With the shifting from traditional grids to smart grids, there is an immense shift towards decentralized energy trading wherein “prosumers” can enter peer-to-peer transactions. This model decreases dependence on centralized utilities and maximizes efficient, flexible, and resilient energy distribution. It enhances transparency and trust by automating and securing trades via smart contracts. No intermediaries are required; hence transaction costs are low. However, an attack that would breach the security guarantees of blockchain systems-by tremendous quantum computers-might break a few of the older cryptographic methods or even reveal very significant portions of their keys. This paper introduces a blockchain-based decentralized framework for energy trading in smart grids, with a strong emphasis on post-quantum cryptography to safeguard transactions against quantum threats. We explore post-quantum cryptographic techniques, particularly lattice-based algorithms due to its compact signature sizes and strong security capability for the future-proof blockchain enabled smart grids. The proposed system model ensures secure and decentralized energy trading while incorporating off-chain signature validation to enhance computational efficiency. Unlike previous studies that primarily focus on market structure or consensus protocols, this work introduces a quantum-resilient architecture with an off-chain transaction validation mechanism, enabling high-throughput trading secured against future cryptographic vulnerabilities. The novel feature of the proposed model is the integration of off-chain post-quantum cryptographic verification into a blockchain energy trading architecture that is practically deployable on embedded hardware. Compared to existing solutions, the proposed method ensures quantum-resilient authentication while reducing gas costs by 40% and improving computational efficiency achieving a signing time of 0.327 ms and verification time of 0.127 ms. The proposed framework represents a significant step toward future-proofing blockchain-enabled smart grids while maintaining performance, transparency, and resilience. The outcome of this research work presents a quantum-safe solution that strengthens the resilience of smart grid operations and ensures the security of decentralized energy trading.
Jonas Ballweg, Amir Kafshdar Goharshady, Zhaorun Lin
We consider the classical problem of running a decentralized and trustless auction, using a smart contract, on a programmable block-chain such as Ethereum. In our setting, there are n bidders who have paid a deposit to join the protocol. Each bidder i can make a bid 1 ≤ bi ≤ m and our goal is to find the highest bid (maxi bi) and its corresponding bidder (argmaxi bi) in a publicly-verifiable manner. Each bidder must be unaware of others' bids when making their own and should not be able to change their bid after having committed to it. Additionally, and most importantly, we aim to provide privacy to the losing bidders, ensuring that their bids remain undisclosed. This is particularly crucial in use-cases with repeated auctions in which knowledge of the bids in the previous auctions can affect the bidders' strategies. Formally, the information gained by any observer, whether a participant in the protocol or not, should precisely consist of the winning bid and its bidder and nothing more. We present a novel yet simple protocol for private sealed-bid auctions on the blockchain. Our protocol is decentralized and trustless. It is also both time- and gas-efficient. Our approach takes O(log m) time and costs O(log m) units of gas for each bidder. It also guarantees observational determinism with respect to all losing bids.
In trans-border data (data transferred or accessed across national jurisdictions) exchange scenarios, identity authentication mechanisms serve as critical components for ensuring data security and privacy protection, with their effectiveness directly impacting the compliance and reliability of transnational operations. However, existing identity authentication systems face multiple challenges in trans-border contexts. Firstly, the transnational transfer of identity data struggles to meet the varying data-compliance requirements across different jurisdictions. Secondly, centralized authentication architectures exhibit vulnerabilities in trust chains, where single points of failure may lead to systemic risks. Thirdly, the inefficiency of certificate verification in traditional Public Key Infrastructure (PKI) systems fails to meet the real-time response demands of globalized business operations. These limitations severely constrain real-time identity verification in international business scenarios. To address these issues, this study proposes a trans-border distributed certificate-free identity authentication framework (STALE). The methodology adopts three key innovations. Firstly, it utilizes email addresses as unique user identifiers combined with a Certificateless Public Key Cryptography (CL-PKC) system for key distribution, eliminating both single-point dependency on traditional Certificate Authorities (CAs) and the key escrow issues inherent in Identity-Based Cryptography (IBC). Secondly, an enhanced Elliptic Curve Diffie–Hellman (ECDH) key-exchange protocol is introduced, employing forward-secure session key negotiation to significantly improve communication security in trans-border network environments. Finally, a distributed identity ledger is implemented, using the FISCO BCOS blockchain, enabling decentralized storage and verification of identity information while ensuring data immutability, full traceability, and General Data Protection Regulation (GDPR) compliance. Our experimental results demonstrate that the proposed method exhibits significant advantages in authentication efficiency, communication overhead, and computational cost compared to existing solutions.
