# Blockchain-Based Privacy-Preserving Vaccine Passport System

Authors: Yangzhou Cao; Jiageng Chen; Yajun Cao
Journal: Security and Communication Networks
 (2022)

---

## Abstract

In this study, we propose a blockchain-based privacy-preserving vaccine passport system for the global prevention and control of infectious diseases. The system operates a double-chain framework which consists of a public blockchain and a consortium blockchain. Among them, the combination of the immutability of the public blockchain and Internet of Things (IoT) technology in the supply chain ensures the openness and transparency of the cold chain logistics records of the vaccines covering the stages from auditing to the target vaccination hospitals. The system adopts the consortium blockchain to achieve the balance between the protection of users’ vaccination privacy and auditing by the government departments. Specifically, a distributed system-based threshold signature is adopted in the vaccine qualification phase to resist collusion between the vaccine manufacturing company and vaccine approval institutions. The cryptographic tools such as the anonymous credentials, zero-knowledge protocols, and range proofs ensure that users do not disclose any private information other than proving that they have a legally valid vaccine passport when users display the vaccine passports to customs. At the same time, customs can apply various vaccine prevention policies based on the conditions on the specific vaccine passports. Regarding the security properties of the system, a formal security model is given along with the corresponding security proofs.


---

## Body

## 1. Introduction

With the outbreak of COVID-19 in early 2020, the global defense against the spread of COVID-19 has been severely tested. Following the outbreak, scientists, physicians, and vaccine manufacturers in various countries engaged in the development of vaccines for the coronavirus. On January 24, 2020, the Chinese Center for Disease Control and Prevention (CDC) successfully isolated the first coronavirus strain in China [1]. The National Pathogenic Microbial Resource Library released information and electron microscopy photos of this strain (Wuhan strain 01 of the novel coronavirus), as well as important authoritative information such as primers and probe sequences for nucleic acid detection of the novel coronavirus, all of which laid the foundation for vaccine development. On this basis, COVID-19 vaccines in each country were promoted from the R&D stage to the clinical trial stage. In the second half of 2020, COVID-19 vaccines developed in each country gradually were approved for marketing by various national approval authorities.At the stage when COVID-19 vaccines were introduced into the market and society, vaccination would face social problems in various aspects. With the gradual introduction of COVID-19 vaccines, vaccine management and vaccination become important issues for national governments. Especially in emergency cases when the COVID-19 vaccine is not sufficient, it is vital for the privacy of vaccination information to be protected to prevent social conflicts. As the epidemic is effectively controlled in various regions, the people returning from various countries and regions are also a serious test for the prevention and control of the local epidemic. Therefore, the application of vaccine passports was born.As countries around the world gradually recovered from the effects of the COVID-19 epidemic, urgent cultural communication and trade between countries led to the implementation of vaccine passports. On July 26, 2021, municipalities, wards, towns, and villages throughout Japan began accepting applications for the official certificate (“vaccine passport”) for COVID-19 vaccine [2]. The key information of the vaccine certificate includes the individual’s name, date of birth, passport number, type of vaccine used, and date of vaccination. The idea is that the certificates exempt travelers from Japan from quarantine and other antivirus measures after their arrival in overseas destinations. However, the Japanese government does not make such exemptions for people who enter Japan with vaccine passports issued by other nations for now, and the government is considering making vaccine passports digital. At 1 : 00 p.m. Vancouver time on August 23, the Premier of British Columbia held a press conference to announce the implementation rules for the British Columbia vaccine certificate. Starting from September 13, people attending indoor concerts, sporting events, movie theaters, and other nondiscretionary activities must receive at least one dose of the COVID-19 vaccine and show proof of it. On October 24, the vaccination requirement will be increased to 7 days after completing two doses of the vaccine before being allowed to enter certain public places with a vaccination card [3].The vaccine passport should be an internationally recognized certificate of vaccination for COVID-19 [4] and possibly other types as well. In February 2021, the concept of the vaccine passport was still in the initial stages of controversy, and international opinion was divided. In the view of proponents, the emergence, use, and popularity of a vaccine passport would significantly mitigate the impact of the COVID-19 pneumonia outbreak on international travel and facilitate global economic recovery. In contrast, in the view of opponents, it is far from simple to establish a globally circulating and mutually recognized certification system that can effectively protect the privacy and ensure fairness.The purpose of this study is to design protocols to ensure the transparency and privacy of vaccination, as well as the privacy of vaccine passports through the technology of cryptography to address the issues of privacy protection. However, we point out that the vaccine passports are subjected to a global consensus. It assumes that the design, implementation, and operation of the vaccine passport system should be supported and accepted by countries around the world.


