Most of the existing identity management is the centralized architecture that has to validate, certify, and manage identity in a centralized approach by trusted authorities. Decentralized identity is causing widespread public concern because it enables to give back control of identity to clients, and the client then has the ability to control when, where, and with whom they share their credentials. A decentralized solution atop on blockchain will bypass the centralized architecture and address the single point of the failure problem. To our knowledge, blockchain is an inherited pseudonym but it cannot achieve anonymity and auditability directly. In this paper, we approach the problem of decentralized identity management starting from the designated-verifier anonymous credential (DVAC in short). DVAC would assist to build a new practical decentralized identity management with anonymity and auditability. Apart from the advantages of the conventional anonymous credential, the main advantage of the proposed DVAC atop blockchain is that the issued cryptographic token will be divided into shares at the issue phase and will be combined at the showing credential phase. Further, the smooth projective hash function ( <a:math xmlns:a="http://www.w3.org/1998/Math/MathML" id="M1"> <a:mi mathvariant="sans-serif">SPHF</a:mi> </a:math> in short) is regarded as a designated-verifier zero-knowledge proof system. Thus, we introduce the <d:math xmlns:d="http://www.w3.org/1998/Math/MathML" id="M2"> <d:mi mathvariant="sans-serif">SPHF</d:mi> </d:math> to achieve the designated verifiability without compromising the privacy of clients. Finally, the security of the proposed DVAC is proved along with theoretical and experimental evaluations.
Cristina Regueiro, Iñaki Seco, Santiago de Diego, Óscar Lage · 5 authors
The recent increase in reported incidents of security breaches compromising users' privacy call into question the current centralized model in which third-parties collect and control massive amounts of personal data. Blockchain has demonstrated that trusted and auditable computing is possible using a decentralized network of peers accompanied by a public ledger. Furthermore, Homomorphic Encryption (HE) guarantees confidentiality not only on the computation but also on the transmission, and storage processes. The synergy between Blockchain and HE is rapidly increasing in the computing environment. This research proposes a privacy-enhancing distributed and secure protocol for data aggregation backboned by Blockchain and HE technologies. Blockchain acts as a distributed ledger which facilitates efficient data aggregation through a Smart Contract. On the top, HE will be used for data encryption allowing private aggregation operations. The theoretical description, potential applications, a suggested implementation and a performance analysis are presented to validate the proposed solution.
With the widespread of 5G networks, the application of Federated Learning (FL) in Internet of Things (IoT) has become a trend. However, the trust problem caused by the centralized aggregation server, and the inefficiency problem caused by the low-performance devices, are still key challenges. Several studies involving asynchronous FL have been conducted to accelerate the training process, but they usually have a decreased model performance. In this paper, a blockchain-based asynchronous federated learning framework with a dynamic scaling factor is proposed. By adopting the blockchain, the trust problem among devices can be addressed. Meanwhile, the novel dynamic scaling factor is proposed to help improve the FL efficiency and accuracy. Extensive experiments are conducted on heterogeneous devices and the results show that the proposed framework mitigates the impact of low-performance devices while being as efficient as traditional FL with the extra benefit of alleviating the trust problem among IoT devices.
The development of information and communication technology in terms of sensor technologies cause the Internet of Things (IoT) step toward smart homes for prevalent sensing and management of resources. The gateway connections contain various IoT devices in smart homes representing the security based on the centralized structure. To address the security purposes in this system, the blockchain framework is considered a smart home gateway to overcome the possible attacks and apply Deep Reinforcement Learning (DRL). The proposed blockchain-based smart home approach carefully evaluated the reliability and security in terms of accessibility, privacy, and integrity. To overcome traditional centralized architecture, blockchain is employed in the data store and exchange blocks. The data integrity inside and outside of the smart home cause the ability of network members to authenticate. The presented network implemented in the Ethereum blockchain, and the measurements are in terms of security, response time, and accuracy. The experimental results show that the proposed solution contains a better outperform than recent existing works. DRL is a learning-based algorithm which has the most effective aspects of the proposed approach to improve the performance of system based on the right values and combining with blockchain in terms of security of smart home based on the smart devices to overcome sharing and hacking the privacy. We have compared our proposed system with the other state-of-the-art and test this system in two types of datasets as NSL-KDD and KDD-CUP-99. DRL with an accuracy of 96.9% performs higher and has a stronger output compared with Artificial Neural Networks with an accuracy of 80.05% in the second stage, which contains 16% differences in terms of improving the accuracy of smart homes.
