Trust management systems (TMS) are crucial for managing trust in distributed environments. The rise of decentralized systems and blockchain has sparked interest in credential-based decentralized trust management systems (DTMS). This paper bridges the gap between theory and practice through a systematic review of credential-based DTMS. We analyze existing DTMS solutions through multiple dimensions, including their architectural designs, credential mechanisms, and trust evaluation models. Our survey provides a detailed taxonomy of credential-based DTMS approaches and establishes comprehensive evaluation criteria for assessing DTMS implementations. Through extensive analysis of current systems and implementations, we identify critical challenges and promising research directions in the field. Our examination offers valuable insights for researchers and practitioners working on DTMS, particularly in areas such as access control, reputation systems, and blockchain-based trust frameworks.
Consensus algorithms are essential for blockchain networks to achieve agreement on transaction outcomes. However, mainstream algorithms like Proof of Work (PoW) and Proof of Stake (PoS) exhibit significant limitations in security and efficiency, including high energy consumption, wealth centralization, and a lack of effective node behavior evaluation to guard against internal attacks. To address these issues, this paper proposes an intelligent reputation-based consensus mechanism leveraging a Long Short-Term Memory (LSTM) network. This mechanism analyzes multi-dimensional node attributes (e.g., hostname, country, event sequence, timestamp) to model behavioral patterns using the LSTM, enabling accurate reputation quantification and early detection of malicious intent. Furthermore, we design a dynamic reputation scoring system that calculates a composite reputation score by weighting the LSTM’s predicted score against the node’s historical behavior score. This composite score is directly applied to the dynamic election of authoritative nodes and their role assignment within the consensus process. Simulation results demonstrate that, compared to traditional PoW and PoS mechanisms, our approach significantly reduces the attack success rate of malicious nodes attempting to form monopolies, thereby enhancing the fairness of the consensus process and the overall robustness of the system.
Access control is a security mechanism designed to ensure that only authorized users can access specific resources. Cross-domain access control involves access to resources across different organizations, institutions, or applications. Traditional access control, however, which handles authentication and authorization separately in centralized environments, faces challenges in identity dispersion, privacy leakage, and diversified permission requirements, failing to adapt to cross-domain scenarios. Thus, there is an urgent need for a new access control mechanism that empowers autonomous control over user identity and resources, addressing the demands for privacy-preserving authentication and flexible authorization in cross-domain scenarios.To address cross-domain access control challenges, we propose POLARIS, a unified and extensible architecture that enables policy-based, verifiable and privacy-preserving access control across different domains. POLARIS features a structured commitment mechanism for reliable, fine-grained, policy-based identity disclosure. It further introduces VPPL, a lightweight policy language that supports issuer-bound evaluation of selectively revealed attributes. A dedicated session-level security mechanism ensures binding between authentication and access, enhancing confidentiality and resilience to replay attacks.We implement a working prototype and conduct comprehensive experiments, demonstrating that POLARIS effectively provides scalable, privacy-preserving, and interoperable access control across heterogeneous domains. Our results highlight the practical viability of POLARIS for enabling secure and privacy-preserving access control in decentralized, cross-domain environments.
This study presents a blockchain-backed Role-Based Access Control (RBAC) service for distributed clouds, addressing auditable authorization under multi-region latency and consistency constraints. Although end-to-end costs and tail impacts of permissioned ledgers in RBAC are under-quantified, the present study implements a multi-region deployment with Istanbul Byzantine Fault Tolerance (IBFT), batched commits, and an off-chain cache, with evaluation against centralized and event-sourced baselines, throughput reported in requests per second (RPS), and calibration via Expected Calibration Error (ECE) and Brier Score using multi-seed runs and moving-block bootstrap. At the target load, the candidate achieved 145.0 +/- 4.6 ms 95th percentile (p95) latency and 1008 +/- 13 RPS while meeting the 150.0 ms Service Level Objective at 1000 rps; the 99th percentile (p99) policy-update consistency lag measured 1750.0 +/- 150.0 ms. Connectivity remains the bottleneck. The parts are familiar; the sequencing is not, combining ledger finality with cache-assisted reads and bounded block intervals to narrow the gap to centralized designs under controlled failures. These findings indicate that tamper-evident auditing can be added with modest overhead for enterprise security operators planning multi-region cloud authorization.
