N. S. Swapna, A. Muralidhar, Kambala Madhu Latha, M. Archana · 9 authors
Neural Network design by a group of clients (each is a person who owns the data) where the data remains private. FL is vulnerable to adversarial attacks, data poisoning, and Byzantine faults, which are threats destroying the integrity as well as the security of the trained model. In order to deal with the challenges above, we propose a new framework, namely FL-GAN-TrustDP, for security enhanced FL using Generative Adversarial Networks (GANs) for adversarial defence, blockchain based hierarchical trust evaluation and adaptive differential privacy. Optimizing the privacy-utility tradeoff based on client trust scores, the adaptive privacy mechanism is a mechanism. GAN based adversarial filtering helps in detecting adversarial updates and thus preventing it, and the trust mechanism backed by blockchain dynamically penalizes the malicious clients. Experimental results show that FL-GAN-TrustDP significantly outperforms baseline FL models (in terms of higher model accuracy, lower adversarial success rates, lower false alarms and faster convergence speed) compared to FedAvg, FedSGD, FedDP, FedBlockchain. In particular, the adversarial success rate on adversarial data seems to decrease significantly from 60% to below 30%, and the notice is more precise, recall, and F1 score than previous work for safeguarding FL. This proposed framework promotes security, privacy, and robustness for FL applications and thus can be a secure federated learning solution in IoT and edge computing environments.
Federated Learning (FL) offers a distributed approach to machine learning that preserves data privacy by avoiding the exchange of sensitive IoT sensor information. This paper introduces a novel IoT framework that integrates advanced security tools to tackle key privacy and security challenges. It employs Decentralized Attribute-Based Encryption (DABE) for decentralized authentication and data encryption, Homomorphic Encryption (HE) for secure computations on encrypted data, Secure Multi-Party Computation (SMPC) for collaborative processing, and Blockchain for distributed ledger management and transparent communication. In this system, IoT devices encrypt data locally with DABE, while initial model training occurs on cloud servers within an immutable blockchain network that supports peer-to-peer authentication. Encrypted model weights are then transferred to the fog layer via HE and aggregated using SMPC, after which the FL server updates and distributes the global model to the IoT devices. This innovative framework effectively addresses the challenges of secure decentralized learning, enabling privacy-preserving, efficient, and secure federated learning for IoT applications and real-time analytics.
With the booming development of blockchain, it has gradually gained wide attention in the Internet of Things (IoT), finance, and other fields. However, due to the shared nature of blockchain ledgers among multiple users, sensitive user information, such as transaction amounts and private agreements, can be easily exposed. This poses significant privacy concerns for blockchain users. To address this issue, we propose TrustChain, a high-performance smart contract model based on the Trusted Execution Environment (TEE). TrustChain aims to safeguard the privacy of smart contract codes and user data by leveraging the secure execution environment provided by the TEE. Specifically, we introduce the TEE to run the smart contract with security and privacy without introducing a heavyweight cryptographic algorithm, thus improving the performance of the system. When running smart contracts, the operate nodes equipped with TEE ensure that the Operating System (OS) of the node itself cannot access the data within the TEE. This isolation effectively separates the sensitive information of the smart contract from the external environment. Furthermore, we introduce Verifiable Random Functions (VRFs) to randomly choose the operate nodes to prevent collusion attacks, further improving the security of the model. The graph ledger, based on the Directed Acyclic Graph (DAG), is used to adapt to the high-performance characteristics of a smart contract system based on the TEE. Finally, we simulate the scheme in TrustZone and demonstrate the feasibility of TrustChain through a series of experiments and analyses. The analysis and experimental results demonstrate that our solution exhibits excellent privacy protection performance and achieves higher throughput compared to traditional smart contracts. • We have introduced TrustChain, a smart contract model based on TEE, to ensure the privacy and security of smart contracts. • VRFs are proposed to randomly select operate nodes, preventing collusion and enhancing defense against malicious attacks. • The redesigned consensus mechanism limits blockchain storage to smart contract outputs, preventing leakage of sensitive information. • We enhanced smart contract performance by integrating a DAG-based ledger with TEE's low-latency execution.