With the development of the Internet of Things and the demand for telemedicine, the smart healthcare system has attracted much attention in recent years. As a platform for medical data interaction, the smart healthcare system is demanded to ensure the privacy of both the receiver and the sender, as well as the security of data transmission. In this paper, we propose a privacy-preserving data transmission scheme where both secure ciphertext conversion and malicious users identification are supported. In particular, the OT m n protocol is introduced to guarantee the two-way privacy of communication parties. Meanwhile, we adopt proxy reencryption algorithm to support secure ciphertext conversion so as to ensure the confidentiality of data in many-to-many communication pattern. In addition, by taking advantage of the concept of blockchain technology, a novel OT m n protocol is proposed to prevent data from being tampered with and effectively identify malicious users. Theoretical and experimental analyses indicate that the proposed scheme is practical for smart healthcare with high security and efficiency.
Hanlin Zhang, Peng Gao, Jia Yu, Jie Lin · 5 authors
Linear Regression (LR) is a classical machine learning algorithm which has many applications in the cyber physical social systems (CPSS) to shape and simplify the way we live, work, and communicate. This paper focuses on the data analysis for CPSS when the Linear Regression is applied. The training process of LR is time-consuming since it involves complex matrix operations, especially when it gets a large scale training dataset In the CPSS. Thus, how to enable devices to efficiently perform the training process of the Linear Regression is of significant importance. To address this issue, in this paper, we present a secure, verifiable and fair approach to outsource LR to an untrustworthy cloud-server. In the proposed scheme, computation inputs/outputs are obscured so that the privacy of sensitive information is protected against cloud-server. Meanwhile, computation result from cloud-server is verifiable. Also, fairness is guaranteed by the blockchain, which ensures that the cloud gets paid only if he correctly performed the outsourced workload. Based on the presented approach, we exploited the fair, secure outsourcing system on the Ethereum blockchain. We analysed our presented scheme on theoretical and experimental, all of which indicate that the presented scheme is valid, secure and efficient.
Alexander Djamali, Patrick Dossow, Michael Hinterstocker, Benjamin Schellinger · 7 authors
Abstract Due to a steeply growing number of energy assets, the increasingly decentralized and segmented energy sector fuels the potential for new digital use cases. In this paper, we focus our attention on the application field of asset logging, which addresses the collection, documentation, and usage of relevant asset data for direct or later verification. We identified a number of promising use cases that so far have not been implemented; supposedly due to the lack of a suitable technical infrastructure. Besides the high degree of complexity associated with various stakeholders and the diversity of assets involved, the main challenge we found in asset logging use cases is to guarantee the tamper-resistance and integrity of the stored data while meeting scalability, addressing cost requirements, and protecting sensitive data. Against this backdrop, we present a blockchain-based platform and argue that it can meet all identified requirements. Our proposed technical solution hierarchically aggregates data in Merkle trees and leverages Merkle proofs for the efficient and privacy-preserving verification of data integrity, thereby ensuring scalability even for highly frequent data logging. By connecting all stakeholders and assets involved on the platform through bilateral and authenticated communication channels and adding a blockchain as a shared foundation of trust, we implement a wide range of asset logging use cases and provide the basis for leveraging platform effects in future use cases that build on verifiable data. Along with the technical aspects of our solution, we discuss the challenges of its practical implementation in the energy sector and the next steps for testing in a regulatory sandbox approach.
The anonymity of blockchain identities brings security risks to transactions. To solve this problem, this paper proposes a trusted identity model based on smart contracts and introduces the CA certificate of the PKI system to endorse the authenticity of the user's identity. The model structure is designed, the blockchain digital certificate format is given, the cross-domain authentication scheme based on smart contracts is described, and the security and efficiency of the model are analyzed. In terms of security, the model meets the needs of entity verification; in terms of efficiency, the use of a hash algorithm to construct a complete certificate chain, compared with existing solutions, significantly improves the efficiency of cross-domain authentication.