Artificial intelligence (AI) agents are increasingly capable of initiating financial transactions on behalf of users or other agents. This evolution introduces a fundamental challenge: verifying both the authenticity of an autonomous agent and the true intent behind its transactions in a decentralized, trustless environment. Traditional payment systems assume human authorization, but autonomous, agent-led payments remove that safeguard. This paper presents a blockchain-based framework that cryptographically authenticates and verifies the intent of every AI-initiated transaction. The proposed system leverages decentralized identity (DID) standards and verifiable credentials to establish agent identities, on-chain intent proofs to record user authorization, and zero-knowledge proofs (ZKPs) to preserve privacy while ensuring policy compliance. Additionally, secure execution environments (TEE-based attestations) guarantee the integrity of agent reasoning and execution. The hybrid on-chain/off-chain architecture provides an immutable audit trail linking user intent to payment outcome. Through qualitative analysis, the framework demonstrates strong resistance to impersonation, unauthorized transactions, and misalignment of intent. This work lays the foundation for secure, auditable, and intent-aware autonomous economic agents, enabling a future of verifiable trust and accountability in AI-driven financial ecosystems.
This student propose a new methodology for academic credential verification. The system focuses on tamper resistance, transparency, and scalability-key factor for building trust among institution, employers and student Developed on block chain technology, the system creates an immutable record that can be used in order to store academic credentials that are safe to prevent any third-party modifications to ensure that their alteration is prevented to a significant extent and the fear of fraud is reduced in the system. It integrates the Interplanetary File System (IPFS) that can be used to store data in a decentralized to guarantee fast access to documents and safe guard against tampering. Biometric hashing offers individual-specific users, which increases security and prevents Fraud, and zero-knowledge proofs (zkSNARKs) prove the credentials without expressing crucial confidential data, hence strikes the equilibrium between privacy and verification. Future AI algorithms could also optimize the detection of Fraud by detecting patterns and anomalies that further enhance security and user trust. The system is set in such a way that it is flexible to integrate with the existing block chain networks with significant contributions being seen in increased accuracy in verifications, security integrity, identity confirmation and reduced fraudulent activities. Such a system is essential ultimately to establish trust and credibility in academic credentials across borders thus strengthening the credibility of educational degree.
The security of blockchain systems relies on the honest majority assumption. However, strategic mining threatens this assumption, because selfish miners can gain more block rewards than honest miners by attacks such as withholding blocks. Due to its significant implication, blockchain mining games have been studied in PoW and PoS under various settings using different methods. Nonetheless, this paper argues that the practical limitation of random beacons has not been exploited in strategic mining in PoS blockchains. Current PoS blockchains use random beacons to randomly select validators for each slot. However, the randomness is usually fixed for multiple slots, due to the latency of distributed random beacon protocols. This indicates that validators actually know some information about the election result in the future, which contrasts with the Markov process models in previous analysis. Using this information, this paper presents a close to optimal mining strategy based on an optimal interval scheduling algorithm for each epoch. For proof-of-stake protocols with no propagation delay, we show that a validator with arbitrary proportion of stake can strictly benefit from strategic mining and get significantly higher block rewards than the previous strategies.
