Pham Van Huong, Nguyen Ngoc Tuyen, D. H. Long, Trần Quốc Toanh · 5 authors
The paper proposes a comprehensive data security model for blockchain-based web applications. This model can be used as a general template for Web3 applications. The model consists of two parts: a blockchain core with integrated database encryption modules, replacing Fabric CA; and an application part that also integrates file encryption, database encryption, and digital signatures. The proposed model was tested on a VBCC management website using Hyperledger Fabric. File and database encryption uses AES, and digital signatures use ECDSA. To improve performance, we also replaced the GolevelDB database management system with LevelDB. Experimental results confirm the accuracy and good performance.
P. Anupama, Akhilandeshwari, Shama Priyanka, Putta Srihari · 5 authors
The increasing digitization of administrative and personal records has created a strong demand for systems that guarantee secure storage, data integrity, and reliable verification of sensitive documents. Conventional document management solutions typically depend on centralized servers, where files are vulnerable to unauthorized modification, loss, or deletion without clear traceability. This centralized model reduces trust, increases exposure to cyber threats, and often requires time-consuming manual verification to confirm document ownership and authenticity. Consequently, individuals and organizations encounter challenges such as document forgery, inconsistent records, unauthorized access, and delays in retrieval, emphasizing the necessity for a more secure and tamper-resistant solution. In traditional vault systems, documents are usually stored as basic files with minimal metadata, lacking cryptographic protection and comprehensive audit mechanisms. Due to the absence of immutability, detecting alterations in stored documents becomes difficult. Additionally, reliance on manual validation processes introduces inefficiencies and a higher likelihood of errors. These drawbacks make centralized systems unsuitable for handling critical records such as legal documents, identity credentials, certificates, and criminal records, which require strict integrity and security measures. To overcome these limitations, the proposed solution combines blockchain technology with a Django-based web platform to establish a decentralized and tamper-proof digital vault. Key document metadata, including ownership information, descriptions, timestamps, and file references, is recorded on the blockchain using smart contracts, ensuring permanent and unalterable entries. The actual files are securely stored on the server, while Web3 enables seamless communication between the application and the blockchain network. Functionalities such as document upload, search, verification, and secure access support complete transparency and data integrity. This framework significantly strengthens trust by preventing unauthorized modifications and maintaining a permanent, verifiable history of all stored documents. By integrating blockchain immutability with an intuitive web interface, the system delivers a secure, scalable, and future-oriented solution suitable for government agencies, legal bodies, and organizations managing sensitive records.
This paper presents a comprehensive analysis of the World Wide Web Consortium (W3C) decentralized identity standards and their relationship to the MF+SO sovereign identity vault architecture. We examine the W3C Decentralized Identifier (DID) Core specification (W3C, 2022), the Verifiable Credential (VC) Data Model (W3C, 2022), and related standards including DID Resolution, DID URL dereferencing, and the Verifiable Credential Proof Formats. The paper provides a taxonomic analysis of DID methods (did:key, did:ethr, did:ion, did:web, did:indy) in terms of their trust assumptions, ledger requirements, latency, cost, and privacy properties. We compare MF+SO's identity model—which uses Ed25519 public keys as self-certifying identifiers with a local hash chain for state verification—against the W3C DID Core model, identifying both alignments and divergences. Key findings include: MF+SO identifiers are functionally equivalent to DIDs but use a simplified resolution mechanism that does not require a distributed ledger or external registry; MF+SO's hash chain audit trail provides state verification properties comparable to DID Document versioning on a ledger; and MF+SO's selective disclosure mechanisms using zero-knowledge proofs (see Paper VII) directly implement the W3C Verifiable Credential selective disclosure and data minimization requirements. We analyze the interoperability implications of MF+SO's architecture, demonstrating how MF+SO DIDs can be registered on external DID methods for cross-system interoperability while maintaining the local hash chain as the authoritative state source. The paper also examines the Verifiable Credential lifecycle within MF+SO: issuance, storage, presentation, and revocation, with attention to the credential schema registry, proof format compatibility (Data Integrity Proofs, JSON Web Signatures), and the holder-binding mechanisms that prevent credential sharing. A comparative assessment evaluates MF+SO against three alternative decentra... Part of The Anticloud research corpus by Lois-Kleinner Alpasan (ORCID: 0009-0009-2233-6107). This work explores cryptography, key management in the context of sovereign AI infrastructure, post-cloud computing architectures, and transparent, blackbox-free systems.