Buy Now Pay Later (BNPL) is a rapidly proliferating e-commerce model, offering consumers to get the product immediately and defer payments. Meanwhile, emerging blockchain technologies endow BNPL platforms with digital currency transactions, allowing BNPL platforms to integrate with digital wallets. However, the transparency of transactions causes critical privacy concerns because malicious participants may derive consumers' financial statuses from on-chain asynchronous payments. Furthermore, the newly created transactions for deferred payments introduce additional time overheads, which weaken the scalability of BNPL services. To address these issues, we propose an efficient and privacy-preserving blockchain-based asynchronous payment scheme (Epass), which has promising scalability while protecting the privacy of on-chain consumer transactions. Specifically, Epass leverages locally verifiable signatures to guarantee the privacy of consumer transactions against malicious acts. Then, a privacy-preserving asynchronous payment scheme can be further constructed by leveraging time-release encryption to control trapdoors of redactable blockchain, reducing time overheads by modifying transactions for deferred payment. We give formal definitions and security models, generic structures, and formal proofs for Epass. Extensive comparisons and experimental analysis show that \textsf{Epass} achieves KB-level communication costs, and reduces time overhead by more than four times in comparisons with locally verifiable signatures and Go-Ethereum private test networks.
The purpose of the covert communication scheme is to conceal the communication behavior entirely. In such schemes, the sender and receiver rely on secret keys to establish a covert channel. However, conventional key exchange protocols would expose the key exchange process between them. An adversary who observes the key exchange would be aware of the existence of communication behavior. The keys used in covert communication are not suitable to be generated through conventional key exchange schemes. To address this, we propose a blockchain-based covert elliptic-curve Diffie-Hellman key exchange scheme (BCDH) to conceal the process of the key exchange in blockchain transactions. Following a straightforward setup, BCDH allows the sender and receiver to covertly exchange a secret key on a blockchain without direct communication. Furthermore, we expand the BCDH approach to operate across multiple blockchains, further enhancing its covertness and stability. We analyze BCDH from several perspectives, including covertness, security, randomness, etc. Additionally, we implement a prototype of BCDH on the Ethereum platform to assess its feasibility and performance. Our evaluation demonstrates that BCDH is efficient and well-suited for real-world applications.
Open access
Cryptography and Data Security
Advanced Steganography and Watermarking Techniques
The security proof of a protocol, though formally rigorous within a given model, is entirely contingent on the model's assumptions. If the adversary's capabilities are underspecified, the cryptographic primitives are idealized, or the security properties are incompletely formalized, the proof may not hold in practice.The first contribution advances prior work on refining symbolic models for crypto- graphic primitives to better capture their behaviors. Specifically, we propose more precise equational theories for the ElGamal cryptosystem, DSA signatures, and Zero-Knowledge Proofs. Standard symbolic modeling of these primitives disregards their algebraic prop- erties, which may lead to missed attacks in larger protocols. Additionally, we introduce a formal model of exponentiation and re-encryption Mix-Networks. By combining these models with our equational theories, we can automatically find attacks based on the incorrect use of the Mix-Networks missed by previous symbolic models.The second contribution involves analyzing the WireGuard protocol. We examine the protocol's claimed security properties under an adversary capable of compromising any possible key combinations. To systematize this analysis, we introduce the concepts of minimal defensive model and minimal offensive adversary model. The defensive models ensures that violating a security property requires possessing specific atomic capabilities. Minimal offensive models define the smallest sets of adversarial capabilities that break security. Theses derivations helped to identify an implementation optimization that introduces new attack vectors.The third contribution presents a hybrid protocol combining WireGuard and Post- Quantum WireGuard, aligning with recommendations for a secure transition to post- quantum cryptography. Although a symbolic analysis of PQ-WireGuard existed, we uncover discrepancies between the model and the protocol's specifications, including pre- viously missed Unknown Key-Share attacks. We propose fixes and ensure the hybrid protocol's security relies on both the corrected post-quantum and classical WireGuard protocols. We formally defined a hybrid protocol's security as when there exists both minimal defensive models dependent on post-quantum keys and defensive models depen- dent on classical keys. Our work underscores the importance of iterative analysis during design, as achieving hybrid security required repeated refinement between modeling and verification.