Threshold multi-party fully homomorphic encryption (TMFHE) schemes enable efficient computation to be performed on sensitive data while maintaining privacy. These schemes allow a subset of parties to perform threshold decryption of evaluation results via a distributed protocol without the need for a trusted dealer, and provide a degree of fault tolerance against a set of corrupted parties. However, existing TMFHE schemes can only provide correctness and security against honest-but-curious parties. We construct a compact TMFHE scheme based on the Learning with Errors (LWE) problem. The scheme applies Shamir secret sharing and share resharing to support an arbitrary t-out-of-N threshold access structure, and enables non-interactive reconstruction of secret key shares using additive shares derived from the current set of online participants. Furthermore, the scheme implements commitment and non-interactive zero-knowledge (NIZK) proof techniques to verify the TMFHE operations. Finally, our experiments demonstrate that the proposed scheme achieves active security against malicious adversaries. It overcomes the limitation of existing TMFHE schemes that can only guarantee correct computation under passive semi-honest adversaries.
The Border Gateway Protocol (BGP) experiences multiple security threats during inter-domain routing such as prefix hijacking and route leaks and man-in-the-middle attacks. Resource Public Key Infrastructure (RPKI) and BGPsec along with other security solutions authenticate networks better but lack protection of network privacy and exhibit weaknesses due to concentration of authority. This paper introduces an integrated ZKP-based Route Verification Framework which uses blockchain technology to establish tamper-resistant privacy-preserving route validation. The framework includes five fundamental elements that provide ZKP proof generation for route credentials and blockchain-based proof storage and automated proof verification with BGP extension and off-chain IPFS-based proof management systems. The system architecture uses zk-SNARKs for cryptographic verifications while it relies on Hyperledger Fabric for decentralized proof validation. The proposed solution achieved superior routing security because it maintains both efficient storage scalability and minimal computational overhead according to performance testing results. The system results show that this framework provides adequate capabilities for actual Internet Service Provider deployments which support decentralized routing across domains while maintaining privacy protection.
Privacy-preserving analytics is indeed a critical enabler for businesses that want to glean insights from sensitive data while protecting individual privacy. Tighter regulation and growing concern over data abuse have, respectively, driven the development of techniques involving zero-knowledge proofs and secure multiparty computation. These systems are set to establish trust boundaries among partner organisations while gently permitting significant information transfers for the decision-making process. The practically verifiable assurance of data secrecy is what makes these protocols particularly attractive in sectors heavily reliant on data analysis, like healthcare, banking, and law enforcement. Such integrated architectures guarantee controlled overhead while delivering high-quality output through cryptographic primitives. Real-life implementations show that it is indeed possible to strike a balance between the efficiency of the system and its security constraints. Enhanced Interoperabillty, along with modularity, will allow more widespread use in diverse ecosystems where insights derived from data drive enterprise innovation alongside robust privacy protections.
The proposed research presents a theoretical investigation into the integration of zero-knowledge proofs (ZKP) within autonomous defense architectures, establishing rigorous mathematical foundations for privacy-preserving security verification in next-generation cybersecurity systems. This study addresses fundamental theoretical challenges in autonomous security verification by developing novel mathematical constructs that enable privacy-preserving proof generation and verification while maintaining formal security guarantees. The research methodology encompasses the development of formal mathematical models for non-interactive zero-knowledge proof systems optimized for autonomous verification environments. These models extend existing theoretical frameworks by introducing novel constructs for proof composition and verification in distributed systems, with particular emphasis on formal security properties including completeness, soundness, and zero-knowledge characteristics.
