstrate the efficacy of our solutions in several contexts, including DNN IP ownership, ethical LLM usage enforcement, and transformer inference.
The deployment of distributed digital twin systems in sectors such as healthcare, manufacturing, and critical infrastructure has significantly heightened the importance of data privacy. These systems interact with numerous devices and users, increasing the risk of data leakage or unauthorized access to sensitive information. Traditional centralized identity management and access control mechanisms no longer meet the scalability, autonomy, and privacy requirements of modern distributed architectures. This article explores how smart contracts operating in blockchain environments can provide decentralized access management for digital twin systems. Smart contracts enable transparent and reliable enforcement of access policies without relying on centralized authorities. The study examines the integration of modern cryptographic technologies into smart contract workflows, including zero-knowledge proofs, decentralized identifiers (DIDs), and confidential computing. These technologies make it possible to verify access rights and perform secure operations without revealing sensitive data. The article also analyzes the limitations of existing solutions, such as the high transaction costs of public blockchains, the limited performance of traditional smart contracts, and the challenges of integrating confidential computing into resource-constrained devices. The authors outline future research directions, including optimizing Layer 2 architectures to improve performance, developing secure auditing mechanisms, and ensuring compatibility with self-sovereign identity systems. The conclusions emphasize that privacy should be treated as a fundamental property of digital twin systems. In these environments, smart contracts must serve not only as governance logic but also as trusted agents that guarantee compliance with access policies and regulatory requirements in decentralized ecosystems.
The transition to post-quantum cryptography poses an unprecedented challenge for Bitcoin and Ethereum, as it involves implementing a defensive downgrade that imposes immediate, severe costs with no tangible benefits. While quantum computers capable of breaking secp256k1 require between 523–2,500 logical qubits, with the author deriving 523 logical qubits as an algorithmic lower bound (not inclusive of arithmetic and ancilla qubits) for a canonical Shor/phase-estimation circuit using the formula QL = 2⌈log2(n)⌉ + 2 + ⌈log2(2 + 1/(2ε))⌉ for ε = 0.001, and conservative estimates ranging up to 2,500 logical qubits based on comprehensive resource models—significantly less than the 2,100–2,400 logical qubits es- timated for general elliptic curves—current systems achieve only ∼100 logical qubits. IBM’s quantum roadmap projects 500–1,000 logical qubits by 2029, placing the critical threshold within 4–10 years depending on which estimate proves accurate. This timeline collides with the reality that convincing decentralized communities to accept 50% capacity loss and 2– 3× fee increases may take 10–15 years in themselves, based on historical governance patterns where even beneficial upgrades required 2–5+ years. Current testnet implementations on per- missioned systems show measurable performance degradation. Critically, this data comes from fundamentally different architectures than permissionless networks, which will likely experience 30–50% additional performance degradation due to global verification requirements, heterogeneous hardware, and compounding propagation delays. This methodological limitation—extrapolating from permissioned to permissionless systems—represents a critical infrastructure failure that introduces massive uncertainty into migration planning. Com- pounding this challenge, secp256k1 is not officially approved by NIST under FIPS 186-5 or SP 800-186, creating additional regulatory vulnerabilities. Beyond transient impacts, PQC creates permanent state bloat, with quantum-resistant accounts requiring 59 times more storage (1,952 bytes / 33 bytes = 59.2× for ML-DSA-65), thereby accelerating centralization- tion. This paper presents a comprehensive framework acknowledging these harsh realities. While we propose specific BIP/EIP implementations and optimization strategies that might achieve 50–60% capacity retention, we recognize that the quantum threat timeline may now be shorter than even the minimum viable migration period. Unlike beneficial upgrades like SegWit (which took 20 months for activation and 5+ years for 50% adoption despite offering improvements), PQC migration is a purely defensive measure imposing only costs. The stark reality: blockchain communities must choose between accepting immediate emergency action or facing quantum vulnerability by 2029.
Federated Learning (FL) offers a promising paradigm for privacy-preserving collaborative training, yet it remains highly vulnerable to adversarial behaviors, client unreliability, and challenges associated with non-independent and identically distributed (non-IID) data. Existing secure aggregation techniques, while preserving confidentiality, fail to guarantee the integrity and trustworthiness of model updates, leaving FL deployments exposed to poisoning and consistency attacks. This work introduces FL-SMPC++, a robust and privacy-preserving FL framework designed to address these challenges. The primary objective is to develop a scalable solution that ensures verifiable, privacy-preserving aggregation while mitigating malicious client behaviors, dropouts, and data heterogeneity. Our approach integrates Secure Multi-Party Computation (SMPC), Pedersen commitments, and zero-knowledge proofs (ZKPs) to cryptographically bind clients' submitted updates to their validation outcomes without revealing private data. We propose a dynamic client selection strategy based on shared validation performance, a dropout-tolerant threshold aggregation protocol, and a warm-up initialization phase to counteract non-IID distributions. Comprehensive experiments on MNIST, CIFAR-10, FEMNIST, and UCI Heart Disease show that FL-SMPC++ consistently outperforms FedAvg, FedProx, and FedNova. For example, under a label-flipping attack with 30% malicious clients on CIFAR-10 (non-IID), FL-SMPC++ achieves 78.9% accuracy compared to 67.4% for FedAvg, representing an absolute gain of 11.5%. Across datasets, the framework limits accuracy degradation to 6–8% under attack, while baselines suffer 13–20% losses. These results demonstrate that FL-SMPC++ achieves strong cryptographic privacy guarantees together with empirically validated resilience and convergence, offering a scalable and practical blueprint for trustworthy FL in adversarial and resource-constrained environments. • A novel FL framework combines SMPC, commitments, and zero-knowledge proofs. • Ensures submitted model updates match validated ones without revealing them. • Uses dynamic validation for secure and fair client selection. • Tolerates client dropouts using a threshold-based aggregation mechanism. • Outperforms baseline FL methods under adversarial and non-IID conditions.
