B. Siva Ganesh, Aditya Basantia, Soumya Sambit Mishra, Jagdish Behera · 5 authors
Healthcare systems are essential for patient care and data management but face persistent challenges with data security, interoperability, and transparency. Traditional centralized storage models increase data breach risks and limit patients’ control over personal health information, complicating seamless data sharing across providers. However, centralized storage systems still lack the security and interoperability required for robust data sharing. To address this, our study proposes a ZKP-based verification system integrated with NFT blockchain technology, aimed at enhancing identity verification while ensuring data privacy and patient control. In our method, NFTs serve as unique digital identifiers linked to patient records, while zero-knowledge proofs (ZKPs) confirm data ownership without disclosing sensitive information. Our findings indicate that this approach mitigates identity fraud risks, strengthens data security, and offers a patient-centered system for selective data access. Beyond patient records, our solution supports transparency in clinical trials and pharmaceutical supply chains, combating counterfeiting and improving quality control. In our paper, we proposed a ZKP-based verification system integrated with NFT blockchain technology to improve identity verification in healthcare, offering a robust, patient-centered approach to data security and integrity.
2 source records
Blockchain Technology Applications and Security
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
Vaishnavi S. Jadhav, Sakshi S. Niphade, S. S. Mahale
Secure data sharing has become a critical challenge in modern digital ecosystems due to increasing data breaches, lack of transparency, and dependence on centralized authorities. Traditional data-sharing mechanisms often suffer from single points of failure, unauthorized access, and limited trust among participating entities. Blockchain technology, with its decentralized, immutable, and cryptographically secure architecture, offers a promising solution to these challenges. This research paper explores the application of blockchain technology for secure data sharing, emphasizing its ability to ensure data integrity, confidentiality, transparency, and access control. The study examines how features such as distributed ledgers, smart contracts, and consensus mechanisms can be leveraged to manage data ownership, enforce access policies, and prevent tampering. Various blockchain-based data-sharing models are reviewed across domains such as healthcare, finance, and supply chain management. The paper also discusses key challenges, including scalability, privacy preservation, interoperability, and regulatory concerns. Finally, future research directions are highlighted to enhance the efficiency and practicality of blockchain-enabled secure datasharing systems
• The STipChain+ system employs a combination of cryptographic accumulators and verifiable computing techniques to create a stateless blockchain for smart contracts. This system offers a solution for the use of blockchain in big data scenarios. • A new hierarchical group commitment scheme for smart contracts based on the RSA cryptographic accumulator has been developed with the objective of reducing the storage overhead of contract evidence in the system by 99 • Design a composite RSA accumulator scheme for decentralised SGX Remote Attestation under stateless conditions. This scheme should transfer the trust in Intel to the trust in the group of nodes on the chain, and accumulate the certificate information through cryptographic accumulator technology. This should reduce the burden of storage on the system and reduce the dependence on a single organisation. • The experimental results demonstrate that, while maintaining decentralisation and security, STipChain+ can significantly reduce the storage pressure on consensus nodes, thereby enhancing system throughput. Blockchain is regarded as one of the most transformative and innovative technological developments of recent times, due to its decentralised nature. Nevertheless, the majority of public chains are currently grappling with the challenge of exponential data growth within the block chain system, largely due to the presence of high levels of data redundancy, which is resulting in a significant consumption of node storage resources. However, the scheme is subject to several limitations, including the storage overhead associated with contract evidence under the conditions of extensive smart contracts and the necessity of placing trust in the central node for the purpose of verifying smart contracts. The objective of this paper is to propose a new stateless blockchain architecture, designated as STipChain+. The STipChain+ system enables the real-time computation of contract evidence and the completion of the execution and verification of smart contracts without compromising the decentralization of the blockchain. The layered grouping design of smart contracts enables the reduction of the data involved in generating contract evidence, thus resolving the shortcomings of the existing stateless blockchain scheme, which necessitates the pre-calculation of evidence and its subsequent update in a sequential manner. Furthermore, the storage of substantial amounts of evidence is also alleviated. In addition, the issue of the trusted third party when verifying smart contracts is further addressed by proposing a composite RSA accumulator certificate commitment scheme with a new smart contract execution logic and transaction verification method. The results of experimental studies indicate that STipChain+ reduces the storage requirements for state data by 99% in comparison to existing blockchain storage optimisation schemes. This is achieved without the introduction of third-party trusted entities, and the reduction in storage requirements can be verified in a fixed amount of time for any smart contract.
