Follow blockchain research across journals, conferences, and preprint repositories.
889 results · page 22 of 38
Tuan-Dung Tran, Phong Khuu Minh, Trang Le Tran Thuy, Phan The Duy · 6 authors
No abstract is available for this record.
Igor Calzada
No abstract is available for this record.
Venkata Krishna Bharadwaj Parasaram
Self-sovereign identity models and decentralized, blockchain-based identity management can prevent digital ecosystem data breaches and misuse, the study finds. As digital services proliferate and personal data becomes more valuable, central database-based identity systems expose users to single-point failures, unauthorized access, identity theft, and large-scale breaches. This paper analyzes how decentralized IDs, verifiable credentials, and cryptographic verification reduce middlemen, enable selective disclosure, and promote identity governance privacy. Important academic, industrial, and technical contributions show that blockchain anchors credentials in distributed ledgers rather than institutional repositories, improving authentication, traceability, and tamper resistance while limiting undesired access. Immutable audit trails, user-controlled credentials, and reduced central authority dependency have been touted, but empirical performance data, scalability, interoperability, and comparative evaluations of public and permissioned blockchain environments are lacking. These findings explain self-sovereign identity architecture, which lets trusted authority issue credentials but users store and control them directly through digital wallets utilizing cryptographic proofs instead of database lookups. Users can control or withdraw data sharing while maintaining identity. Transparency, limited disclosure, and contextual data presentation prevent cross-platform tracking and increase user autonomy. The research shows how zero-knowledge proofs and predicate-based validation verify credentials without disclosing sensitive data, protecting privacy. Birthdates and locations are not needed to verify age- and location-based limits. SSI master key-derived domain-specific identities reduce correlation hazards and prevent service surveillance. Consent-based sharing, selective disclosure, and cryptographic compartmentalization decrease data collection and profiling. Decentralised blockchain verification maintains credentials usable when the issuer is offline, preventing service disruptions and third-party participation.
Rohit Yallavula, Ravindra Putchakayala
The unstoppably increasing number of the Internet of Things (IoT), autonomous agents, and massive distributed web ecosystems have made data acquisition a complicated, risk-prone, and a very sensitive process. Regulation Web data collection is a fixed pipeline that is strictly regulated by established rules and legal limits, and reactive policy audits to operate in traditional forms of governance. Nevertheless, the contemporary digital ecosystem requires a decentralized system of governance that could identify unpredictable streams of data, the shifting web framework, loosely distributed computing individuals, and shifting conditions of regulation. This paper will present Governance-of-Things (GoT), an emerging conceptual and architectural design that will address these issues and show how to smoothly integrate ethical intelligence, regulatory and laws compliance, semantic awareness, and integrity assurance within autonomous systems of web data acquisition. GoT suggests a view where governance follows a first-class computation i.e. embedded, adaptive, intelligent and context-aware. In contrast to traditional approaches of governing IoT, GoT regards any acquisition agent as ethics-regulated, compliance-aware, and self-regulating. Agents do not simply pull information, they negotiate access rights, authenticate provenance, reason about risk, and implement multi-jurisdictional policies all by themselves. The framework combines dynamic enforcement of policies, federated governance, semantic classification pipelines, AI-enhanced agent frameworks built on Java and distributed analytics to create an ecosystem, producing an automated acquisition that is compatible with responsible, transparent, and audit-friendly behaviours. Fairness, legality, transparency, explainability and accountability are the principles of ethical autonomy which are expounded in the paper. GoT has the aspect of federated ethical rule orchestration where the governance layers among organizations in various stakeholders share without necessarily providing the raw information. The system incorporates automation using structural integrity that guarantees cryptographic validation and review trails that are not tampered with. The given adaptive monitoring model promotes the constant policy updating, data flows redirection and the detection of threats. Furthermore, GoT involves semantic intelligence so that data classification, contextual labeling, entity recognition, and domain mapping take place before storing or processing data- therein avoiding compliance violation at its early phases. GoT architecturally has a multi-layer stack that is organized and includes Perception Layer, Autonomous Agent Layer, Governance Core, Distributed Analytics Layer, and Compliance Ledger