Jeffson C. Sousa, Bruno Evaristo, Antonio Mateus, Ismael Ávila · 6 authors
This paper presents a performance evaluation of smart contracts designed for managing decentralized digital identities on Ethereum-based blockchain networks. The analysis focuses on core identity lifecycle operations such as creation, update, credential schema definition, and revocation control, all implemented through Solidity smart contracts. Two execution contexts were considered: an environment using Hyperledger Besu operating in permissioned mode, and a reference to the traditional Hyperledger Indy model. The tests were conducted in a private network simulating different load levels and consensus configurations. The evaluated metrics include response time, throughput, resource usage, and scalability. The results provide insights to support the selection of efficient architectures for digital identity solutions based on Self-Sovereign Identity (SSI) and Ethereum, particularly in enterprise or regulated environments.
G will enable sophisticated composite services that can be realized, bought, and sold across multi-stakeholder marketplaces. With the advent of intent-based networking, requests for these composite services will be through high-level intents, together with requisite service-level agreements (SLAs), and with significant latitude on the specifics of how the composite services are realized. At the same time, the 6 G ecosystem will be very large, with new stakeholder entrants dynamically joining and leaving. Hence, buyers and sellers will be concerned about the trustworthiness of the sellers and the realized composite services as well as the trustworthiness of buyers and their behaviors. Current approaches to trust in networking are typically based on measures such as reputation, in a manner that will not scale to such large and dynamic ecosystems and does not encourage new entrants to join. We propose an architecture for intent-based 6G multi-stakeholder marketplaces inspired by decentralized finance (DeFi); namely, intent-based cryptocurrency swaps on blockchains/cross-chains. In such DeFi paradigms, trust is implicitly modeled via techno-economic risk management, rather than explicitly computed measures such as reputation. We propose how to leverage such DeFi paradigms to enable trustworthy intent-based multi-stakeholder 6G services marketplaces with SLAs, in a manner that encourages new entrants. Our approach is based on techno-economic risk vs. market-driven rewards as a proxy for trust, realized through intent-based blockchain/crosschain architectures with SLA assurance. Our work provides an enabler for establishing trusted multi-stakeholder interactions with UNEXT, an intelligent networking platform being created by Nokia Bell Labs.
Decentralized Autonomous Organizations (DAOs) are emerging as key governance structures in Web3 ecosystems, enabling community-driven decision-making without centralized control. Yet, current DAO implementation frameworks often lack modularity, role adaptability, and low-code accessibility, limiting broader adoption-especially among non-technical users and emerging organizations. Targeting these issues, this paper proposes a modular, template-driven DAO system for public blockchains such as Ethereum, integrating reusable governance logic units, token-based role configuration, and low-code interfaces to support flexible and secure deployment. The system allows role-scoped configuration of governance parameters via templates and supports scenario-specific deployment using predefined smart contracts, avoiding the need for direct code modification in the demonstrated use case. A quadratic votingbased governance scenario was used to demonstrate how the proposed framework can enable DAO setup and participation without requiring direct contract modification for that specific use case. Internal validation, conducted with simulated stakeholder roles, confirmed improvements in usability, configuration safety, and governance clarity, while also identifying practical gaps in role-specific UI guidance and simulation tooling. Although the current implementation is limited to a single voting model and local deployment, the findings highlight the potential of templatebased DAO systems to enable more inclusive, adaptable, and transparent decentralized governance.
Feng Wang, Shuo Yang, Min Zhang, Yang Liu · 6 authors
In decentralized ecosystems, Decentralized Identifiers (DID) and Verifiable Credentials (VC) enable self-sovereign identity, cross-domain interoperability, and privacy-preserving data exchange. However, current VC models face critical limitations, including static attribute binding, inefficient updates, high on-chain verification costs, and privacy leakage. To address these issues, this paper proposes a Dynamic Attribute-oriented Verifiable Credential (DAVC) model, designed to support flexible attribute lifecycle management. The model adopts a three-layer architecture that combines minimal on-chain anchoring, off-chain attribute decoupling, and hierarchical recursive verification to enable efficient and scalable identity verification. First, the onchain layer introduces Sparse Merkle Tree (SMT) root hashes to reduce the need for recording off-chain attribute statuses. Second, the off-chain layer achieves semantic isolation between attributes and identities through an Anonymous Attribute Identifier (AID) mechanism, while improving update efficiency via path caching and incremental strategies. Finally, a Hierarchical Recursive Zero-Knowledge Proof (HR-ZKP) mechanism, based on the Halo2 framework, achieves logarithmic complexity in multiattribute proof generation, supporting attribute-level minimal disclosure and structural anonymization. Experimental results demonstrate that DAVC maintains constant on-chain storage, significantly reduces gas consumption, keeps proof sizes within reasonable limits (e.g., 2.9KB for 10 attributes), and achieves proof generation delays within hundreds of milliseconds. Overall system performance exhibits logarithmic growth as the number of attributes increases. The DAVC model achieves a balance between strong privacy protection, high composability, and dynamic identity expression through minimal on-chain data usage and closed verification paths. This provides a valuable reference for composable identity authentication in Web3 scenarios.
