The rise of digital healthcare has intensified concerns over data privacy, particularly in cross-institutional medical data exchanges. This study introduces a blockchain-based protocol leveraging Zero-Knowledge Proofs (ZKP), specifically zk-SNARK, to enable verifiable yet privacy-preserving health data sharing. Built on a permissioned Ethereum blockchain, the protocol ensures that medical data validity can be confirmed without disclosing sensitive content. System implementation involves Python-based zk-circuits, smart contracts in Solidity, and RESTful APIs supporting HL7 FHIR formats for interoperability. Performance evaluations show promising results: proof verification times remained under 100 ms, with average proof sizes below 2 KB, even under complex transaction scenarios. Gas consumption analysis indicates a trade-off—ZKP-enabled transactions consumed approximately 93,000 gas units, compared to 52,800 in baseline cases. Interoperability testing across 10 FHIR-based scenarios resulted in 100% parsing success and an average data integration time of 1.7 seconds. Security assessments under white-box threat models confirmed that sensitive information remains unreconstructable, preserving patient confidentiality. Compared to previous implementations using zk-STARK, this protocol offers a 30% improvement in verification efficiency and a 45% reduction in proof size. The novelty lies in combining lightweight ZKP mechanisms with an interoperability-focused design, tailored for realistic hospital infrastructures. This research delivers a scalable, standards-compliant architecture poised to advance secure digital healthcare ecosystems while complying with regulations like GDPR
Federated learning (FL) has emerged as a promising paradigm for training machine learning models across distributed devices while preserving data privacy, finding applications in edge computing, healthcare, and IoT systems. However, the heterogeneity of client devices and asynchronous updates often lead to significant challenges, including computational inefficiency, model inconsistency, and lack of trust in aggregation processes. Existing FL methods, such as synchronous aggregation or fully decentralized approaches, struggle to balance efficiency and consistency, often relying on centralized servers that introduce single points of failure or fail to fairly account for client contributions in asynchronous settings. To address these issues, we propose a novel dual-layer aggregation framework that integrates local asynchronous micro-aggregation with global synchronous macro-aggregation, leveraging blockchain and IPFS for trust and scalability. Our approach dynamically clusters clients based on gradient similarity, employs staleness-aware asynchronous aggregation within clusters, and enforces secure, transparent inter-cluster synchronization via smart contracts. By storing model updates on IPFS and managing metadata on-chain, our method reduces computational overhead while ensuring fairness and tamper-proof execution. Experimental results demonstrate that this framework achieves superior model performance, convergence stability, and equitable contribution tracking compared to traditional FL systems.
A. Althaf Ali, M. A. Gunavathie, V. Srinivasan, M. Aruna · 6 authors
The integration of smart city applications with healthcare has revolutionized patient monitoring and medical data management. However, ensuring the privacy and security of Electronic Health Records (EHR) remains a critical challenge, especially in IoT-based environments with resource-constrained devices. This paper proposes a novel Blockchain-Enabled Federated Learning (BFL) framework to enhance privacy preservation in EHR processing. The proposed framework leverages zero-knowledge proofs (ZKP) for authentication and homomorphic encryption for secure computation, ensuring robust data security without exposing raw patient data. Federated Learning (FL) enables decentralized model training across IoT devices, reducing privacy risks while maintaining data utility. Additionally, blockchain technology enhances the integrity and transparency of EHR transactions by creating a tamper-proof ledger. The performance of the proposed BFL framework is evaluated based on data utility, model accuracy, execution time, and scalability across varying sizes of EHR datasets. Results demonstrate improved privacy preservation, reduced computational overhead, and enhanced model efficiency, making it a promising approach for secure and privacy-aware IoT-based smart healthcare systems.
Mohammad Inairat, Nema Abuhelou, Mohammed A. Afifi, Nizar Sahawneh · 6 authors
The rapid transformation of technology in financial services has greatly highlighted the need for precise and secure financial forecasting models. Nevertheless, the centralized analysis of financial data is being increasingly limited by privacy legislation and the possibility of data infringement. Federated Learning (FL) appears as a groundbreaking concept, allowing for decentralized model training over various data sources without losing the privacy of the data. The paper investigates the implementation of FL in the decentralized financial forecasting while addressing important issues such as data diversity, communication overload, and non-IID financial dataset model optimization. Using the real-world datasets we assess the efficiency of FL frameworks against the existing centralized methods, thus exposing the higher precision, safety, and ability to scale in forecast viability. The results show the promise of FL in changing the process of financial forecasting, issuing solid estimates of future events while protecting sensitive financial information. This study could be seen as an initial step towards a more widespread application of FL in finance which could lead to the promotion of innovations in secure and decentralized analysis of data.
