The healthcare industry faces several security, privacy, and data integrity issues; blockchain technology provides a strong foundation to handle these issues. Traditional healthcare systems face issues such as unauthorized data access, breaches, and lack of interoperability across heterogeneous infrastructures. By leveraging decentralization, immutability, and consensus mechanisms, blockchain enables privacy-preserving data sharing and patient-centric identity management through Self-Sovereign Identity (SSI) frameworks. Cryptographic techniques such as Secure Multi-Party Computation (SMPC), Zero-Knowledge Proofs (ZKP), homomorphic encryption, commitment schemes, and many more provide the privacy of computation, the verification of consent, and the security of interactions among healthcare professionals, research institutions, and patients. Smart contracts further streamline automated processes, such as consent management, clinical trials, and electronic health record (EHR) transactions. Despite these advantages, challenges remain in scalability, key management, regulatory compliance, and usability. This review explores blockchain-based architectures, cryptographic methods, and privacy-preserving strategies, emphasizing their potential to strengthen trust, enhance security, and enable interoperable, efficient, and patient-centric healthcare systems while adhering to emerging global data protection standards.
In 2016, Locher and Haenni (Locher andHaenni, 2016) proposed an e-voting scheme that offers verifiability, everlasting vote privacy, and computational receipt-freeness, as well as an informal discussion of how the scheme achieves such properties.We advance this line of work by proposing a new cryptographic scheme that provably satisfies those properties as well as everlasting participation privacy and efficient tallying.Receiptfreeness relies on deniable vote updating and verifiable null ballot posting, generated from public knowledge stored on the bulletin board.The everlasting vote and participation privacy properties directly result from the hash-based commitment scheme and efficient zero-knowledge proofs (SNARKs).Finally, we provide mathematical proofs for all the properties, including a new game-based definition of participation privacy.
In the big data era, machine learning has devel-oped prominently and is widely used in real-world systems. Yet, machine learning raises fairness concerns, which incurs discrimination against groups determined by sensitive attributes such as gender and race. Many researchers have focused on developing fairness audit technique of machine learning model that enable users to protect themselves from discrimination. Existing solutions, however, rely on additional external trust as-sumptions, either on third-party entities or external components, that significantly lower the security. In this study, we propose a trustless verifiable fairness audit framework that assesses the fairness of ML algorithms while addressing potential security issues such as data privacy, model secrecy, and trustworthiness. With succinctness and non-interactive of zero knowledge proof, our framework not only guarantees audit integrity, but also clearly enhance security, enabling fair ML models to be publicly auditable and any client to verify audit results without extra trust assumption. Our evaluation on various machine learning models and real-world datasets shows that our framework achieves practical performance.
We construct the first actively-secure threshold version of the cryptosystem based on class groups from the so-called CL framework (Castagnos and Laguillaumie, 2015). We show how to use our threshold scheme to achieve general universally composable (UC) secure multiparty computation (MPC) with only transparent set-up, i.e., with no secret trapdoors involved. On the way to our goal, we design new zero-knowledge (ZK) protocols with constant communication complexity for proving multiplicative relations between encrypted values. This allows us to use the ZK proofs to achieve MPC with active security with only a constant factor overhead. Finally, we adapt our protocol for the so called âYou-Only-Speak-Onceâ (YOSO) setting, which is a very promising recent approach for performing MPC over a blockchain. This is possible because our key generation protocol is simpler and requires significantly less interaction compared to previous approaches: in particular, our new key generation protocol allows the adversary to bias the public key, but we show that this has no impact on the security of the resulting cryptosystem.
Decentralized identities return control of identities to the identity owners. Although current work enhances the privacy of these publicly stored identities using encryption and zero-knowledge proofs, decentralized identities can still be abused due to the following problems: identity holders, e.g., blockchain peers, can profile identity owners by looking at âwho is reading which identity dataâ, and identity verifiers, e.g., applications and websites, learn private data about owners, like their monetary values and previous transactions during the identity linking. In the worst case scenario, the identity holders and verifiers collaboratively profile users to learn more information. As a practical solution, we introduce the notion of Double Blind Proofs of Existence (DBPoE), which shows that an opened DID is committed in one of the constant-sized multi-generator Pedersen commitments (33 Bytes at 128-bit security), and nothing else. Hence, our DBPoE double-blinds identity holders and identity verifiers to mitigate private information leakage. Equally importantly, our multi-generator commitment-based DBPoE is more resistant to graph analysis than other one-of-many proofs, e.g., ring signatures, which we show mathematically using the maximal flow problem. Our DBPoE protocol has a size complexity ofO(log2(N) +m) when the real commitment is hidden inNcommitments andmgenerators are used, e.g., whenm= 4, a DBPoE of 1000 commitments is only 3 KB.