S. Vishnu Murthy, Panduranga Vital Terlapu, Rakesh Salakapuri, R. S. S. Devi Ganesh · 6 authors
Web3 technology is changing social media. It helps solve problems like data ownership and censorship. This research paper presents a new decentralized social media system. It uses blockchain to focus on user privacy and trust. The study describes a Web3 platform. It uses Next.js for the front end. Solidity is used for smart contracts. Hardhat is for local deployment. IPFS provides decentralized storage. Web3.js helps with blockchain interactions. The platform allows user registration, post creation, liking, commenting, and sharing. It keeps user data secure with blockchain's immutability and encryption. The authors look at ways to make money and manage the ecosystem and also focus on making the platform easy to use. Our research shows that the platform gives users more control, keeps their information private, and prevents censorship. These features solve some problems with centralized systems. However, the authors also discuss challenges like scalability and getting users to adopt the platform and suggest future research to address these issues. This work highlights how Web3 can change social media by fostering a secure, transparent, and user-centric digital community.
In the contemporary online interaction, digital iden- tity is central, but most systems follow a centralized provider like Google or Facebook. Although convenient, these models pose ma- jor risks to data breach, surveillance, and single point of failure. The proposed paper proposes a privacy-sensitive decentralized identity verification system that uses Zero-Knowledge Proofs (ZKPs) to allow users to make it through claims (e.g., age, citizen- ship, or enrollment) without any personal data being provided, thereby solving the challenges outlined in the paper. Our architecture integrates verifiable credentials, zero-knowledge-SNARKs and an issuer trust registry that is maintained on blockchain smart contracts to guarantee trustless verification and eliminate dependence on centralized authorities. Its system gives its users full control over credentials, allows reuse across applications, and does not expose data.A proof-of-concept implementation has shown the approach to be feasible with Circom and SnarkJS to generate proof, Solidity smart contracts to verify them, and a user interface implemented in React. Results of the evaluations showed that determination of the verification latency is low, the overhead to generate proofs is moderate, and no privacy leakage occurs. It can be used in potential applications such as education, e-governance, healthcare, finance, and online voting.
Decentralized applications (dApps) in Decentralized Finance (DeFi) face a fundamental tension between regulatory compliance requirements like Know Your Customer (KYC) and maintaining decentralization and privacy. Existing permissioned DeFi solutions often fail to adequately protect private attributes of dApp users and introduce implicit trust assumptions, undermining the blockchain's decentralization. Addressing these limitations, this paper presents a novel synthesis of Self-Sovereign Identity (SSI), Zero-Knowledge Proofs (ZKPs), and Attribute-Based Access Control to enable privacy-preserving on-chain permissioning based on decentralized policy decisions. We provide a comprehensive framework for permissioned dApps that aligns decentralized trust, privacy, and transparency, harmonizing blockchain principles with regulatory compliance. Our framework supports multiple proof types (equality, range, membership, and time-dependent) with efficient proof generation through a commit-and-prove scheme that moves credential authenticity verification outside the ZKP circuit. Experimental evaluation of our KYC-compliant DeFi implementation shows considerable performance improvement for different proof types compared to baseline approaches. We advance the state-of-the-art through a holistic approach, flexible proof mechanisms addressing diverse real-world requirements, and optimized proof generation enabling practical deployment.
