The public blockchain lacks data confidentiality. Although a level of anonymity seems guaranteed, it is still possible to link transactions and disclose related information. A solution to the privacy problem is to use cryptography in transactions, however this can lead to increased costs and slowdown in network throughput. Recent works experiment with advanced cryptography, in particular Zero-Knowledge proofs (ZK-proofs) can be supplied within a transaction to prove its validity, without revealing sensitive information. We analyze solutions that adopt ZK-proofs, such as Confidential Transactions (CTs). Several challenges emerge depending on both the zero-knowledge system and the balance model considered (UTXO, hybrid or account model). For ZK-proofs, systems that do not introduce additional trust are required. On the other hand, the account model is the most flexible for addressing security challenges. Moreover, CTs do not fully exploit the potential of ZK-proofs, since each transaction comes with one or more ZK-proof for a single transfer. Within this paper, we present ZeroMT, a novel multi-transfer private payment scheme for account-based blockchains. Drawing inspiration from Zether, our approach extends their work to develop a payment model that supports multiple payees within a single transaction. This also benefits scalability: ZeroMT enriches the CTs with the aggregation property, i.e., the batch verification of multiple transfers from a single and aggregate proof. We show that in our extended model the overdraft-safety and privacy security properties still hold. We provide an implementation and evaluation of ZeroMT, which shows the benefits of aggregating multiple transfers.
Rahma Mukta, Hye-Young Paik, Qinghua Lu, Salil S. Kanhere
We propose CredAct, a user activity verification designed with data minimisation to protect privacy. Many Benefits Schemes, such as discount offers, loyalty programs, and incentive systems, require verification of user activity (e.g., buying healthy food, step counts) in their business processes. These service providers can collect a large amount of users’ personal information, and often users do not have fine-grained control over the scope of data disclosure. In CredAct, we propose a Self-Sovereign Identity based framework implemented on blockchain that enables users participating in a benefits scheme to minimise data sharing during the submission and verification of data. We use a smart contract-based function along with a Zero-Knowledge Proof cryptographic commitment scheme, that forces the entities involved in the business process to collect or disclose only the required (minimum) data to fulfill the intended purpose. The evaluation shows that the system is feasible with minimal operational overheads compared to traditional cryptographic techniques. We also perform a qualitative privacy and security analysis considering relevant threats to CredAct.
Blockchain is an immutable and distributed ledger managed by all participants, enhancing data transparency and safety. Immutability is a crucial factor in ensuring data transparency and safety. However, there is a significant demand for redaction of the ledger due to security and privacy concerns. In this paper, we propose a redactable blockchain solution based on meta-transactions using zk-SNARK to improve anonymity in a decentralised manner. A one-time cryptographic key generation scheme, designed for a signature generation scheme, produces different keys for each transaction to enhance security and privacy by preventing identity tracing. We also employ zk-SNARK to hide the information of cryptographic keys and signatures. The modification history for each transaction is linked together, and the verification time is significantly short, around 10 msec, even when transactions have multiple modifications. Furthermore, we introduce a redaction fee scheme for transaction owners to maintain concise modification histories encouraging removal instead of modification to minimise the performance overhead associated with this redaction approach.
The sixth-generation (6 G) wireless networks are envisioned to build a data-driven digital world with widespread Artificial Intelligence (AI). Federated learning (FL) is a distributed AI paradigm that coordinates different data owners to train shared AI models cooperatively. However, traditional FL faces challenges in practically deploying in 6 G networks: (i) the central server becomes the bottleneck and fails to identify clients' malicious behaviors, and (ii) the lack of incentive mechanisms makes heterogeneous nodes hard to collaborate when considering unilateral returns. To address the above challenges, we first propose a blockchain-enabled FL (BFL) framework where clients' malicious behaviors could be identified without a central server. Then we propose a Bayesian game-driven incentive mechanism to encourage honest nodes to provide valid models while hindering the training interference from malicious clients. Moreover, we propose a dynamic data contribution scheme to schedule data resources equitably while ensuring model performance. Finally, a Proof-of-Incentive consensus mechanism is designed as benign impetuses to guide the system toward the direction of more secure model aggregation and higher incentives. Experimental results show that our proposed schemes can obtain high-precision models even with malicious clients and effectively motivate honest nodes to join FL in 6 G networks.