As the "agentic web" takes shape-billions of AI agents (often LLM-powered) autonomously transacting and collaborating-trust shifts from human oversight to protocol design. In 2025, several inter-agent protocols crystallized this shift, including Google's Agent-to-Agent (A2A), Agent Payments Protocol (AP2), and Ethereum's ERC-8004 "Trustless Agents," yet their underlying trust assumptions remain under-examined. This paper presents a comparative study of trust models in inter-agent protocol design: Brief (self- or third-party verifiable claims), Claim (self-proclaimed capabilities and identity, e.g. AgentCard), Proof (cryptographic verification, including zero-knowledge proofs and trusted execution environment attestations), Stake (bonded collateral with slashing and insurance), Reputation (crowd feedback and graph-based trust signals), and Constraint (sandboxing and capability bounding). For each, we analyze assumptions, attack surfaces, and design trade-offs, with particular emphasis on LLM-specific fragilities-prompt injection, sycophancy/nudge-susceptibility, hallucination, deception, and misalignment-that render purely reputational or claim-only approaches brittle. Our findings indicate no single mechanism suffices. We argue for trustless-by-default architectures anchored in Proof and Stake to gate high-impact actions, augmented by Brief for identity and discovery and Reputation overlays for flexibility and social signals. We comparatively evaluate A2A, AP2, ERC-8004 and related historical variations in academic research under metrics spanning security, privacy, latency/cost, and social robustness (Sybil/collusion/whitewashing resistance). We conclude with hybrid trust model recommendations that mitigate reputation gaming and misinformed LLM behavior, and we distill actionable design guidelines for safer, interoperable, and scalable agent economies.
As cloud adoption grows, Identity and Access Management (IAM) faces increasing complexity due to reliance on centralized systems controlled by Cloud Service Providers (CSPs), raising concerns over data leakage and single points of failure. This paper proposes BZET-IAM, a trust-based Single Sign-On IAM (SSO-IAM) framework built on Consortium Blockchain to support hybrid, multi-application cloud environments across domains. The system integrates Zero Trust Architecture (ZTA), Self-Sovereign Identity (SSI), and Zero-Knowledge Proofs (ZKPs) to enable dynamic, privacy-preserving authentication using verifiable claims. Trust-scores and contextual information are embedded in access tokens to support continuous verification and adaptive access control. Blockchain ensures tamper-proof, auditable authentication and authorization. Experimental results show that the proposed approach achieves lower authentication and privilege update costs under dynamic, context-aware access scenarios.
The Denial-of-service (DoS) attacks pose a significant risk in smart contracts. They often arise from unexpected failures in external calls. This papers thoroughly examines DoS vulnerabilities in smart contracts and looks at effective ways to reduce these risks. The authors explore contract scenarios that are vulnerable to refund-failure DoS attacks. In these cases, bad actors can disrupt contract operations. The experiments show that some methods completely defend against these attacks, but they might some with a cost and hamper overall user experience. Other methods find a middle ground, improving security and usability by improving DoS and re-entrancy risks without interfering with single interaction flows. The research provides a solid evaluation for DoS mitigation strategies and offers practical advice for developing secure smart contracts.
In 2023, over 15 million health records were exposed, highlighting vulnerabilities in traditional Electronic Health Records (EHRs). This paper proposes a novel Ethereum-based decentralized EHR system to enhance security, privacy, and patient agency in Healthcare 4.0. Unlike prior systems like MedRec and Patientory, our framework introduces a time-bound emergency access protocol, reducing critical care response time by$\mathbf{2 0 \%}$, and an AI-driven module for digitizing paper records. ZeroKnowledge Proofs (ZKPs) ensure privacy-preserving verification, while the InterPlanetary File System (IPFS) provides scalable, tamper-proof storage. A ReactJS application with MetaMask empowers patients with data ownership. Integrated with FHIR/HL7 standards and GDPR-compliant, the system supports smart city initiatives. Prototype testing demonstrates robust scalability, paving the way for patient-centric national digital health frameworks.