This analysis focuses on password-free Electronic IDentity (eID) solutions for eGovernment services under the federated identity management framework Electronic IDentification, Authentication and trust Services (eIDAS). The scope of eID systems is centred on their alignment of the associated technical, legal, and procedural challenges. Through an analysis of five password-free eID solutions—Fast IDentity Online 2 (FIDO2) tokens, Secure Identity Across Borders Linked (STORK), distributed ledgers, mobile authenticators, and eID cards—the study evaluates their compliance with eIDAS standards and identifies key gaps in their design and implementation. While certain solutions, such as FIDO2 tokens and mobile authenticators, demonstrate full compliance, others, including STORK and distributed ledger-based systems, face challenges in achieving interoperability, privacy, and regulatory alignment. This research contributes to the discourse on digital identity management by offering insights into current limitations and recommending pathways for advancing the design, standardization, and deployment of eID systems. These results support the larger objectives of the European digital single market by highlighting the significance of regulations, innovations, and user-oriented design in creating password-free eID systems.
Current systems for exchanging medical records struggle with efficiency and privacy issues. While establishing the Electronic Medical Record Exchange Center (EEC) in 2012 was intended to alleviate these issues, its centralized structure has brought about new attack vectors, such as performance bottlenecks, single points of failure, and an absence of patient consent over their data. Methods: This paper describes a novel EMR Gateway system that uses blockchain technology to exchange electronic medical records electronically, overcome the limitations of current centralized systems for sharing EMR, and leverage decentralization to enhance resilience, data privacy, and patient autonomy. Our proposed system is built on two interconnected blockchains: a Decentralized Identity Blockchain (DID-Chain) based on Ethereum for managing user identities via smart contracts, and an Electronic Medical Record Blockchain (EMR-Chain) implemented on Hyperledger Fabric to handle medical record indexes and fine-grained access control. To address the dual requirements of cross-platform data exchange and patient privacy, the system was developed based on the Fast Healthcare Interoperability Resources (FHIR) standard, incorporating stringent de-identification protocols. Our system is built using the FHIR standard. Think of it as a common language that lets different healthcare systems talk to each other without confusion. Plus, we are very serious about patient privacy and remove all personal details from the data to keep it confidential. When we tested its performance, the system handled things well. It can take in about 40 transactions every second and pull out data faster, at around 49 per second. To give you some perspective, this is far more than what the average hospital in Taiwan dealt with back in 2018. This shows our system is very solid and more than ready to handle even bigger workloads in the future.
The rapid co-evolution of Artificial Intelligence (AI) and blockchain technology has exposed a persistent gap between intelligence-the ability to extract insight from data-and trust-the assurance that data, models, and decisions are transparent, verifiable, and tamper-proof.This study introduces the Unified Trust-Intelligence Framework (UTIF), an end-to-end architecture that natively fuses AI and distributed-ledger technologies to deliver auditable, privacy-preserving, and energy-aware intelligent services.A systematic review compliant with PRISMA guidelines (167 peer--reviewed sources, 2018-2024) reveals four critical deficiencies in the current literature: (i) the lack of formal on-chain model certification, (ii) opaque immutability of operational logs, (iii) limited cross-chain and cross-domain interoperability, and (iv) sub--optimal energy footprints.UTIF addresses these gaps through: On-chain algorithmic certification that fingerprints model weights and training metadata via cryptographic hashing.Federated data governance that combines privacy-preserving federated learning with zero-knowledge proofs (ZK-SNARKs) for regulatory compliance (GDPR, EU AI Act).An AI-assisted hybrid PoS-BFT consensus that dynamically tunes fault-tolerance parameters under varying network conditions.A self-verifiable MLOps pipeline deployed on Hyperledger Fabric with Layer-2 rollups, providing continuous integration, delivery, and audit trails.Experimental validation uses two open-access benchmarks-MIMIC-IV (clinical) and ECB-SDW (financial)-executed on a 20-node heterogeneous testbed.UTIF reduces transaction latency by 38 % and operational energy consumption by 27 % compared with Fabric 2.x and PoA baselines, while enhancing adversarial ro-bustness (F1 + 12 %) through on-chain model attestation.A perception survey of 46 domain experts reports a statistically significant boost in trustability (+1.27 0.31 on a 5-point Likert scale, p < 0.01).Stress tests show 98 % valid throughput under Sybil scenarios with 1,000 malicious nodes, maintaining a carbon footprint below 0.25 kg CO e per 1,000 transactions.The findings demonstrate that deep, native convergence of AI and blockchain can simultaneously achieve measurable trust guarantees, competitive performance, and sustainability.The article concludes with regulatory implications, identified limitations (network scale, oracle dependencies), and a research roadmap toward edge-to--cloud, 6G-ready, Web3-compliant intelligent infrastructures.