Cloud computing has transformed data storage, accessibility, and enterprise operations; however, it has also increased exposure to sophisticated cyber threats. Traditional centralized Identity Management Systems (IDMs) often suffer from critical vulnerabilities such as a single point of failure, where the compromise of a central authority can expose sensitive user credentials. This research proposes ZKP-Shield, a security framework that integrates Non-Interactive Zero-Knowledge Proofs (NIZKPs) with a Software-Defined Perimeter (SDP) to create a secure and invisible cloud authentication environment. The proposed architecture eliminates the need to transmit passwords or sensitive identity data by allowing users to mathematically prove their identity without revealing secret information. Simultaneously, the SDP layer conceals cloud resources from unauthorized users by enforcing a “dark cloud” model, where services remain hidden until authentication is successfully verified. The framework employs cryptographic techniques such as the Discrete Logarithm Problem and the Fiat–Shamir heuristic to transform interactive proofs into efficient non-interactive authentication processes. Experimental simulations conducted in a distributed cloud environment demonstrate that the ZKP-SDP integration significantly reduces attack surfaces, prevents credential-based attacks, and maintains acceptable latency for enterprise applications. The results indicate that combining cryptographic identity verification with network invisibility provides a scalable and resilient security model for modern cloud infrastructures.
Tuan Nguyen Kim, Ha Nguyen Hoang, Son Doan Trung, Lam Nguyen
Cloud computing has become a vital platform for large-scale data analytics, yet it poses significant privacy challenges when handling sensitive information, especially in healthcare and financial domains.Homomorphic Encryption (HE) enables computation on encrypted data, providing strong privacy guarantees, but traditional HE frameworks lack efficient query representation, do not protect query patterns, and cannot prove correctness of cloud-side computations.This paper proposes HE-Cloud, an integrated privacy-preserving framework that combines DSL-driven query compilation, HE, Zero-Knowledge Proofs (ZKP), and Oblivious RAM (ORAM).Our framework allows clients to express high-level analytical queries, securely executes them on encrypted data, protects query access patterns via ORAM, and returns verifiable results through ZKP.A proof-of-concept implementation using the Pima Diabetes dataset demonstrates feasibility: Average glucose computations can be performed entirely on encrypted data with sub-second latency for homomorphic operations and minimal accuracy loss (approximately 0.001).Scalable secure analytics, extendable to larger datasets and machine learning tasks.
Every standard signature scheme enforces one property: only the key holdercan sign. What the key holder signs is unconstrained. Policy enforcement-- spending limits, rate limits, access control -- lives in smartcontracts, middleware, or governance: layers that can be upgraded,bypassed, or exploited. We call this the software-layer assumption:compliance holds only if the enforcing code is correct and unmodified. We eliminate this assumption. We introduce behavior-bound signatures(BBS), in which a policy constraint delta(x) < epsilon is committed atkey generation and enforced inside the signature's zero-knowledge proof.If the action violates the policy, the ZK constraint system isunsatisfiable -- no witness, no proof, no signature. This is not asoftware check. It is a mathematical impossibility. No software canoverride. Unlike policy-based signatures (where an authority imposes policy onsigners), BBS is self-committed: the signer binds their own futurebehavior at key generation, and even the signer cannot later violate orrevoke this commitment. We formalize this as policy-soundness (PS-CMA), a security modelstrictly stronger than EUF-CMA, and prove it under standard assumptions(Pedersen binding, Poseidon CR, ZK knowledge soundness). From thissingle primitive, five independent consequences follow -- not as separatedesigns, but as necessary implications of one cryptographic root: (A) Compliance safety under f <= n-1 Byzantine faults, decoupled from honest-quorum assumptions.(B) O(1) verification and audit via a single ZK check and Pedersen homomorphic aggregation.(C) Elimination of the virtual-machine execution layer for policy-constrained transactions.(D) A gasless ledger: branch C removes metering, while ZK-encoded rate limits make spam mathematically nonexistent.(E) The first cryptographic guarantee that a compromised autonomous AI agent cannot exceed its authorized behavioral envelope.