Layer. The primitives of computational governance are embedded in each layer, making it highly modular and allowing run-time updates of rules and cooperating across agents. Java frameworks boosted with AI facilitate interoperability with legacy enterprise systems and with current base systems. Using experimental simulation, it was found that GoT enhances compliance accuracy, governance throughput, policy adaptation latency and decision explainability on varying scenarios of acquisitions. This article is in the pre-2021 academic style, has extensive literature review, methodological description, architectural schematics, theoretical framework, and profound results discussion. It ends by establishing GoT as an innovative paradigm which is able to influence the future of web data governance, autonomous systems, and distributed analytics
Sarah A. Flanery, Kamalesh Mohanasundar, Christiana Chamon, Srujan Kotikela · 5 authors
With the natural evolution of the web, the need for decentralization has rendered the current centralized education system out of date. The student does not "own" their credentials, as the only way their accomplishments are directly linked to their person and considered valuable is by verification through a stamp of an expensive, prestigious institution. However, going to a university is no longer the only way to acquire an education; open-source learning material is widely available and accessible through the internet. However, our society does not deem these methods of education as verifiable if they do not include a degree or certificate. Additionally, a valid certificate for the vast majority of open-source courses costs a few hundred dollars to obtain. The centralized nature of education inadvertently places students in underprivileged communities at a disadvantage in comparison to students in economically advantaged communities, thus a decentralized approach to education would eliminate the vast majority of such discrepancies. In the present paper, we integrate Decentralized Identity (DID) with Web 3.0 to upload credentials linked directly to the user. Each credential is appended to an Ethereum blockchain that, by design, cannot be altered once uploaded. We include DID document based access controls to display the candidate's upload and verification history. Finally, we utilize TLS protocols to provide a secure connection to the internet for ensuring non-fungibility of credentials and authentication of users.
Xuyang Liu, Lanju Kong, Yuehan Su, Chenfei Sun
To alleviate the pressure on storage and execution on blockchain, existing platforms such as Ethereum have designed payment channels, attempting to transfer some of the pressure to off chain. Consistency protocols such as “lock-submit” based on asset are used to ensure consistency between on chain and off chain. However, the increasing number of multi-property-right and multi-attribute assets pose challenges to the parallel performance of existing payment channels. This paper proposes an on chain and off chain consistency protocol for multi-attribute digital assets based on data property rights. Firstly, we use a hypergraph to store asset contents off chain. Also, we use an index MMI (multi-property-right and multi-attribute index) on chain to store the relationship between accounts and assets, partial information of assets. Secondly, a multiparty payment channel is opened, verifiers verify the legitimacy of the transaction request based on the attribute state list in MMI and allow collaborative attribute modification on and off chain. Finally, nodes merge assets based on asset version numbers to ensure the consistency and security of asset content. After experiments, our consistency protocol has a success rate of 99.68% after asset merging, and the performance of execution can be improved by about 14%-29%, throughput can be improved by about 6%-14%, and the transaction size in the block is smaller.
Jannik Lucas Sommer, Magnus Mølgaard Lund, Nicola Cibin, Michele Albano
The frequency of software supply chain attacks has reached unprecedented levels, primarily due to the increasing reliance on huge numbers of software and hardware dependencies, and the inherent vulnerabilities they harbor. Currently, vendors providing these software and hardware components share security advisories to centralized databases or post them on proprietary websites, which security engineers have to search manually to find vulnerabilities relevant for their systems. Furthermore, the security advisories often do not follow a standard machine-readable format, which results in the engineers having to manually analyze the documents. In this paper, SENTINEL, a novel solution for automating dissemination and discovery of security advisories leveraging Web3 technologies, is presented. In particular, the Ethereum blockchain is used by vendors to notify asset owners of novel vulnerabilities in their systems in a reliable and accountable manner. Evaluation tests conducted on the Ethereum Sepolia Testnet confirm that our proposal is a functional and functioning solution for securely disseminating and discovering security advisories utilizing a fully decentralized infrastructure. SENTINEL’s source code is released as open source software on GitHub.
