This paper proposes an architecture based on the Selective Disclosure JSON Web Token (SD-JWT) standard for securely sharing read-only files, which embeds cryptographic signatures and integrity protection directly into the shared resource, providing verifiable authenticity without relying on complex IAM infrastructures.
Abstract
Access control to networked resources has been a longstanding challenge. The conventional solution relies on authentication mechanisms, which introduce additional complexities associated with Identity and Access Management (IAM). Such systems require user authentication, identity management, and authorization services, while also introducing security risks arising from vulnerabilities, misconfigurations, or implementation flaws. Furthermore, different file formats employ different mechanisms for ensuring authenticity and integrity through digital signatures. For example, PDF documents support the PDF Advanced Electronic Signature (PAdES) standard, whereas plain text files typically lack a standardized mechanism for embedding digital signatures. This paper proposes an architecture based on the Selective Disclosure JSON Web Token (SD-JWT) standard for securely sharing read-only files. The proposed architecture embeds cryptographic signatures and integrity protection directly into the shared resource, providing verifiable authenticity without relying on complex IAM infrastructures, such as centralized user databases, authentication services, or authorization mechanisms. By eliminating these components, the proposed solution simplifies deployment while maintaining strong security guarantees for the distribution of immutable resources.
The rapid growth of digital services has increased the demand for identity systems that provide strong authentication while minimizing unnecessary disclosure of personal information. Conventional identity management architectures generally depend on centralized identity providers and frequently require users to disclose complete identity attributes even when a service requires only a limited assertion. Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) provide an alternative model in which identity holders can manage cryptographically verifiable credentials independently of a centralized identity provider. However, the privacy guarantees of decentralized identity systems depend substantially on the cryptographic proof mechanism used during credential presentation.
Zero-Knowledge Proofs (ZKPs) enable a prover to demonstrate knowledge of a secret or the validity of a statement without revealing the underlying secret. Different ZKP and selective-disclosure mechanisms exhibit significantly different characteristics with respect to proof size, generation time, verification time, communication overhead, computational requirements, privacy guarantees, interoperability, and implementation complexity. Consequently, selecting a single proof mechanism for every decentralized identity scenario can result in unnecessary computational cost or inadequate privacy protection.
This paper proposes an Adaptive ZKP Selection Framework (AZSF) for privacy-preserving decentralized identity using DIDs and Verifiable Credentials. The framework dynamically selects an appropriate proof mechanism according to the privacy sensitivity of requested attributes, disclosure requirements, verifier trust conditions, computational resources, proof-generation latency, communication constraints, interoperability requirements, and unlinkability requirements. The proposed architecture introduces a policy-driven decision layer between the credential wallet and proof-generation subsystem. It evaluates candidate mechanisms including selective-disclosure signatures, BBS-based proofs, SD-JWT-based selective disclosure, and general-purpose succinct zero-knowledge proof systems such as zk-SNARK/PLONK-style approaches.
A formal multi-criteria decision model is developed to represent the selection process. The framework defines privacy, performance, communication, interoperability, and deployment criteria and computes an adaptive suitability score for each candidate proof mechanism. A threat model covering credential theft, replay, correlation, malicious verifiers, issuer compromise, metadata leakage, and proof substitution is presented. The paper further proposes an experimental methodology for evaluating proof generation time, verification time, proof size, communication overhead, privacy leakage, unlinkability, and resource consumption. The proposed framework provides a systematic foundation for choosing cryptographic proof mechanisms according to application requirements instead of adopting a one-size-fits-all approach.
Index Terms— Decentralized Identity, Decentralized Identifiers, Verifiable Credentials, Zero-Knowledge Proofs, Privacy-Preserving Identity, Selective Disclosure, BBS Signatures, SD-JWT, Self-Sovereign Identity, Privacy Engineering, Adaptive Cryptography.