The rising energy demands of large data centers call for energy-efficient AI training methods. Federated Learning (FL), a decentralized paradigm, offers a solution by enabling model training across distributed devices without centralizing sensitive data. This review explores FL's integration with distributed data centers to achieve energy efficiency, analyzing methods like federated averaging and energy-aware protocols to minimize resource use. It highlights techniques such as model compression, quantization, and adaptive FL to reduce on-device computation while maintaining performance. Practical implementation is discussed through tools like TensorFlow Federated and PySyft, with case studies from healthcare, finance, and IoT showcasing cost reductions and sustainability. Future research directions include combining FL with edge computing and low-power AI hardware, emphasizing FL's potential for scalable, sustainable AI.
Purpose The growing concern over privacy leakage has led to reduced user participation in data sharing, prompting the exploration of novel techniques such as federated learning (FL). Meanwhile, existing FL solutions often overlook the validation of the training process, leaving room for malicious trainers to introduce false or toxic local models, detrimental to the global model’s utility. This study aims to propose a zero-knowledge proof-based verifiable federated learning (ZKP-FL) framework on the blockchain. Design/methodology/approach ZKP-FL leverages zero-knowledge proofs to verify the extensive local training process without threatening the local privacy. To reduce the memory and runtime overhead, the authors divide the training algorithm to be proven into smaller pieces and generating proofs for each segment. The authors leverage sigma-protocol to ensure the consistency and reliability of these proofs. Moreover, they design a secure model aggregation protocol that matches the local proofs, safeguarding the data privacy of individual local models throughout the process. Furthermore, this aggregation protocol can also guarantee the correctness of the aggregation. Findings To establish the effectiveness and security of ZKP-FL, the authors conduct a formal security analysis in terms of completeness, soundness and zero-knowledge properties. Experimental evaluations with different algorithms and models within the ZKP-FL framework demonstrate that with parallel execution the additional proof time per round is minimal. Originality/value This paper offers a novel perspective on security and privacy of FL, providing valuable insights that extend the current understanding of verifiable FL. The findings contribute to the ZKP-FL, highlighting areas for future research and practical applications.
Joy Nnenna Okolo, Adesola Adul-Gafar Arowogbadamu, Samuel Adetayo Adeniji, Rhoda Kalu Tasie
The rapid adoption of mobile AI applications in areas such as healthcare, finance, and personalized services has raised significant concerns about data privacy and security. Traditional centralized machine learning (ML) models require mobile devices to transmit user data to cloud servers, posing risks of data breaches and regulatory non-compliance. Federated learning (FL) addresses these concerns by allowing decentralized AI model training directly on user devices, ensuring that raw data remains private and never leaves the device. However, FL faces security vulnerabilities and performance limitations, including model inversion attacks, data poisoning risks, and high computational overhead. This paper explores key privacy-preserving techniques such as differential privacy, secure aggregation, and homomorphic encryption, which enhance FL security while maintaining model accuracy. Additionally, emerging trends such as blockchain-integrated FL, post-quantum cryptography, and AI-driven optimization are analyzed to highlight the future of privacy-preserving mobile AI ecosystems. By integrating advanced cryptographic techniques and decentralized verification mechanisms, FL can enable scalable, secure, and regulation-compliant AI applications, ensuring a balance between data privacy and AI innovation.
The rapid adoption of cloud computing has transformed how organizations store, process, and manage data, shifting from centralized infrastructures to highly distributed environments. This evolution has necessitated a parallel advancement in cloud security strategies to address emerging threats, regulatory demands, and architectural complexities. Initially, cloud security relied on perimeter-based defenses, such as firewalls and VPNs, which proved insufficient as architectures evolved toward hybrid, multi-cloud, and edge computing models. Modern security paradigms now emphasize Zero Trust principles, data-centric protection, and DevSecOps integration, ensuring security is embedded throughout the development lifecycle. Additionally, advancements in AI-driven threat detection, encryption technologies, and identity management have become critical in safeguarding distributed workloads. However, challenges persist, including securing serverless and containerized environments, mitigating supply chain risks, and preparing for post-quantum cryptography. Future trends point toward autonomous security systems, confidential computing, and decentralized identity solutions, reinforcing the need for adaptive, intelligent security frameworks. This paper explores the evolution of cloud security, analyzing past approaches, current best practices, and future directions to ensure robust data protection in an increasingly decentralized digital landscape. Keywords: Cloud Security, Zero Trust, Data-Centric Security, DevSecOps, AI in Cybersecurity, Distributed Environments
With the diversity of data generated in daily life and the high economic benefits of effective use of data in various aspects, data trading has become a trend, and the fairness of data trading has also received increasing attention in recent years. Fairness means that the buyer and seller either get what they want or neither, which is one of the most basic requirements of transactions. Studies have shown that it is difficult to design a fair agreement based on buyers and sellers alone. Therefore, existing fair agreements generally rely on Trusted Third Parties (TTP) for transactions, and their fairness is based on the behavior of TTP and the trust of both parties in TTP. After the emergence of blockchain and smart contracts, their decentralization and transparency make them excellent candidates for replacing TTP. Therefore, this paper attempts to design a secure and fair data transaction protocol based on smart contracts. In order to ensure the security of data, we use an advanced Passive Proxy Re-Encryption (PPRE) scheme to enable the smart contract to transfer the decryption right to the buyer after receiving the buyer’s payment. In addition, based on smart contracts and PPRE, a fair protocol for data trading is proposed, and the fairness of the protocol is guaranteed by an arbitration protocol. The protocol supports ciphertext publicity and repeatable sale, thereby reducing the number of interactions. Comprehensive experimental results verify the feasibility and effectiveness of the proposed protocol.
