Tengku Mohd Diansyah, Nuraminah Ramli, Muzammil Jusoh
This study addresses the limitations of existing decentralized e-voting systems, particularly their reliance on public distributed infrastructures, limited real-world deployment feasibility, and lack of comprehensive evaluation. Previous studies have demonstrated the potential of distributed ledger-based voting mechanisms; however, most focus on conceptual designs or small-scale prototypes without detailed performance and usability validation. To address this gap, this research proposes and implements a decentralized e-voting system deployed on a local server infrastructure using distributed ledger technology and automated validation mechanisms for vote integrity. The system is designed to reduce dependency on external networks while maintaining transparency, immutability, and operational efficiency. The system was evaluated through functional testing, performance analysis, and user acceptance testing involving 30 participants in a controlled environment with 20 simulated voters. The results show that the system achieved a functional accuracy of 96% across 25 test scenarios. The average transaction response time ranged between 0.6 and 1.6 seconds, indicating efficient processing under moderate load conditions. However, the evaluation is limited to small-scale simulations and does not include stress testing, large-scale scalability analysis, or advanced security validation. Therefore, the findings demonstrate system feasibility rather than fully validated effectiveness. These results suggest that decentralized e-voting systems deployed on local infrastructures can provide a practical and efficient solution for controlled election environments, while further research is required to evaluate scalability, security robustness, and real-world deployment readiness.
Applies the Evidence-Based Subjective Logic (EBSL) framework to zero-knowledge reputation systems and decentralised identity. Demonstrates how reputation opinions that are provably correct can be published without revealing the underlying evidence graph, using the EZKL zkML framework for proof generation.
Access control in P2P network is extremely challenging due to several reasons such as decentrailized network, anonymous connectivity, high churn, resource constraints and large attack surface. The number of attributes to be tracked grows exponentially as P2P networks scale, exacerbating issues in traditional approaches such as RBAC, ABAC, RuBAC. This paper presents a novel blockchain-based access control framework for P2P networks using Ethereum smart contracts to offer an adaptable, decentralized, and scalable solution. Our token economy framework incentivizes nodes that demonstrate consistent compliance and penalize malicious actions using fungible ERC-20 tokens. Hierarchical static role-based structure consisting of regular members, primary and secondary group is the foundational layer of role management. Dynamic state management through a finite state machine classifies peers as benign, suspicious, or malicious mapping their behavior to the STRIDE threat model. We have used standard blockchain tool stack consisting of OpenZeppelin (contract library), Mocha (testing), and Web3.js (deployment). Our framework is tested with eight test cases, such as privilege escalation and denial-of-service attacks, and built using three types of Ethereum smart contracts. Our focus is on collecting four metrics gas cost, latency, execution time, simultaneous requests that provides a comprehensive view of realistic network activity. This study goes beyond conceptual nature of state-of-art architecture to showcase the realistic mapping between resources, peer roles and standard threats in a P2P network. The experimental results shows low gas costs (upto 1.4 million gas) and fast execution times (80–550 ms), confirming the design efficiency. The framework handles up to five concurrent requests with minimal performance impact, demonstrating strong scalability across roles and threat conditions. This framework enables scalable, behavior-driven governance in P2P networks, enhancing IoT and Web3 security.
A proof-carrying trust framework where every EQBSL trust claim ships with a zero-knowledge validity certificate verifiable by any third party without re-running the computation. Establishes the formal link between evidence-based subjective logic opinions and zero-knowledge proof systems, enabling trustless trust attestation in decentralised networks.