An increasing number of DeFi protocols are gaining popularity, facilitating transactions among multiple anonymous users. State Manipulation is one of the notorious attacks in DeFi smart contracts, with price variable being the most commonly exploited state variable-attackers manipulate token prices to gain illicit profits. In this paper, we propose PriceSleuth, a novel method that leverages the Large Language Model (LLM) and static analysis to detect Price Manipulation (PM) attacks proactively. PriceSleuth firstly identifies core logic function related to price calculation in DeFi contracts. Then it guides LLM to locate the price calculation code statements. Secondly, PriceSleuth performs backward dependency analysis of price variables, instructing LLM in detecting potential price manipulation. Finally, PriceSleuth utilizes propagation analysis of price variables to assist LLM in detecting whether these variables are maliciously exploited. We presented preliminary experimental results to substantiate the effectiveness of PriceSleuth . And we outline future research directions for PriceSleuth.
We present a secure and efficient federated learning protocol for autonomous vehicles that resists data leaks, redundancy, and adversarial attacks. Our system combines fast zero-knowledge proofs and compressed Bloom filters to verify updates without exposing private data. Compared to traditional approaches, our method reduces proof sizes by 90 % (under 10 KB), memory by up to 75 %, and maintains accuracy with less than 4% degradation under 30% attack rates. The entire update cycle completes in under 600 ms, making it practical for real-time use in vehicles. This work advances trustworthy AI deployment in dynamic, resource-limited networks.
Wael Issa, Nour Moustafa, Benjamin Turnbull, Kim‐Kwang Raymond Choo
Sixth-generation (6G) wireless networks are set to transform the Internet of Things (IoT) by enabling faster, smarter, and more connected systems. These networks will bring together a wide range of devices, including cars, robots, industrial machines, and smartphones, to support edge intelligence and real-time decision-making. Federated learning (FL) supports this shift by allowing devices to collaboratively train models without sharing raw data, which helps to protect user privacy. Despite its advantages, FL faces significant security challenges, including poisoning attacks and Byzantine clients, both of which can compromise the training process and degrade the accuracy and reliability of the global model. Although existing methods can detect malicious updates, many advanced attacks still bypass statistical defenses relying on metrics such as median and distance. Thus, developing an FL system that ensures both reliable decision-making and privacy and security guarantees in IoT networks remains a significant challenge. This study introduces a Digital Twin-driven Blockchain-enabled Federated Learning (DT-BFL) framework designed for IoT networks. The framework creates a digital representation of the IoT environment to support secure and decentralized edge intelligence using blockchain and federated learning technologies. DT-BFL is built to detect and filter out potentially poisoned model updates from malicious participants. This is achieved through a new smart contract-enabled decentralized aggregation method called Local Updates Purify (LUP). LUP uses a two-stage filtering process: First, it applies Median Absolute Deviation (MAD) to initially remove outliers, then uses statistical features and clustering to separate honest from malicious updates before aggregating the global model. It also assigns a Trust Score (TS) to each participant based on how much their updates differ from the global model and then uses a genuine criterion to select honest clients by evaluating trust scores, update similarity, and deviation from the global model. Experimental results show that DT-BFL effectively defends against various poisoning attacks on datasets like MNIST, ToN-IoT, and CIFAR-10 using models such as CNN, MLP, ResNet, and DenseNet, and maintains high accuracy even when 50% of the clients are malicious. Using a permissioned blockchain further secures the system by enabling aggregation of the decentralized model and authentication of clients through smart contracts. The source code is available on https://github.com/UNSW-Canberra-2023/LUP .
