zk-Guard: A Privacy-Preserving Access Control Framework Based on zk-SNARKs and Blockchain for Decentralized Data Sharing

Venue: IEEE Transactions on Dependable and Secure Computing, 2026. DOI: 10.1109/TDSC.2026.3657485

Abstract

The increasing demand for autonomous and open peer-to-peer (P2P) data sharing has driven the widespread adoption of decentralized file systems, such as the InterPlanetary File System (IPFS). However, decentralized data sharing inherently requires distributed access control mechanisms due to the absence of centralized authorities. Although blockchain-based access control has become a primary solution, the public nature of blockchain can unintentionally reveal user attributes, posing significant privacy risks. To address the leakage of attribute sets in blockchain, we propose zk-Guard, a decentralized access control framework integrating blockchain and zero-knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs) tailored for IPFS. To further improve the efficiency of zero-knowledge policy checking and reduce the delay of policy updating, we employ a universal constraint circuit and encode policies into sparse configuration matrices, achieving fine-grained, rapid policy updates without regenerating proving keys while guaranteeing constant-time verification regardless of policy complexity. Additionally, to prevent repeated permission checks for large files and improve system responsiveness, zk-Guard integrates Merkle Tree Proof (MTP) mechanisms to securely link sub-data blocks to their root block. Comprehensive theoretical complexity analysis and extensive experiments demonstrate that zk-Guard achieves substantial performance improvements over existing schemes, with constant-time proof verification under 2.5 ms enabling efficient data retrieval, and policy deployment and updates completed within 0.2 seconds even for 1,000 attributes. The source code is available at https://github.com/ningboliucug/zk-Guard.