Fernando Castillo, Jonathan Heiss, Sebastian Werner, Stefan Tai
Blockchain and distributed ledger technologies (DLTs) facilitate decentralized computations across trust boundaries. However, ensuring complex computations with low gas fees and confidentiality remains challenging. Recent advances in Confidential Computing -- leveraging hardware-based Trusted Execution Environments (TEEs) -- and Proof-carrying Data -- employing cryptographic Zero-Knowledge Virtual Machines (zkVMs) -- hold promise for secure, privacy-preserving off-chain and layer-2 computations. On the other side, a homogeneous reliance on a single technology, such as TEEs or zkVMs, is impractical for decentralized environments with heterogeneous computational requirements. This paper introduces the Trusted Compute Unit (TCU), a unifying framework that enables composable and interoperable verifiable computations across heterogeneous technologies. Our approach allows decentralized applications (dApps) to flexibly offload complex computations to TCUs, obtaining proof of correctness. These proofs can be anchored on-chain for automated dApp interactions, while ensuring confidentiality of input data, and integrity of output data. We demonstrate how TCUs can support a prominent blockchain use case, such as federated learning. By enabling secure off-chain interactions without incurring on-chain confirmation delays or gas fees, TCUs significantly improve system performance and scalability. Experimental insights and performance evaluations confirm the feasibility and practicality of this unified approach, advancing the state of the art in verifiable off-chain services for the blockchain ecosystem.
Ruonan Chen, Ye Dong, Yizhong Liu, Tingyu Fan · 8 authors
Federated Learning (FL) is a distributed machine learning paradigm that allows multiple clients to train models collaboratively without sharing local data. Numerous works have explored security and privacy protection in FL, as well as its integration with blockchain technology. However, existing FL works still face critical issues. i) It is difficult to achieving poisoning robustness and data privacy while ensuring high model accuracy. Malicious clients can launch poisoning attacks that degrade the global model. Besides, aggregators can infer private data from the gradients, causing privacy leakages. Existing privacy-preserving poisoning defense FL solutions suffer from decreased model accuracy and high computational overhead. ii) Blockchain-assisted FL records iterative gradient updates on-chain to prevent model tampering, yet existing schemes are not compatible with practical blockchains and incur high costs for maintaining the gradients on-chain. Besides, incentives are overlooked, where unfair reward distribution hinders the sustainable development of the FL community. In this work, we propose FLock, a robust and privacy-preserving FL scheme based on practical blockchain state channels. First, we propose a lightweight secure Multi-party Computation (MPC)-friendly robust aggregation method through quantization, median, and Hamming distance, which could resist poisoning attacks against up to <50% malicious clients. Besides, we propose communication-efficient Shamir's secret sharing-based MPC protocols to protect data privacy with high model accuracy. Second, we utilize blockchain off-chain state channels to achieve immutable model records and incentive distribution. FLock achieves cost-effective compatibility with practical cryptocurrency platforms, e.g. Ethereum, along with fair incentives, by merging the secure aggregation into a multi-party state channel. In addition, a pipelined Byzantine Fault-Tolerant (BFT) consensus is integrated where each aggregator can reconstruct the final aggregated results. Lastly, we implement FLock and the evaluation results demonstrate that FLock enhances robustness and privacy, while maintaining efficiency and high model accuracy. Even with 25 aggregators and 100 clients, FLock can complete one secure aggregation for ResNet in 2 minutes over a WAN. FLock successfully implements secure aggregation with such a large number of aggregators, thereby enhancing the fault tolerance of the aggregation.