Damiano Di Francesco Maesa, Matteo Loporchio, Frank Tietze
This paper considers the application scenario of Intellectual Property (IP) management, a business process yet to fully embrace digitisation and the advantages it brings. We propose to leverage Distributed Ledger Technology (DLT) to digitise license agreements management by providing automated and trustworthy royalty computation, transaction execution, and payment distribution. This can be achieved by employing smart licenses, i.e., bundles of smart contracts implementing the royalty logic of license agreements. To provide scalability, flexibility, and resilience, we propose to deploy smart licenses on a network of networks model, i.e., a set of heterogeneous networks potentially running different DLT protocols and connected by cross-chain information exchange protocols. A novel advantage of the network of networks approach is that it allows for the use of private values for royalty computation, which is impossible in the traditional model. Of course, supporting private DLT networks requires privacy-preserving cross-chain schemes, a still open problem in the literature. This is why we present two alternative privacy-preserving cross-chain schemes for our considered application scenario of license agreements management, one based on Homomorphic Encryption (HE) and the other on Zero-Knowledge (ZK) proofs. Besides discussing their theoretical advantages and drawbacks, we present an experimental evaluation of a prototype implementation of smart licenses based on both schemes. • We propose a network of networks model that enhances scalability in smart license ecosystems. • The proposed model allows smart licenses to leverage data from heterogeneous networks, including private ones. • We compare two methods for privacy-preserving cross-chain communication: homomorphic encryption and zero-knowledge proofs. • We experimentally evaluate and compare two different privacy-preserving smart license implementations.
ABSTRACT Self‐sovereign identity management systems operate in open network environments and face security threats from semi‐trusted or malicious adversary models. In such environments, verifiable credentials are susceptible to attacks such as theft and forgery. In response to the privacy risks associated with verifiable credentials during issuance and revocation, this article proposes a privacy protection scheme for user information during the issuance and revocation processes of verifiable credentials in self‐sovereign identity management based on blockchain technology. First, a privacy‐preserving method that does not rely on a single identity provider and resists Sybil attacks has been designed using secure multi‐party computation cryptographic techniques. Second, the consortium blockchain committee nodes act as the issuer of verifiable credentials. By combining attribute commitments and zero‐knowledge proof techniques, the user's identity information is hidden, achieving the privacy protection goal during the issuance of verifiable credentials. Furthermore, in order to protect user privacy during the revocation of verifiable credentials (VCs), we employ a cryptographic accumulator technique to implement the revocation operation. This approach ensures the security of user privacy while effectively managing the revocation of credentials. Finally, this paper conducts a security analysis and performance evaluation of the proposed scheme. The results show that our scheme strikes a balance between security needs and time efficiency.
Federated Machine Learning (FML) is an unconventional method that performs decentralized analysis of financial data without the need for sensitive data to be uploaded for secure model training that works across distributed platforms. In this paper, we explored the feasibility of applying FML to the cloud for financial institutions, which ultimately satisfies major privacy-preserving and compliance requirements. We discuss the unique challenges brought up by decentralized settings, including issues with data heterogeneity, communication efficiency, and convergence. As a solution, we present a federated learning framework that enables collaborative training under a cloud infrastructure while ensuring that private data does not leave the local institutions. This is to improve performance, maximize the use of resources, increase speed and scalability of analytical actions in the finance sector. The experimental results demonstrate the efficacy of the proposed system in delivering trustworthy and secure financial predictions, paving the way for considerable improvements in decentralized machine learning for the financial industry.
