Decentralized identity systems have emerged as a transformative paradigm, granting users unprecedented data sovereignty and privacy-preserving capabilities, fueling critical innovations in Web3 ecosystems. However, these systems primarily serve as identity-layer solutions, forcing verifiers to design special cryptographic protocols for access control deployment, which is an error-prone and expert-dependent process. Moreover, existing approaches fail to effectively combat credential fraud (e.g., credential theft and revoked credential reuse) without compromising privacy guarantees. This paper presents FRAC (Flexible Fraud-Resistant Access Control), an efficient decentralized access control framework that achieves two paradigm shifts: 1) Streamlined access control deployment: a logic-centric paradigm encodes access criteria through declarative verification rules, eliminating manual cryptographic protocol design while enabling instant verifier onboarding and efficient presentation generation; 2) Provable fraud resistance: a format-agnostic defensive mechanism based on Merkle trees prevents malicious credential use, requiring only lightweight hash operations and signature verification instead of computation-intensive operations. We conduct rigorous security analysis based on universally composable security and evaluate the performance, demonstrating FRAC’s security and efficiency.

Decentralized identity (DID) is pivotal to Web3 applications as it empowers users to manage their identities and credentials without relying on any central authority. Multi-controller is a new and indispensable scenario outlined by the W3C DID standards, while its privacy and security issues have not yet been fully explored. In this paper, we find two new attacks caused by multiple controllers toward DID management, and propose a privacy-preserving and secure identity management scheme to defend against both attacks. The first proposed controller-correlation attack allows an attacker to infer relationships between different subjects by correlating the public keys uploaded by multiple controllers to the blockchain. To avoid this kind of privacy leakage, we propose a masking scheme based on the Merkle tree, which allows the controllers to prove their ownership over the multi-controller identities without publicizing the plaintext of their public keys. The other identity impersonation attack exploits insecure controller revocation caused by high block synchronization latency. To resist this attack, we propose a lightweight authentication scheme. The holders provide digest freshness proof while the verifiers only need to download block headers. To evaluate the feasibility of our proposed scheme, we implement our system on the Sepolia TestNet. The experimental result demonstrates that our system can prevent these attacks with acceptable gas consumption and time consumption, compared with the state-of-the-art.

Online diagnosis is one of the data services, which can use the machine learning model placed on the cloud and collected physical data from internet of medical things (IoMT) for better medical services. However, the collected user data, diagnosis results and the deployed machine learning model contain sensitive information of users and the healthcare provider, which may lead to serious privacy leakage. To achieve a secure outsourced diagnosis, both high security and low burden for users should be considered. However, the existing works can not solve these problems simultaneously. In this article, based on two non-colluding servers, a privacy-preserving cloud-aided diagnosis scheme for IoMT is proposed. Concretely, a hybrid data encryption method based on homomorphic encryption and AES is used to generate user requests in an efficient way. Besides, we propose a class of secure two-party protocols using homomorphic encryption, such as secure kernel function computation, secure multiplication, and secure comparison, and a privacy-preserving diagnosis scheme based on multi-class SVM with these building blocks is constructed, which can keep users offline in the diagnosis process. Finally, the security analysis and evaluation further illustrate that our scheme is superior to the prior works in terms of security and user-friendliness.