The combination of blockchain and Internet of Things technology has made significant progress in smart agriculture, which provides substantial support for data sharing and data privacy protection. Nevertheless, achieving efficient interactivity and privacy protection of agricultural data remains a crucial issues. To address the above problems, we propose a blockchain-assisted federated learning-driven support vector machine (BAFL-SVM) framework to realize efficient data sharing and privacy protection. The BAFL-SVM is composed of the FedSVM-RiceCare module and the FedPrivChain module. Specifically, in FedSVM-RiceCare, we utilize federated learning and SVM to train the model, improving the accuracy of the experiment. Then, in FedPrivChain, we adopt homomorphic encryption and a secret-sharing scheme to encrypt the local model parameters and upload them. Finally, we conduct a large number of experiments on a real-world dataset of rice pests and diseases, and the experimental results show that our framework not only guarantees the secure sharing of data but also achieves a higher recognition accuracy compared with other schemes.
In today's data-driven world, the convergence of advanced machine learning techniques with privacy concerns has prompted the development of innovative approaches to safeguard sensitive information while harnessing the power of data analytics.This research article delves into the realm of privacy-preserving machine learning algorithms, specifically focusing on methodologies that embrace the concept of local information privacy.The abstract provides a succinct overview of the key themes, methodologies, and implications elucidated within the paper.The abstract begins by contextualizing the contemporary landscape, emphasizing the proliferation of big data and the attendant privacy challenges it poses.It highlights the dichotomy between the utility of machine learning algorithms and the imperative of preserving individuals' privacy, setting the stage for exploring novel solutions.Central to the abstract is the conceptual framework of local information privacy, which forms the cornerstone of privacy-preserving machine learning algorithms discussed in the paper.The abstract delineates the theoretical foundations of this framework, elucidating how decentralized computation and differential privacy principles contribute to safeguarding sensitive data.Moving beyond theoretical underpinnings, the abstract provides insights into the methodologies employed in privacy-preserving machine learning.It outlines diverse approaches such as federated learning, secure multi-party computation, and homomorphic encryption, showcasing their utility in mitigating privacy risks while enabling collaborative model training and inference.Furthermore, the abstract underscores the practical implications of adopting privacy-preserving machine learning algorithms leveraging local information privacy.It cites examples across various sectors, including healthcare, finance, and IoT, where decentralized learning frameworks empower organizations to derive actionable insights from data while upholding privacy regulations and ethical standards.The abstract concludes by delineating potential avenues for future research and development in the field.It emphasizes the importance of scalability, efficiency, and robustness in privacy-preserving techniques, calling for interdisciplinary collaborations to address emerging challenges and navigate regulatory landscapes effectively.The abstract encapsulates the essence of the research article, providing a concise yet comprehensive overview of privacy-preserving machine learning algorithms using local information privacy.It serves as a gateway for readers to delve deeper into the nuances of the topic while highlighting its significance in addressing contemporary privacy challenges in the era of big data and advanced analytics.
Smart contracts, leveraging the power of blockchain technology, have revolutionized the execution and enforcement of agreements. However, their adoption also brings forth substantial challenges in terms of security and privacy. This research paper aims to identify the recent areas of focus and provide a comprehensive perspective on blockchain applications and smart contracts, highlighting their main issues and corresponding solutions. Furthermore, it seeks to address the gaps in current research and outline future avenues of investigation. The primary objective is to assess the security and privacy concerns associated with smart contracts in blockchain and propose effective measures to enhance their robustness. By conducting a thorough analysis of vulnerabilities, attack vectors, and privacy considerations, this study offers valuable insights into the risks involved in smart contracts. It also puts forth practical solutions and best practices to mitigate these risks, ensuring a more secure and privacy-preserving environment for the deployment and execution of smart contracts.
Cheng Zhang, Yang Xu, Xiaowei Wu, En Wang · 6 authors
Decentralized federated learning (DFL) overcomes the single point of failure issue of centralized federated learning. Building upon DFL, blockchain-based federated learning (BFL) takes further strides in establishing trust, enhancing security, and fault tolerance. However, BFL based on the classical linear blockchain exhibits diminished training efficiency in heterogeneous environments and is limited by the performance bottleneck of blockchain. Recent solutions introduce the directed acyclic graph (DAG) blockchain to address these issues, yet they compromise the verifiability of BFL, struggle with handling outdated models, and have a slow convergence speed. In this paper, we propose TGFL, a decentralized federated learning framework based on the Tree-Graph blockchain. The underlying blockchain structure of TGFL is designed as a block-centered DAG to support verifiable and semi-asynchronous training. To facilitate fast convergence, we design a pivot chain generation algorithm that topologically sorts the semi-asynchronous training process, guiding participants in sampling appropriate models. The consensus mechanism, which is closely integrated with federated learning, ensures that the TGFL can effectively resist attacks on the model and the blockchain system. Extensive experiments in various settings demonstrate that TGFL can achieve better training efficiency and model accuracy compared to three baselines.