The maritime sector is undergoing a profound digital transformation (e.g., e-Navigation) but currently operates in a complex environment without a defined trust model, creating a strong need for secure communication. Current technical efforts, such as the Maritime Connectivity Platform (MCP), rely on traditional, centralized PKIs. This approach introduces single points of trust and failure and utilizes revocation mechanisms (like CRLs and OCSP) that are inadequate, especially in offline maritime scenarios. This thesis proposes a "privacy-aware" Distributed PKI (DPKI) architecture built on a Permissioned Distributed Ledger (PDL) to overcome these limitations. The solution employs a "Dual-Chain" model to logically separate information: an Identity channel stores PII (Personally Identifiable Information) with access restricted to Ports and Maritime Authorities, while a Certificate channel stores anonymous (pseudonymous) X.509 certificates, accessible to all members. In this decentralized model, actors (Ocean Carriers, Ports, Authorities) maintain independence by managing their own nodes; carriers can even deploy nodes on ships. This eliminates the single point of trust and failure. A Proof of Concept using Hyperledger Fabric was developed to validate the architecture. The primary innovation is the ability to enable offline certificate verification (e.g., Ship-to-Ship scenarios) by leveraging the local copy of the ledger. The "Dual-Chain" model provides selective privacy, balancing operational anonymity with controlled "linkability" by authorities. The use of standard X.509 certificates ensures native interoperability with existing protocols like TLS and SECOM while the PDL guarantees data integrity, non-repudiation, and auditability.
Healthcare collaborative processes still encounter major challenges, particularly regarding the interoperability of heterogeneous information systems, the traceability of medical interventions, and the secure sharing of patient data under strict privacy regulations such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). This paper presents a patient-centric, blockchain-based framework designed to overcome these limitations. The proposed solution integrates smart contracts and non-fungible tokens (NFTs) within the Ethereum blockchain to ensure data integrity, traceability, and privacy preservation. Furthermore, a compliance-by-design mechanism is embedded into the smart contracts to enable self-supervision of collaborative workflows without third-party intervention. A Proof-of-Authority (PoA) consensus protocol is also adopted to optimize validation efficiency and significantly reduce computational and energy costs.
The rapid expansion of Internet of Things (IoT) devices poses significant challenges for traditional centralized identity and access management (IdM) systems, which suffer from scalability limitations, single points of failure, and notable privacy risks. Although blockchain technology presents a promising decentralized solution, its direct adoption is often constrained by limited transaction throughput, high operational costs, and the computational constraints of IoT devices. To address these issues, this study proposes and rigorously evaluates HybID-AC, a novel hybrid architecture for decentralized identity and access management, specifically designed for large-scale, heterogeneous IoT ecosystems. HybID-AC employs a dual-layer design that separates global trust anchoring from local execution. A highly scalable, feeless Directed Acyclic Graph (DAG)-based distributed ledger functions as a public anchor layer, registering W3C-standard Decentralized Identifiers (DIDs) and access policy hashes. High-frequency access control operations are handled off-chain at the edge layer, leveraging the DIDComm v2 peer-to-peer protocol, Attribute-Based Access Control (ABAC) for fine-grained policy enforcement, and Zero-Knowledge Proofs (ZKP) to preserve attribute privacy. Analytical results demonstrate that the HybID-AC architecture significantly improves latency and cost-efficiency compared to fully on-chain approaches, maintaining stable performance even as network scale increases. Additionally, a novel probabilistic model is introduced to provide a quantitative measure of the integral security risk of ABAC policies under potential attribute compromise. Overall, the study concludes that this hybrid architecture effectively addresses the inherent trade-offs of blockchain in IoT systems, delivering a secure, scalable, and interoperable framework that empowers devices with self-sovereign identity while ensuring privacy and security by design.
Decentralized anonymous credentials (DACs) enable users to prove possession of specific identity attributes without disclosing additional information or relying on a centralized authority. However, existing DAC schemes commonly rely on complex zero-knowledge proofs, resulting in high computational overhead. They also lack sufficient flexibility and efficiency in handling multi-authority environments and supporting complex access policies, while facing limitations in trust assumptions and scalability. To address these challenges, this paper proposes a novel threshold anonymous credential scheme. Specifically, we introduce a ciphertext-policy attribute-based encryption (CP-ABE) scheme that supports threshold key distribution and aggregation, and leverage it to construct the threshold anonymous credential scheme. Experimental results and security analysis demonstrate that the proposed scheme exhibits high efficiency and flexibility in constructing authentication for complex access policies.