Sanchita Shukla· International Journal of Cre...· 0 citations
Public cloud file sharing enhances accessibility and scalability but still suffer from the same issues as bearer tokens and centralized key services: credential theft, credential replay, single point compromise, and continued key availability after credential expiration. To tackle these deficiencies, this study presents a file-sharing prototype system which is a combination of AES-256-GCM encryption, ES256 recipient-bound JSON Web Tokens, proof-of-possession signatures, nonce based replay prevention, atomic single use enforcement, and 3-of-5 Shamir threshold key sharing. A set of trials was employed to evaluate the cryptographic processing, token attacks, threshold recovery, guardian failures, expiration behaviour, and concurrent access, along with synthetic access logs for anomaly detection. The legitimate access succeeded in all trials, while most of the other types of attacks (expired, modified, replayed, stolen-token attacks) reached 0% success rate. Key reconstruction failed with less than 3 guardian failures, was still possible with a maximum of 2 guardian failures and was not possible after deletion of guardian shares. The threshold design had a small amount of extra latency across centralized baseline designs and was able to serve 100 concurrent requests with 100% success. The study concludes that with a combination of recipient bound temporal authorization with distributed key custody, auditable cryptographic expiration becomes possible. The most significant contribution it makes is the union of different features in an integrated and experimented verified workflow, which consists of secure access, replay resistance, threshold recovery, and verifiable post-expiry key unavailability.
M. Mrunalini, Chethan Venkatesh, K. Suneetha et al.· Journal of Intelligent Decis...· 0 citations
Abstract Ensuring the long-term security and accessibility of digital resources is a critical challenge for libraries and archives. Traditional cryptographic methods, including RSA and elliptic curve schemes, are threatened by advances in quantum computing, which could compromise the confidentiality and authenticity of stored data. To address this, we present a Post-Quantum Digital Preservation and Secure File Sharing Framework that safeguards archival materials while enabling controlled user access. The framework integrates three core components: (i) a key encapsulation mechanism (KEM) for secure session key distribution; (ii) AES-GCM for efficient and file encryption; and (iii) digital signatures for authenticity verification. A dual-application design supports both repository operators and end-users: Repository operators encrypt, sign, and package digital assets into bundles, while users verify signatures, decrypt files, and restore content through a dedicated receiver GUI. Although the prototype employs X25519 and Ed25519 as placeholders, its architecture is fully compatible with NIST-standardized post-quantum algorithms such as Kyber (KEM) and Dilithium (signatures). By combining preservation with secure file sharing, the framework ensures confidentiality, authenticity, integrity, and resistance to quantum-era threats, offering a practical and forward-looking solution for Digital repositories.
S. Balachandran, S. Sivankalai· Preservation, Digital Techno...· 0 citations
Security analysis demonstrates that SecuAudit can effectively resist data forgery, metadata tampering, and sub-threshold collusion attacks under the defined threat model, and establishes a feasible framework for secure data circulation under the evaluated deployment assumptions.
Yufa Shi, Jiaxing Hu, Lipeng Wang et al.· Computers, Materials & C...· 0 citations
This work introduces a confidential software-based HSM ( ccHSM) designed to provide strong isolation and scalable key management without the need for dedicated hardware, and shows that ccHSM doesn’t suffer substantial performance trade-offs while significantly reducing cost relative to conventional hardware and cloud-based solutions.
The efficient and secure management of healthcare records is crucial, as it contains sensitive medical information. Any modifications or tampering in the medical information can result in dreadful conditions due to the wrong diagnosis. Existing methods deployed for maintaining secure storage faced complexities due to larger key lengths, resource requirements, and interoperability issues across a broader deployment. Therefore, to address these limitations, the Dual Attentive Consensus mechanism‐enabled Authentication Security (DACAS) scheme is proposed in this research. Specifically, the Dual Attentive Consensus mechanism (DAC) handles the block creations and blockchain transactions to elevate the security against malicious validator nodes and balances the efficiency of the system. Moreover, the proposed method utilizes the dual verification mechanism that involves the Advanced Encryption Standard (AES) algorithm for encrypting the user credentials and the Elliptic Curve Digital Signature Algorithm (ECDSA) for signature generation, bolstering data integrity and authenticity. Additionally, the Ring Learning with Errors (RLWE) Homomorphic algorithm is employed to encode the patient data before storing it in the cloud via blockchain. The method generates the ciphertext without altering the original contents and improves the data integrity by providing strict privacy compliance. Extensive experiments demonstrate that the proposed DACAS scheme exhibits higher security, outperforming the existing BDSS and AES‐IDEA methods with a time delay of 1.48 ms, GUR of 0.902, gas usage of 13414.78, and verification time of 2.54 ms for evaluation over a data volume of 100 KB/patient and network size of 250 nodes. Further, the experimental results show that the DACAS scheme significantly lowers the processing cost of both encryption and decryption, while elevating the security level of data storage.
A. Cholke, S. Rajput, U. Mulani et al.· Concurrency and Computation· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