In multi-stakeholder systems, such as healthcare, the Internet of Things, and supply chain management, there is frequent data generation, exchange, and sharing. As a result, data owners often desire control over their data and maintain privacy, while data consumers require methods to ascertain the origins and creators of the data. These conflicts of interest require developing data governance systems that guarantee data provenance, privacy protection, consent management, and selective disclosure. This research proposed a decentralized data governance system utilizing blockchain technology, proxy re-encryption (PRE), and Boneh, Boyen, and Shacham (BBS) signatures to address these challenges. The proposed system enables data owners to control, selectively share, and track their data through privacy-enhancing, consent management, and selective disclosure mechanisms while also allowing data consumers to understand the lineage of the data through a blockchain-based provenance mechanism. As a case study, the research examined and evaluated electronic prescriptions involving sensitive data and multiple stakeholders, including patients as data owners and doctors and pharmacists as data consumers. The research was structured as a collection of published articles organized in the following sequence: problem formulation and developing smart contracts, implementing privacy and consent management through PRE, and applying BBS signatures for selective data sharing. The proof-of-concept implementation and evaluations, conducted using CosmWasm, Hyperledger Besu, Ethereum, pyUmbral PRE, and BBS signatures, demonstrate that the proposed decentralized system is platform-agnostic, scalable, and capable of providing a higher level of transparency, privacy, and trust with minimal overhead.
Anonymous Zether, proposed by Bünz et al. (FC, 2020) and subsequently improved by Diamond (IEEE S&P, 2021) is an account-based confidential payment mechanism that works by using a smart contract to achieve privacy (i.e. identity of receivers to transactions and payloads are hidden). In this work, we look at simplifying the existing protocol while also achieving batching of transactions for multiple receivers, while ensuring consensus and forward secrecy. To the best of our knowledge, this work is the first to formally study the notion of forward secrecy in the setting of blockchain, borrowing a very popular and useful idea from the world of secure messaging. Specifically, we introduce:•FUL-Zether, a forward-secure version of Zether (Bünz et al. , FC, 2020),•PRIvate DEcentralized Confidential Transactions (PriDe CT), a much-simplified version of Anonymous Zether that achieves competitive performance and enables batching of transactions for multiple receivers.•PRIvate DEcentralized Forward-secure Until Last update Confidential Transactions (PriDeFUL CT), a forward-secure version of PriDe CT.We also present an open-source, Ethereum-based implementation of our system. PriDe CT uses linear homomor-phic encryption as Anonymous Zether but with simpler zero-knowledge proofs. PriDeFUL CT uses an updatable public key encryption scheme to achieve forward secrecy by introducing a new DDH-based construction in the standard model.In terms of transaction sizes, Quisquis (Asiacrypt, 2019), which is the only cryptocurrency that supports batchability (albeit in the UTXO model), has 15 times more group elements than PriDe CT. Meanwhile, for a ring of N receivers, Anonymous Zether requires 6 log N more terms even without accounting for the ability to batch in PriDe CT. Further, our implementation indicates that, for N = 32, even if there were 7 intended receivers, PriDe CT outperforms Anonymous Zether in proving time and gas consumption.
Borui Gong, Wang Fat Lau, Man Ho Au, Rupeng Yang · 6 authors
We present an efficient zero-knowledge argument of knowledge system customized for the Paillier cryptosystem. Our system enjoys sublinear proof size, low verification cost, and acceptable proof generation effort, while also supporting batch proof generation/verification. Existing works specialized for Paillier cryptosystem feature linear proof size and verification time. Using existing sublinear argument systems for generic statements (e.g., zk-SNARK) results in unaffordable proof generation cost since it involves translating the relations to be proven into an inhibitive large Boolean or arithmetic circuit over a prime order field. Our system does not suffer from these limitations.The core of our argument systems is a constraint system defined over the ring of residue classes modulo a composite number, together with novel techniques tailored for arguing binary values in this setting. We then adapt the approach from Bootle et al. (EUROCRYPT 2016) to compile the constraint system into a sublinear argument system. Our constraint system is generic and can be used to express typical relations in Paillier cryptosystems including range proof, correctness proof, relationships between bits of plaintext, relationships of plaintexts among multiple ciphertexts, and more. Our argument supports batch proof generation and verification, with the amortized cost outperforming state-of-the-art protocol specialized for Paillier when the number of Paillier ciphertext is in the order of hundreds.We report an end-to-end prototype and conduct comprehensive experiments across multiple scenarios. Scenario 1 is Paillier with packing. When we pack 25.6K bits into 400 ciphertexts, a proof that all these ciphertexts are correctly computed is 17 times smaller and is 3 times faster to verify compared with the naive implementation: using 25.6K OR-proofs without packing. Furthermore, we can prove additional statements almost for free, e.g., one can prove that the sum of a subset of the witness bits is less than a threshold t. Another scenario is range proof. To prove that each plaintext in 200 Paillier ciphertexts is of size 256 bits, our proof size is 10 times smaller than the state-of-the-art. Our analysis suggests that our system is asymptotically more efficient than existing protocols, and is highly suitable for scenarios involving a large number (more than 100) of Paillier ciphertexts, which is often the case for data analytics applications.