Open access
3 source records
Cryptography and Data Security
Advanced Authentication Protocols Security
Physical Unclonable Functions (PUFs) and Hardware Security
The proliferation of cloud infrastructures has intensified concerns regarding data security, integrity, identity and access management, and user privacy. Despite recent advances, existing solutions often lack comprehensive integration of privacy-preserving mechanisms, dynamic trust management, and cross-provider interoperability. This study proposes an AI-enabled, zero-trust, blockchain-fused identity management framework for secure, privacy-preserving multi-cloud environments. The framework integrates homomorphic encryption with differential privacy for aggregate-level protection and secure multi-party computation for collaborative data processing. The proposed system was validated in a simulated multi-cloud environment using CloudSim, Ethereum blockchain, and AWS EC2. Experimental results indicate homomorphic encryption latency of approximately 450ms per operation and statistically significant security improvements (t(128) = 12.47, p < 0.001), privacy (t(95) = 8.93, p < 0.001), and throughput (t(156) = 15.21, p < 0.001). The framework achieved differential privacy with ε = 0.1 while retaining 99.2% data utility, and demonstrated a 34% improvement in processing speed over conventional differential privacy approaches. In addition, the implementation was observed to be 2.3× faster than BGV-based configurations, with 45% lower memory consumption than CKKS and a 67% reduction in ciphertext size relative to baseline implementations. From an operational perspective, the framework shows a 23% reduction in security management costs, a 31% improvement in resource utilization efficiency, and an 18% decrease in compliance audit expenses. The model further indicates a 27% reduction in total cost of ownership (TCO) compared with multi-vendor security solutions, a projected return on investment (ROI) within 14 months, and an 89% reduction in security incident response costs under the evaluated conditions.
Zero-knowledge (ZK) proofs can be formally correct while their deployment pipelines remain fragile. The practical failure modes often arise not at the proof layer, but at the layers where trust is injected: setup, key custody, entropy sourcing, implementation, governance, and deployment interfaces. This paper models ZK pipelines as trust-graphs and proposes an audit-first separation between (i) proof correctness and (ii) pipeline integrity. The core claim is structural: for any non-trivial ZK pipeline, there exists at least one responsibility binding layer R where trust is required and accountability must be assigned. Removing a ceremony does not remove responsibility; it relocates it. We provide minimal definitions, a traceable audit interface, and compact structural examples intended to support reproducible security reviews without overclaiming. Keywords: zero-knowledge; trusted setup; CRS; SNARK; STARK; trust graph; audit; governance; pipeline integrity; responsibility relocation
This study develops a blockchain-enabled framework to improve educational administration data sharing by addressing persistent challenges related to data silos, security risks, trust deficits, and inefficient approval workflows that hinder cross-institutional collaboration. The approach examines the alignment between blockchain capabilities and data-sharing requirements and designs a consortium-chain implementation pathway that integrates distributed ledgers, smart contracts, encryption, and dynamic authorization across both standardized and emerging scenarios. A multi-province pilot involving 40 institutions was conducted to evaluate impacts on efficiency, security, and user trust. The results demonstrate an 89% reduction in processing time, near-zero internal tampering, substantial decreases in error rates, and significant improvements in perceived data credibility and clarity of rights and responsibilities. These findings indicate that blockchain can function as a foundational trust infrastructure, supporting the development of secure, accountable, and scalable educational data ecosystems.
The lattice-based encryption is one of the most appropriate choices to secure the blockchain technology during the post-quantum era withstanding security against a quantum adversary attack. The authors study lattice-based cryptography and integrate it with the blockchain architecture in order to address gaps that have recently been exposed because of the continued advances with quantum systems. However, a majority of the classical cryptographic designs such as RSA and ECC are designed around the difficulty of particular mathematical problems, one of which is the Shor algorithm, which makes them highly susceptible to quantum algorithms. Learning with Errors (LWE) and Short Integer Solution (SIS). The paper will discuss the feasibility of lattice-based digital signatures, zero-knowledge proofs, and encryption systems that should be deployed in blockchain so that the integrity of data should be maintained, transactions should be secure, and privacy of users should be preserved. Furthermore, it introduces performance features of blockchain where it considers the lattice-based cryptographic systems where it entails scalability, complexity of computing, and latency. The results are then employed to support the options of encryption with lattices to lay the groundwork for the architecture to quantum-resistant blockchain-based frameworks, and the ultimate stage of secure and scalable decentralized networks in the post-quantum world.