In this work, we present a concretely efficient lattice-based zero-knowledge proof system that satisfies straight-line extractability. At the heart of our construction is a novel, non-generic application of the Katsumata transform (CRYPTO 2021) to the widely adopted zero-knowledge framework of Lyubashevsky, Nguyen and Plançon (CRYPTO 2022). Our approach significantly optimizes the proof size, achieving a 2X reduction compared to prior generic techniques. This makes our scheme particularly well-suited for anonymous credential systems, secure multi-party computation, and proving quantum security, where straight-line extractability is essential.
Background and aims: Intensive care units (ICUs) face growing challenges with cybersecurity, data interoperability, medication safety, and resource management in an increasingly digital healthcare environment. This review explores how blockchain technology can address these issues and improve critical care delivery. Data sources: Relevant literature was sourced from peer-reviewed journals, healthcare cybersecurity reports, and studies on blockchain applications in medical settings. Study selection: Included works focused on blockchain's role in enhancing data security, drug traceability, consent management, and integration with AI tools in ICU contexts. Data synthesis: Blockchain offers tamper-proof health records, decentralized data sharing, and automated smart contracts, potentially transforming ICU operations. Benefits include improved patient safety, resource efficiency, and decision support. However, challenges such as scalability, regulatory concerns, and implementation costs remain. Conclusion: Blockchain holds strong potential to enhance ICU workflows and patient outcomes. Realizing its impact will require collaborative efforts and further research to overcome current limitations. How to cite this article: Gondode P, Dass C, Kumar S, Malviya A, Ashwin M, Khanna P. Blockchain in Critical Care. Indian J Crit Care Med 2025;29(6):525-530.
Verifiable Delay Function (VDF) is a cryptographic concept that ensures a minimum delay before output through sequential processing, which is resistant to parallel computing. One of the significant VDF protocols academically reviewed is the VDF protocol proposed by Pietrzak. However, for the blockchain environment, the Pietrzak VDF has drawbacks including long proof size and recursive protocol computation. In this paper, we present an implementation study of Pietrzak VDF verification on Ethereum Virtual Machine (EVM). We found that the discussion in the Pietrzak's original paper can help a clear optimization in EVM where the costs of computation are predefined as the specific amounts of gas. In our results, the cost of VDF verification can be reduced from 4M to 2M gas, and the proof length can be generated under 8 KB with the 2048-bit RSA key length, which is much smaller than the previous expectation.
In blockchain networks, so-called "full nodes" serve data to and relay transactions from clients through an RPC interface. This serving layer enables integration of "Web3" data, stored on blockchains, with "Web2" mobile or web applications that cannot directly participate as peers in a blockchain network. In practice, the serving layer is dominated by a small number of centralized services ("node providers") that offer permissioned access to RPC endpoints. Clients register with these providers because they offer reliable and convenient access to blockchain data: operating a full node themselves requires significant computational and storage resources, and public (permissionless) RPC nodes lack financial incentives to serve large numbers of clients with consistent performance. Permissioned access to an otherwise permissionless blockchain network raises concerns regarding the privacy, integrity, and availability of data access. To address this, we propose a Permissionless Accountable RPC Protocol (PARP). It enables clients and full nodes to interact pseudonymously while keeping both parties accountable. PARP leverages "light client" schemes for essential data integrity checks, combined with fraud proofs, to keep full nodes honest and accountable. It integrates payment channels to facilitate micro-payments, holding clients accountable for the resources they consume and providing an economic incentive for full nodes to serve. Our prototype implementation for Ethereum demonstrates the feasibility of PARP, and we quantify its overhead compared to the base RPC protocol.