This study proposes a framework to enhance privacy in Blockchain-based Internet of Things (BIoT) systems used in the healthcare sector. The framework addresses the challenge of leveraging health data for analytics while protecting patient privacy. To achieve this, the study integrates Differential Privacy (DP) with Federated Learning (FL) to protect sensitive health data collected by IoT nodes. The proposed framework utilizes dynamic personalization and adaptive noise distribution strategies to balance privacy and data utility. Additionally, blockchain technology ensures secure and transparent aggregation and storage of model updates. Experimental results on the SVHN dataset demonstrate that the proposed framework achieves strong privacy guarantees against various attack scenarios while maintaining high accuracy in health analytics tasks. For 15 rounds of federated learning with an epsilon value of 8.0, the model obtains an accuracy of 64.50%. The blockchain integration, utilizing Ethereum, Ganache, Web3.py, and IPFS, exhibits an average transaction latency of around 6 seconds and consistent gas consumption across rounds, validating the practicality and feasibility of the proposed approach.
This article introduces a new asynchronous Byzantine-tolerant asset transfer system (cryptocurrency) with three noteworthy properties: quasi-anonymity, lightness, and consensus-freedom. Quasi-anonymity means no information is leaked regarding the receivers and amounts of the asset transfers. Lightness means that the underlying cryptographic schemes are \textit{succinct}, and each process only stores data polylogarithmic in the number of its own transfers.Consensus-freedom means the system does not rely on a total order of asset transfers. The proposed algorithm is the first asset transfer system that simultaneously fulfills all these properties in the presence of asynchrony and Byzantine processes. To obtain them, the paper adopts a modular approach combining a new distributed object called agreement proofs and well-known techniques such as vector commitments, universal accumulators, and zero-knowledge proofs. The paper also presents a new non-trivial universal accumulator implementation that does not need knowledge of the underlying accumulated set to generate (non-)membership proofs, which could benefit other crypto-based applications.
Federated learning (FL) is decentralized machine learning framework that finds various applications in health, finance, and the internet of things. This paper studies the under-explored business competition in FL, where organizations are both collaborators in training a shared model and competitors in providing model-based services to a continuum of customers. We focus on an oligopoly case with three organizations. To understand how competition affects FL collaboration, we start with a benchmark case where organizations are not competitors, and show that they have an incentive to collaborate. However, in the presence of competition, organizations may prefer to train local models instead of collaborating via FL (even if FL incurs zero training costs). The reason is that FL intensifies price competition by improving organizations’ model performance to a similar level. To address this issue, we devise a model differentiation mechanism in which organizations adaptively adjust their model performance, enabling differentiated model-based services to customers. We prove that the adaptive mechanism converges in polynomial time and is incentive compatible. Perhaps surprisingly, numerical experiments on CIFAR-10 show that the mechanism can simultaneously improve the model performance, organizations’ revenues, and social welfare. The improvement is up to 22.31%, 14.42%, and 19.50%, respectively.
Federated learning has emerged as a promising paradigm for large-scale collaborative training tasks, harnessing diverse local datasets from different clients to jointly train global models. In real-world implementations, client data could have label noise, causing the quality of the global model to be influenced. Existing label-correction solutions assume all the clients are discreet and fail to consider detecting the malicious clients, thus are not practical or privacy-preserving. In this paper, we present zkCor, an efficient and reliable label noise correction scheme with zero-knowledge confidentiality. Our method is designed upon FedCorr [1], but with more relaxed security assumptions. zkCor is established from the ingenious synergy of the label noise correction protocol and the zero-knowledge proof (ZKP), requiring each client to provide a computation integrity proof to the aggregator in each iteration. Thus, clients are forced to jointly guarantee label-correction reliability. We further devise a batch ZKP that is efficient and more suitable for federated learning settings. We rigorously illustrate the building blocks of zkCor and complete the prototype implementation. The extensive experiments demonstrate that zkCor can gain at least 2 to 30 times better performance than the baseline approach on verification workloads with nearly no extra proof time cost from clients.