This paper presents a decentralized authorization framework that employs non-transferable Non-Fungible Tokens (NFTs), also known as soul-bound tokens (SBTs), to deliver tamper-resistant, identity-bound access control. Access rights are permanently linked to a user's blockchain wallet and can be upgraded via metadata updates without reminting, enabling dynamic tier management while preventing resale or delegation. The architecture combines an ERC-721 smart contract backend with a decentralized front-end interface for wallet-based authentication and administrator-controlled content distribution. Implementation on the Binance Smart Chain test network demonstrates secure and cost-effective access management with tiered content control. An experimental evaluation quantifies the gas costs associated with NFT minting, tier upgrades, and InterPlanetary File System (IPFS) metadata storage. Results show that using the native Base32 encoding of IPFS content identifiers reduces storage gas costs by approximately 6% compared to the previously standard Bitcoin-style Base58 encoding. Furthermore, shorter uniform resource identifiers (URIs) avoid costly expansions of the storage slots of the Ethereum Virtual Machine (EVM), which can increase transaction costs by 20,000 gas per slot. These findings provide practical guidelines for designing scalable and cost-effective NFT-based authorization systems. Source code and implementation details are available on GitHub.
S. Parvathi, I Umamaheshwar Rao, Kummari Venkatesh, Yacharam Uma · 6 authors
Information is crucial in every area of activity in the contemporary digital era. Safe processing and storage of data are required, especially for software handling sensitive information. Because electronic data can be manipulated, it must be protected from unauthorized alterations. Organizations are always exposed to cyberattacks where malicious actors attempt to alter crucial information. Because preservation of the digital evidence as original and its source is still very important in an investigation, such an event is very alarming. Because every data breach case has a likely impact on the legal process, evidence preservation and maintaining watch at every point of existence becomes very vital. The custody of evidence relies on reports passing through several middlemen, i.e., pathology labs, physicians, and police. One healthy method of obtaining security, immutability, and transparency in the process is with the help of blockchain technology. Blockchain makes the transfer of evidence possible and traceable securely without relying on a single central entity by decentralizing data management. In this paper, we suggest an Ethereum blockchain-based system for evidence management with the help of Ethereum. Through use of IPFS in decentralized storage, the system optimizes security through secure storage of evidence and reports with simplicity of access. Additionally, interoperability between agencies without sacrificing security levels guarantees smooth transmission of data. The proposed solution effectively protects against tampering and guarantees evidence as credible in the course of the investigation process due to the high integrity, traceability, and immutability capabilities of blockchain.
Over the years, managing patient consent for sharing health data has remained a significant challenge due to a lack of transparency about how the data is shared with other systems and the absence of a verifiable audit trail. This paper introduces a new hybrid design that uses an industry-standard Open Authorization (OAuth) 2.0 authorization framework for detailed access grants, complemented by a decentralized, on-chain consent ledger built on the ERC-6551 blockchain standard, enabling digital assets (using Non Fungible Tokens) to act as independent accounts. The primary concept behind this paper is the utilization of the ERC-6551 Token Bound Account (TBA) as a patient-controlled on-chain portfolio of consent grant tokens, which are represented as semi-fungible tokens. We have solved the problem of converting the static, database-bound permissions into a dynamic, patient-owned digital system supported by timely-expiring JWT tokens. With the utilization of the OAuth 2.0 flow, short-lived JSON Web Tokens (JWTs) act as pointers to the durable, immutable consent records on the Blockchain. With our dual-validation approach, resource servers can verify both the off-chain time-based short-lived tokens and the granted access, along with on-chain consent status, to determine whether the patient has revoked the token. This provides a robust, auditable, and patient-sovereign system for managing healthcare data access. Finally, we present the complete design and architecture, along with data flows and cryptographic operations, which we used to analyze the security and performance characteristics and evaluate the outcomes of this implementation.