Ensuring privacy and security in healthcare data sharing is critical due to the sensitive nature of patient information and the growing threat of cyber attacks. This paper explores the development of privacy-preserving data-sharing protocols for healthcare systems by integrating cryptographic techniques and blockchain technology. The study aims to establish a secure framework that facilitates seamless data exchange among healthcare stakeholders while maintaining data integrity, confidentiality, and access control. Key cryptographic mechanisms, including homomorphic encryption, zero-knowledge proofs, and attribute-based encryption, are employed to ensure that only authorized entities can access patient records without exposing sensitive details. Blockchain technology is leveraged to create a decentralized and tamper-resistant ledger, ensuring transparency and auditability in data-sharing transactions. Smart contracts are utilized to enforce predefined access policies automatically, enhancing security and compliance with regulations such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). The findings indicate that the proposed framework significantly mitigates risks associated with unauthorized access, data breaches, and single points of failure. Comparative analysis with traditional centralized systems demonstrates improved efficiency, scalability, and security in healthcare data management. The integration of blockchain and cryptographic techniques ensures robust privacy-preserving mechanisms without compromising accessibility or interoperability. This research provides a novel approach to secure data sharing in healthcare, fostering trust among stakeholders while ensuring compliance with privacy regulations. Future work will focus on optimizing computational efficiency and addressing scalability challenges to facilitate widespread adoption in real-world healthcare ecosystems.
Web-based credit card payments require complete disclosure of all payment card details for transaction authorization. The card’s CVV (Card Verification Value) is the secret code that authorizes card not presented transactions. Currently, all payment card details must be shared among various intermediaries involved in processing the transaction. To mitigate the risks associated with fraudulent transactions, industries have adopted security standards such as the PCI DSS. Credit card data confidentiality rests on all involved stakeholders adhering to best security practices, including data communication encryption, and do not misuse the payment information. However, this security posture does not prevent potential credit card data leaks. We propose an alternative method for conducting remote card payments that does not require disclosing the authorization code while ensuring high interoperability with existing payment networks. Our approach demonstrates how designated verifier Zero-Knowledge Proofs (ZKP) enable minimal disclosure of card details, particularly protecting the confidentiality of authorization codes.
Daria Schumm, Cedric von Rauscher, Katharina Olga Emilia Müller, Burkhard Stiller
Transparency and immutability of blockchains can expose metadata and raise concerns about its classification as personal data under privacy regulations. This paper investigates privacy risks associated with metadata in blockchain-based identity systems. Additionally, two privacy-preserving mechanism designs, namely Zero-Knowledge Proof (ZKP) and Homomorphic Encryption (HE), to protect metadata are proposed. As a result, this work introduces the first use case of HE privacy-preserving mechanism in the context of Decentralized Identity (DI) and Self-Sovereign Identity (SSI) systems.
Nai‐Wei Lo, Chi-Ying Chuang, Jheng-Jia Huang, Yuxuan Luo
With the rise of the Internet of Vehicles (IoV), secure and efficient authentication is essential to prevent cyber threats. This paper proposes a session key establishment protocol using Zero-Knowledge Proofs (zk-SNARKs) and Elliptic Curve Cryptography (ECC), including the Elliptic Curve Diffie–Hellman (ECDH) key exchange, to ensure privacy and efficiency. While zk-SNARK computations introduce additional verification overhead, our optimizations, such as precomputed proof parameters and lightweight session re-authentication, mitigate delays. Performance evaluation shows a 20% reduction in computation overhead and a 75% faster re-authentication time compared to existing methods, making it a secure and practical solution for real-world IoV applications.
Juan Alamrio Berrios Moya, John Ayoade, Md. Ashraf Uddin
Academic credential fraud presents a significant challenge to the global academic and labor markets, undermining the credibility of legitimate qualifications. In this paper, we introduce ZKBAR-V, a Zero-Knowledge Proof-Enabled Blockchain-Based Academic Record Verification System. This system is designed to provide a privacy-preserving, immutable, and secure framework for managing academic credentials. The proposed system leverages zkEVM smart contracts on a blockchain-based infrastructure that enables credential verification without exposing underlying data. The approach integrates Decentralized Identifiers (DIDs) to standardize identity management while eliminating reliance on centralized authorities. We have used dual-blockchain, which separates public and private information, which can enhance both efficiency and privacy. In addition, this approach employs the Interplanetary File System (IPFS) for decentralized and secure document storage. ZKBAR-V is designed as an open-source, interoperable solution with a standardized Application Programming Interface (API) for seamless integration. We implemented the system and conducted comprehensive testing, which demonstrates its capability to manage transactions securely, maintain privacy, and reduce costs compared to traditional Ethereum mainnet-based solutions. By combining advanced blockchain technologies, decentralized storage, and globally unique identifiers, ZKBAR-V offers a scalable, adaptable, and robust solution for academic credential management. This strategy can significantly enhance credential integrity, promote global student mobility, and provide institutions worldwide with a trustworthy and efficient verification system.