The rapid growth of decentralized systems in theWeb3 ecosystem has introduced numerous challenges, particularly in ensuring data security, privacy, and scalability [3, 8]. These systems rely heavily on distributed architectures, requiring robust mechanisms to manage data and interactions among participants securely. One critical aspect of decentralized systems is key management, which is essential for encrypting files, securing database segments, and enabling private transactions. However, securely managing cryptographic keys in a distributed environment poses significant risks, especially when nodes in the network can be compromised [9]. This research proposes a decentralized database scheme specifically designed for secure and private key management. Our approach ensures that cryptographic keys are not stored explicitly at any location, preventing their discovery even if an attacker gains control of multiple nodes. Instead of traditional storage, keys are encoded and distributed using the BFLUT (Bloom Filter for Private Look-Up Tables) algorithm [7], which enables secure retrieval without direct exposure. The system leverages OrbitDB [4], IPFS [1], and IPNS [10] for decentralized data management, providing robust support for consistency, scalability, and simultaneous updates. By combining these technologies, our scheme enhances both security and privacy while maintaining high performance and reliability. Our findings demonstrate the system's capability to securely manage keys, prevent unauthorized access, and ensure privacy, making it a foundational solution for Web3 applications requiring decentralized security.
This article explores the role of zero-knowledge cryptographic proofs as a basic trust mechanism for financial and government digital services. The theoretical section explains how such proofs shift compliance verification from a "reveal data and verify" mode to a "prove property and admit access to service" mode, thereby reducing transaction costs, mitigating information asymmetries, and limiting agency costs. Drawing on insights from new institutional economics and mechanism theory, it demonstrates how formalized verifiability improves rule robustness, makes truthful reporting individually rational, and reduces the negative externalities of leaks. The analytical section systematizes classes of constructions, highlighting tradeoffs between proof size, latency, the need for trusted configuration, and operational risks. The practical section describes applications in payment infrastructure, lending, insurance, cross-border settlements, digital identity, and ledger management: range constraint verification, threshold and attribute verification, verifiable computation, and selective disclosure. It is demonstrated that with proper design, it is possible to combine data minimization with targeted transparency and effective enforcement, including in projects involving central bank digital money and pan-European identity wallets. Implementation metrics are discussed: marginal cost of proof and verification, average latency, fault tolerance, and the proportion of cases where primary documents are replaced with proof of property.
Blockchain technology, with its characteristics of decentralization, immutability, auditability, and traceability, has gradually become a core infrastructure in the digital economy era, demonstrating great potential in fields such as finance, government services, and the Internet of Things (IoT). However, as the scale of blockchain networks expands and data volumes surge, issues such as full-node storage redundancy, limited transaction throughput, and inefficient synchronization of historical data have become increasingly prominent, severely restricting the large-scale application of blockchain systems. The storage scalability problem faced by blockchain is therefore becoming more critical. To address the challenge in which on-chain storage expansion still cannot meet the demand for large-scale data storage, a storage method combining the InterPlanetary File System (IPFS) with blockchain, referred to as IPFS-BC, is proposed. In IPFS-BC, large-scale raw data are stored in the decentralized and content-addressable IPFS network, while the blockchain only retains the unique content identifier (CID) hash and related metadata. Through smart contracts enabling dynamic permission management and fine-grained access control, efficient interaction and collaborative storage between on-chain and off-chain systems are achieved. In this work, file upload simulation experiments were conducted, and two evaluation indicators—storage space consumption and storage performance (file read/write time and speed)—were used to compare three storage approaches: Distributed Hash Table (DHT)-based off-chain storage, Financial Blockchain Shenzhen Open Source (FISCO BCOS) on-chain storage, and the IPFS-BC on-chain/off-chain collaborative storage model. Experimental results show that the IPFS-BC model reduces storage space consumption by approximately 75% compared with FISCO BCOS blockchain storage when storing file data, significantly decreasing data redundancy. Moreover, IPFS-BC ensures system security during the on-chain process, and through the automated management and auditing provided by smart contracts, it effectively enhances system security and realizes scalable on-chain/off-chain collaborative storage.