Organizations operating multiple AI systems generate independent cryptographic ledgers that may need mutual verification, cross-referencing, or consolidated audit for enterprise-wide compliance reporting. Cross-chain notarization provides cryptographic evidence that a ledger's state is acknowledged by another independent ledger, enabling distributed audit verification without central coordination. This paper presents the design and analysis of the AIOSS cross-chain notarization protocol, which anchors the hash chain head of one ledger into another by inserting a notarization entry containing the cross-chain proof. We define three notarization modes: unilateral (ledger A notarizes ledger B's state), bilateral (mutual notarization between A and B), and supervised (third-party notarizer with independent proof). The notarization proof comprises a Merkle inclusion proof of the source ledger's state proof within a notarization ledger entry, enabling verification by any party holding both ledger files. We analyze the security of cross-chain anchoring under the common prefix assumption, proving that notarization preserves the integrity of both ledgers. Performance benchmarks demonstrate that notarization completes in under 200 milliseconds for ledgers of up to 1 million entries. We further evaluate the notarization merge operation, which produces a unified ledger from multiple notarized ledgers with cross-reference integrity. The protocol supports regulatory requirements for multi-system audit consolidation under SOC2 reporting and GDPR Article 30 record-of-processing activities. --- Part of The Anticloud research corpus by Lois-Kleinner Alpasan (ORCID: 0009-0009-2233-6107). This work explores hash chain, cryptography in the context of sovereign AI infrastructure, post-cloud computing architectures, and transparent, blackbox-free systems.
This paper examines the cryptographic foundations of audit ledgers, with particular focus on hash chains, transparency logs, and verifiable data structures as implemented in the 01s Sovereign (Kaiman) operating system's .aioss ledger format. We survey the evolution from simple hash-linked data structures to sophisticated transparency frameworks such as Certificate Transparency (CT), CONIKS, and Trillian, and demonstrate how these technologies converge in the 01s Sovereign OS to create an immutable, verifiable record of all system and AI-assisted decisions. Part of The Anticloud research corpus by Lois-Kleinner Alpasan (ORCID: 0009-0009-2233-6107). This work explores api gateway, ai routing in the context of sovereign AI infrastructure, post-cloud computing architectures, and transparent, blackbox-free systems.
This paper presents a comprehensive analysis of zero-knowledge proof (ZKP) systems and their application to privacy-preserving identity management within the MF+SO sovereign identity vault. Zero-knowledge proofs, introduced by Goldwasser, Micali, and Rackoff (1985), enable a prover to convince a verifier of the truth of a statement without revealing any information beyond the statement's validity. We examine three families of ZKP systems in the context of MF+SO's identity assertions: zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge), zk-STARKs (Zero-Knowledge Scalable Transparent Arguments of Knowledge), and Bulletproofs. For each family, we analyze the setup assumptions (trusted setup vs. transparent), proof size, verification complexity, prover computation, and post-quantum security. The paper identifies three canonical use cases within MF+SO: (1) age verification without date of birth disclosure, where the user proves that their age exceeds a threshold without revealing their exact birth date; (2) credential possession proof, where the user proves they hold a valid credential for a resource without revealing which credential among a set they hold; and (3) membership in an allowlist without position disclosure, where the user proves their identifier appears in a list without revealing their position in the list. We present benchmark data for each use case using the Groth16 zk-SNARK (prover time: 1.2 seconds, proof size: 192 bytes, verification: 2.3 ms) and the STARK-based approach using the Winterfell library (prover time: 4.8 seconds, proof size: 48 KB, verification: 8.1 ms). The implementation complexity analysis demonstrates that zk-SNARKs require trusted setup ceremonies but provide the most compact proofs, while zk-STARKs eliminate the trusted setup requirement at the cost of larger proofs. The paper concludes with an analysis of the protocol integration requirements, including circuit compilation for the MF+SO identity predicate lang... Part of The Anticloud research corpus by Lois-Kleinner Alpasan (ORCID: 0009-0009-2233-6107). This work explores cryptography, key management in the context of sovereign AI infrastructure, post-cloud computing architectures, and transparent, blackbox-free systems.