In this study, we delve into cutting-edge solutions for security-centric, privacy-enhanced federated learning, a rapidly evolving area of research that bridges the gap between data privacy and collaborative machine learning. Our analysis offers a comprehensive comparative evaluation of existing methodologies, shedding light on the strengths and limitations of current approaches. By introducing new perspectives, we aim to push the boundaries of secure federated learning, exploring techniques that enhance data protection without compromising learning efficiency. Additionally, we highlight emerging challenges and opportunities in the field, emphasizing the importance of scalable, privacy-preserving mechanisms in decentralized systems. As federated learning continues to gain traction across various sectors such as healthcare, finance, and IoT, our study serves as a foundation for future research, identifying key areas for innovation and improvement. This forward-looking approach ensures that federated learning can continue to evolve as a trustworthy and robust solution for privacy-sensitive applications, addressing both current and future security concerns.
Aulia Arif Wardana, Grzegorz Kołaczek, Parman Sukarno
This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.
Jesús García-Rodríguez, Stephan Krenn, Jorge Bernal Bernabé, Antonio Skármeta
The increasing user awareness and regulatory framework (e.g., GDPR, eIDAS2) have contributed to considering data minimization and privacy-by-design as central guiding principles for new systems. Among others, this has led to a paradigm shift towards Self-Sovereign Identity solutions to put the user in full control over their data. Despite the promising landscape, privacy-preserving Attribute-Based Credentials (p-ABC) have not been widely adopted, mainly due to the lack of secure, flexible and efficient implementations that cover the basic and advanced needs in p-ABC systems. In this work, we tackle this gap by developing an improved zero-knowledge showing protocol of a distributed p-ABC scheme based on Pointcheval-Sanders Multi-Signatures to allow for modular extensions through commit-and-prove techniques. We use it to implement a flexible p-ABC system with decentralized issuance that, apart from the basic notions of p-ABCs, covers range proofs, pseudonyms, inspection and revocation. Lastly, we thoroughly evaluate the performance of the system under different testbed conditions, showing a significant efficiency improvement over previous implementations.
Syed Thouheed Ahmed, T R Mahesh, E. Srividhya, V. Vinoth Kumar · 7 authors
Categorizing Artificial Intelligence of Medical Things (AIoMT) devices within the realm of standard Internet of Things (IoT) and Internet of Medical Things (IoMT) devices, particularly at the server and computational layers, poses a formidable challenge. In this paper, we present a novel methodology for categorizing AIoMT devices through the application of decentralized processing, referred to as "Federated Learning" (FL). Our approach involves deploying a system on standard IoT devices and labeled IoMT devices for training purposes and attribute extraction. Through this process, we extract and map the interconnected attributes from a global federated cum aggression server. The aim of this terminology is to extract interdependent devices via federated learning, ensuring data privacy and adherence to operational policies. Consequently, a global training dataset repository is coordinated to establish a centralized indexing and synchronization knowledge repository. The categorization process employs generic labels for devices transmitting medical data through regular communication channels. We evaluate our proposed methodology across a variety of IoT, IoMT, and AIoMT devices, demonstrating effective classification and labeling. Our technique yields a reliable categorization index for facilitating efficient access and optimization of medical devices within global servers.
The rapid expansion of Internet of Things (IoT) devices has revolutionized data generation and sharing but simultaneously introduced profound privacy concerns for both individuals and organizations. To mitigate these risks, this paper evaluates cutting-edge privacy-preserving techniques specifically designed for data exchange within the IoT framework. These techniques are categorized into cryptographic, anonymization, and differential privacy approaches, with each offering distinct advantages and limitations across diverse IoT scenarios. Cryptographic techniques, including homomorphic encryption, attribute-based encryption, secure multiparty computation, and zero-knowledge proofs, offer robust privacy protection by encrypting data during transmission and computation. However, they may incur considerable computational overhead and require sophisticated key management mechanisms. Anonymization techniques such as k-anonymity, l-diversity, t-closeness, and differential privacy-based anonymization aim to conceal sensitive information by aggregating or perturbing data. While effective in safeguarding privacy, these methods may struggle to balance privacy and data utility, leading to potential information loss or re-identification risks.