The InterPlanetary File System (IPFS) has been extensively promoted as a decentralized, censorship-resistant, and fault-tolerant storage protocol. This paper systematically dismantles these claims by demonstrating four critical and compounding vulnerability classes: (1) the structural dependency on centralized pinning services such as Pinata, Infura, and Web3.Storage, where compromising a single provider's dashboard or API effectively eliminates supposedly “immutable” content; (2) the futility of self-hosted pinning nodes as a mitigation strategy, given their susceptibility to targeted Distributed Denial-of-Service (DDoS) attacks capable of rendering them permanently unreachable; (3) the catastrophic implications of a cryptographic backdoor or collision discovery in SHA-256 or SHA-3 (Keccak), which would enable arbitrary content substitution while preserving valid Content Identifiers (CIDs), thereby destroying IPFS's fundamental integrity guarantees; and (4) the vulnerability of distributed pinning strategies to gossip-protocol-based reconnaissance attacks, wherein a state-level adversary (e.g., NSA, GCHQ, or equivalent) can enumerate all nodes hosting a target CID by compromising a single peer and leveraging protocol-level metadata propagation to systematically identify and neutralize every replica simultaneously. We formalize each attack vector with mathematical models, provide proof-of-concept algorithms, analyze the compounding effects of multi-vector attacks, and demonstrate that even the most sophisticated defense-in-depth strategies fail against a sufficiently resourced adversary. Our analysis conclusively establishes that IPFS, as deployed in practice, provides no meaningful censorship resistance and constitutes what we term Decentralization Theater—a system that employs the aesthetics and terminology of decentralization while maintaining the vulnerability profile of traditional centralized architectures, augmented by a dangerous false sense of security.
With the deepening application of big data technology across various fields, data faces increasingly severe threats of privacy leakage and security risks throughout its entire processing lifecycle. Traditional protection mechanisms, which focus on static data or isolated stages, struggle to address the systemic risks arising from the continuity, dynamism, and complexity of big data processes. This paper aims to systematically investigate the collaborative mechanisms for privacy protection and data security within the big data processing pipeline. First, it analyzes the inherent vulnerabilities at each stage of data processing, as well as the limitations faced by key technologies such as anonymization, differential privacy, and secure multi-party computation when integrated into practical workflows. Next, it explores the evolution of process-oriented encryption strategies, including attribute-based encryption supporting dynamic policies, homomorphic encryption optimized for practical use, and verifiable computation and zero-knowledge proofs that ensure computational integrity. Finally, the paper constructs a dynamic balancing model for privacy, security, and utility, and proposes forward-looking systematic collaborative mechanisms such as distributed auditing based on trust chains and adaptive response. These contributions provide theoretical reference and technical pathways for building next-generation inherently secure big data processing architectures.
João Gião, Fernando Luis-Ferreira, Joao Sarraipa, Ricardo Jardim-Gonçalves
Nowadays, with the increased integration of cloud-computing, data integrity continues to be a problem in the current eHealth sector. This security principle is considered fundamental to ensure the accuracy and reliability of data by ensuring protection from unauthorized and illicit tampering. The present work aims to demonstrate the ability for the Distributed Ledger Technology (DLT) to provide trust and confidence in the healthcare infrastructure for patients, healthcare professionals and policy makers. The DLT has the potential to become one of the most reliable solutions for the many challenges facing the healthcare industry for its potential to enable more secure, transparent, and equitable data management. Although much documentation exists about applications in this domain, it is mostly presented in high-level conceptualization, without detailing the actual development or implementation. This document proposes a metadata-based approach to protect healthcare data integrity in compliance with GDPR, ensuring trustworthy data access for end-users, while demonstrating that the solution can be deployed on low-resource hardware with minimal adaptation effort and time constraints.
Open access
Security and Verification in Computing
Cloud Data Security Solutions
Physical Unclonable Functions (PUFs) and Hardware Security
Ensuring the reliable, auditable, and privacy-oriented distribution of donations in disaster logistics constitutes a critical challenge due to multi-stakeholder coordination difficulties and the risk of misuse. This study presents a modular architecture, named SecureRelief, operating on a permissioned Hyperledger Fabric platform. The architecture integrates authentication based on Self-Sovereign Identity (SSI), Decentralized Identifiers (DID), and WebAuthn, together with Attribute-Based Access Control (ABAC), and enables the verification of delivery evidence through privacy-preserving validation using zero-knowledge proofs (ZKP). Documents are stored off-chain on the InterPlanetary File System (IPFS), while only cryptographic summary (hash) values sufficient for integrity verification are maintained on-chain. In scenario-based laboratory experiments, the blockchain layer demonstrated low latency (p95 < 16 ms) and stable transaction throughput, confirming its scalability. While the API layer handled high burst request loads with a 0% error rate, the additional computational overhead introduced by the integrated privacy-preserving (ZKP) mechanisms kept the end-to-end transaction latency within acceptable limits for disaster management applications (3.5–4.5 s).