Cloud providers need to report to their customers what carbon emissions have arisen from their use of computing resources, so that customers can include them in their own mandated emissions reporting. At present, these reports are neither verifiable nor audited. We show how a data centre operator can produce cryptographic zero-knowledge proofs to each customer that the emissions reported to that customer are accurate, without the customer being able to learn sensitive information about the data centre operator or other customers. Our approach is scalable, costing a data centre operator with one million customers an estimated $150 USD per month plus $0.01 USD for each customer who requests a verifiable emissions report. For customers, a proof is 37 KiB in size, and verifying it takes less than a second. By making emissions reports more trustworthy, we hope to give companies and policymakers the data they need to push towards decarbonisation.
Dr. B. Indira Reddy, Naga Siva Jyothi Kompalli, Dr. Rohita yamaganti, CH Sai Saketh · 6 authors
The ongoing digital evolution in the healthcare sector has increased the demand for reliable and secure systems to manage medical records. Conventional centralized storage methods are vulnerable to security threats such as data breaches, unauthorized usage, and potential data alteration, which can compromise patient confidentiality and data integrity. To overcome these challenges, this work presents a blockchain-enabled medical record management system designed to provide secure and tamper-resistant data storage. The proposed system is implemented as a decentralized web application, utilizing React.js for the user interface and Web3.js or Ethers.js to enable interaction with the blockchain network. Smart contracts written in Solidity are deployed on the Ethereum platform to handle record management and enforce strict access permissions. User authentication is facilitated through MetaMask, ensuring a secure and decentralized method of identity verification. Healthcare information, including patient records, diagnoses, prescriptions, and treatment details, is maintained on the blockchain to guarantee transparency and immutability. The system empowers patients by allowing them to control access to their data, including granting and revoking permissions for healthcare providers. Tools such as Truffle and Ganache are used during development for efficient testing and deployment. In summary, the proposed solution improves data security, privacy, and accessibility, offering a dependable and scalable approach for managing healthcare records in modern digital environments.
The paper presents the results of the authors' research for 14 months within a project funded by the Romanian Academy of Scientists. The design, implementation and testing of a decentralized web3 platform, based on Blockchain technologies – including smart contracts and Quantum, useful for education and diplomacy, is presented. The platform can also be used for knowledge management - for explicit knowledge flows. Our architecture allows quantum-enhanced authentication – offering an experimental, but future-oriented alternative to completely classical systems. It consists of a modular, layered structure, which includes the components: frontend, backend, quantum service integration, decentralized storage (IPFS) and blockchain registry. The platform is implemented and tested using several work scenarios. The paper demonstrates the efficacy of a decentralized academic infrastructure capable of harmonizing hybrid security paradigms with distributed storage technologies. Theoretically and technically, the major contribution of this work lies in the transition from a theoretical model to a fully operational system validated through an end-to-end workflow.
<title>Abstract</title> This study presents a comparative analysis of cloud-native and Distributed Ledger Technology (DLT)-based synchronization models for resilient geospatial data management in multi-cloud environments. With the rising demand for real-time geospatial data in applications such as smart cities, disaster response, and environmental monitoring, ensuring data consistency, availability, and integrity across distributed cloud infrastructures has become increasingly critical. Cloud-native models offer high throughput and scalability through managed replication and consistency protocols but may be limited by eventual consistency and reliance on provider-managed security. In contrast, DLT-based models, particularly those using blockchain, enhance data integrity and auditability through decentralized, tamper-proof synchronization, albeit at the cost of increased latency and operational complexity. To evaluate these trade-offs, we propose a composite performance framework encompassing resilience, synchronization efficiency, and operational cost. Using simulation-based analysis, we assess both models under various failure scenarios and performance conditions. Results highlight the strengths and limitations of each approach and underscore the value of a hybrid model—combining the speed of cloud-native systems with the trust guarantees of DLT—for mission-critical geospatial applications. This research offers practical recommendations for system designers and contributes to the evolving integration of blockchain, cloud, and AI technologies in secure, multi-cloud geospatial infrastructures.