Verifiable credentials (VCs) serve as the digital counterparts to physical credentials, with their security assured through cryptographic methods. The interest on VCs has been renewed by the publication of the European Regulation eIDAS 2.0 that instructs the member states to provide their citizens with a digital wallet (EUDI Wallet) that stores such credentials and that the citizens can use all across the European Union. A great effort has been placed in the definition of common standards that are described in the EUDI Architecture and Reference Framework (ARF), that will be used for the design of the EUDI Wallet. One of the crucial aspects is the identification of the formats and types of VCs supported to be stored in it. The goal of this thesis is twofold: first, to provide a systematic description and analysis of the two VC formats that have been the primary candidates for support by the EUDI Wallet, and second, to propose cryptographic protocols and primitives that facilitate the addition of new features to these credential formats or improve the existing ones. The two VC formats that have been the primary candidates in the development of the EUDI ARF covers (1) the VCs based on hiding commitments that are signed by the issuer using a general purpose digital signature algorithm, and (2) the anonymous credentials generated using the framework of Camenisch and Lysyanskaya, that make use of special digital signature schemes supporting NIZKP that allow one to prove knowledge of a signature created by the issuer. We describe and characterize these formats with a special focus on the cryptographic aspects underlying their design. Then, we introduce a novel cryptographic primitive that can be used to increase the security of the storage of anonymous credentials. We call this primitive multi-holder anonymous credential, and it allows a holder to split an anonymous credential in shares and store them on multiple devices. To present the credential, the holder will need the contribution of a given threshold of the devices. This ensures that as long as an adversary does not compromise enough devices, reaching the threshold, it cannot steal the credential and use it to impersonate the holder. We instantiate a multi-holder anonymous credential that is compatible with the BBS anonymous credential scheme, and we prove its security. Finally, we present a cryptographic commitment scheme whose security is proven in the standard model under assumptions on cryptographic group actions, which are quantum resistant. This commitment scheme, unlike the more efficient commitment based on hashing and salting, supports algorithms and non-interactive zero knowledge proofs to prove predicates about the committed messages, which is an important feature for privacy-preserving applications. To be more specific, when our scheme is used to create VCs, it enables holders to create predicate proofs about the attributes included in their VC, increasing their ability to minimize the disclosure of data.
Stefanos Chaliasos, Imam Al-Fath, Alastair F. Donaldson
Zero-knowledge proofs (ZKPs) have evolved from a theoretical cryptographic concept into a powerful tool for implementing privacy-preserving and verifiable applications without requiring trust assumptions. Despite significant progress in the field, implementing and using ZKPs via \emph{ZKP circuits} remains challenging, leading to numerous bugs that affect ZKP circuits in practice, and \emph{fuzzing} remains largely unexplored as a method to detect bugs in ZKP circuits. We discuss the unique challenges of applying fuzzing to ZKP circuits, examine the oracle problem and its potential solutions, and propose techniques for input generation and test harness construction. We demonstrate that fuzzing can be effective in this domain by implementing a fuzzer for \texttt{zk-regex}, a cornerstone library in modern ZKP applications. In our case study, we discovered \textit{$10$} new bugs that have been confirmed by the developers.
While blockchain’s immutability ensures data integrity, it also poses significant challenges when dealing with illegal or erroneous data that require modification. The concept of redactable blockchain has emerged, utilizing Chameleon Hash (CH) and subsequent Policy-based Chameleon Hash (PCH) for controlled data editing. However, current redactable blockchain implementations exhibit significant limitations, particularly in their inability to separate data editing from policy modification and their insufficient support for decentralized management of diverse editing operations. To address these issues, this paper initially introduces the concept of Flexible Policy Chameleon Hash (FPCH), which integrates PCH with non-interactive zero-knowledge proofs to enable enhanced policy management flexibility. Moreover, this paper proposes a Redactable Blockchain Framework with Fine-grained Access Control (RBFAC) based on FPCH. The RBFAC framework employs a hybrid cryptographic approach to separate the right of data editing from policy modification. The framework also provides essential functionalities, including editing accountability, key tracking and revocation mechanisms, and policy privacy protection. Finally, experimental evaluations demonstrate that the RBFAC framework maintains acceptable performance overhead while delivering these advanced features. The results indicate that the proposed solution addresses the limitations of existing redactable blockchain systems, offering a more flexible and secure approach to controlled data editing in blockchain environments.