Aleksandr Kormiltsyn, Vimal Dwivedi, Chibuzor Udokwu, Alex Norta
Integrating personal health records (PHRs) and electronic health records (EHRs) facilitates the provision of novel services to individuals, researchers, and healthcare practitioners. Simultaneously, integrating healthcare data leads to complexities arising from the structural and semantic heterogeneity within the data. The subject of healthcare data evokes strong emotions due to concerns surrounding privacy breaches. Blockchain technology is employed to address the issue of patient data privacy in inter-organizational processes, as it facilitates patient data ownership and promotes transparency in its usage. At the same time, blockchain technology creates new challenges for e-healthcare systems, such as data privacy, observability, and online enforceability. This article proposes designing and formalizing automatic conflict resolution techniques in decentralized e-healthcare systems. The present study expounds upon our concepts by employing a running case study centered around preventive and personalized healthcare domains. Plain Language Summary: This paper suggests using blockchain technology for privacy concerns in integrating personal health records and electronic health records in decentralized e-healthcare systems. This report focuses on designing automatic conflict resolution techniques to ensure patient data ownership, transparency, and privacy in inter-organizational processes. This paper proposes designing automatic conflict resolution techniques in decentralized e-healthcare systems, which can improve inter-organizational processes in healthcare. Using blockchain technology to integrate personal and electronic health records can ensure patient data ownership and promote transparency in data usage, addressing privacy concerns in healthcare systems. This paper emphasizes the importance of data privacy and protection in healthcare systems, highlighting the need for compliance with laws and regulations. The research results, including the proof-of-concept prototype, can provide practical insights into implementing conflict resolution techniques in decentralized e-healthcare systems.
Venkata Raghava Kurada, P. Baruah
Federated Learning is susceptible to various kinds of attacks like Data Poisoning, Model Poisoning and Man in the Middle attack. We perceive Federated Learning as a hierarchical structure, a federation of nodes with validators as the head. The process of validation is done through consensus by employing Novelty Detection and Snowball protocol, to identify valuable and relevant updates while filtering out potentially malicious or irrelevant updates, thus preventing Model Poisoning attacks. The opinion of the validators is recorded in blockchain and trust score is calculated. In case of lack of consensus, trust score is used to determine the impact of validators on the global model. A hyperparameter is introduced to guide the model generation process, either to rely on consensus or on trust score. This approach ensures transparency and reliability in the aggregation process and allows the global model to benefit from insights of most trusted nodes. In the training phase, the combination of IPFS , PGP encryption provides : a) secure and decentralized storage b) mitigates single point of failure making this system reliable and c) resilient against man in the middle attack. The system is realized by implementing in python and Foundry for smart contract development. Global Model is tested against data poisoning by flipping the labels and by introducing malicious nodes. Results found to be similar to that of Flower.
Morteza Alizadeh, Karl Andersson, Olov Schelén
Decentralized identification is an interesting topic for Internet-based systems. Although the use of centralized systems for identification is prevalent, there is still a need for decentralized identification systems that do not rely on a centralized entity. We propose using Distributed Ledger Technology (DLT) to fulfill the needs. Although DLT and Distributed Hash Table (DHT) can be used as technologies in Decentralized Identifiers (DIDs), immutability and the growth of transactions are still challenging. This paper investigates DIDs under the W3C standard and DLT-based technology as one of the solutions for verifiable data registries in DIDs. We evaluate our proposed solution by comparing three models wrt. query time for verifiable data registries. Our proposed architecture for data registry achieves better query time by concealing old transactions from the main DLT.