The traditional ways of handling academic credentials are considered inefficient, expensive, and very vulnerable to fraud and data alteration as they rely on single-point databases. To counter these drawbacks, the authors of this paper propose a novel conception relying on blockchain technology with its central traits such as decentralization, immutable state, and cryptographic security. Under such framework, all the academic credentials are stored in a distributed ledger as non-variable and visible entries, where each credential is securely encrypted, stamped with the time of its creation, and linked in an irreversible chain, thus practically eliminating the possibility of their falsification or unauthorized change without the agreement of the entire network. The verification process is decentralized so that employers, educational institutions, and students can instantly and directly authenticate the credentials through the blockchain thereby cutting the intermediaries and considerably shortening the administrative delays and reducing overheads. Moreover, smart contracts contribute to further efficiency by automatically taking care of the issuance, management, and verification of credentials according to the pre-defined rules, thus ensuring consistency and accuracy. However, the system still offers the highest user control and privacy through the provision of tools like digital wallets and decentralized identifiers for the students to own and manage their digital credentials. These tools also give the students power to decide who can access their records and under what conditions. To ensure the integrity and confidentiality of the data, advanced security technologies such as cryptographic hashing and zero-knowledge proofs are deployed while still allowing transparency to the process of verification.
D. Suganya, R Vinaya Kumar, Arulselvy R, Ilakiya J
Digital evidence now plays a major role in criminal investigations, but managing that evidence securely is still a challenge. In many existing systems, records are stored in centralized environments where tracking every action is difficult and unauthorized changes can be hard to detect. When that happens, the reliability of evidence can be questioned during legal proceedings. In this work, we propose a digital forensic evidence management framework that uses decentralized technologies to make evidence handling more dependable. Instead of storing files in a single location, the evidence is encrypted and stored through IPFS, which helps reduce the risk of data loss and unauthorized modification. Every important action performed on the evidence is also recorded on a blockchain using the Proof of Staked Authority consensus method so that investigators can verify the complete history whenever required. To strengthen security further, the XChaCha20 algorithm is used before storage. The system also applies a VGG19based verification method to study printer-related patterns and confirm whether a document is genuine. By bringing together distributed storage, blockchain tracking, encryption, and document verification, the proposed approach offers a practical way to improve the security and trustworthiness of digital forensic evidence.