Zero-knowledge Succinct Non-interactive ARguments of Knowledge (zkSNARKs) are becoming an increasingly fundamental tool in many real-world applications where the proof compactness is of the utmost importance, including blockchains. A proof of security for SNARKs in the Universal Composability (UC) framework (Canetti, FOCSâ01) would rule out devastating malleability attacks. To retain security of SNARKs in the UC model, one must show their simulation-extractability such that the knowledge extractor is both black-box and straight-line , which would imply that proofs generated by honest provers are non-malleable . However, existing simulation-extractability results on SNARKs either lack some of these properties, or alternatively have to sacrifice witness succinctness to prove UC security. In this paper, we provide a compiler lifting any simulation-extractable NIZKAoK into a UC-secure one in the global random oracle model, importantly, while preserving the same level of witness succinctness. Combining this with existing zkSNARKs, we achieve, to the best of our knowledge, the first zkSNARKs simultaneously achieving UC-security and constant sized proofs.
The recent increase in security breaches and digital surveillance highlights the need to improve privacy and security, especially of users' personal data. Advances in cybersecurity and new legislation promise to improve the protection of personal data. Blockchain and distributed ledger (DTL) technologies provide new opportunities to protect user data through decentralized identification and other privacy mechanisms. These systems can give users greater sovereignty through tools that allow them to own and control their own data. The purpose of the article is to research blockchain technology and mechanisms for achieving reliability in blockchain for the protection and security of personal data. Decentralized and federated identity systems give users control over what, when and how much of their personal information can be shared and with whom. These systems can also reduce cybersecurity threats. Through various consensus algorithms, blockchain-based privacy solutions allow users to better manage their data and ensure that the data and models derived from it are more accurate, honest and reliable.
Data from interconnected vehicles may contain sensitive information such as location, driving behavior, personal identifiers, etc. Without adequate safeguards, sharing this data jeopardizes data privacy and system security. The current centralized data-sharing paradigm in these systems raises particular concerns about data privacy. Recognizing these challenges, the shift towards decentralized interactions in technology, as echoed by the principles of Industry 5.0, becomes paramount. This work is closely aligned with these principles, emphasizing decentralized, human-centric, and secure technological interactions in an interconnected vehicular ecosystem. To embody this, we propose a practical approach that merges two emerging technologies: Federated Learning (FL) and Blockchain. The integration of these technologies enables the creation of a decentralized vehicular network. In this setting, vehicles can learn from each other without compromising privacy while also ensuring data integrity and accountability. Initial experiments show that compared to conventional decentralized federated learning techniques, our proposed approach significantly enhances the performance and security of vehicular networks. The system's accuracy stands at 91.92\%. While this may appear to be low in comparison to state-of-the-art federated learning models, our work is noteworthy because, unlike others, it was achieved in a malicious vehicle setting. Despite the challenging environment, our method maintains high accuracy, making it a competent solution for preserving data privacy in vehicular networks.
Vesal Ahsani, Ali Rahimi, Mehdi Letafati, Babak Hossein Khalaj
In this article, the authors provide a comprehensive overview on three core pillars of metaverse-as-a-service (MaaS) platforms; privacy and security, edge computing, and blockchain technology. The article starts by investigating security aspects for the wireless access to the metaverse. Then it goes through the privacy and security issues inside the metaverse from data-centric, learning-centric, and human-centric points-of-view. The authors address private and secure mechanisms for privatizing sensitive data attributes and securing machine learning algorithms running in a distributed manner within the metaverse platforms. Novel visions and less-investigated methods are reviewed to help mobile network operators and metaverse service providers facilitate the realization of secure and private MaaS through different layers of the metaverse, ranging from the access layer to the social interactions among clients. Later in the article, it has been explained how the paradigm of edge computing can strengthen different aspects of the metaverse. Along with that, the challenges of using edge computing in the metaverse have been comprehensively investigated. Additionally, the paper has comprehensively investigated and analyzed 10 main challenges of MaaS platforms and thoroughly discussed how blockchain technology provides solutions for these constraints. At the final, future vision and directions, such as content-centric security and zero-trust metaverse, some blockchain's unsolved challenges are also discussed to bring further insights for the network designers in the metaverse era.