Edge-Cloud-Systeme ermöglichen Anwendungen, die auf Basis von Daten intelligenter Objekte und Infrastrukturen wirtschaftliche Mehrwerte schaffen und gesellschaftliche Herausforderungen adressieren. Dies bedarf häufig eines Teilens von Daten mit Partnern in etablierten Wertschöpfungsnetzwerken oder entlang des Edge-Cloud-Kontinuums. Eine fundamentale Anforderung ist dabei die Sicherstellung des Schutzes sensibler betrieblicher und personenbezogener Informationen. Während die lokale Datenverarbeitung an der Edge ein grundlegendes Maß an Datenschutz und Informationssicherheit ermöglicht, reicht ein ausschließlicher Rückgriff auf diese Maßnahme oftmals nicht aus, um diese Anforderungen bei gleichzeitiger Erzielung der Mehrwerte datengetriebener Anwendungen zu erfüllen. Beispielsweise besteht häufig die Notwendigkeit, schützenswerte Daten an zentraler Stelle, beispielsweise der Cloud, zu aggregieren, um zu reichhaltigen Erkenntnissen zu gelangen oder die Integrität der verwendeten Daten sicherzustellen. An dieser Stelle rücken Privacy-Enhancing-Technologies (PET) in den Fokus, die Mechanismen umfassen, um Datenschutz, Informationssicherheit und Datensouveränität „by-Design“ in Systemarchitekturen zu integrieren. Bei PET handelt es sich um eine Klasse von individuellen Werkzeugen, die jeweils spezifische Informationssicherheitsanforderungen und -risiken in Edge-Cloud-Systemen adressieren können. Für Praktiker ergibt sich die Herausforderung, auf Basis der spezifischen Bedarfe ihrer Anwendungen und der verfügbaren PET-Werkzeuge passende PET-Strategien zu entwickeln, die eine Realisierung der Edge-Cloud-Anwendung unter Berücksichtigung der Anforderungen und Risiken für die Informationssicherheit ermöglichen. Diese Orientierungshilfe unterstützt Praktiker bei der Entwicklung eigener PET-Strategien für Edge-Cloud-Anwendungen. Sie bietet Hilfestellungen bei der Identifikation von Informationssicherheitsanforderungen und -risiken, der Auswahl passender PET-Werkzeuge und deren Integration in das Anwendungsdesign. Zentrales Element der Studie ist hierbei die Analyse von PET-Werkzeugen in Edge-Cloud-Anwendungskontexten. Die Orientierungshilfe zeigt, wie PET-Werkzeuge zur Umsetzung von Informationssicherheit beitragen können, welche Voraussetzungen für ihren Einsatz in spezifischen Szenarien geschaffen werden müssen und welche Implikationen sich aus dem Praxiseinsatz der PET-Werkzeuge ergeben. Dazu beruft sich die Orientierungshilfe auf die Erkenntnisse der Early-Adopter von Edge-Cloud-Systemen und PET aus den Projekten des Technologieprogramms „Edge Datenwirtschaft“ des Bundesministeriums für Forschung, Technologie und Raumfahrt (BMFTR). Die Inhalte dieser Orientierungshilfe adressieren insbesondere Systemarchitektinnen und -architekten und Datenschutzbeauftragte, die Datenverarbeitungsprozesse in Edge-Cloud-Systemen datenschutzkonform gestalten müssen. Ausgehend von der Darstellung möglicher Risiken wie physischen Angriffen und Cyberangriffen, unsicherer Datenhoheit, Insiderbedrohungen und Fehlkonfigurationen sowie Anforderungen wie Datenminimierung, Integrität, Zweckbindung und die Verhinderung von Datenabflüssen „by-Design“ in Edge-Cloud-Anwendungen analysiert diese Orientierungshilfe fünf konkrete PET-Werkzeuge in praxisnahen Anwendungsszenarien: § Hardware-Schlüssel für die sichere Authentifizierung ohne personenbezogene Daten in der Lebensmittelwirtschaft, § Federated-Learning für kollaboratives KI-Training ohne Rohdatenweitergabe in der industriellen Fertigung, § Compute-to-Data zur Ausführung von Analysen in der Umgebung des Dateneigentümers in der industriellen Fertigung, § Zero-Knowledge-Proofs für datenbasierte Nachweise ohne Offenlegung sensibler Daten in der Energiewirtschaft, § Trusted-Execution-Environments für vertrauliche Berechnungen in isolierten Hardware-Umgebungen in der Energiewirtschaft. Zudem präsentiert die Studie vier Handlungsfelder und zugehörige Handlungsempfehlungen für den erfolgreichen Einsatz von PET-Werkzeugen in Edge-Cloud-Anwendungen: 1) Aufbau vertrauenswürdiger Partnerökosysteme