Background and Gap Information: Positive, negative and hybrid external confirmation processes are the pillars of audit evidence as posed in the standard ISA 505, however the response rate is very low 48-72%, fraud is not detected 12-38% and there is an unresolvable conflict between assurance and data privacy. This “auditor’s dilemma” intensifies with cross-border transactions and tight data privacy regulations such as Iraq’s Personal Data Protection Law No. 10 of 2024. Although there are recent proposals based on blockchain or homomorphic encryption, none of them has presented a mathematically zero-knowledge, empirically verified, and regulatorily compliant confirmation protocol that seamlessly performs over heterogeneous ERP systems without leaking its underlying commercial data. Objective: We present the Decentralized Confirmation Matrix (DCM) - a game-changing evidence of audit protocol based on zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) to cryptographically prove a set of external transactions, while leaking only the fact that they are consistent (“valid/invalid”) together with a timestamp. The paper (1) details the DCM design, including its novel dual-nullifier and heterogeneous trust models; (2) presents an empirical comparison of DCM with traditional techniques based on authentic Iraqi state-owned enterprise (SOE) data; (3) scrutinizes DCM against Iraqi higher educational certification standards and Scopus Q1 repeatability requirements; and (4) delivers an open-source route-to-implementation (ZKCaaS). Methodology: We developed a complete DCM prototype using Circom 2.1.6 and SnarkJS over a permissioned blockchain sandbox (Iraqi National Blockchain Sandbox). 4We acquired genuine transaction logs (n=25,000+ confirmations) from three Iraqi SOEs: Northern Refineries Company (Baghdad), Basra Oil Terminal (Basra), and Iraqi Telecommunications Company (Erbil).A controlled field experiment with 45 Iraqi auditors (repeated measures, counterbalanced) was conducted to evaluate DCM vis-a-vis traditional positive and email-hybrid confirmations on response time, error rates, cost, auditor satisfaction (UTAUT2), and attack resilience. Results: DCM reduced average confirmation response time by 99.6% (to 0.05 days), attained a 100% response rate by automation, elevated fraud detection from traditional 62% to 97%, and brought in cost per confirmation (from 6% to 0.45%). Auditor satisfaction rated 4.6/5, and the dual‑nullifier scheme prevented 100% of replay and collusion attacks - a guarantee not found in any prior work. Audit risk (ISA 315) decreased by 93% (from 6% to 0.45%).Cross‑platform rollup between SAP and Oracle succeeded at 98%, solving a long‑standing interoperability ga. Conclusion: DCM is the first practical, privacy-preserving, and empirically superior external consistency checking protocol that satisfies ISA 500/505 while enabling “cryptographically sealed evidence” as a novel evidence type. The article is in line with the quality requirements of the Iraqi accreditation agency as well as Scopus Q1, which consider theoretical novelty, empirical rigour and open‑source replicability. We propose a strategic vision for 2025-2030 and an Autonomous Audit Agent (AAA) for full automation.
George Sebastian, Neethu Tom, Saritha M S, Vimal Babu P
Existing cloud storage auditing mechanisms rely on third-party auditors (TPAs) or centralized verification, introducing single points of failure and trust assumptions. While blockchain-based approaches have been proposed, they suffer from high on-chain storage overhead, linear verification complexity, and lack of dynamic auditor reputation. This paper introduces ZK-PoR-DR — a novel Zero-Knowledge Proof of Retrievability integrated with a Dynamic Reputation Consensus mechanism. Unlike prior work, ZK-PoR-DR enables: (1) constant-size proofs regardless of file size, (2) off-chain proof generation with on-chain verification using zk-SNARKs, (3) a reputation-based auditor selection protocol that penalizes malicious or lazy auditors via slashing and reward distribution, and (4) post-quantum security via lattice-based commitments. We provide a full algorithm, system architecture, security proofs against adaptive adversaries, and experimental evaluation showing 90% reduction in on-chain gas costs and 3.2x faster verification compared to baseline schemes (Proofs of Replication, Filecoin). No prior work has combined these four properties simultaneously. The protocol is ready for deployment but has not yet been adopted by any major cloud or blockchain platform.
The rapid digitalization of global infrastructure has amplified the vulnerabilities inherent in centralized cloud storage systems, where single points of failure, administrative access abuses, and external cyberattacks routinely compromise sensitive data.Traditional cloud architectures rely on centralized trust models that frequently succumb to data breaches and censorship.To address these critical flaws, this paper proposes De-Drive, a zeroknowledge, hybrid decentralized storage application (DApp) that seamlessly integrates Web3 architecture with robust cryptographic protocols.De-Drive leverages a hybrid storage model: heavy file payloads are stored off-chain on the decentralized InterPlanetary File System (IPFS) via Pinata nodes, while the immutable reference links-Content Identifiers (CIDs)-are permanently logged on the Ethereum blockchain (Sepolia Testnet) utilizing a custom, highly gas-optimized Solidity smart contract.To solve the inherent privacy flaws of public IPFS networks, De-Drive implements strict client-side Advanced Encryption Standard (AES) cryptography.Files are converted to Base64 strings and encrypted locally within the React frontend utilizing a user-defined symmetric key prior to network transmission.This architecture ensures absolute zero-knowledge storage; neither the IPFS nodes hosting the data nor the blockchain observers auditing the ledger can decipher the underlying content without the specific decryption key.The proposed architecture successfully resolves the blockchain storage trilemma by delivering a decentralized, immutable, and strictly private data vault, demonstrating significant improvements in cost-efficiency and security over both traditional cloud services and purely on-chain storage alternatives.