Asma Jodeiri Akbarfam, Sina Barazandeh, Deepti Gupta, Hoda Maleki
Access control is a critical component of computer security, governing access to system resources. However, designing policies and roles in traditional access control can be challenging and difficult to maintain in dynamic and complex systems, which is particularly problematic for organizations with numerous resources. Furthermore, traditional methods suffer from issues such as third-party involvement, inefficiency, and privacy gaps, making transparent and dynamic access control an ongoing research problem. Moreover detecting malicious activities and identifying users who are not behaving appropriately can present notable difficulties. To address these challenges, we propose DLACB, a Deep Learning Based Access Control Using Blockchain, as a solution to decentralized access control. DLACB uses blockchain to provide transparency, traceability, and reliability in various domains such as medicine, finance, and government while taking advantage of deep learning to not rely on predefined policies and eventually automate access control. With the integration of blockchain and deep learning for access control, DLACB can provide a general framework applicable to various domains, enabling transparent and reliable logging of all transactions. As all data is recorded on the blockchain, we have the capability to identify malicious activities. We store a list of malicious activities in the storage system and employ a verification algorithm to cross-reference it with the blockchain. We conduct measurements and comparisons of the smart contract processing time for the deployed access control system in contrast to traditional access control methods, determining the time overhead involved. The processing time of DLBAC demonstrates remarkable stability when exposed to increased request volumes.
Amir Jaberzadeh, Ajay Kumar Shrestha, Faijan Ahamad Khan, Mohammed Afaan Shaikh · 6 authors
With the increasing importance of data sharing for collaboration and innovation, it is becoming more important to ensure that data is managed and shared in a secure and trustworthy manner. Data governance is a common approach to managing data, but it faces many challenges such as data silos, data consistency, privacy, security, and access control. To address these challenges, this paper proposes a comprehensive framework that integrates data trust in federated learning with InterPlanetary File System, blockchain, and smart contracts to facilitate secure and mutually beneficial data sharing while providing incentives, access control mechanisms, and penalizing any dishonest behavior. The experimental results demonstrate that the proposed model is effective in improving the accuracy of federated learning models while ensuring the security and fairness of the data-sharing process. The research paper also presents a decentralized federated learning platform that successfully trained a CNN model on the MNIST dataset using blockchain technology. The platform enables multiple workers to train the model simultaneously while maintaining data privacy and security. The decentralized architecture and use of blockchain technology allow for efficient communication and coordination between workers. This platform has the potential to facilitate decentralized machine learning and support privacy-preserving collaboration in various domains.
This paper presents a novel reference architecture for blockchain-enabled federated learning (BCFL), a state-of-the-art approach that amalgamates the strengths of federated learning and blockchain technology. We define smart contract functions, stakeholders and their roles, and the use of interplanetary file system (IPFS) as key components of BCFL and conduct a comprehensive analysis. In traditional centralized federated learning, the selection of local nodes and the collection of learning results for each round are merged under the control of a central server. In contrast, in BCFL, all these processes are monitored and managed via smart contracts. Additionally, we propose an extension architecture to support both cross-device and cross-silo federated learning scenarios. Furthermore, we implement and verify the architecture in a practical real-world Ethereum development environment. Our BCFL reference architecture provides significant flexibility and extensibility, accommodating the integration of various additional elements, as per specific requirements and use cases, thereby rendering it an adaptable solution for a wide range of BCFL applications. As a prominent example of extensibility, decentralized identifiers (DIDs) have been employed as an authentication method to introduce practical utilization within BCFL. This study not only bridges a crucial gap between research and practical deployment but also lays a solid foundation for future explorations in the realm of BCFL. The pivotal contribution of this study is the successful implementation and verification of a realistic BCFL reference architecture. We intend to make the source code publicly accessible shortly, fostering further advancements and adaptations within the community.