Michele Orrù, George Kadianakis, Mary Maller, Greg Zaverucha
A fundamental challenge in zero-knowledge proof systems is implementing operations that are “foreign” to the underlying constraint system, in that they are arithmetic operations with a different modulus than the one used by the proof system. The modulus of the constraint system is a large prime, and common examples of foreign operations are Boolean operations, field arithmetic, or public-key cryptography operations. We present novel techniques for efficiently embedding such foreign arithmetic in zero-knowledge, including (i) equality of discrete logarithms across different groups; (ii) scalar multiplication without requiring elliptic curve operations; (iii) proving knowledge of an AES encryption. Our approach combines rejection sampling, sigma protocols, and lookup protocols. We implement and provide concrete benchmarks for our protocols.
Federated learning (FL) has emerged as a leading methodology for facilitating collaborative edge learning (EL) across Artificial Intelligence of Things (AIoT) devices, enabling efficient model training and bolstering privacy protection. Nevertheless, current EL methods that depend on trusted servers engender apprehensions concerning potential data leakage and misuse. Moreover, the untrusted AIoT environment increases security threats in EL collaboration. In addressing these challenges, we introduce an innovative swarm reputation (SR)-based decentralized autonomous organization (DAO) autonomous FL framework, SRFL. Within SRFL, we utilize DAO nodes as autonomous units for processing local services, effectively diminishing the communication overhead attributed to frequent interactions, the SR-based DAO committee oversees the FL process and ensures model consistency. SRFL seamlessly integrates FL with the distributed consensus process and introduces an SR-based consensus mechanism to enhance the collaboration process’s trustworthiness. SR utilizes a hierarchical reward and punishment mechanism, designed to equitably reward honest participants and hammer penalize those undermining the system’s stability. Through extensive experimentation with SRFL, employing different models and datasets, we have substantiated its superior performance in efficiency and robustness.
Federated learning (FL) emerges as a distributed training method in the Internet of Vehicles (IoVs), which promotes connected and automated vehicles (CAVs) to train a global model by exchanging models instead of raw data to protect data privacy. In this paper, consider the limitation of model accuracy and communication overhead in FL, as well as further verification in the real scenarios, we propose a directed acyclic graph (DAG) blockchain-based IoV system that comprises a DAG layer and a CAV layer for model sharing and training, respectively. Furthermore, a DAG blockchain-assisted asynchronous federated mutual learning (DAFML) algorithm is introduced to improve the model accuracy, which utilizes mutual distillation method to train a teacher-student model simultaneously. Moreover, a policy network will first be pre-trained by an expert data augmentation strategy through the DAFML algorithm via the behavior cloning, and be re-trained through the proposed proximal policy optimization (PPO) algorithm based autonomous driving framework. Finally, simulation results demonstrate that the proposed DAFML algorithm outperforms other benchmarks in terms of the model accuracy, distillation ratio and autonomous driving decision.
The proliferation of numerous portable mobile devices has made mobile crowd-sensing (MCS) systems a promising new trend. Traditional MCS systems typically outsource sensing tasks to the data aggregator (e.g., cloud server). They collect and analyze the provided sensing data through an appropriate truth discovery (TD) method to identify valuable data sets. However, existing privacy-preserving MCS systems lack transparency, enabling data aggregators to deviate from the specified protocols and allowing malicious users to provide false or invalid sensing data, thereby contaminating the resulting data sets. The lack of transparency and public verifiability in MCS systems undermines widespread adoption by preventing data requesters from confidently verifying data integrity and accuracy. To address this issue, we propose a transparent and privacy-preserving mobile crowd-sensing system with truth discovery (TP-MCS) constructed using zero-knowledge proof (ZKP) and the Merkle commitment tree. This scheme enables data requesters to effectively verify the correctness of the truth discovery service while ensuring data privacy. Furthermore, theoretical analysis and extensive experiments demonstrate that this scheme is secure and efficient.
The integration of Artificial Intelligence (AI) and Blockchain technology has opened new possibilities in secure distributed systems, addressing several inherent challenges in cybersecurity, trust management, and data privacy. This article explores the synergies between AI and Blockchain, focusing on how they can complement each other in creating secure, transparent, and efficient distributed systems. AI's capabilities in predictive analytics, machine learning, and decision-making combined with Blockchain's decentralized, immutable ledger offer enhanced security and operational efficiency for applications ranging from financial transactions to healthcare and supply chain management. Through a comprehensive analysis of recent advancements and case studies, we highlight the practical implications of these technologies in fostering secure distributed systems and provide a roadmap for their future integration.