Cross-domain data sharing in decentralised environments faces persistent challenges related to confidentiality, auditability, and trust decentralisation, particularly when data transmission relies on centralised intermediaries or single proxy entities. To address these issues, this paper proposes a blockchain-enabled auditable data sharing scheme that integrates threshold secret sharing with non-interactive zero-knowledge proofs. In the proposed framework, the encrypted file fragments and secret key shares are decentralised across multiple blockchain nodes using threshold cryptography, preventing any single entity from reconstructing the encryption key or unilaterally performing ciphertext transformations. Zero-knowledge proofs are employed to publicly verify the correctness of the transmission and sharing operations without disclosing plaintexts, secret keys, or sensitive metadata, while the blockchain records verifiable proofs to support tamper-evident auditing. Security analysis shows that the scheme achieves confidentiality, collusion resistance, and verifiable correctness under standard cryptographic assumptions.Experimental evaluations indicate that the proposed scheme incurs acceptable computational and on-chain overhead, suggesting its feasibility in decentralised and cross-domain data sharing scenarios.
Umar . Abubakar, Hamza Itopa Sanni, Abdulsalam Aliyu
Conventional attendance management approaches in academic and organisational settings face persistent challenges that include susceptibility to proxy attendance, inadequate protection of biometric credentials, and the absence of privacy-preserving verification mechanisms in cloud-hosted deployments. This paper presents SecureAttend, a cloud-based attendance management framework that addresses these deficiencies through the integration of Zero-Knowledge Proof (ZKP) cryptographic authentication with biometric capture via a ZKTeco K40 Pro fingerprint terminal. The proposed framework employs a challenge-response ZKP protocol that enables users to demonstrate possession of valid authentication credentials without disclosing underlying private keys or biometric templates to the server. Attendance records are encrypted using AES-256 prior to storage in a MongoDB cloud database, while SHA-256 hashing provides tamper-evidence for each record. Session integrity is maintained through JWT-based token management, and access boundaries are enforced via a Role-Based Access Control (RBAC) policy. Functional evaluation across eighteen test scenarios confirmed complete compliance with stated requirements. Security assessment validated correct operation of cryptographic mechanisms, access controls, and audit logging subsystems. Performance benchmarks recorded average API response latencies of approximately 85 milliseconds for authentication requests and 120 milliseconds for attendance marking operations. The results demonstrate that ZKP authentication can be deployed effectively in real-world attendance management contexts, offering measurable improvements in privacy, integrity, and resistance to credential-based attacks compared with conventional approaches.
Certificate management systems encompass aca-demic records; government-issued documents; professional li-censes; notary services.They play a vital role in creating a modern e-government system.Current certificate management methods are plagued by forgery, slow veri-fication, fragmented records between several institutions and vulnerability to compro-mise because of increasing numbers of data breaches.Blockchain innovations create the potential to address these different chal-lenges given their unique features such as: immutability, de-centralization, cryptographic security and full traceability via transparent auditability.The objective of this paper is to combine the current research on certificate management with blockchain technology via a systematic review of 12 peer-reviewed journals which focus on: Research methods used by each author.Data sets used by each author.The evaluation environment used by each author.The performance and security metrics that are being utilized in each author's research.The comparative findings of each author's research with respect to certificate management using public and permissioned blockchains.Results of this study demonstrate that the current core tech-nical functionality of certificate management using blockchain has been established; however, there are still major gaps in the current body of knowledge that need to be addressed, including:1. Privacy solutions, specifically zero-knowledge proofs.2. Ability to scale to the national level.3. Cross-platform interoperability.4. Validation of real-world prototypes.Additionally, we have described each of these gaps explic-itly and created a prioritized future agenda for research that addresses issues related to privacy, scalability, interoperability, security auditing and user-centered evaluation.
