# A Privacy-Preserving Record Linkage Method Based on Secret Sharing and Blockchain
## 4 Methods
### Output and Audit Module
#### 4.4.4 Record Keeping and Provenance
* If a majority of validation nodes are compromised: This would destroy the system's core trust mechanism, as the audit and reputation systems (maintained by the audit verification and reputation management smart contracts) would fail. * If both types of nodes are compromised on a large scale: This is a catastrophic scenario. Attackers could submit malicious data and have it \"legitimized\" by compromised validation nodes, causing the defense system built by various smart contracts and IPFS to face systemic failure. The immutability of the blockchain would only preserve a trace for post-mortem analysis. Regarding Bloom filters, while they might have risks if used in isolation (especially when facing malicious attackers), in SSB-PPRL, they primarily serve as an encoding tool. Their privacy is ensured by subsequent steps strictly orchestrated and enforced by various smart contracts, such as secret sharing (shares stored on IPFS), mask computation, and random permutation, which largely mitigate their inherent weaknesses. However, to further strengthen against complex malicious attacks that directly analyze or crack Bloom filters encoding themselves, future introduction of techniques like salted hashing or noise injection would be a very valuable supplement. In the output and audit phase, participants only receive the aggregated Hamming distance \(D_{ij}\). Audit verification nodes access data from IPFS as authorized by smart contracts for recomputation. All critical operations and metadata are recorded on the blockchain, ensuring transparency and traceability. In summary, this method integrates various techniques, including blockchain smart contract-driven access control and process management, alongside IPFS distributed storage. Information available to a single node is limited, and the system is designed to resist collusion by \(t-1\) nodes. However, primary risks and trust requirements shift to node behavioral security and underlying technology robustness. Therefore, the security and correctness of various smart contracts, the effectiveness of node selection and reputation mechanisms, the secret sharing threshold \(t\), and IPFS data guarantees are crucial for maintaining system privacy and usability in complex adversarial environments. ### Linkage Quality Analysis

This method achieves approximate matching by computing the Hamming distance between Bloom filters, a technique that effectively handles data errors and variations, offering broader applicability compared to methods limited to exact matching. The Hamming distance reflects the similarity of original records based on q-grams. Linkage quality significantly depends on the choice of Bloom filter parameters (length \(m\), number of hash functions \(k\), q-gram length \(q\)). These parameters determine the precision of representation and the false positive rate \(f\), directly impacting linkage accuracy. Parameter settings require a trade-off between linkage quality, privacy protection, and system overhead. This method adopts Hamming distance as the similarity metric; it is sensitive to differences in all bit positions, distinguishing it from metrics like the Dice coefficient which focus on shared features. Consequently, its matching performance may vary compared to other metrics under different data characteristics (e.g., sparsity) or application scenarios, necessitating practical evaluation. Subsequent processes, including secret sharing, mask computation, B2A conversion, and final Hamming distance aggregation, are designed to precisely compute the Hamming distance determined by Bloom filter representation, assuming no computational errors or malicious behavior. These cryptographic operations should theoretically not introduce additional loss in linkage quality. Thus, the primary factors affecting linkage quality remain the Bloom filter encoding strategy and its parameter settings in the initial stage.