Democratic institutions increasingly rely on verifiable digital trust to enable fair participation and evidence-based decisions. Truvry is a decentralised protocol that converts behaviour-based evidence (usage patterns, transaction integrity, peer attestations) into portable cryptographic proofs that remain independent of any single platform or identifier, allowing individuals to transfer trust capital across domains while preserving privacy. The current prototype is zero-knowledge–compatible; in this version we use hashed proof anchoring and field-level redaction (no zk-SNARK module is deployed), with configurable smart-contract verifiers. By decoupling trust from identity, Truvry widens citizen inclusion, mitigates gatekeeping bias, and supplies auditable inputs for AI-mediated governance. In prototype tests (n=112), end-to-end proof issuance averaged 3.7 s (fastest local 1.4 s), verifier parse+check averaged 1.8 s, and the current minimum anonymisation entropy is 8.9 bits; gas costs for optional on-chain anchoring remained below US$0.02. All results are based on simulated user streams; a production pilot is planned.
In the context of cultural resource big data sharing and trading, existing practices face challenges such as coarse-grained permission management, privacy leakage during data delivery, and insufficient process automation. To address these issues, this paper proposes an integrated solution for permission management and automated transaction delivery. First, a multi-dimensional attribute permission model (MDAPM) for cultural resources is introduced, which leverages fuzzy mathematics and smart contracts to achieve dynamic authorization across the three dimensions of user, resource, and context, while incorporating zero-knowledge proofs (ZKP) to mitigate privacy leakage in permission verification. Second, a permission-data-address coupled delivery framework (PDACPF) is designed, which integrates the consortium blockchain and the interPlanetary file system (IPFS) for distributed storage to enable end-to-end automation of cultural resource data management, from preprocessing and transaction triggering through secure delivery. Simulation results demonstrate that under a lOO-concurrency scenario, the solution achieves a permission adjustment response time of less than 0.8 s, a data delivery success rate of at least 99.9%, and reduces privacy leakage risk to zero, thereby effectively supporting standardized trading and sharing of cultural resource big data.
Hope Leticia Nakayiza, Love Allen Chijioke Ahakonye, Dong‐Seong Kim, Jae‐Min Lee
In cyber-physical multi-agent systems, ensuring secure and decentralized cooperation among autonomous agents is crucial for maintaining system integrity and operational reliability. However, the presence of malicious or selfish agents in these systems often disrupts message delivery and trust. This paper presents a blockchain-based reputation management framework that integrates adaptive trust scoring, decentralized relay selection, and non-transferable soulbound tokens to incentivize cooperation and build reputation. By combining off-chain trust evaluation with on-chain transparency through the PureChain permissioned blockchain, the framework achieves secure, tamper-proof reputation management. Experimental results show average trust score above 80% under varying proportions of malicious behavior (20% to 80%). The proposed PureChain blockchain also achieved approximately 7.7 times lower transaction latency and 1.4 times higher throughput compared to Ethereum Sepolia, making it suitable for resilient communication in cyber-physical multi-agent systems.
Istiaque Ahmed, Tadashi Nakano, Kentaroh Toyoda, Thi Hong Tran
Digital identity verification has become crucial to every service in daily life. The privacy concerns associated with traditional Know Your Customer (KYC) systems have come to the forefront. These systems often require the sharing of personal information, which is stored in centralized databases, making them vulnerable to unauthorized access. To address these challenges, this work implements an electronic KYC system with selective disclosure using Merkle Tree and Zero-Knowledge Proofs (ZKP). Selective disclosure enables users to share only the necessary information, thereby reducing the exposure of sensitive data. ZKP enables the verification of this information without revealing the actual data, ensuring that privacy is preserved. The combination of selective disclosure and zkSNARKs in the proposed framework provides a solution for generating a single proof compared to multiple market proofs. This work demonstrates significant improvements in privacy protection compared to traditional identification systems. The implementation process and performance evaluation explore its potential impact on eKYC.