Electronic Healthcare Records (EHRs) provide distributed access to patient and doctor information through pervasive cloud-based storage. As this data is highly sensitive, robust privacy measures are essential to mitigate adversarial impacts. To ensure optimal privacy across multiple shared EHRs, this article proposes a Session-dependent Zero Knowledge Proof Technique (SZKPT). The framework identifies privacy breaches using two truth values: the first representing optimal session closure, and the second reflecting verification at each sharing instance. Both truth values are validated through iterated session validations, which are managed using a deep learning paradigm. During training, different combinations of truth values are employed to maximize privacy during data sharing, while iterative processes train consecutive validation instances to improve breach detection. Truth values are continuously updated to reflect the session closure and the most recent privacy verification. In practice, if either truth value equals zero, the session is suspended; otherwise, if truth values are valid in consecutive iterations, data sharing is delegated to the authorized user. The process is repeatted at regular intervals with updated truth values, ensuring continuous monitoring and adaptive privacy protection. The proposed technique is rigorously evaluated using key performance metrics, including access verification, computational complexity, privacy breach detection, verification time, and access delegation time. Results demonstrate that SZKPT effectively balances privacy preservation with usability, providing a reliable, scalable, and efficient solution for secure EHR management in cloud-based healthcare systems.
In the context of rapid and widespread digitalization of society, active implementation of new innovative technologies, and the growth of cyber threats, the issue of organizing effective cybersecurity for enterprises is becoming particularly important. To protect today's modern digital enterprise, you need a comprehensive strategy for secure access to your corporate resources anytime, anywhere, regardless of where they are located. By following Zero Trust Architecture (ZTA) principles, which call for least privilege access and continuous verification, businesses can effectively minimize their attack surface and limit potential losses from compromised accounts. However, existing access control and authentication mechanisms alone are not always sufficient to ensure complete protection of critical data, especially in scenarios where proof of access rights or actions is required without revealing content. In such cases, an effective addition to ZTA can be the use of Zero-Knowledge (ZK) concept, which allows confirming access rights or ownership (knowledge) of certain information without the need to disclose it, which significantly reduces the risks of leaks and unauthorized access. At the same time, representatives of businesses interested in the security of their systems are not yet fully aware of the advantages of this concept. The practical application of already known Zero-Knowledge Proof (ZKP) capabilities in various relevant areas that ensure security is being hampered, among other things, by a lack of awareness and insufficient theoretical training in this area among specialists responsible for security and communicating these capabilities (their potential) to the managers of relevant IT companies. In other words, there is currently a problem related to a lack of awareness about the zero-knowledge concept (its theoretical and practical significance) for making the right decision when building a security system for a corporate information system in modern conditions. This article is exactly aimed at solving this problem. The purpose of this work is to systematize the theoretical foundations and practical application of the zero-knowledge concept using simple and obvious examples in order to understand the potential of ZKP in solving problems of confidentiality/privacy and data verification. To this end, it outlined the main aspects of the zero-knowledge concept, including an analysis of the applicability of interactive and non-interactive approaches, an assessment of existing ZKP systems, and a conceptual representation of zk-SNARK technology based on the popular Groth16 scheme with mathematical justification. This contributes to a better understanding and future use of this dynamically developing and complex concept as one of the key mechanisms of modern cryptography, providing the ability to prove the correctness of calculations without disclosing the computational process or the initial data.