Vikas Reddy Mandadhi
I took a close look at what a blockchain-based compliance layer might actually do for U.S. payment systems using zero-knowledge proofs (ZKPs) as the key ingredient. The study lays out a conceptual model, grounded in current research, and then walks through different architectural options so you can see the trade-offs. The big takeaway? ZKPs appear capable of meeting core U.S. AML and KYC obligations without forcing people to hand over more personal details than necessary. Frankly, that's kind of the point: keep compliance intact, but avoid needless data exposure. The analysis also suggests that a ZKP-enabled layer could smooth regulatory workflows, cut down on operational risk and costs, and perhaps most importantly drastically reduce how much sensitive information gets shared across payment networks. It's promising, if a bit early-stage, but worth paying attention to.
Umer Majeed, Sheikh Salman Hassan, Zhu Han, Choong Seon Hong
In the rapidly evolving landscape of Web3 and blockchain technologies, decentralized autonomous organizations (DAOs) have emerged as innovative structures that operate autonomously through blockchain and smart contracts, eliminating the need for centralized control. The federated learning (FL) process, akin to an information flow under structured transparency, involves local models (LMs) as inputs and the global model (GM) as the output for each global iteration. The lack of transparency and security in traditional FL systems can be attributed to the centralized validation of LMs and GM updates. In this paper, we propose DAO-FL, a smart contract-based framework that leverages the power of DAOs to address these FL challenges. DAO-FL introduces the concept of DAO Membership Tokens (DAOMTs) as a governance tool within a DAO. DAOMTs play a crucial role within the DAO, facilitating members’ enrollment and expulsion. Our framework incorporates a Validation-DAO for decentralized input verification (DIV) of the FL process, ensuring reliable and transparent validation of LMs. Additionally, DAO-FL employs a multi-signatures approach facilitated by an Orchestrator-DAO to achieve decentralized GM updates, and thus decentralized output verification (DOV) of the FL process. We present a comprehensive system architecture, detailed execution workflow, implementation specifications, and qualitative evaluation for DAO-FL. Evaluation under threat models highlights DAO-FL’s out-performance against traditional centralized-FL, effectively countering input and output attacks. DAO-FL excels in scenarios where DIV and DOV are crucial, offering enhanced transparency and trust. In conclusion, DAOFL provides a compelling solution for FL, reinforcing the integrity of the FL ecosystem through decentralized decision making and validation mechanisms.
Iakovos Pittaras, George C. Polyzos
The Internet of Things (IoT) involves diverse devices exchanging data and impacting the real world through actuators, often unattended. IoT data and actuation are accessed by many and diverse stakeholders, emphasizing the need for security and privacy and in particular for effective, efficient, usable, and fine-grained access control solutions. Unfortunately, most of the conventional access control approaches have been proven inefficient or ineffective for the IoT. Novel access control mechanisms have been designed, specifically for the IoT, with some of them taking advantage of Distributed Ledger Technologies (DLTs). DLTs and smart contracts provide increased availability, automation, transparency, and decentralization. Here, we first review the related literature and then we develop IoT access control requirements and solutions. We argue that DLT-based access control systems can address the key requirements for the IoT and we validate this claim by designing a realistic access control solution for a smart city use case.