Chenchen Tan, Xinghao Li, Tom H. Luan, Bruce Gu · 6 authors
With the evolving Internet of Vehicles (IoVs), the onboard resources of vehicles in computing and communication are experiencing fast growth. The sharing of road information and computing results among vehicles in proximity can effectively improve the utility of IoVs. However, remote inter-vehicular resource sharing, e.g., information and computing resource sharing, remains an under-explored issue. Motivated by this, we propose a novel digital twin based fair trading platform built upon consortium blockchain to enable city-wide vehicular resource sharing. Specifically, we first develop a digital twin based vehicular platform to enable vehicular resource sharing in the cloud. To track and secure the resource sharing among digital twins, the consortium blockchain is deployed, which is enforced by the designed smart contracts with an efficient Proof-of-Stake (PoS) consensus algorithm. In addition, an innovative incentive mechanism is devised to motivate the city-wide resource sharing for vehicles, which can maximize the profits of task publishers. Using extensive evaluations, we show the effectiveness of the proposed system.
Houshyar Honar Pajooh, Mohammad A. Rashid, Fakhrul Alam, Serge Demidenko
Abstract The diversity and sheer increase in the number of connected Internet of Things (IoT) devices have brought significant concerns associated with storing and protecting a large volume of IoT data. Storage volume requirements and computational costs are continuously rising in the conventional cloud-centric IoT structures. Besides, dependencies of the centralized server solution impose significant trust issues and make it vulnerable to security risks. In this paper, a layer-based distributed data storage design and implementation of a blockchain-enabled large-scale IoT system are proposed. It has been developed to mitigate the above-mentioned challenges by using the Hyperledger Fabric (HLF) platform for distributed ledger solutions. The need for a centralized server and a third-party auditor was eliminated by leveraging HLF peers performing transaction verifications and records audits in a big data system with the help of blockchain technology. The HLF blockchain facilitates storing the lightweight verification tags on the blockchain ledger. In contrast, the actual metadata are stored in the off-chain big data system to reduce the communication overheads and enhance data integrity. Additionally, a prototype has been implemented on embedded hardware showing the feasibility of deploying the proposed solution in IoT edge computing and big data ecosystems. Finally, experiments have been conducted to evaluate the performance of the proposed scheme in terms of its throughput, latency, communication, and computation costs. The obtained results have indicated the feasibility of the proposed solution to retrieve and store the provenance of large-scale IoT data within the Big Data ecosystem using the HLF blockchain. The experimental results show the throughput of about 600 transactions, 500 ms average response time, about 2–3% of the CPU consumption at the peer process and approximately 10–20% at the client node. The minimum latency remained below 1 s however, there is an increase in the maximum latency when the sending rate reached around 200 transactions per second (TPS).
The emerging smart city is driving massive transformations of modern cities, facing the huge influx of sensor data from IoT devices. Edge computing distributes computing tasks to the near-edge end, which greatly enhances the service quality of IoT applications, that is, ultralow latency, large capacity, and high throughput. However, due to the constrained resource of IoT devices, currently, systems with a centralized model are vulnerable to attacks, such as DDoS from IoT botnet and central database failure, which can hardly provide high-confidence services. Recently, blockchain with a high security promise is considered to provide new approaches to enhancing the security of IoT systems. However, blockchain and IoT have obvious incompatibility, and low-capacity IoT devices can hardly be incorporated into blockchain with high computing requirements. In this paper, a blockchain-edge computing hybrid system (BEHS) is presented to make the adaptation of blockchain to edge computing and provide trustworthy IoT management services for a smart city. A novel extensible consensus protocol designed for proof-of-work, named proof-of-contribution (PoC), is proposed to regulate the data upload behaviors of nodes, especially the data upload frequency of IoT device nodes, so as to protect the system from attack about frequency. In order to secure the data privacy and authenticity, a data access control scheme is designed by integrating symmetric encryption with asymmetric encryption algorithm. We implemented a concrete BEHS on Ethereum, realized the function of PoC mechanism via smart contracts, and conducted a case study for smart city. The extensive evaluations and analyses show that the proposed PoC mechanism can effectively detect and automatically manage the behavior of nodes, and the time cost of data access control scheme is within an acceptable range.