Healthcare data management in cloud environments faces critical challenges in balancing security, privacy, operational efficiency, and regulatory compliance, as traditional access control mechanisms are inadequate for addressing the complex, multi-tenant, and dynamic nature of modern cloud infrastructures handling sensitive Electronic Health Records (EHRs). This paper introduces a novel hybrid framework that integrates Attribute-Based Access Control (ABAC) with Ethereum blockchain technology to establish a comprehensive multi-layered security architecture for cloud-based healthcare systems, combining advanced cryptographic techniques including double encryption using AES and RSA algorithms, Shamir's Secret Sharing for key management, smart contracts for automated policy enforcement, and multi-party computation protocols to ensure privacy preservation without compromising system performance. Extensive experimental evaluation conducted using 4,412 anonymized clinical records with 12 distinct attributes demonstrates exceptional efficiency with average record insertion time of 1.90 ms, retrieval time of 0.14 ms, blockchain mining time of 0.01 seconds, and hybrid architecture throughput of 562.94 records/second with 1.78 ms latency, significantly outperforming traditional centralized systems (337.17 rec/s, 2.97 ms) and pure blockchain implementations (3.37 rec/s, 296.98 ms). Security assessments reveal 100% operational reliability, 97.3% policy violation detection accuracy, 89% reduction in unauthorized access attempts, and comprehensive regulatory compliance with HIPAA (97%), GDPR (92%), ISO 27001 (94%), and SOC 2 (89%) standards, while maintaining optimized system resource utilization with CPU usage at 35.6%, memory at 48.0%, and network I/O at 34.1%. The framework addresses key limitations of existing approaches by providing seamless integration across multiple cloud layers, eliminating single points of failure, ensuring data immutability through distributed consensus mechanisms, maintaining comprehensive audit trails, and offering practical implications for healthcare organizations seeking secure, scalable, and compliant data sharing mechanisms in cloud-native environments, thereby contributing to the advancement of secure healthcare informatics by bridging the gap between theoretical access control models and practical implementation requirements in distributed cloud infrastructures.
Network Systems, AT&T, United States, Amar Gurajapu, Vardhan Garimella, United States Intellibus
ABSTRACT: Distributed cloud services across multiple providers demand consistent identity verification and policy enforcement. Centralized IAM and policy managers introduce single points of failure, limited auditability, and latency. We propose BC-IdPol, a blockchain-based framework that stores identities and governance policies on a permissioned ledger. Smart contracts enforce registration, authentication, and policy retrieval. Off-chain cloud agents query the chain for runtime decisions. In experiments over a three-cloud prototype (Azure, AWS, GCP) on Hyperledger Fabric, BC- IdPol achieved: 99.9 % tamper-resistance (vs. 0 % baseline) 45 ms median identity lookup latency (vs. 18 ms centralized API) 60 ms median policy fetch time (vs. 20 ms baseline) 1,800 req/sec enforcement throughput (vs. 2,200 req/sec) We detail architecture, smart-contract design, mermaid diagrams, evaluation results, limitations, and future work.
Ensuring the integrity of business processes without disclosing confidential business information is a major challenge in inter-organizational processes. This paper introduces a zero-knowledge proof (ZKP)-based approach for the verifiable execution of business processes while preserving confidentiality. We integrate ZK virtual machines (zkVMs) into business process management engines through a comprehensive system architecture and a prototypical implementation. Our approach supports chained verifiable computations through proof compositions. On the example of product carbon footprinting, we model sequential footprinting activities and demonstrate how organizations can prove and verify the integrity of verifiable processes without exposing sensitive information. We assess different ZKP proving variants within process models for their efficiency in proving and verifying, and discuss the practical integration of ZKPs throughout the Business Process Management (BPM) lifecycle. Our experiment-driven evaluation demonstrates the automation of process verification under given confidentiality constraints.
