Federated Learning (FL) emerges as a viable solution to facilitate data collaboration, enabling multiple clients to collaboratively train a machine learning (ML) model under the supervision of a central server while ensuring the confidentiality of their raw data. However, existing studies have unveiled two main risks: (i) the potential for the server to infer sensitive information from the client's uploaded updates (i.e., model gradients), compromising client input privacy, and (ii) the risk of malicious clients uploading malformed updates to poison the FL model, compromising input integrity. Recent works utilize secure aggregation with zero-knowledge proofs (ZKP) to guarantee input privacy and integrity in FL. Nevertheless, they suffer from extremely low efficiency and, thus, are impractical for real deployment. In this paper, we propose a novel and highly efficient approach RiseFL for secure and verifiable data collaboration, ensuring input privacy and integrity simultaneously. Firstly, we devise a probabilistic integrity check method that transforms strict checks into a hypothesis test problem, offering great optimization opportunities. Secondly, we introduce a hybrid commitment scheme to satisfy Byzantine robustness with improved performance. Thirdly, we present an optimized ZKP generation and verification technique that significantly reduces the ZKP cost based on probabilistic integrity checks. Furthermore, we theoretically prove the security guarantee of RiseFL and provide a cost analysis compared to state-of-the-art baselines. Extensive experiments on synthetic and real-world datasets suggest that our approach is effective and highly efficient in both client computation and communication. For instance, RiseFL is up to 28x, 53x, and 164x faster than baselines ACORN, RoFL, and EIFFeL for the client computation.
The privacy-focused concept of Federated Learning (FL) allows local data processing without disclosing patients’ health details to a central server. However, its vulnerability to privacy breaches through shared model weights and susceptibility to a single point of failure remain concerns. Energy constraints of Wireless Body Area Networks (WBANs) necessitate considering computation and transmission energy in the FL process. Thus, this article introduces a smart healthcare system prioritizing energy efficiency and privacy through a blockchain-backed FL model. Yet, WBAN users might be unwilling to share data without adequate incentives, and miners might hesitate due to the high energy usage associated with maintaining the blockchain. Therefore, an optimization problem is formulated to maximize system utility while considering energy, WBAN incentives, miner revenue, and FL loss. A computationally efficient stable matching-based algorithm is proposed for optimizing utility via associating WBANs and miners. Associated WBANs use Quantized Neural Networks (QNNs) to minimize computation energy. Moreover, this work integrates Differential Privacy (DP) and Homomorphic Encryption (HE) mechanisms to prevent information leakage by adding noise to gradients before updating model weights and encrypting consequences before transmitting them to miners. Real-world experiments validate the framework, yielding an average of 15.1%, 9.03%, and 15.35% improvements over existing methods.
Privacy and trust are highly demanding in practical recommendation engines. Although Federated Learning (FL) has significantly addressed privacy concerns, commercial operators are still worried about several technical challenges while bringing FL into production. In addition, classical FL has several intrinsic operational limitations such as single-point failure, data and model tampering, and heterogenic clients participating in the FL process. To address these challenges in practical recommenders, we propose a responsible recommendation generation framework based on blockchain-empowered asynchronous FL that can be adopted for any model-based recommender system. In standard FL settings, we build an additional aggregation layer in which multiple trusted nodes guided by a mediator component perform gradient aggregation to achieve an optimal model locally in a parallel fashion. The mediator partitions users into K clusters, and each cluster is represented by a cluster head. Once a cluster gets semi-global convergence, the cluster head transmits model gradients to the FL server for global aggregation. In addition the trusted cluster heads are responsible to submit the converged semi-global model to a blockchain to ensure tamper resilience. In our settings, an additional mediator component works like an independent observer that monitors the performance of each cluster head, updates a reward score, and records it into a digital ledger. Finally, evaluation results on three diversified benchmarks illustrate that the recommendation performance on selected measures is considerably comparable with the standard and federated version of a well-known neural collaborative filtering recommender.
A zeroknowledge proof is a game between a prover and a verifier, where the aim of the prover is to present the correctness of an assertion without giving the actual proof. This enables systems to achieve privacy with transparency and, if required, compliance. Zero knowledge proofs have been used in protection of data in healthcare and other systems, anonymous verifiable voting, financial systems like digital currencies, secure exchange of digital assets, secure remote biometric authentication, secure auction, and blockchain. The challenge of zero-knowledge proofs is that they are computationally hard to produce, some implementations need a trusted third party for setup and system initialization, some require efficiency optimization methods. Moreover, common algorithms cannot resist quantum computing attacks warranting research in the area.