The digital money world is facing a massive security challenge. We have Decentralized Finance (DeFi), built on Smart Contracts-which are supposed to be self-executing and unbreakable-running on top of Cloud Computing, which is fast, scalable, but inherently centralized and has a big, easy-to-hit security perimeter. This awkward partnership creates a critical weak point. Hackers aren't breaking the blockchain itself; they are exploiting the connections, like manipulating data feeds (Oracles) or stealing cloud credentials, something old, siloed security checks simply miss. We've developed the Integrated Cloud-DeFi Resilience (ICDR) Framework to fix this. Think of it as a single, smart security bodyguard that protects your system from the cloud down to the code. The ICDR Framework seamlessly brings together three crucial defense layers: first, we automatically audit the Smart Contract code before it even launches; second, we use Cloud Security Posture Management (CSPM) to continuously monitor the cloud infrastructure’s health in real-time; and third, we use specialized Blockchain Technology (DLT) to create an unchangeable, honest record of every security event. The core innovation is its ability to play detective: it catches stealthy attacks by connecting a suspicious administrative action in the cloud (like a key change) with an immediate, shady transaction on the DeFi chain. In our tests on a simulated financial application, this unified approach reduced the time a system was vulnerable (Vulnerability Exposure Rate, or VER) by over 80% compared to separate monitoring tools. The ICDR Framework offers a crucial, practical model for the financial industry to build the resilient, compliant, and trustworthy digital banking systems of tomorrow. Keyword: Security Auditing; Decentralized Finance (DeFi), Smart Contracts, Cloud Computing, Cloud Security Posture Management (CSPM), Oracle Manipulation,Interoperability Risks, Cross-Stack Correlation, Immutable Audit Trail.
This research paper explores the critical challenge of verifiable execution integrity in modern cloud and serverless computing platforms. While services like Amazon Web Services Lambda and Google Cloud Functions provide scalable and efficient execution environments, they operate as opaque systems where users cannot verify whether their code is executed correctly or securely. The paper identifies a fundamental trust gap in current cloud architectures and presents a comprehensive threat model covering risks such as hypervisor compromise, malicious insiders, supply chain attacks, and output manipulation. It highlights how existing security certifications and auditing mechanisms fail to provide cryptographic guarantees of correctness. To address this problem, the paper proposes a novel framework called the CodeNet Integrity Layer (CIL). This system integrates multiple advanced technologies, including Trusted Execution Environments (TEEs), Zero-Knowledge Proofs (ZKPs), and blockchain-based audit mechanisms, to create a decentralized and trustless verification model. The framework ensures that computation outputs are provably linked to the correct code and inputs without relying on blind trust in the provider. The proposed solution is evaluated through experimental implementation, demonstrating that strong execution integrity can be achieved with minimal performance overhead, making it practical for real-world deployment. The research contributes to the future of secure, transparent, and trustless cloud computing, particularly for sensitive applications in finance, healthcare, and critical infrastructure.
Canon² — Trust Layer Research Archive. Modern distributed computing has historically relied upon probabilistic consensus mechanisms—such as Proof-of-Work and Proof-of-Stake—to secure state transitions across decentralized networks. These models evaluate the validity of a transaction entirely upon the weight of the underlying cryptographic expenditure or financial collateral, without inspecting the semantic content or structural objective of the payload itself. I propose a fundamental paradigm shift: Proof-of-Intent (PoI). By elevating "intent" to a first-class computational primitive, deterministic ecosystems can sequence, validate, and execute operational states based upon the cryptographic verification of the initiator's structural objective rather than arbitrary hash power or capital accumulation. Proof-of-Intent formalizes a requested operation into a rigid, deterministic Intent Tuple. This tuple binds mathematically to the Trust Layer Certificate Fabric through SHA3-256 hash commitment, locking agent identity directly to explicit execution parameters. By utilizing Lume-V envelopes and Deterministic AI Guided Subsystems (DAIGS) arbitration heuristics, PoI creates an environment for synthetic organism evolution, cyber-physical governance, and multi-agent coordination where every state transition carries verifiable semantic context. Nodes running PoI validate transactions by hashing the execution intent and checking adherence to local and global algorithmic governance constraints. Because the system rejects structurally flawed or contradictory intents before physical execution cycles are expended, Proof-of-Intent achieves what is, to my knowledge, unprecedented throughput and finality guarantees, bypassing the probabilistic race conditions inherent in classical consensus schemas.