Zero Trust is now the de facto standard to secure cloud-native, distributed, and AI-driven enterprise infrastructures. It's not only crucial to address human identities but also to secure non-human entities such as APIs, software agents, RPA bots, and smart city workloads. As hybrid infrastructures become the new normal and agentic AI systems (e.g., self-driving cars) grow more autonomous, identity remains the most stable and trustworthy security control plane. This document proposes an intent-aware Zero Trust Identity Architecture designed to consolidate governance, authentication, and access control for human and non-human entities. The architecture consists of decentralized identity provisioning, policy-as-code enforcement, real-time telemetry ingestion, trust scoring, and AI-powered intent detection to provide inputs for continuous verification and least privilege enforcement. Compliant with standards such as NIST SP 800-207, NIST SP 800-63, CISA Zero Trust Maturity Model, and DoD's Zero Trust Strategy, the architecture also aligns with industry developments from Microsoft Entra ID, AWS IAM Identity Center, Google BeyondCorp, SPIFFE/SPIRE, and W3C DIDs. The whitepaper explores use cases in healthcare, finance, retail, and industrial IoT spaces that are struggling with unique challenges like OT/IT convergence, multi-user devices, and governance of sensitive data access. High-profile attacks such as SolarWinds, MOVEit, and Log4Shell are broken down to highlight weaknesses in legacy IAM architectures and underscore the need for intent-based security. By intersecting behavior, purpose, and identity, this architecture remakes trust in hybrid, edge, and cloud-native settings with a conclusion of actionable paths of mitigation and a vision for intent-based Zero Trust governance
Mohamed Abdessamed Rezazi, Mouhamed Amine Bouchiha, A. Bendada, Yacine Ghamri-Doudane
Roaming settlement in 5G and beyond networks demands secure, efficient, and trustworthy mechanisms for billing reconciliation between mobile operators. While blockchain promises decentralization and auditability, existing solutions suffer from critical limitations-namely, data privacy risks, assumptions of mutual trust, and scalability bottlenecks. To address these challenges, we present B5GRoam, a novel on-chain and zero-trust framework for secure, privacy-preserving, and scalable roaming settlements. B5GRoam introduces a cryptographically verifiable call detail record (CDR) submission protocol, enabling smart contracts to authenticate usage claims without exposing sensitive data. To preserve privacy, we integrate non-interactive zero-knowledge proofs (zkSNARKs) that allow on-chain verification of roaming activity without revealing user or network details. To meet the high-throughput demands of 5G environments, B5GRoam leverages Layer 2 zk-Rollups, significantly reducing gas costs while maintaining the security guarantees of Layer 1. Experimental results demonstrate a throughput of over 7,200 tx/s with strong privacy and substantial cost savings. By eliminating intermediaries and enhancing verifiability, B5GRoam offers a practical and secure foundation for decentralized roaming in future mobile networks.
Predictive maintenance in cross-border unmanned logistics systems (CBULS) faces persistent challenges, including data privacy, system heterogeneity, and collaborative efficiency. Existing studies that combine federated learning with blockchain address only partial aspects—such as communication or trust—but fail to effectively handle non-independent and identically distributed (non-IID) data, integrate multi-layer privacy, or design consensus mechanisms tailored to cross-border logistics. This paper proposes a predictive maintenance framework that integrates an improved FedProx algorithm with a hybrid Delegated Proof of Stake (DPoS) and Practical Byzantine Fault Tolerance (PBFT) consensus. The framework incorporates zero-knowledge proofs, fully homomorphic encryption, and local differential privacy, while employing hierarchical architecture and sharding for scalability. Simulation results show that the proposed method improves prediction accuracy by 6.9% compared with FedAvg and 3.7% compared with FedProx, enhances privacy protection by over 12%, increases system throughput by approximately 23%, and reduces transaction confirmation latency by nearly 18%. These results demonstrate that the framework provides a secure, efficient, and scalable solution for predictive maintenance in CBULS.
The article presents a comprehensive overview of zero-knowledge proof (ZKP) protocols as a fundamental concept of modern cryptography. The historical background of their emergence and the main properties ensuring reliability and confidentiality, i.e., completeness, soundness, and zero-knowledge — are considered. A classification of protocols into interactive and non-interactive ones is provided, with a special focus on modern solutions such as the zk-SNARK and the zk-STARK. The mathematical foundations of ZKPs are described in detail, including discrete logarithm proofs, the use of homomorphic encryption, polynomial commitments, hashing, and elliptic curves. Practical application areas are analyzed, including cryptocurrencies (Zcash, Ethereum), authentication systems, digital identity, and electronic voting. The advantages of using ZKPs are shown, such as enhanced privacy, reduced need for trusted intermediaries, and strengthened security. At the same time, key challenges are outlined, including scalability, implementation complexity, the problem of trusted setup, and potential vulnerability to quantum computing. It is concluded that zero-knowledge proof protocols are a powerful tool for ensuring confidentiality and reliability of digital systems, while further research is aimed at creating more efficient and quantum-resistant solutions.