In recent years, the increasing prevalence of digital transactions and data sharing has underscored the critical importance of privacy and security in the digital realm. Blockchain technology, initially designed to support cryptocurrencies like Bitcoin, has evolved into a versatile platform with the potential to provide trust, transparency, and data immutability in a wide range of applications. Concurrently, zero-knowledge proofs have emerged as a pioneering approach to safeguarding data privacy, allowing parties to validate information without disclosing the underlying data. This review paper thoroughly investigates the convergence of blockchain technology and zero-knowledge proofs, aiming to understand how their synergy can foster privacy-preserving transactions. We examine the foundational principles of zero-knowledge proofs, their theoretical underpinnings, and practical implementation within blockchain networks. Through a comprehensive analysis, we assess the effectiveness of this amalgamation in protecting sensitive data and consider its applicability to diverse use cases. This review provides a detailed exploration of the synergistic potential of blockchain and zero-knowledge proofs in reshaping the landscape of data privacy in an increasingly interconnected world.
The Zcash cryptocurrency is the first well-known application of zk-SNARKs in the blockchain. The role of Zk-SNARK is to provide privacy and confidentiality. As blockchain is incapable of providing privacy in the blockchain system, the researchers are banking at Zero Knowledge Proof protocols as the solution to the privacy problem. The Zero Knowledge Proof is a relatively new technique. Hence, currently, it comes with many risks and vulnerabilities. This paper mentions risks in cryptocurrency with Zero Knowledge Proof, primarily of Zcash. The discussed vulnerabilities are information leakage in transactions, trust risk, implementation vulnerability, and other security issues.
Web 3.0, as the third generation of the World Wide Web, aims to solve contemporary problems of trust, centralization, and data ownership. Driven by the latest advances in cutting-edge technologies, Web 3.0 is moving towards a more open, decentralized, intelligent, and interconnected network. However, increasingly widespread data breaches have raised awareness of online privacy and security of personal data. Additionally, since Web 3.0 is a sophisticated and complex convergence, the technical details behind it are not as clear as the characteristics it presents. In this survey, we conduct an in-depth exploration of Web 3.0 from the perspectives of blockchain, artificial intelligence, and edge computing. Specifically, we begin with summarizing the evolution of the Internet and providing an overview of these three key technological factors. Afterward, we provide a thorough analysis of each technology separately, including its relevance to Web 3.0, key technology components, and practical applications. We also propose decentralized storage and computing solutions by exploring the integration of technologies. Finally, we highlight the key challenges alongside potential research directions. Through the combination and mutual complementation of multiple technologies, Web 3.0 is expected to return more control and ownership of data and digital assets back to users.
The location information of cars contains great value, but the uncontrollable characteristics of public data and the difficulty in distributing benefits derived from the potential value of the data greatly reduces the enthusiasm for data owners to share their data. In addition, the current selective disclosure schemes based on merkle tree still require large costs when there are many data items. To solve these problems, a blockchain-based framework for sharing cars’ location information applicable to the online car hailing industry is proposed in this paper, enabling the sharing of cars’ location information while protecting passengers’ privacy through selective disclosure. The combination of homomorphic encryption and probabilistic verification enables a faster batch data verification compared to other blockchain-based data sharing schemes, as well as ensures the authenticity of the data uploaded to the blockchain. The experimental results show that the proposed selective disclosure mechanism based on hash exclusive or tree has lower costs than the baseline for cases with many data items. Moreover, the proposed framework meets both security and feasibility requirements. Specifically speaking, under the constraint of 128-bits security level, the costs of time and space on the location information during one drive are at microsecond level and kilobyte level, respectively. Finally, the scheme is suitable for scenarios with higher throughput.