The convergence of blockchain and Zero Trust Architecture (ZTA) offers a transformative pathway for enhancing security and resilience in financial infrastructures. Traditional network perimeter models are increasingly inadequate for safeguarding decentralized finance (DeFi), payment systems, and digital asset platforms that operate across distributed environments. This study explores how Zero Trust principles rooted in continuous verification, least privilege access, and micro-segmentation can be effectively integrated into blockchain ecosystems to mitigate identity spoofing, insider threats, and data tampering. By examining hybrid frameworks that combine permissioned blockchains with Zero Trust access controls, the research highlights a paradigm shift toward adaptive, identity-centric security postures in financial networks. The proposed model emphasizes dynamic authentication, real-time monitoring, and cryptographic assurance to ensure trustless yet verifiable interactions among nodes and participants. This integration not only fortifies compliance with emerging regulatory standards but also enhances interoperability and transparency across multi-chain financial systems. The findings suggest that embedding Zero Trust principles within blockchain-oriented infrastructures can create a self-healing, auditable, and future-ready digital finance ecosystem.
The proliferation of multi-vendor autonomous systems (MVAS), such as shared warehouses, necessitates robust cooperation frameworks for robotic agents from different vendors. Ensuring operational integrity in these environments is a critical challenge, as the misbehaviour of a single agent can disrupt the entire system. This paper proposes a decentralised framework for secure and trustworthy multi-robot cooperation. Our approach leverages distributed ledger technology (DLT) to create an immutable record of operations and introduces a novel, lightweight Proof of Location (PoL) mechanism. This PoL allows agents to verify task completions both physically and cryptographically with minimal computational overhead. The framework is further strengthened by a real-time, algorithmic trust and reputation system that continuously evaluates agent behaviour. A key advantage over traditional methods is our support for asynchronous verification, which enhances both scalability and efficiency by removing centralised bottlenecks. Extensive simulations in a warehouse setting demonstrate that our framework effectively detects and mitigates malicious activities, thereby improving the security and performance of MVAS. The broader applicability of our approach is further illustrated through a conceptual case study in a smart city parking scenario.
Chong Chen, Jiachi Chen, Lingfeng Bao, David F. Lo · 10 authors
Smart contract vulnerabilities, particularly improper Access Control that allows unauthorized execution of restricted functions, have caused billions of dollars in losses. GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files-these serve as intermediate development artifacts that must be compiled and packaged before deployment. Third-party developers often reference, reuse, or fork code from these repositories during custom development. However, if the referenced code contains vulnerabilities, it can introduce significant security risks. Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories, as they typically require the target contract to be compilable to generate an abstract representation for further analysis. This paper presents TRACE, a tool designed to secure non-compilable smart contract repositories against access control vulnerabilities. TRACE employs LLMs to locate sensitive functions involving critical operations (e.g., transfer) within the contract and subsequently completes function snippets into a fully compilable contract. TRACE constructs a function call graph from the abstract syntax tree (AST) of the completed contract. It uses the control flow graph (CFG) of each function as node information. The nodes of the sensitive functions are then analyzed to detect Access Control vulnerabilities. Experimental results demonstrate that TRACE outperforms state-of-the-art tools on an open-sourced CVE dataset, detecting 14 out of 15 CVEs. In addition, it achieves 89.2% precision on 5,000 recent on-chain contracts, far exceeding the best existing tool at 76.9%. On 83 real-world repositories, TRACE achieves 87.0% precision, significantly surpassing DeepSeek-R1's 14.3%.
Asif Mahmood, Razib Hayat Khan, Jahid Hasan Rony, M. M. Mahbubul Syeed · 5 authors
The rapid growth of digital services has made it essential to have secure, transparent, and decentralized platforms to support reliable and efficient service exchanges in recent time. This study presents a distributed blockchain-based framework that facilitates trustworthy and reputation-driven interactions between service providers and receivers. Service providers can register and promote their services, while users can browse, search, and request offerings through a decentralized and transparent network in this system. Each transaction is immutably recorded on a blockchain ledger, ensuring tamper-proof documentation of service details, including transaction ID, participants, status, timestamp, and review content. The platform also uses a dynamic reputation system where user feedback generates a score that influences future service interactions for both the service provider and the receiver. A proof-of-concept prototype was developed and evaluated to demonstrate the feasibility of integrating this blockchain-based distributed peer-to-peer system into serviceoriented digital platforms. The experimental results validate the system's capacity to handle diverse transaction types while maintaining performance, scalability, and user satisfaction. This approach improves accountability, fosters trust, and mitigates fraud in peer-to-peer digital marketplaces.