In the era of digital markets, the challenge for consumers is discerning quality amidst information asymmetry . While traditional markets use brand mechanisms to address this issue, transferring such systems to internet-based P2P markets â where misleading practices like fake ratings are rampant â remains challenging. Current internet platforms strive to counter this through verification algorithms, but these efforts find themselves in a continuous tug-of-war with counterfeit actions. Exploiting the transparency, immutability, and traceability of blockchain technology, this paper introduces a robust reputation voting system grounded in it. Unlike existing blockchain-based reputation systems, our model harnesses an intrinsically economically incentivized approach to bolster agent integrity. We optimize this model to mirror real-world user behavior , preserving the reputation systemâs foundational sustainability . Through Monte-Carlo simulations, using both uniform and power-law distributions enabled by an innovative inverse transform method, we traverse a broad parameter landscape, replicating real-world complexity. The findings underscore the promise of a sustainable, transparent, and formidable reputation mechanism. Given its structure, our framework can potentially function as a universal, sustainable oracle for offchain-onchain bridging, aiding entities in perpetually cultivating their reputation. Future integration with technologies like Ring Signature and Zero Knowledge Proof could amplify the systemâs privacy facets, rendering it particularly influential in the ever-evolving digital domain.
Reviews and reputation scores of sellers play an important role in decision-making process of potential buyers in an e-commerce system. A trustworthy and reliable reputation system is a crucial component in the e-commerce ecosystem, as buyers rely on it to make informed decisions. In this work, we propose a privacy-preserving decentralized reputation system designed to include countermeasures against some known attacks. Our model is built on two permissioned blockchains, namely Hyperledger Indy and Hyperledger Fabric. Hyperledger Indy provides an infrastructure for implementing verifiable credentials with Zero Knowledge Proof support, which is essential for privacy preservation, while Hyperledger Fabric is a robust platform for implementing smart contracts. One of the key advantages of the proposed approach is the use of verifiable credentials for digital identities of sellers, feedback tokens issued to buyers after performing an e-commerce transaction and discount tokens issued to buyers after feedback submission. This helps to ensure that the feedback and identity information is authentic and tamper-proof, reducing the likelihood of identity-related attacks. Additionally, the collection of feedbacks and application of business rules are implemented as smart contracts on Hyperledger Fabric blockchain. This provides a secure and transparent mechanism for processing feedback, reducing the likelihood of unfair feedbacks. Overall, the proposed approach presents a robust reputation system that can help reduce identity-related attacks and unfair feedbacks. The privacy-preserving nature of the system ensures that sensitive information is protected while still enabling the verification of digital identities. The use of feedback and discount tokens incentivizes buyers to provide accurate and honest feedback, which can help reduce unfair feedbacks and identity-related attacks. Finally, the use of smart contracts ensures transparency and immutability, which enhances the overall reliability of the system.
Advancements in digital technologies have made the storage, sharing, and verification of educational credentials extremely important for entities such as students, universities, institutions, and companies. Digital credentials play an important role in studentsâ lives as a lifelong learning passport. The educational field is experiencing numerous issues such as academic record forgery, record misuse, credential data tampering, time-consuming verification procedures, and issues related to ownership and control. Modern-day technology, Blockchain, is an appropriate alternative to resolve these issues and increase trust among entities. In this research, we intend to propose a Blockchain-based educational digital credential issuance, and verification model that addresses these issues in the education system using Ethereum Blockchain and smart contracts. The method we propose offers a way to demonstrate the correctness of specific credential attributes without revealing other attributes, thereby leading to ownership, minimal disclosure, and control. We offer an interface for storing massively encrypted academic records in a decentralized file system like Interplanetary File System (IPFS). Furthermore, Ethereum provides tamper-resistant chains to maintain the integrity of digital credentials. Finally, in comparison with the time it requires to issue credentials, our model safely accelerates the verification process by about 8%.