Abstract: Federated deep learning (FDL) is an emerging paradigm that enables multiple decentralized devices or institutions to collaboratively train a shared model while keeping data localized. This approach preserves privacy, reduces communication overhead, and complies with data governance regulations. In this paper, we explore the implementation and performance of FDL in real-world scenarios such as healthcare, finance, and IoT systems. Utilizing frameworks like TensorFlow Federated, PyTorch, and interpretability tools like SHAP and LIME, we evaluate FDL against centralized deep learning models. We analyze convergence rates, model accuracy, data privacy risk, and computational efficiency. Regression and predictive analyses reveal that FDL can retain over 90% accuracy of centralized models with significantly enhanced data security. Keywords: Federated Learning, Deep Learning, Privacy Preservation, Decentralized Training, TensorFlow Federated, Secure AI, SHAP, LIME, Model Interpretability
Decentralized applications are often composed of multiple interconnected smart contracts. This is especially evident in DeFi, where protocols are heavily intertwined and rely on a variety of basic building blocks such as tokens, decentralized exchanges and lending protocols. A crucial security challenge in this setting arises when adversaries target individual components to cause systemic economic losses. Existing security notions focus on determining the existence of these attacks, but fail to quantify the effect of manipulating individual components on the overall economic security of the system. In this paper, we introduce a quantitative security notion that measures how an attack on a single component can amplify economic losses of the overall system. We study the fundamental properties of this notion and apply it to assess the security of key compositions. In particular, we analyse under-collateralized loan attacks in systems made of lending protocols and decentralized exchanges.
Electronic voting (e-voting) has emerged as a transformative technology in the modern digital era. Many countries across the world are using e-voting systems in different types of elections, from political to non-political. One of the primary goals of e-voting is ensuring both verifiability and privacy simultaneously, which we refer to as security. Verifiability is a security feature that guarantees voters can confirm their vote is reflected in the final election result, while privacy guarantees that no one is able to link a vote to the voter who cast it. Verifiability needs to hold only for the duration of the election, whereas privacy needs to extend beyond the election period, even decades after the election. This property, known as everlasting privacy in the literature, ensures that even computationally unbounded adversaries cannot compromise voter privacy, securing elections against future advances in computing, including quantum computing. Researchers have proposed a wide variety of protocols to achieve this ambitious goal in secure e-voting, however, these protocols differ significantly, making the analysis and state-of-the-art complicated. In this thesis, we first address this fragmentation by systematically analyzing all existing e-voting protocols designed to ensure everlasting privacy. We map out the relationships and dependencies among these protocols, evaluate their security and efficiency under realistic assumptions, and identify unresolved challenges in the field. Our work provides a foundational reference for researchers aiming to design secure e-voting systems with everlasting privacy, paving the way for privacypreserving elections in the post-quantum era. Building on these insights, we propose a novel e-voting system that integrates the best practices from prior research while addressing their limitations. Leveraging the Hyperion scheme as a foundation, we develop an enhanced protocol that not only guarantees everlasting privacy but also introduces everlasting receipt-freeness and coercion mitigation. Unlike existing systems like Selene and Hyperion, which rely on computational assumptions for privacy, our protocol offers privacy even against adversaries with unlimited computational power. In secure electronic voting systems with everlasting privacy, the focus is on futureproofing privacy, while sometimes election verifiability relies on the computational soundness of zero-knowledge proofs (ZKP), which are vulnerable to quantum adversaries. Therefore, a key technical challenge is designing e-voting systems with efficient post-quantum cryptographic primitives to secure both privacy and verifiability against quantum attacks. In this thesis, we advance the state of post-quantum ZKPs by focusing on the ZKPs proposed by Jain et al., which are based on the conservative Learning Parity with Noise (LPN) assumption. We optimize the efficiency of these ZKPs, achieve formal security verification using EasyCrypt, and uncover flaws in existing implementations, demonstrating their vulnerability to malicious provers. Additionally, we construct the first code-based ZKP of shuffle, enabling a verifiable and privacy-preserving e-voting protocol with mixing-based tallying. Our e-voting system ensures both verifiability and vote privacy through the computational difficulty of decoding random linear codes, marking it as the first verifiable code-based e-voting system.