Rui Han, Bin Yuan, Weizhong Qiang, Deqing Zou · 5 authors
The widespread use of IoT devices in the accommodation and hospitality sectors has created demand for temporary device-permission sharing and transfer. Prior work has largely focused on security issues in device permission sharing, with far less attention devoted to device permission transfer. However, inappropriate access control management during device permission transfer can also lead to violations of the users' expectations of control over their devices. For example, a malicious host retaining or regaining access to a camera after its permission has been transferred to a tenant. In this paper, we present the first systematic study on understanding and enhancing the security of device permission transfer in IoT leasing. To this end, we propose Forseti, a new authorization framework that leverages zero-knowledge proof and a decentralized ledger to ensure that the rights of both hosts and tenants are not violated. Our evaluation demonstrates that Forseti is effective, efficient, scalable, and compatible with existing IoT platforms.
Cloud computing facilitates scalable data sharing across multiple organizations and users, but also raises concerns about data privacy. Matchmaking encryption (ME) is a prominent technique that enforces bilateral access control in cloud services such as cloud marketplace, allowing both senders and receivers to specify policies for the encrypted data to be revealed. However, receivers may be at risk of being exposed to malicious or harmful content, thus undermining their trust in cloud service platforms. To this end, we introduce MBAC, a content-moderated bilateral access control framework for privacy-preserving cloud data sharing services, which allows receivers to acquire data from authentic senders while preserving their anonymity, and report malicious content in a verifiable manner, i.e., empowering the service provider to hold senders accountable. MBAC is built upon a novel primitive called franking broadcast ME (FBME), which generates a franking signature for the data by designating the service provider as the moderator to ensure accountability and deniability, and encrypts both the data and its franking signature while embedding the sender secret key for privacy and authenticity. We then present a concrete construction of FBME from key-private public key encryption, strongly unforgeable one time signature and non-interactive zero-knowledge proof. Formal security analysis and extensive experiments demonstrate that MBAC provides efficient bilateral access control and content moderation for cloud data sharing services.
Zero Trust is now the de facto standard to secure cloud-native, distributed, and AI-driven enterprise infrastructures. It's not only crucial to address human identities but also to secure non-human entities such as APIs, software agents, RPA bots, and smart city workloads. As hybrid infrastructures become the new normal and agentic AI systems (e.g., self-driving cars) grow more autonomous, identity remains the most stable and trustworthy security control plane. This document proposes an intent-aware Zero Trust Identity Architecture designed to consolidate governance, authentication, and access control for human and non-human entities. The architecture consists of decentralized identity provisioning, policy-as-code enforcement, real-time telemetry ingestion, trust scoring, and AI-powered intent detection to provide inputs for continuous verification and least privilege enforcement. Compliant with standards such as NIST SP 800-207, NIST SP 800-63, CISA Zero Trust Maturity Model, and DoD's Zero Trust Strategy, the architecture also aligns with industry developments from Microsoft Entra ID, AWS IAM Identity Center, Google BeyondCorp, SPIFFE/SPIRE, and W3C DIDs. The whitepaper explores use cases in healthcare, finance, retail, and industrial IoT spaces that are struggling with unique challenges like OT/IT convergence, multi-user devices, and governance of sensitive data access. High-profile attacks such as SolarWinds, MOVEit, and Log4Shell are broken down to highlight weaknesses in legacy IAM architectures and underscore the need for intent-based security. By intersecting behavior, purpose, and identity, this architecture remakes trust in hybrid, edge, and cloud-native settings with a conclusion of actionable paths of mitigation and a vision for intent-based Zero Trust governance
This paper presents a novel Zero-Knowledge Machine Learning (zkML)-assisted framework for secure identity enrollment in Zero Trust Network (ZTN) architectures. The proposed system addresses the limitations of static credential-based authentication by integrating zkML-driven behavioral validation with permissioned blockchain-based token issuance. A Non-Fungible Token (NFT) is used to encapsulate a one-time enrollment token (OTT) encrypted with the public key of the requesting user. The zkML layer verifies behavioral features prior to token issuance, ensuring that only users with legitimate interaction patterns receive access credentials. A permissioned Ethereum blockchain handles NFT creation and ownership management, while the enrollment process is executed through OpenZiti APIs for secure overlay network participation. Experimental evaluation shows that the zkML-validated system achieves a 96.3% fake user block rate and $98.7 \%$ NFT precision, outperforming traditional methods by significantly reducing unauthorized access. Although the zkML approach introduces a modest increase in processing time, the enhanced accuracy and security justify the trade-off. This work demonstrates the potential of combining AI-driven inference and verifiable blockchain mechanisms to achieve scalable, privacypreserving, and behavior-aware enrollment in decentralized network environments.