Metaverse, the core of the next-generation Internet, is a computer-generated holographic digital environment that simultaneously combines spatio-temporal, immersive, real-time, sustainable, interoperable, and data-sensitive characteristics. It cleverly blends the virtual and real worlds, allowing users to create, communicate, and transact in virtual form. With the rapid development of emerging technologies including augmented reality, virtual reality and blockchain, the metaverse system is becoming more and more sophisticated and widely used in various fields such as social, tourism, industry and economy. However, the high level of interaction with the real world also means a huge risk of privacy leakage both for individuals and enterprises, which has hindered the wide deployment of metaverse. Then, it is inevitable to apply privacy computing techniques in the framework of metaverse, which is a current research hotspot. In this paper, we conduct comprehensive research on the necessity, taxonomy and challenges when privacy computing meets metaverse. Specifically, we first introduce the underlying technologies and various applications of metaverse, on which we analyze the challenges of data usage in metaverse, especially data privacy. Next, we review and summarize state-of-the-art solutions based on federated learning, differential privacy, homomorphic encryption, and zero-knowledge proofs for different privacy problems in metaverse. Finally, we show the current security and privacy challenges in the development of metaverse and provide open directions for building a well-established privacy-preserving metaverse system. For easy access and reference, we integrate the related publications and their codes into a GitHub repository: https://github.com/6lyc/Awesome-Privacy-Computing-in-Metaverse.git.
Quy T. L, Khanh H. V, Huong H. L, Khiem H. G · 12 authors
In todayâs medical landscape, the effective management and availability of diagnostic data, including current and historical medical tests, play a critical role in inform-ing physiciansâ therapeutic decisions. However, the conventional centralized storage system presents a significant impediment, particularly when patients switch healthcare providers. Given the sensitive nature of medical data, retrieving this information from a different healthcare facility can be fraught with challenges. While decentralized storage models using blockchain and smart contracts have been suggested as potential solutions, these methodologies often expose sensitive personal information due to the inherently open nature of data on the blockchain. Addressing these challenges, we present an innovative approach integrating Non-Fungible Tokens (NFTs) to facilitate the creation and sharing of medical document sets based on test results within a medical environment. This novel approach effectively balances data accessibility and security, introducing four key contributions: (a) We introduce a mechanism for sharing medical test results while preserving data privacy. (b) We offer a model for generating certified, NFT-based document sets that encapsulate these results.(c) We provide a proof-of-concept reflecting the proposed modelâs functionality and (d) We deploy this proof-of-concept across four EVM-supported platformsâBNB Smart Chain, Fantom, Polygon, and Celoâto identify the most compatible platform for our proposed model. Our work underscores the potential of blockchain, smart contracts, and NFTs to revolutionize medical data management, demonstrating a practical solution to the challenges posed by centralized storage systems.
Privacy plays a crucial role in the internet era, where many applications allow people to communicate and use their services through the internet. Privacy-preserving Identity Management (PPIdM) system is a scheme that helps manage usersâ identities and protects usersâ privacy by enabling users to authenticate themselves without disclosing their real identities. The PPIdM system also allows users to reveal some minor identity attributes while others remain secret selectively. However, anonymity also encourages malicious users to break the systemâs policy and commit crimes since their real identities are anonymous. Existing PPIdM systems use the identity provider (IP) as a medium to verify usersâ identity attributes, record all usersâ real identities, and ensure that malicious usersâ identities are traceable. Therefore, usersâ identities are hidden from all entities but the IP. However, the userâs privacy is vulnerable because there is nothing to guarantee that the IP is always honest and not curious about their usersâ activities and private information. This paper proposes a PPIdM system on the blockchain that helps users manage their identity attributes and keeps their real identities secret from all entities, including the IP. Still, the systemâs consensus can trace malicious usersâ real identities if they violate the systemâs policy. The PPIdMâs security requirements are analyzed and proved informally using the game-based proof scheme. The main idea of this study is to combine zk-SNARK, a type of zero-knowledge proof (ZKP), Shamirâs secret sharing (SSS), and several other cryptographic techniques.
We study Privacy Pools, a novel smart contract-based privacy-enhancing protocol. The protocol introduces a mechanism for users to reveal certain properties of their transaction without having to reveal the transaction itself. The core concept involves allowing users to publish a zero-knowledge proof, demonstrating that their funds (do not) originate from known (un-)lawful sources, without publicly revealing their entire transaction history. This is achieved by proving membership in custom association sets, which are designed to demonstrate compliance with regulatory frameworks or social consensus. We illustrate how this mechanism can create a separating equilibrium between compliant and non-compliant withdrawals. Our work describes the technical underpinnings, incentives and broader implications of this mechanism, highlighting how Privacy Pools-like protocols can create more private yet compliant blockchain transactions.