Reputation/trust-based blockchain systems have attracted considerable research interests for better integrating Internet of Things with blockchain in terms of throughput, scalability, energy efficiency, and incentive aspects. However, most existing works only consider static adversaries. Hence, they are vulnerable to slowly adaptive attackers, who can target validators with high reputation value to severely degrade the system performance. Therefore, we introduce$\textsf{zkRep}$, a privacy-preserving scheme tailored for reputation-based blockchains. Our basic idea is to hide both the identity and reputation of the validators by periodically changing the identity and reputation commitments (i.e., aliases), which makes it much more difficult for slowly adaptive attackers to identify validators with high reputation value. To realize this idea, we utilize privacy-preserving Pedersen-commitment-based reputation updating and leader election schemes that operate on concealed reputations within an epoch. We also introduce a privacy-preserving identity update protocol that changes the identity and time-window-based cumulative reputation commitments during each epoch transition. We have implemented and evaluated$\textsf{zkRep}$on the Amazon Web Service. The experimental results and analysis show that$\textsf{zkRep}$achieves great privacy-preserving features against slowly adaptive attacks with little overhead.
The majority of hacking accidents in cryptocurrency occur when the information of a cryptocurrency wallet is stolen. Since the cryptocurrency wallet is simply used for a key storage, when connecting to a transaction network, it is vulnerable for a key theft. Blockchain is not traceable, but it should communicate to applicate data of blockchain. To communicate to applicate data of blockchain, this study proposes a key protocol design to secure cryptocurrency transactions for user privacy of cryptocurrency to resolve the drawback of decentralized exchange. The key protocol includes a session key for a blockchain data structure and the Federated Byzantine Agreement (FBA) for the key-exchange agreement among users. In F-measure model, the values of Key Cluster Mode, Test Session key Mode and Original Session key Mode resulted in True Positive Ratio greater than 0.5 and False Positive Ratio lesser than 0.5. Therefore, the key protocol model has optimal security. In addition, computation costs of the protocol improve by compared with former studies. It may be played an important role in the cryptocurrency hacking accident and supported robust cryptocurrency market The study guarantees the security of cryptocurrency users without decentralized exchange, and it is scalable to other areas by using secure distributed networks.
Ponlawat Weerapanpisit, Sergio Trilles, Joaquı́n Huerta, Marco Paìnho
Social Internet of Things (SIoT) is a concept that integrates the Internet of Things and human social networks. An SIoT system has to store and manage device reputation values, which are used by end devices to determine the trustworthiness of another one. This device trustworthiness can also be affected by its geographical location. In this work, we introduced an architecture that includes the geospatial context in the part concerned with reputation management. The proposed architecture is based on the cloud-fog-edge architecture and uses the fog layer as the management system. The devices in the fog layer form an Ethereum Blockchain network and store the Smart Contracts. These in turn allow the management functionalities to be carried out in a decentralised, transparent and secure way, which are the advantages of Blockchain. To enable the characteristics with a geospatial component, it is necessary to apply a geocoding technique. This work shows how geocoding techniques can be adapted to cover the main geospatial functionalities and compares two geocoding options (Geohash or S2). The results showed that it is possible to include the geospatial context in a decentralised reputation management system by using hierarchical geocoding techniques, and the experiments showed that both Geohash and S2 can offer a similar performance in the proposed architecture.
After the General Data Protection Regulation (GDPR) was introduced, some organizations and big data companies shared data without conducting any privacy protection and compliance authentication, which endangered user data security, and were punished financially for this reason. This study proposes a blockchain-based GDPR compliance data sharing scheme, aiming to promote compliance with regulations and provide a tool for interaction between users and service providers to achieve data security sharing. The zero-knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARK) algorithm is adopted for protecting data and ensure that the user’s private data can satisfy the individual requirements of the service provider without exposing user data. The proposed scheme ensures mutual authentication through the Proof of Authority consensus based on the Committee Endorsement Mechanism (CEM-PoA), and prevents nodes from doing evil using the reputation incentive mechanism. Theoretical analysis and performance comparison indicate that the scheme meets the confidentiality, availability, and other indicators. It has superiority in efficiency and privacy protection compared with other schemes.
Abstract The explosive growth of big data is pushing forward the paradigm of cloud-based data store today. Among other, distributed storage systems are widely adopted due to their superior performance and continuous availability. However, due to the potentially wide attacking surfaces of the public cloud, outsourcing data store inevitably raises new concerns on user privacy exposure and unauthorized data access. Besides, directly introducing a centralized third-party authority for query authorization management does not work because it still can be compromised. In this paper, we propose a blockchain-assisted framework that can support trustworthy data sharing services. In particular, data owners allow to outsource their sensitive data to distributed systems in encrypted form. By leveraging smart contracts of blockchain, a data owner can distribute secret keys for authorized users without extra round interaction to generate the permitted search tokens. Meanwhile, such blockchain-assisted framework naturally solves the trust issues of query authorization. Besides, we devise a secure local index framework to support encrypted keyword search with forward privacy and mitigate blockchain overhead. To validate our design, we implement the prototype and deploy it at Amazon Cloud. Extensive experiments demonstrate the security, efficiency, and effectiveness of the blockchain-assisted design.