Escrow trust is a foundational requirement for high-value campaign execution in Web3 marketing marketplaces. When campaign budgets exceed USD 50,000 and settlement is enforced on-chain, the security properties of the escrow contract and its surrounding settlement architecture determine whether the platform can be trusted by enterprise brands. Naive escrow designs — single-key deployment, monolithic contract logic, and implicit state transitions — expose platforms to fund loss through key compromise, smart contract exploit, and fraudulent dispute resolution. This paper presents SESA (Secure Escrow and Settlement Architecture), a formal engineering framework for Web3 campaign escrow that integrates multi-signature approval policies, strict role segregation between campaign management and fund release authority, control-plane and data-plane separation with hardware-backed signing, and explicit finite-state machine governance of all escrow lifecycle transitions including dispute resolution. SESA is grounded in a formal threat model that enumerates eleven attack vectors specific to Web3 escrow systems and maps each to a corresponding architectural control. A formal verification of the escrow state machine using the TLA+ specification language demonstrates the absence of deadlock, fund loss, and unauthorised release under all reachable states. A gas cost analysis of the reference Solidity implementation demonstrates that SESA's security controls add a mean overhead of 23% in gas cost relative to a naive single-key escrow — a trade-off that enterprise buyers consistently accept in exchange for verifiable security assurances. SESA enables campaign budgets that would be commercially unviable under insecure escrow designs to flow safely through the platform, directly expanding the addressable market for high-value brand partnerships.
Pablo Sotres, Alberto Carelli, M Festa, Maxime Costalonga · 9 authors
The secure and trustworthy exchange of interoperable data assets is a key enabler for the development of IoT-based data spaces. This paper presents a decentralised framework for offering management and asset sharing within trusted and interoperable data spaces, leveraging Distributed Ledger Technologies (DLTs) and the Self-Sovereign Identity (SSI) paradigm to ensure transparency, integrity, and participant self-sovereignty. The proposed architecture integrates identity management and tamper-resistant smart contracts leveraging the IOTA Tangle to support decentralised offering discovery, access control and verifiable transactions. By addressing critical challenges related to trust, interoperability, and decentralisation, the framework contributes to the technological foundations required for scalable, secure, and resilient data ecosystems.
Web3 applications require execution platforms that maintain confidentiality and integrity without relying on centralized trust authorities. While Trusted Execution Environments (TEEs) offer promising capabilities for confidential computing, current implementations face significant limitations when applied to Web3 contexts, particularly in security reliability, censorship resistance, and vendor independence. This paper presents dstack, a comprehensive framework that transforms raw TEE technology into a true Zero Trust platform. We introduce three key innovations: (1) Portable Confidential Containers that enable seamless workload migration across heterogeneous TEE environments while maintaining security guarantees, (2) Decentralized Code Management that leverages smart contracts for transparent governance of TEE applications, and (3) Verifiable Domain Management that ensures secure and verifiable application identity without centralized authorities. These innovations are implemented through three core components: dstack-OS, dstack-KMS, and dstack-Gateway. Together, they demonstrate how to achieve both the performance advantages of VM-level TEE solutions and the trustless guarantees required by Web3 applications. Our evaluation shows that dstack provides comprehensive security guarantees while maintaining practical usability for real-world applications.
Sep 4, 2025·2025 IEEE 13th International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS)
Privacy-preserving reputation systems are critical for decentralized Web3 environments, where trust must be managed without centralized authorities. This paper presents a blockchain-based protocol leveraging Subjective Logic (SL) and Hybrid Homomorphic Encryption (HHE) to securely aggregate reputation scores while preserving user privacy. Subjective Logic enables modeling trust with quantified u ncertainty, a llowing for m ore fl exible tr ust enforcement across decentralized identity systems, marketplaces, and DAOs. To enhance performance and confidentiality, we integrate the PASTA symmetric cipher for efficient encryption of auxiliary data. Our protocol enables encrypted reputation aggregation, smart contract-based trust enforcement, and selective disclosure via zero-knowledge proofs. The proposed design balances efficiency, scalability, and privacy, making it well-suited for dynamic Web3 ecosystems requiring decentralized, privacy-preserving trust mechanisms.