Fernando Castillo, Eduardo Brito, Sebastian Werner, Pille Pullonen · 5 authors
Service Level Agreement (SLA) monitoring in service-oriented environments suffers from inherent trust conflicts when providers self-report metrics, creating incentives to underreport violations. We introduce a framework for generating verifiable SLA violation claims through trusted hardware monitors and zero-knowledge proofs, establishing cryptographic foundations for genuine trustworthiness in service ecosystems. Our approach starts with machine-readable SLA clauses converted into verifiable predicates and monitored within Trusted Execution Environments. These monitors collect timestamped telemetry, organize measurements into Merkle trees, and produce signed attestations. Zero-knowledge proofs aggregate Service-Level Indicators to evaluate compliance, generating cryptographic proofs verifiable by stakeholders, arbitrators, or insurers in disputes, without accessing underlying data. This ensures three security properties: integrity, authenticity, and validity. Our prototype demonstrates linear scaling up to over 1 million events per hour for measurements with near constant-time proof generation and verification for single violation claims, enabling trustless SLA enforcement through cryptographic guarantees for automated compliance verification in service monitoring.
AbstractAs a key bridge between the real economy and financial capital, supply chain finance generates core data such as transaction documents, logistics information, and financing contracts, whose secure, trustworthy, and controllable management is crucial.Traditional centralized notarization schemes suffer from single points of failure, risks of data tampering, and high trust costs.Although blockchain offers tamper-evident notarization, limited on-chain storage and throughput constrain its direct use in large-scale data scenarios.To address this tension, this paper investigates a secure data notarization and access control algorithm grounded in an on-chain/off-chain hybrid storage architecture and smart contracts.We first construct a layered data management model: high-value, low-volume data hashes (digital fingerprints) and key access-control policies are anchored on-chain to ensure immutability, while complete large-volume raw data are encrypted and stored off-chain (e.g., in IPFS or distributed databases) to ensure scalability.To tackle potential challenges of on-/off-chain consistency and integrity verification under this hybrid architecture, we design an efficient verification mechanism based on cryptographic commitments, ensuring any tampering with off-chain data can be detected quickly and succinctly.Furthermore, to achieve fine-grained privacy protection and compliant use, we propose a smart-contract-based dynamic access control algorithm.By deploying access-control policies as executable code on-chain, the algorithm performs automated logical checks to deliver precise authorization and comprehensive audit logging, ensuring security and transparency throughout data sharing and circulation.Through theoretical security analysis and prototype experiments, the proposed scheme preserves data immutability and traceability while significantly improving the storage efficiency and processing performance of supply chain finance notarization systems, and it enables flexible and secure access control.The results indicate that the coordinated mechanism of on-chain/off-chain hybrid storage and smart contracts offers a feasible technical pathway for building efficient, trustworthy, and secure supply chain finance infrastructure.
Octara Pribadi, Johanes Terang Kita Perangin Angin, Erick Erick
The development of information technology has driven the need for stronger security systems and guaranteed privacy on web-based platforms. Traditional verification methods such as passwords and two-factor authentication are increasingly seen as insufficient in facing the growing complexity of cyber threats. Zero-Knowledge Proof (ZKP) emerges as an alternative solution that enables identity verification without revealing sensitive information. This research aims to implement ZKP technology in web-based systems to enhance user security and privacy. The method involves the implementation of a simple XOR-based ZKP algorithm to prove identity without disclosing personal data, as well as a three-step verification mechanism between the verifier and the prover. Implementation results show that the system can prevent attacks such as man-in-the-middle and replay attacks, while maintaining data confidentiality during the authentication process. This study also identifies challenges in system efficiency and verification process integrity and offers technical solutions to support broader ZKP integration in digital platforms. Thus, the use of ZKP in web-based systems holds great potential to improve user trust and security in the digital era.