Bryan Kumara, Mark Hooper, Carsten Maple, Timothy Hobson · 5 authors
Redactable Signature Schemes and Zero-Knowledge Proofs are two radically different approaches to enable privacy. This paper analyses their merits and drawbacks when applied to decentralized identity system. Redactable Signatures, though competitively quick and compact, are not as expressive as zero-knowledge proofs and do not provide the same level of privacy. On the other hand, zero-knowledge proofs can be much faster but some protocols require a trusted set-up. We conclude that given the benefits and drawbacks, redactable signatures are more appropriate at an earlier stage and zero-knowledge proofs are more appropriate at a later stage for decentralized identity systems
Issam Al-Azzoni, Saqib Iqbal
Access controls are principles and policies that are deployed on a system to ensure privileged access to system resources. Role-based access controls are a type of access controls which ensure access to resources based on users' roles. There has been a recent interest in generating smart contracts for the design of access controls. Smart contracts are computerized applications or protocols which execute automatically between contributory entities without an intermediary interference. The smart contracts, however, have a limitation of being dependent on the blockchain platform for which they are designed. This limitation has been resolved by iContractML framework, which offers a provision of designing and implementing smart contracts for multiple platforms. In this study, we have used a model-driven engineering (MDE) based approach to exploit iContractML for generating smart contract for role-based access controls. We have extended the meta-model of iContractML with new notations and have used the revised meta-model to generate smart contracts for role-based access controls. The generated contracts have been thoroughly tested and evaluated for correctness.
Arthur Baudet, Oum-El-Kheir Aktouf, Annabelle Mercier, Philippe Elbaz–Vincent
No abstract is available for this record.
Shallu Sharma, Balraj Singh, Ranbir Singh Batth
Smart contract is the core of blockchain networks. It eliminates the requirement for third-party services. They are the self- executing contracts that compose rules and terms of transactions that should be agreed upon by every participating node. Smart contracts are executed in a decentralized environment of blockchain. The conditions of an agreement are written in a code that is coded using various programming languages. With more advancement in technology, access control to data has become increasingly difficult. The users need to have access to their assets and resources to complete the job even if the location is remote. We proposed smart contract-based system architecture to implement contract policies to manage access control over the given data. This will help in maintaining data security and integrity and avoid unauthorized attacks.
Bindu Babu, K. Suresh Babu, Durga Prasad Kare
The security of computerized systems depends on mechanisms for controlling access. For the enrichment and reinforcement of such systems, a combination of attribute-based access control and blockchain technologies may be deployed. On the other hand, attribute-based encryption may be used to enable secure data management and safeguard access policies. In this research, we have presented innovative blockchain-enabled attribute-based access control. Our architecture is the first to integrate different aspects to accomplish many security aspects as well as give partial and total revocation at the same time. The experimental findings and analysis, done utilizing the blockchain of the Ethereum network, proved the superior performance of the suggested method compared to prior research works.
Badr Bellaj, Aafaf Ouaddah, Noël Crespi, Abdellatif Mezrioui · 5 authors
In blockchain space, access control is a crucial aspect of smart contract development, as it guarantees that only authorized users can execute specific functions within a contract. The growing interest in employing smart contracts for access control mechanisms stems from their ability to provide reliable, secure and efficient enforcement of access control policies. However, Solidity, the most popular smart contract language, was not designed explicitly for writing access control policies, unlike specialized languages such as Alfa or XACML. The differences between these languages leads to a difficulty for those who wish to use smart contracts as access control mechanisms but lack the knowledge of Solidity or the ability to evaluate their code's security. To bridge this gap, we introduce ASAC, an Alfa to Solidity transpiler that translates Alfa policies into secure Solidity contracts. Our transpiler leverages the ANTLR (ANother Tool for Language Recognition) parser generator and translate complex Alfa policies into smart contracts. We showcase the effectiveness of our transpiler through a set of case studies and offer an evaluation of its performance.
Jiewei Feng, Christopher King, Ken R. Duffy
Blockchain and other decentralized databases, known as distributed ledgers, are designed to store information online where all trusted network members can update the data with transparency. The dynamics of ledger's development can be mathematically represented by a directed acyclic graph (DAG). One essential property of a properly functioning shared ledger is that all network members holding a copy of the ledger agree on a sequence of information added to the ledger, which is referred to as consensus and is known to be related to a structural property of DAG called one-endedness. In this paper, we consider a model of distributed ledger with sequential stochastic arrivals that mimic attachment rules from the IOTA cryptocurrency. We first prove that the number of leaves in the random DAG is bounded by a constant infinitely often through the identification of a suitable martingale, and then prove that a sequence of specific events happens infinitely often. Combining those results we establish that, as time goes to infinity, the IOTA DAG is almost surely one-ended.