Federated Learning (FL) enables collaborative model training across hospitals while keeping patient data local, thus aiming to satisfy strict healthcare privacy regulations (e.g. HIPAA, GDPR). However, FL still leaks information via shared model updates, exposing it to membership inference and gradient inversion attacks. In this work, we propose an end-to-end framework that integrates zero-knowledge proofs (ZKPs) with FL to ensure both data privacy and trust in the aggregation process. In our design, each hospital (client) sends encrypted model updates to a central aggregator, which then computes the global model and simultaneously generates a succinct ZKP (e.g. a zk-SNARK) attesting to the correctness of the aggregation. Clients (or a verifier network) can efficiently verify this proof without learning any additional information. We simulate a disease-prediction task on synthetic medical data and evaluate metrics including predictive accuracy, proof generation/verification time, and communication overhead. Our results (see Table 1 and Fig. 3) show that incorporating ZKP maintains almost identical model accuracy compared to standard FL while adding moderate computational and bandwidth overhead. ZKP verification costs scale favorably (often <50% of proof generation time) and can be offloaded to a blockchain network to avoid burdening resource-constrained hospitals. The key contribution is a structured ZK-FL framework combining FL and zk-SNARKs, along with a formal threat model. This approach closes FL’s trust gap in healthcare settings, and suggests future work on scalable proof systems (e.g. post-quantum ZKPs) and integration with blockchain-based verifiers.
Ahmed M. Tawfik, Ayman Al-Ahwal, Adly S. Tag Eldien, Hala H. Zayed
Ensuring privacy and confidentiality in healthcare data management remains a critical challenge. Traditional centralized access control mechanisms are susceptible to security breaches, including unauthorized access, data leakage, and single points of failure, as well as privacy violations such as patient record exposure and improper data sharing. To address these issues, this paper proposes ACHealthChain, a blockchain-based framework leveraging Hyperledger Fabric for decentralized and transparent access control. The framework integrates the InterPlanetary File System (IPFS) for decentralized storage and ensures privacy through Hyperledger Fabric channels. ACHealthChain features PolicyChain for fine-grained access control and revocation, structuring patient health data into separate subchains for EHRs and diagnoses with permissioned access. Additionally, LogChain enhances auditing and accountability. A series of experiments evaluate ACHealthChain's performance and scalability, considering metrics such as throughput, latency, and resource utilization. Results demonstrate that ACHealthChain improves throughput by 19.7% and reduces latency by 87%, outperforming existing frameworks built on the same platform. The scalability analysis further confirms the framework's capability to handle increasing workloads within an expanding blockchain network. ACHealthChain presents a promising solution for secure and efficient healthcare data sharing with potential real-world applications.
The Ethereum blockchain has transformed decentralized finance (DeFi) and is widely used to issue ERC20 tokens. However, many of these tokens rely on unverified smart contracts, which pose serious security risks. Hackers can take advantage of vulnerabilities in these unverified ERC20 tokens, leading to scams, financial losses, and a decline in user trust. Although several tools are available to audit smart contracts, their effectiveness in analyzing unverified ERC20 tokens remains uncertain. This study examines three auditing tools HoneyBadger, Maian, and Mythril by testing how well they detect security issues in unverified ERC20 tokens. The SmartBugs framework was used to support the auditing process, enabling parallel execution, standardized reports, and bulk auditing of contracts. For a thorough evaluation, two datasets were used: one from 50,581 Ethereum blockchain blocks and another from the DappRadar list of blacklisted ERC20 tokens. These datasets were chosen to provide a broad and realistic view of how the tools perform on both typical and high-risk contracts. The tools were compared based on their ability to detect issues, their execution speed, and their overall effectiveness. The results revealed clear differences in performance: some tools were better at finding vulnerabilities accurately, while others focused more on speed than depth. This study emphasizes the need to improve smart contract auditing methods and highlights the importance of developing more effective security tools to strengthen the Ethereum blockchain.