und Schaffung notwendiger Anreizmechanismen, 2) Schaffung betrieblicher Voraussetzungen für den PET-Einsatz inklusive Schulung und Akzeptanzförderung, 3) Sicherstellung technischer Validität und Integrationsfähigkeit der PET in den Anwendungskontext, 4) Gewährleistung regulatorischer Konformität der PET-gestützten Edge-Cloud-Anwendung. Im Zuge der steigenden Relevanz von Edge-Cloud-Systemen und dem Teilen von Daten zur Generierung von Datenwertschöpfung bei mindestens gleichbleibenden Anforderungen an Datenschutz und Informationssicherheit wird der Einsatz von PET zu einem entscheidenden Erfolgsfaktor. PET ermöglichen nicht nur die Einhaltung regulatorischer Vorgaben, sondern schaffen die Grundlage für vertrauensbasierte Kooperationen in komplexen Edge-Cloud-Ökosystemen. Unternehmen, die zukünftig gemeinsam datengetriebene Wertschöpfung betreiben wollen, sollten sich aktiv mit PET beschäftigen.
R. Priyadarshini, K. Reddy Geethika, V. Sravya, K. Pujitha · 6 authors
The increasing adoption of cloud computing has revolutionized data storage and accessibility, but it has also presented severe security and privacy issues, particularly in the context of developing quantum computing threats. Despite being effective against classical assaults, conventional encryption and password protection mechanisms are becoming more susceptible to quantum algorithms that can compromise current cryptographic systems. This paper presents QPause, a Password-Protected, Quantum-Resilient Data Offloading for Cloud Platforms forsafe cloud storage, in response to these new threats. To guarantee data confidentiality, integrity, and resilience against both classical and quantum adversaries, the suggested system combines sophisticated password-based authentication methods with post-quantum cryptography approaches. QPause uses zero-knowledge proof methods to enable secure verification without disclosing sensitive credentials, and it leverages lattice-based encryption to safeguard data that is outsourced. Additionally, the system integrates efficient key management and access control mechanisms to boost scalability and user confidence. QPause delivers strong resilience to quantum attacks while preserving low processing overhead and excellent usability for practical cloud applications, according to experimental evaluation. This framework offers a solid solution for secure and future-proof data outsourcing, bridging the gap between existing cloud services and the next generation of quantum-secure computing environments.
The increasing cases of data breaches, data tampering and information loss have posed an immediate demand to secure file sharing systems that guarantee privacy and verifiable integrity. The paper presents an end-to-end (E2E), encrypted file-sharing system based on the combination of client-side encryption and privately hosted, blockchain-based, notary service. All the encryption is done locally with the aid of the Networking and Cryptographic Library (NaCl) box primitive, and only the approved recipients are allowed access to the shared files with valid credentials. A lightweight local backend stores the encrypted data (ciphertext) and operates with public keys and user metadata; however, it does not access plaintext files and cannot decrypt them, keeping the entire data confidential. In order to offer non-repudiation, a hash of every encrypted file is computed with the Secure Hash Algorithm (SHA-256) and the result is stored in a private Hyperledger Fabric network. This provides an audit trail that can never be changed or tampered with and will not reveal the true files or encryption keys. In our prototype, sending to the blockchain ledger creates latency on an order of seconds 2.3 seconds in a 2.35-second total file-send path and file integrity verification by hash requires an average of 183 milliseconds. The suggested architecture is a good way to ensure confidentiality, proof of authenticity and integrity, and is a convenient way to provide the organization with a requirement to exchange files privately.