Abstract Blockchain technology has attracted considerable attention due to the boom of cryptocurrencies and decentralized applications. Among them, the emerging blockchain-based crowdsourcing is a typical paradigm, which gets rid of centralized cloud-servers and leverages smart contracts to realize task recommendation and reward distribution. However, there are still two critical issues yet to be solved urgently. First, malicious evaluation from crowdsourcing requesters will result in honest workers not getting the rewards they deserve even if they have provided valuable solutions. Second, unfair evaluation and reward distribution can lead to low enthusiasm for work. Therefore, the above problems will seriously hinder the development of blockchain-based crowdsourcing platforms. In this paper, we propose a new blockchain-based crowdsourcing framework with enhanced trustworthiness and fairness, named TFCrowd. The core idea of TFCrowd is utilizing a smart contract of blockchain as a trusted authority to fairly evaluate contributions and allocate rewards. To this end, we devise a reputation-based evaluation mechanism to punish the requester who behaves as “false-reporting” and a Shapley value -based method to distribute rewards fairly. By using our proposed schemes, TFCrowd can prevent malicious requesters from making unfair comments and reward honest workers according to their contributions. Extensive simulations and the experiment results demonstrate that TFCrowd can protect the interests of workers and distribute rewards fairly.
Chun‐Wei Tsai, Yi‐Ping Phoebe Chen, Tzu‐Chieh Tang, Yuchen Luo
The unlimited possibilities of machine learning have been shown in several successful reports and applications. However, how to make sure that the searched results of a machine learning system are not tampered by anyone and how to prevent the other users in the same network environment from easily getting our private data are two critical research issues when we immerse into powerful machine learning-based systems or applications. This situation is just like other modern information systems that confront security and privacy issues. The development of blockchain provides us an alternative way to address these two issues. That is why some recent studies have attempted to develop machine learning systems with blockchain technologies or to apply machine learning methods to blockchain systems. To show what the combination of blockchain and machine learning is capable of doing, in this paper, we proposed a parallel framework to find out suitable hyperparameters of deep learning in a blockchain environment by using a metaheuristic algorithm. The proposed framework also takes into account the issue of communication cost, by limiting the number of information exchanges between miners and blockchain.
Sin Kit Lo, Yue Liu, Qinghua Lu, Chen Wang · 7 authors
Federated learning is an emerging privacy-preserving AI technique where clients (i.e., organisations or devices) train models locally and formulate a global model based on the local model updates without transferring local data externally. However, federated learning systems struggle to achieve trustworthiness and embody responsible AI principles. In particular, federated learning systems face accountability and fairness challenges due to multi-stakeholder involvement and heterogeneity in client data distribution. To enhance the accountability and fairness of federated learning systems, we present a blockchain-based trustworthy federated learning architecture. We first design a smart contract-based data-model provenance registry to enable accountability. Additionally, we propose a weighted fair data sampler algorithm to enhance fairness in training data. We evaluate the proposed approach using a COVID-19 X-ray detection use case. The evaluation results show that the approach is feasible to enable accountability and improve fairness. The proposed algorithm can achieve better performance than the default federated learning setting in terms of the model's generalisation and accuracy.
Delegation of cryptographic signing rights has found many application in the literature and the real world. However, despite very advanced functionalities and specific use cases, existing solutions share the natural limitation that the number of usages of these signing rights cannot be efficiently limited, but users can at most be disincentivized to abuse their rights. In this paper, we suggest a solution to this problem based on blockchains. We let a user define a smart contract defining delegated signing rights, which needs to be triggered to successfully sign a message. By leveraging the immutability of the blockchain, our construction can now guarantee that a user-defined threshold of signature invocations cannot be exceeded, thereby circumventing the need for dedicated hardware or similar assistance in existing constructions for one-time programs. We discuss different constructions supporting different features, and provide concrete implementations in the Solidity language of the Ethereum blockchain, proving the real-world efficiency and feasibility of our construction.