The protection of personal privacy has become a paramount issue in the field of data science, with its significance continuously rising. Differential privacy technology has garnered significant attention for its effectiveness in preserving individual privacy. However, the implementation of differential privacy relies on a degree of trust in the entities or individuals executing the algorithms. This paper proposes an innovative solution: a verifiable differential privacy mechanism based on zero-knowledge proofs. This approach integrates differential privacy with zero-knowledge proof technology to not only verify the correctness of the differential privacy techniques but also enhance the transparency and reliability of the algorithms. Additionally, we have designed a publicly verifiable data release scheme that integrates commitment mechanisms and range proofs, ensuring that the range of published data noise does not exceed predetermined thresholds, thereby ensuring the utility of the data. Compared to other verifiable differential privacy solutions, our approach is unique in that it does not rely on the number of participants but is solely dependent on the precision of the data. This means that our computational cost will not increase with the addition of more participants. Finally, we conducted a performance evaluation of the solution, which only took 700ms to complete a single verification. On average, there was a 6% reduction in expectation and a 40% reduction in variance, demonstrating the enhancement of its data utility and the feasibility and effectiveness in practical applications.
Multi-Party Computation (MPC), as a distributed computing paradigm, is considered to be a potential solution for providing privacy-preserving for applications following the client-server model. However, traditional MPC solutions cannot satisfy the publicly verifiable requirement of the client-server model. In this paper, we propose a blockchain-based verifiable MPC solution using Pedersen's threshold secret sharing and Lifted ElGamal encryption. We first build a data distribution method using Pedersen's threshold secret sharing and symmetric encryption to protect the privacy of inputs while ensuring robustness. Then, we propose a result processing algorithm using Lifted ElGamal encryption to safeguard the privacy of the outputs. Finally, we employ non-interactive zero-knowledge proof and Pedersen commitment to publicly verify the correctness of the encrypted outputs in the smart contract, enabling the detection of malicious parties. Theoretical analysis indicates that the proposed method can publicly verify the correctness of outputs without revealing plain-text inputs and outputs, which satisfy the privacy-preserving requirements of the client-server model. Experimental evaluations have demonstrated that our proposed approach is efficient regarding computation overhead, communication overhead, and response time in the output verification phase while achieving stronger privacy and robustness.
Farhana Javed, Engin Zeydan, Josep Mangues‐Bafalluy, Kapal Dev · 5 authors
As edge computing gains prominence in Internet of Things (IoTs), smart cities, and autonomous systems, the demand for real-time machine intelligence with low latency and model reliability continues to grow. Federated Learning (FL) addresses these needs by enabling distributed model training without centralizing user data, yet it remains reliant on centralized servers and lacks built-in mechanisms for transparency and trust. Blockchain, a type of Distributed Ledger Technologies (DLTs) can fill this gap by introducing immutability, decentralized coordination, and verifiability into FL workflows. This article presents current standardization efforts from 3GPP, ETSI, ITU-T, IEEE, and O-RAN that steer the integration of FL and blockchain in IoT ecosystems. We then propose a blockchain-based FL framework that replaces the centralized aggregator, incorporates reputation monitoring of IoT devices, and minimizes overhead via selective on-chain storage of model updates. We validate our approach with IOTA Tangle, demonstrating stable throughput and block confirmations, even under increasing FL workloads. Finally, we discuss architectural considerations and future directions for embedding trustworthy and resource-efficient FL in emerging 6G networks and vertical IoT applications. Our results underscore the potential of DLT-enhanced FL to meet stringent trust and energy requirements of next-generation IoT deployments.
Sang-Hyeon Park, Jeonghyuk Lee, Seunghwa Lee, Jung Hyun Chun · 8 authors
Merging Internet (web2) identities with blockchain (web3) identities is increasingly important for enhancing user experience and ensuring regulatory compliance. However, conventional solutions that map web2 identities to web3 accounts often lead to privacy concerns and fragmented identifiers across networks. To address these challenges, we propose a new identity scheme named Address Abstraction (AA), which redefines blockchain address and signing systems while preserving key properties: uniqueness, immutability, and privacy-preservation. This approach eliminates the limitations of chain-specific identity systems, enabling users to interact with multiple blockchains using their web2 certificates and unified identifiers. This chain-agnostic identifier also promotes cross-chain compatibility. We further present Zero-Knowledge Address Abstraction (zkAA), an implementation of AA that uses zero-knowledge proofs to uphold AA's core properties. Additionally, a proof aggregation technique combines multiple proofs into one, achieving approximately 5.5 times gas cost savings during verification in real-world scenarios. As of August 2024, zkAA with proof aggregation incurs an additional cost of only $0.66 per transaction on Ethereum.