The Paris Journal on AI & Digital Ethics Bootstrapping Trust across Web2 and Web3 Domains Using Publicly Verifiable Web Data Yuan Lu¹, Qiang Tang² Corresponding authors:luyuan@iscas.ac.cn • qiang.tang@sydney.edu.au Abstract Through […]
Riku Miyake, Toru NAKANISHI, Teruaki Kitasuka, Zhuotao Lian
Although current digital identity systems are centralized, decentralized systems based on Verifiable Credentials (VCs) are gaining attention and moving towards practical implementation. As one of VC systems, a VC system with selective disclosure has been proposed, where credentials are represented as directed graph based on the concept of Linked Data (LD). However, in the existing VC system, the verification time increases depending on the number of RDF terms that correspond to vertices and edges in the proved graph, due to the characteristics of the utilized signature scheme. Meanwhile, a zero-knowledge proof system for directed graphs using a pairing-based accumulator has been proposed. This system is characterized by its verification time and proof data size being independent of the number of vertices and edges in the graph. In this paper, we propose a LD-based VC system with selective disclosure that leverages the zero-knowledge proof system on graph; the verification time and proof size are independent of the number of vertices and edges. Furthermore, we reduce the proof data size by modifying the signature scheme from AHO signatures to SPS-EQ signatures and from the pairing-based accumulator to a set commitment. We implement and evaluate the proposed system on a PC.
In the need for high-security mechanisms, Trust Management Systems (TMSs) are implemented in vehicular networks such as Vehicular Ad Hoc Networks (VANETs) and the Internet of Vehicles (IoV) to ensure reliable interactions between vehicles. These systems nowadays are a key factor in building up security by evaluating and managing trust relationships among network participants. However, TMSs are inherently very vulnerable to Trust Manipulation Attacks (TMA), where we find malicious nodes attempting to deceive trust models by exploiting their evaluation mechanisms. One critical variant of this attack involves malicious nodes creating multiple fake identities, known as the Sybil attack, to falsely reinforce their trustworthiness. This deception will totally mislead legitimate vehicles, manipulate the decision-making processes, and at the end compromise the overall security and reliability of the network. To address this challenge, we propose a Zero-Knowledge Proof (ZKP)-based trust authentication scheme that ensures each vehicle can prove its legitimacy without exposing sensitive information. Our approach can and will prevent attackers from fabricating multiple identities to manipulate trust values. By integrating cryptographic authentication with trust management, our method significantly strengthens security and ensures that only legitimate vehicles can participate in trust-based evaluations. Through simulations, we demonstrate the effectiveness of our proposed solution in reducing the risk of Sybil-based. The results indicate that our approach not only enhances security but also maintains efficient trust computation, making it a viable solution for real-world vehicular networks.
Private BitTorrent trackers enforce upload-to-download ratios to prevent free-riding, but suffer from three critical weaknesses: reputation cannot move between trackers, centralized servers create single points of failure, and upload statistics are self-reported and unverifiable. When a tracker shuts down, users lose their contribution history and cannot prove their standing to new communities. We address these problems by storing reputation in smart contracts and replacing self-reports with cryptographic attestations. Peers sign receipts for received pieces; the tracker aggregates them via BLS signatures and updates reputation. If a tracker is unavailable, peers fall back to an authenticated distributed hash table (DHT): stored reputation acts as a public key infrastructure (PKI), preserving access control without the tracker. Reputation is portable across tracker failures through single-hop migration in factory-deployed contracts. We also address the privacy implications of publishing public keys and reputations tied to private trackers on a public ledger: we propose ephemeral session keys to prevent linking peer identities, zero-knowledge membership proofs for anonymous DHT participation, and confidential reputation using homomorphic commitments. We formalize the security requirements, prove four security properties under standard cryptographic assumptions, and evaluate a prototype. Measurements show that transfer receipts add less than 5\% end-to-end overhead with typical piece sizes. To minimize signing overhead, we adopt a hybrid signature scheme: ECDSA signs individual piece receipts at transfer time for low per-operation latency, while BLS serves as the overarching scheme, enabling compact aggregation of many receipts into a single proof at report time. This design reduces client-side signing cost by an order of magnitude compared to using BLS throughout.
Matei Sofronie, Andrei Brînzea, Alexandru Bratu, Iulian Aciobăniţei · 5 authors
Verifiable Credentials (VCs) are a core component of decentralized identity systems, enabling individuals to prove claims without centralized intermediaries. However, managing VC revocation across segregated blockchain networks remains a key interoperability challenge. In this paper, we present a bidirectional blockchain bridge that enables the cross-chain verification of VCs between two Ethereum-compatible private blockchain networks: Geth and Besu. The system allows credentials issued and revoked on one chain to be validated from another without duplicating infrastructure or compromising security. Our architecture combines on-chain smart contracts with an off-chain relay, ensuring auditable, low-latency credential checks across chains. Our proposal is validated through an open-source working prototype. It is particularly relevant for domains where independent organizations must validate shared credentials across segregated blockchain infrastructures, including education, healthcare, and governmental identity services.