Ensuring the integrity and efficiency of academic record verification has become increasingly important for modern educational institutions. This study presents a blockchain-powered verification system specifically designed for confirming the credentials of graduated students from Mekelle University. By integrating Ethereum blockchain with GraphQL APIs, the system enhances transparency and reliability in the verification process. The university’s existing system, built with Ruby on Rails, lacked automated verification, relied heavily on centralized control, and was prone to delays and potential data tampering. To overcome these issues, a decentralized application (DApp) was developed using various tools, including Ethers.js, Node.js, Ganache, Apollo Server, GraphQL, and React. This application enables the secure submission and retrieval of student records through Ethereum smart contracts. Data can be uploaded via CSV files or manually entered through forms, and each record is retrievable using a unique student ID, ensuring data immutability and public verifiability. Stakeholder feedback was gathered through interviews, and thematic analysis was used to assess the system’s usability, scalability, and trustworthiness. Findings showed strong support for the blockchain-based system, with over 90% of participants agreeing that it improves transparency and reduces the risk of credential fraud. This research demonstrates a feasible bridge between traditional university information systems and decentralized technologies, highlighting both the practicality and institutional readiness for adopting blockchain in higher education.
Nacereddine Sitouah, Francesco Bruschi, Stefano De Cillis
The passing of the eIDAS amendment marks an important milestone for EU countries and changes how they must manage digital credentials for both public services and businesses. Italy has led in adopting eIDAS, first with CIE and SPID identity schemes, and now with the Italian Wallet (IO app) aligned to eIDAS 2.0. Self-Sovereign Identity (SSI) is a decentralized model born from the success of Distributed Ledgers, giving individuals full control over their digital identity. The current eIDAS 2.0 and its implementation acts diverge from SSI principles, rendering the European Digital Identity Wallet (EUDIW) centralized and merely user-centric, prioritizing security and legal protection over true self-sovereignty. This paper proposes an architecture that enables the use of IT Wallet credentials and services in an SSI-compliant environment through Trusted Execution Environments and Zero-Knowledge Proofs.
Student Information Management Systems (SIMS) are mission critical to higher learning institutions because they govern admissions, registration, fee status, assessment results, progression, graduation, and alumni verification. Yet conventional centralized SIMS architectures may face persistent challenges: record tampering risk, weak end‑to‑end audit trails, fragmented reconciliation across units and campuses, slow and costly credential verification, and limited interoperability with external verifiers.This study develops a conceptual and technical framework for applying Distributed Ledger Technology (DLT) to strengthen SIMS at the Tanzania Institute of Accountancy (TIA). The framework positions DLT as a trust and interoperability layer rather than a replacement for SIMS. It proposes (i) an architecture that anchors cryptographic proofs on‑chain while keeping personal data off‑chain; (ii) standards based digital credentialing using W3C Verifiable Credentials and Decentralized Identifiers; (iii) governance and compliance controls aligned to Tanzanian data protection and cybercrime regimes; and (iv) an implementation roadmap and evaluation metrics grounded in established information systems theories. To make design trade‑offs concrete, the study includes simulated calculations and figures for event volume, storage growth, verification turnaround time, and risk intensity across rollout phases. The framework provides a practical blueprint for a staged pilot at TIA starting with credential verification and assessment audit‑trail anchoring before scaling to additional workflows.
Contemporary enterprises encounter substantial difficulties managing information dispersed across varied cloud infrastructures, geographically separated facilities, and specialized application environments. Traditional centralized frameworks, including consolidated data repositories and analytical warehouses, demonstrate limited capacity to deliver the required velocity, accuracy, and contextual intelligence necessary for sustained digital progression. Multi-Cloud Data Mesh constitutes a transformative architectural approach, advocating decentralized, domain-centric methodologies that systematically address intricate governance complexities and interoperability obstacles at the organizational scale. This framework establishes operational foundations through four fundamental tenets: Domain-Oriented Ownership, Data as a Product, Self-Serve Platform, and Federated Computational Governance. These architectural pillars collectively resolve decentralization imperatives, scalability prerequisites, interoperability complications, and sovereignty considerations inherent in modern enterprise ecosystems. Through ownership distribution to specialized domains, product-oriented information treatment, self-service platform provisioning, and federated governance implementation, organizations attain necessary scalability, operational flexibility, and contextual precision for continuous innovation across sophisticated multi-cloud landscapes