Federated learning (FL) has emerged as a promising paradigm for training machine learning models across distributed devices while preserving data privacy, finding applications in edge computing, healthcare, and IoT systems. However, the heterogeneity of client devices and asynchronous updates often lead to significant challenges, including computational inefficiency, model inconsistency, and lack of trust in aggregation processes. Existing FL methods, such as synchronous aggregation or fully decentralized approaches, struggle to balance efficiency and consistency, often relying on centralized servers that introduce single points of failure or fail to fairly account for client contributions in asynchronous settings. To address these issues, we propose a novel dual-layer aggregation framework that integrates local asynchronous micro-aggregation with global synchronous macro-aggregation, leveraging blockchain and IPFS for trust and scalability. Our approach dynamically clusters clients based on gradient similarity, employs staleness-aware asynchronous aggregation within clusters, and enforces secure, transparent inter-cluster synchronization via smart contracts. By storing model updates on IPFS and managing metadata on-chain, our method reduces computational overhead while ensuring fairness and tamper-proof execution. Experimental results demonstrate that this framework achieves superior model performance, convergence stability, and equitable contribution tracking compared to traditional FL systems.
To provide the encrypted data with public tamperproof and traceability, in this paper, we first explore and discuss that the alone signature attached to the encrypted data is in a low coupling state with the ciphertext which gives rise to signature substitution attack destructing assurance of the encrypted data. Then we propose a new cryptographic primitive called Secret-Embedded Ciphertext Signature of Knowledge (SECTSoK). And then give the general construction of SE-CTSoK in Schnorr identification scheme form over groups. The proposed SE-CTSoK is not only a signature for the ciphertext to make the ciphertext tamper-proof, but also a zero-knowledge argument of the ciphertext random secret to give the proof that the ciphertext secret is embedded in SE-CTSoK for sure without revealing it. Furthermore, we introduce the standardized definition of the Irreconfigurability model for the ciphertext signature to cover any type of the signature substitution attack, and then we give the formalized proof to our proposed SE-CTSoK in Irreconfigurability model which demonstrates that the ciphertext with the corresponding SE-CTSoK can only be correctly traced and confirmed to the ciphertext generator.
The electronic voting system guarantees the impar-tial, confidential and secure execution of the voting process. However, most existing electronic voting schemes are tailored to specific voting rules and employ particular encryption tools to ensure swift elections under predefined conditions. This often limits their adaptability to accommodate diverse voting modes. Addressing these challenges, the SecureVote scheme proposed in this article incorporates score-based voting rules, supports five different voting rules, thereby catering to a wide range of real-world electronic voting scenarios. The Secure Vote can ensure the privacy and anonymity of the scheme through homomorphic encryption and privacy set intersection technology, and at the same time use non-interactive zero-knowledge proofs to ensure the verifiability of voting, and is better than the scheme with a central trust entity in terms of communication, efficiency and rationality. Finally, we illustrate the nature and efficiency of the scheme through safety proofs and experiments.
Internet Traffic Analysis and Secure E-voting
Cryptography and Data Security
Advanced Steganography and Watermarking Techniques
This research presents a novel framework and experimental results that combine zero-knowledge proofs (ZKPs) with private blockchain technology to safeguard whistleblower privacy while ensuring secure digital evidence submission and verification. For example, whistleblowers involved in corporate fraud cases can submit sensitive financial records anonymously while maintaining the credibility of the evidence. The proposed framework introduces several key innovations, including a private blockchain implementation utilising proof-of-work (PoW) consensus to ensure immutable storage and thorough scrutiny of submitted evidence, with mining difficulty dynamically aligned to the sensitivity of the data. It also features an adaptive difficulty mechanism that automatically adjusts computational requirements based on the sensitivity of the evidence, providing tailored protection levels. In addition, a unique two-phase validation process is incorporated, which generates a digital signature from the evidence alongside random challenges, significantly improving security and authenticity. The integration of ZKPs enables iterative hash-based verification between parties (Prover and Verifier) while maintaining the complete privacy of the source data. This research investigates the whistleblower’s niche in traditional digital evidence management systems (DEMSs), prioritising privacy without compromising evidence integrity. Experimental results demonstrate the framework’s effectiveness in preserving anonymity while assuring the authenticity of the evidence, making it useful for judicial systems and organisations handling sensitive disclosures. This paper signifies notable progress in secure whistleblowing systems, offering a way to juggle transparency with informant confidentiality.