With the continuous expansion of Internet of Things (IoT) devices, edge computing mode has emerged in recent years to overcome the shortcomings of traditional cloud computing mode, such as high delay, network congestion, and large resource consumption. Thus, edge-thing systems will replace the classic cloud-thing/cloud-edge-thing systems and become mainstream gradually, where IoT devices can offload their tasks to neighboring edge nodes. A common problem is how to utilize edge computing resources. For the sake of fairness, double auction can be used in the edge-thing system to achieve an effective resource allocation and pricing mechanism. Due to the lack of third-party management agencies and mutual distrust between nodes, in our edge-thing systems, we introduce blockchains to prevent malicious nodes from tampering with transaction records and smart contracts to act as an auctioneer to realize resources auction. Since the auction results stored in this blockchain-based system are transparent, they are threatened with inference attacks. Thus in this paper, we design a differentially private combinatorial double auction mechanism by exploring the exponential mechanism such that maximizing the revenue of edge computing platform, in which each IoT device requests a resource bundle and edge nodes compete with each other to provide resources. It can not only guarantee approximate truthfulness and high revenue, but also ensure privacy security. Through necessary theoretical analysis and numerical simulations, the effectiveness of our proposed mechanisms can be validated.
Haiqin Wu, Boris Düdder, Liangmin Wang, Shipu Sun · 5 authors
The ubiquity of crowdsourcing has reshaped the static sensor-enabled data sensing paradigm with cost efficiency and flexibility. Still, most existing triangular crowdsourcing systems only work under the centralized trust assumption and suffer from various attacks mounted by malicious users. Although incorporating the emerging blockchain technology into crowdsourcing provides a possibility to mitigate some of the issues, how to concretely implement the crucial components and their functionalities in a verifiable and privacy-aware manner remains unaddressed. In this article, we present BRPC, a blockchain-based decentralized system for general crowdsourcing. BRPC integrates the confident-aware truth discovery algorithm to provide task requesters with reliable task truths while evaluating each worker’s data quality. To mitigate the biased evaluation of malicious requesters, we propose a privacy-aware verification protocol leveraging the threshold Paillier cryptosystem, with which a certain number of workers can collaboratively verify the evaluation results without knowing any sensory data. Furthermore, we define the three roles of a user and elaborate a comprehensive reputation evaluation model enforced by smart contracts for its trustworthy running. Financial and social incentives are both offered to motivate users’ honest participation. Finally, we implement a prototype of BRPC and deploy it on the Ethereum blockchain. Theoretical analyses and experiment results show its security and practicality.
The Internet of things (IoT) is an active, real-world area in need of more investigation. One of the top weaknesses in security challenges that IoTs face, the centralized access control server, which can be a single point of failure. In this paper, Dynamic-IoTrust, a decentralized access control smart contract based aims to overcome distrusted, dynamic, trust and authentication issues for access control in IoT. It also integrates dynamic trust value to evaluate users based on behavior. In particular, the Dynamic-IoTrust contains multiple Main Smart Contract, one Register Contract, and one Judging Contract to achieve efficient distributed access control management. Dynamic-IoTrust provides both static access rights by allowing predefined access control policies and also provides dynamic access rights by checking the trust value and the behavior of the user. The system also provides to detected user misbehavior and make a decision for user trust value and penalty. There are several levels of trusted users to access the IoTs device. Finally, the case study demonstrates the feasibility of the Dynamic-IoTrust model to offer a dynamic decentralized access control system with trust value attribute to evaluate the internal user used IoTs devices.
The amount of information generated grows as more and more sensor and IoT devices are deployed in smart cities. It is of utmost importance for us to consider the privacy data leakage and compromised identity from both outside adversaries and inside abuse of data access privilege. The security assumption of the system should not solely rely on the fact that permission and access control were being implemented correctly. Quite the contrary, a system can be designed in a way that user's identity data and usage traces are not leaked even if the system had been compromised. Based upon our previous on-street parking system utilizing Bluetooth Low Energy (BLE) beacons, we applied a cryptographic primitive called zero-knowledge proof to our authentication system. A commitment scheme and Merkle tree is combined in the setup to achieve zero-knowledge set membership proof. Doing so, the user is anonymous to the server between authentication sessions, while the server's still able to verify the legitimacy of such user. The on-street parking system is therefore immune to privacy data leakage, as for now one cannot mass-query and profile certain user's traces within the system.