New digital technologies generate large amounts of information. This data is processed by Service Providers in order to improve and develop new services and products, but also to fund themselves. However, processing personal data may result in the extraction of sensitive information, which, in turn, may lead to jeopardizing the users’ privacy. To mitigate this significant risk, the European Parliament and Council of the European Union elaborated the General Data Protection Regulation (GDPR). This regulation forces Service Providers to obtain Data Subjects’ explicit consent prior to collecting and processing their personal data. Nevertheless, the GDPR’s legislative text does not define how Service Providers must transparently demonstrate that they already have these consents. Moreover, most individuals do not know the rights they have over their personal data, neither does this regulation provide them with efficient methods to be aware of what third parties are doing with such data. In order to address this situation, we propose a lightweight blockchain-based GDPR-compliant personal data management platform. The new solution provides public access to immutable evidences that reflect the reached agreements between Data Subjects and Service Providers. In this way, Service Providers can effectively demonstrate that they are fulfilling the regulation, and Data Subjects are able to control and manage their personal data according to their legitimate rights. We have implemented the new system, and we have performed a detailed study which includes: GDPR-compliance, provided functionality, security and privacy issues, and the cost in terms of gas and US dollars of the different operations to be run on the blockchain.
Ricardo Martins Gonçalves, Miguel Mira da Silva, Paulo Rupino da Cunha
Abstract Blockchain has been gaining significant interest in several domains. However, this technology also raises relevant challenges, namely in terms of data protection. After the General Data Protection Regulation (GDPR) has been published by the European Union, companies worldwide changed the way they process personal data. This project provides a model and implementation of a blockchain system to store personal data complying with GDPR. We examine the advantages and challenges and evaluate the system. We use Hyperledger Fabric as blockchain, Interplanetary File System to store personal data off-chain, and a Django REST API to interact with both the blockchain and the distributed file system. Olympus has three possible types of users: Data Subjects, Data Processors and Data Controllers and a fourth participant, Supervisor Authority, that, despite not being an explicit role, can perform all verifications that GDPR mandates. We conclude that it is possible to create a system that overcomes the major challenges of storing personal data in a blockchain (Right to be Forgotten and Right to Rectification), while maintaining its desirable characteristics (auditability, verifiability, tamper resistance, distributed—remove single points of failure) and complying with GDPR.
The rise of digital globalization necessitates robust cross-border data sharing mechanisms, presenting challenges in security, privacy, and regulatory compliance. This paper introduces a novel blockchain-based framework to address these challenges, facilitating secure and efficient data exchange while meeting diverse international compliance requirements. Our approach combines advanced cryptographic techniques with smart contracts to create a dual-layered blockchain architecture. The first layer provides participant anonymity through zero-knowledge proofs, and the second ensures traceable, compliant data transactions. This solution streamlines compliance with varied data protection laws, offering a transparent and privacy-preserving platform for global data sharing initiatives. It promises significant benefits for entities engaged in multinational operations, enhancing security, simplifying regulatory adherence, and protecting user privacy.
To address the issues of malicious nodes being easily selected as consensus nodes and the problem of untimely processing of malicious nodes in the DPoS consensus algorithm, we propose a Trust-authorized Delegated Proof of Stake (Ta-DPoS) consensus algorithm based on reputation authorization. The Ta-DPoS consensus algorithm uses the PowerTrust model to conduct global reputation evaluation of nodes, enhances the authority and credibility of selected consensus nodes, balances the competition for bookkeeping rights while ensuring a fair selection process, and improves decentralization. At the same time, under a reputation reward and punishment mechanism based on dynamic games, malicious nodes are promptly excluded from the network edge, achieving constraints and incentives for blockchain node behavior. Experimental results show that to some extent, the Ta-DPoS consensus algorithm overcomes security issues that exist in node election and consensus processes and achieves relatively better performance in consensus efficiency, decentralization, and scalability.