Ensuring the authenticity and integrity of products in a supply chain while maintaining privacy is a significant challenge. Traditional blockchain-based verification systems often expose sensitive information, such as location, batch ID, and manufacturer identity. To address this, we propose a zk-Rollup-based privacy-preserving identity and transaction verification system that leverages Zero-Knowledge Proofs (ZKPs) to ensure trust without revealing confidential data. Our architecture includes a producer and a manufacturer, where the producer generates verifiable proofs of product origin, and the manufacturer appends metadata such as manufacturing date and expiry. A centralized server aggregates producer and manufacturer data, generating zk-SNARK proofs for each transaction. The system employs zk-Rollups for efficient transaction batching, significantly reducing on-chain gas fees and improving scalability. Additionally, all data is end-to-end encrypted using SHA-256, ensuring robust security. Users and third parties can verify proof validity using a QR code-based authentication mechanism, which queries the server endpoint without exposing private details. Performance evaluations demonstrate significant improvements in proof generation time, verification latency, and cost efficiency. Our proposed solution enables secure and scalable supply chain verification, preserving privacy while maintaining transparency and trust. The results indicate that zk-Rollups reduce gas fees by a factor of 10x, making the system feasible for real-world applications. Future work will focus on further optimizing proof generation and exploring decentralized identity solutions for enhanced security.
In the context of cloud computing, services are held on cloud servers, where the clients send their data to the server and obtain the results returned by server. However, the computation, data and results are prone to tampering due to the vulnerabilities on the server side. Thus, verifying the integrity of computation is important in the client-server setting. The cryptographic method known as Zero-Knowledge Proof (ZKP) is renowned for facilitating private and verifiable computing. ZKP allows the client to validate that the results from the server are computed correctly without violating the privacy of the server’s intellectual property. Zero-Knowledge Succinct NonInteractive Argument of Knowledge (zkSNARKs), in particular, has been widely applied in various applications like blockchain and verifiable machine learning. Despite their popularity, existing zkSNARKs approaches remain highly computationally intensive. For instance, even basic operations like matrix multiplication require an extensive number of constraints, resulting in significant overhead. In addressing this challenge, we introduce $z k V C$, which optimizes the ZKP computation for matrix multiplication, enabling rapid proof generation on the server side and efficient verification on the client side. zkVC integrates optimized ZKP modules, such as Constraint-reduced Polynomial Circuit (CRPC) and Prefix-Sum Query (PSQ), collectively yielding a more than $\mathbf{1 2}$-fold increase in proof speed over prior methods. The code is available at https://github.com/UCF-Lou-Lab-PET/zkformer.
Blockchain-based digital voting systems have emerged as a promising solution to enhance the security, transparency, and accessibility of voting processes. By leveraging distributed ledger technology, these systems aim to mitigate various challenges associated with traditional voting methods, such as fraud, manipulation, and logistical complexities. However, the adoption of blockchain in voting introduces both security and usability considerations that must be carefully evaluated. In this paper, we conduct a comprehensive analysis of blockchain-based digital voting systems, focusing on their security and usability aspects. We examine the underlying cryptographic mechanisms, consensus protocols, and smart contract implementations to assess their resilience against potential attacks and vulnerabilities. Additionally, we investigate the user experience, accessibility, and scalability of these systems to evaluate their usability in real-world voting scenarios. Through this analysis, we aim to provide insights into the strengths, limitations, and trade-offs associated with blockchain-based digital voting systems, facilitating informed decision-making and further research in the field of secure and user-friendly electronic voting technologies.
This paper introduces the Cartesian Merkle Tree, a deterministic data structure that combines the properties of a Binary Search Tree, a Heap, and a Merkle tree. The Cartesian Merkle Tree supports insertions, updates, and removals of elements in $O(\log n)$ time, requires $n$ space, and enables membership and non-membership proofs via Merkle-based authentication paths. This structure is particularly suitable for zero-knowledge applications, blockchain systems, and other protocols that require efficient and verifiable data structures.