Srinivas P M, Ruthvik M T, Sanjay UG, Shiva Kumar S · 6 authors
Secure digital identity management is every emerging concern. Traditional authentication which includes use of passwords, central databases, and third party recovery present great security and also usability issues. Zero- Knowledge Proofs (ZKPs) and blockchain have put forth as very good for Decentralized identity systems. But also many present solutions have large compute requirements, don’t scale well, and have poor user recovery. This review puts forth that in present ZKP based identity systems we see the lack of password less login, human readable identities, and self sovereign recovery. We look at recent systems which we note have a heavy use of complex crypto credentials, central verification which is a point of failure, and extensive infrastructure which in turn do not see wide scale adoption. To present solutions to these issues we have put forth a UID based identity which uses ZKPs for authentication which does not require storage of passwords or private keys. We introduce a novel recovery which uses a human readable phrase from private key, salt, and UID which in turn is a user controlled method. What we did is we put the UID on the blockchain which in turn improves privacy and scale. Our analysis which we present improves on issues of usability, scale and security which in turn we present a very simple and practical solution for today’s identity management issues. Also this study we present which we put forth to be the base for what we think will be future works in the development of useable ZKP based identity systems.
Blockchains are considered for healthcare data sharing due to their immutability, decentralization, and auditability. However, ledger transparency exposes on-chain identifiers and activity metadata, enabling linkage across pseudonyms and inference over user behavior. Prior work has primarily focused on content confidentiality and access control, while leaving identity unlinkability insufficiently addressed. To this end, we present an approach that integrates Account ion (AA), zeroknowledge proofs (Groth16), and Pedersen commitments. The approach embeds proof- and commitment-based verification into programmable smart contract accounts (SCAs), enabling authentication without disclosing identifiers and decoupling transactions from static keys. We develop a proof-of-concept on the Polygon Amoy testnet using Circom and Solidity, and evaluate privacy under a global, passive, external, static, and computationally bounded attacker. For the ERC-4337 comparison, the attacker is assumed to know user-SCA mappings; for the account-shuffling comparison, the attacker knows one SCA per user. Using entropy metrics and clustering-based inference over on-chain metadata, our approach achieves the maximum entropy of $\log _{2}(10) \approx 3.32$ in a ten-user setting (versus 0 for ERC-4337 as specified, i.e., without privacy extensions) and substantially reduces clustering accuracy relative to address shuffling (ARI $0.468 \rightarrow 0.038$, NMI $0.653 \rightarrow 0.177$), while maintaining the auditability required for healthcare governance.
Hongzhi Li, Dun Li, Gang Lv, Noël Crespi · 8 authors
The widespread application of medical information systems has promoted the growth of personal electronic medical records (EMRs), which are typically produced in different medical institutions and stored in data centers. Consequently, data owners no longer retain control over their medical data, nor can they establish access control rules for their EMRs. Therefore, this study designs a patient-centered EMR access control system that integrates decentralized smart contracts and role-based access control (RBAC) to provide fine-grained data access control. In this system, we integrate a role-based access control model to achieve user-permission definition and adopt a personalized data access policy definition mechanism to achieve patient-centered data access control. The proposed system allows data owners to define a series of data access policies through smart contracts, achieving decentralized management of data access control permissions. In addition, we analyze the security features of this scheme and design a series of comparative experiments to evaluate the performance. The experimental results show that this system can efficiently achieve access control of personal electronic medical records and has higher reliability compared to traditional cloud-based EMR sharing systems.