Issam Al-Azzoni, Reiko Heckel
We propose a simple modelling language extending iContractML 2.0 for access control policies on smart contracts. The language supports multi-party authorisation and dynamic role-based access control (RBAC) where role members can be added or removed at runtime. Models in this language can be mapped to both Solidity and DAML in a model-driven approach to RBACs.
Rohini Pise, Sonali Patil
Smart contracts are self-executing programs that run on blockchain platforms. While smart contracts offer a range of benefits, such as immutability and transparency, they are not immune to vulnerabilities. Malicious actors can exploit smart contract vulnerabilities to execute unintended actions or access sensitive data[1]. One approach to mitigating smart contract vulnerabilities is formal verification. Formal verification is a method of verifying the correctness of software using mathematical techniques. It involves mathematically proving that a program conforms to a set of specifications. Formal verification can help detect and eliminate vulnerabilities in smart contracts before they are deployed on the blockchain. KEVM (K Framework-based EVM) is a framework that allows for formal verification of smart contracts on the Ethereum Virtual Machine (EVM). KEVM uses the K Framework, a formal semantics framework, to specify the behavior of the EVM. With KEVM, smart contract developers can verify the correctness of their contracts before deployment, reducing the risk of vulnerabilities. In this paper, we have studied smart contract vulnerabilities such as Over usage of Gas, Signature Replay attack, and misuse of fallback function. We have also written the formal specification for these vulnerabilities and executed it using KEVM.
Alessandro Aldini, Suzana Maranhão Moreno, Jean-Marc Seigneur
Despite many efforts to increase access to financial services, 1,4 billion people still are unbanked. One significant barrier to decreasing this number is the lack of official personal documents (e.g., government-issued identification or utility bills) to comply with the necessary KYC/AML regulation. Innovative schemes can recognize one by using inputs like the personal trail generated when one uses the phone or engages in some digital activity. This paper proposes a formal language-based approach for modeling financial inclusion services and for representing in a structured way the existing KYC/AML compliance rules from different countries. Currently, those rules are written in an unstructured format using natural language and spread in regulatory documents from these jurisdictions. Our proposed language is a core building block of a computational trust and risk engine model, also discussed in this paper. Our approach supports the use of traditional and innovative recognition schemes, helping to overcome the barrier for those who cannot comply with conventional KYC/AML requirements. Moreover, it can also be used to power the risk calculation of computational trust and risk engines. Finally, the proposal is generic enough to be applied to both traditional and decentralized finance.
Mariia Bakhtina, K. Leung, Raimundas Matulevičius, Ahmed Awad · 5 authors
X-Road is an open-source solution that acts as a data exchange layer and enables secure data exchange between organisations. X-Road serves as the backbone of digital infrastructure in the public sector (e.g., enabling Estonia’s digital public services) and private sector (e.g., enabling clients’ data exchange in the Japanese energy sector). An approach and architecture were recently proposed for the X-Road data exchange systems to move from public key infrastructure (PKI) with centralised certification authorities to decentralised PKI (DPKI). In this paper, we develop a proof of concept for the designed DPKI-based architecture that leverages distributed ledger-based identifiers and verifiable credentials to establish trust between information systems using Hyperledger Indy and Hyperledger Aries. We evaluate the proof of concept implementation against the design and functional requirements. The results show that the proposed system architecture is technically feasible and satisfies the identified design goals and functional requirements. To the best of our knowledge, this paper presents the first open-access system prototype for an organisation’s identity management following self-sovereign identity principles. The presented proof of concept proves that DPKI helps to address some of the scalability issues of PKI, improve control over identity and mitigate replay attacks and a single point of failure in the X-Road system.