The rapid development of the Internet of Things (IoT) has resulted in vast amounts of widely distributed data. Sharing these data can spur innovative advancements and enhance service quality. However, conventional data-sharing methods often involve third-party intermediaries, posing risks of single-point failures and privacy leaks. Moreover, these traditional sharing methods lack a secure transaction model to compensate for data sharing, which makes ensuring fair payment between data consumers and providers challenging. Blockchain, as a decentralized, secure, and trustworthy distributed ledger, offers a novel solution for data sharing. Nevertheless, since all nodes on the blockchain can access on-chain data, data privacy is inadequately protected, and traditional privacy-preserving methods like anonymization and generalization are ineffective against attackers with background knowledge. To address these issues, this paper proposes a decentralized, privacy-preserving, and fair data transaction model based on blockchain technology. We designed an adaptive local differential privacy algorithm, MDLDP, to protect the privacy of transaction data. Concurrently, verifiable encrypted signatures are employed to address the issue of fair payment during the data transaction process. This model proposes a committee structure to replace the individual arbitrator commonly seen in traditional verifiable encrypted signatures, thereby reducing potential collusion between dishonest traders and the arbitrator. The arbitration committee leverages threshold signature techniques to manage arbitration private keys. A full arbitration private key can only be collaboratively constructed by any arbitrary t members, ensuring the key’s security. Theoretical analyses and experimental results reveal that, in comparison to existing approaches, our model delivers enhanced transactional security. Moreover, while guaranteeing data availability, MDLDP affords elevated privacy protection.
Given the widespread adoption and fusion of artificial intelligence (AI) and blockchain technologies, safeguarding privacy has become paramount. These techniques not only ensure the confidentiality of individuals' data but also uphold the integrity and reliability of the information. This study provides an introductory overview of AI and blockchain, elucidating their fusion and subsequent emergence of privacy protection methodologies. It delves into specific application contexts such as data encryption, de-identification, multi-tier distributed ledgers, and k-anonymity techniques. Furthermore, the paper critically assesses five pivotal dimensions of privacy protection systems within AI-blockchain integration: authorization management, access control, data security, network integrity, and scalability. Additionally, it conducts a thorough analysis of existing shortcomings, pinpointing their root causes and proposing corresponding remedies. The study also categorizes and synthesizes privacy protection methodologies based on AI-blockchain application contexts and technical frameworks. In conclusion, it outlines prospective avenues for the evolution of privacy protection technologies stemming from the integration of AI and blockchain, emphasizing the need to enhance efficiency and security for a more holistic safeguarding of privacy.
Federated learning, as one of the three main technical routes for privacy computing, has been widely studied and applied in both academia and industry. However, malicious nodes may tamper with the algorithm execution process or submit false learning results, which directly affects the performance of federated learning. In addition, learning nodes can easily obtain the global model. In practical applications, we would like to obtain the federated learning results only by the demand side. Unfortunately, no discussion on protecting the privacy of the global model is found in the existing research. As emerging cryptographic tools, the zero-knowledge virtual machine (ZKVM) and homomorphic encryption provide new ideas for the design of federated learning frameworks. We have introduced ZKVM for the first time, creating learning nodes as local computing provers. This provides execution integrity proofs for multi-class machine learning algorithms. Meanwhile, we discuss how to generate verifiable proofs for large-scale machine learning tasks under resource constraints. In addition, we implement the fully homomorphic encryption (FHE) scheme in ZKVM. We encrypt the model weights so that the federated learning nodes always collaborate in the ciphertext space. The real results can be obtained only after the demand side decrypts them using the private key. The innovativeness of this paper is demonstrated in the following aspects: 1. We introduce the ZKVM for the first time, which achieves zero-knowledge proofs (ZKP) for machine learning tasks with multiple classes and arbitrary scales. 2. We encrypt the global model, which protects the model privacy during local computation and transmission. 3. We propose and implement a new federated learning framework. We measure the verification costs under different federated learning rounds on the IRIS dataset. Despite the impact of homomorphic encryption on computational accuracy, the framework proposed in this paper achieves a satisfactory 90% model accuracy. Our framework is highly secure and is expected to further improve the overall efficiency as cryptographic tools continue to evolve.
Sylvain Chatel, Christian Mouchet, Ali Utkan Şahin, Apostolos Pyrgelis · 6 authors
Multiparty fully homomorphic encryption (MFHE) schemes enable multiple parties to efficiently compute functions on their sensitive data while retaining confidentiality. However, existing MFHE schemes guarantee data confidentiality and the correctness of the computation result only against honest-but-curious adversaries. In this work, we provide the first practical construction that enables the verification of MFHE operations in zero-knowledge, protecting MFHE from malicious adversaries. Our solution relies on a combination of lattice-based commitment schemes and proof systems which we adapt to support both modern FHE schemes and their implementation optimizations. We implement our construction in PELTA. Our experimental evaluation shows that PELTA is one to two orders of magnitude faster than existing techniques in the literature.