Smart contracts have become a foundational component of blockchain systems, enabling decentralized, transparent, and autonomous execution of application logic across various domains, including decentralized finance (DeFi), gaming, and digital identity. Due to their immutable and trustless nature, smart contracts often manage and transfer substantial amounts of assets without human intervention. However, vulnerabilities in smart contracts can lead to substantial financial losses. Among these, access control vulnerabilities are particularly critical, typically originating from inadequately designed or incorrectly implemented permission mechanisms. Most existing methods for detecting access control vulnerabilities are based on static analysis, which heavily relies on manually defined rules and pattern matching. While these methods are efficient at identifying certain classes of known vulnerabilities, they are inherently limited in scope and generalization. In particular, they often fail to capture the underlying business logic of smart contracts.In this paper, we propose an LLM-based multi-agent system, named ACTaint, for detecting access control vulnerabilities in Solidity smart contracts. ACTaint first performs static analysis to guide the sink agent in identifying potential sinks. Then, based on the identified sinks, the taint agent conducts taint analysis to determine whether a data flow exists from untrusted sources to these sinks. We evaluate our approach on three datasets: known CVE cases, a set of 624 real-world smart contracts, and another set of 93 real-world smart contracts. The results demonstrate that our method outperforms existing tools in both datasets. On the first dataset, our approach outperforms state-of-the-art tools, including AChecker and GPTLens, achieving higher recall and F1-score. On the second dataset, our method surpasses the leading static analysis tool AChecker, with a 8.3% improvement in precision and an 9.7% improvement in F1-score.
Han Liu, Daoyuan Wu, Yi Sun, Shuai Wang · 5 authors
Access control (AC) vulnerabilities are among the most critical security threats to smart contracts. Despite extensive research, they remain widespread and damaging in the Ethereum ecosystem. To understand and advance the current state-of-the-art (SOTA) in AC vulnerability detection, we first curate a diverse dataset of 180 real-world AC vulnerabilities from CVE entries, DeFiHackLabs incidents, and Code4rena audit reports.Using this dataset, we conduct a systematic benchmark study along three dimensions. First, we develop a cause-based taxonomy and analyze the prevalence and evolution of AC vulnerabilities. Second, we evaluate six SOTA tools, including two from industry and four from academia, revealing low recall (3% to 8%) and significant blind spots. To understand these failures, we examine 1.2 million deployed contracts and uncover practical gaps in AC protection mechanisms overlooked by existing tools. Finally, we assess the potential of large language models (LLMs) for AC vulnerability detection and show that LLMs detect 53–75% of vulnerabilities, outperforming traditional tools but facing challenges such as hallucinations and scalability. Our findings highlight the need for hybrid approaches that combine static analysis with LLM-based semantic reasoning to address the complexity of modern AC vulnerabilities.
Blockchain, as a new distributed technology, plays important roles in various areas. But due to unsupervised transaction model of blockchain, Decentralized Application (DAPP) mainly focus on limited Decentralized Finance (DEFI) areas such as lending or trading, leaving enterprise and government application untouched. This paper propose a supervised transaction algorithm with identity privacy enabled on blockchain to tackle this problem. In essence, we encrypt transaction before its submission onto the chain, and execute transaction after supervisor's approval. The paper satisfies the compliance of regulation in finance and social application, and ensures that identity privacy of trader can be protected. In this way, blockchain can be adapted to broader domains without technology compromise.
Multi-agent systems (MAS) have emerged as a critical paradigm for distributed problem-solving in complex environments. However, their deployment in mission-critical applications faces significant challenges regarding trust, security, and adversarial robustness. This paper presents TrustOrch, a novel dynamic trust-aware orchestration framework designed to enhance the resilience of multi-agent collaboration against adversarial attacks. TrustOrch introduces five key innovations: (1) a dynamic trust assessment mechanism that evaluates agent reliability in real-time using multi-dimensional metrics, (2) an adversary-aware orchestration strategy combining reinforcement learning and game theory to detect and mitigate prompt injection attacks, (3) an adaptive collaboration topology that dynamically adjusts agent communication structures based on task complexity and trust levels, (4) explainable decision tracing for complete audit chains, and (5) a layered security architecture leveraging blockchain technology for decentralized trust verification. Our experimental evaluation demonstrates that TrustOrch reduces collision rates by 62%, achieves 91.7% robustness under adversarial attacks, and reduces communication overhead by 39.8% compared to baseline approaches. The framework achieves robust performance under various adversarial scenarios while maintaining transparency and regulatory compliance, making it particularly suitable for deployment in high-risk domains such as finance, healthcare, and autonomous systems.