### 1.1. Prior and Related Work

COVID-19 outbreak led to research on vaccine supply chain improvements. Many researchers in cryptography proposed blockchain-based systems for the distribution and management of vaccine supply chains. The idea is to take advantage of the nontamperability of blockchain, and the nature of jointly maintaining a unified ledger to ensure the supply of vaccines is regulated and transparent. Meanwhile, with the update and development of IoT technology, IoT in the field of traditional commodity logistics has been migrated to the field of logistics and transportation of pharmaceutical products. Among them, the monitoring and supervision of environmental conditions of vaccines belonging to biological products in the process of cold chain logistics transportation can combine IoT devices with sensors. Specific sensors feedback to the CDC, which monitors the logistics of biologics, about the humidity, temperature, light protection, and other transport conditions during the cold chain transportation of vaccines. As vaccination users, they also own the right to know that vaccine production and transportation meet quality control. Cui et al. [5] proposed a blockchain-based vaccine tracking system to protect the entire vaccine cycle. The blockchain is used as a global, unique, and verifiable database to store all circulating databases. Antal et al. [6] used Ethernet’s smart contract technology to achieve the integrity of guaranteed vaccine data and the immutability of registration for vaccinators, avoiding identity theft and imitation. Yong et al. [7] applied machine learning techniques to analyze and process data in the vaccine blockchain.Abid’s proposed vaccine platform [8] provides a sovereign user identity that gives users full control over their data and encrypts personally identifiable information to enhance privacy. The platform also leverages W3C verifiable credential standards to facilitate instant verification of COVID-19 proofs and allow users to share selected information with trusted parties. However, the platform’s privacy is protected by hashing sensitive information and then storing it on the blockchain, which is at risk when the data are broadcasted. Haque et al. [9], the authors proposed an architectural framework of a permission blockchain-based vaccination passport for the European Union’s General Data Protection Regulations (GDPR). The scope of this regulation is broad, and any organization that collects, transfers, retains, or processes personal information involving all EU member states is subject to the regulation. Then, the double-chain structured blockchain system proposed by Qiu and Zhu [10] combines a public blockchain and a private blockchain to manage and store data information in different processes of vaccine logistics and vaccination. However, the user privacy of this system relies too much on the authorization mechanism of the private blockchain.


### 1.2. Contributions

In this study, we propose a double-chain framework with the vaccine cold chain logistics system and vaccination record system. We introduce threshold signature technology at the vaccine audit stage of public blockchain to deal with complicity between vaccine manufacturing companies and vaccine approval institutions. Second, it applies the consortium blockchain to record the information of vaccination hospitals to give vaccination to users. Its process ensures the privacy of vaccination hospitals, vaccination users, and vaccination vaccines and reserves the right to reveal and audit the vaccination information records by government departments under special circumstances.In the issuance and presenting of the vaccine passport, the use of anonymous credential, ring signature, and range proofs ensures that the validity of the vaccine passport is proven without revealing the user’s vaccination hospital and identity information during the process.


### 1.3. Paper Organization

In the subsequent content of this study, we present the entities and the system threat model in the vaccine passport system in Section2. We show the cryptographic techniques and tools used to build the system protocol in Section 3. Section 4 of this article provides the structural design of the system and the specific protocol design. We give the security analysis and proof of the protocols in this model in Section 5. We give a system evaluation in Section 6, and we finally conclude this article in Section 7.


## 1.1. Prior and Related Work

COVID-19 outbreak led to research on vaccine supply chain improvements. Many researchers in cryptography proposed blockchain-based systems for the distribution and management of vaccine supply chains. The idea is to take advantage of the nontamperability of blockchain, and the nature of jointly maintaining a unified ledger to ensure the supply of vaccines is regulated and transparent. Meanwhile, with the update and development of IoT technology, IoT in the field of traditional commodity logistics has been migrated to the field of logistics and transportation of pharmaceutical products. Among them, the monitoring and supervision of environmental conditions of vaccines belonging to biological products in the process of cold chain logistics transportation can combine IoT devices with sensors. Specific sensors feedback to the CDC, which monitors the logistics of biologics, about the humidity, temperature, light protection, and other transport conditions during the cold chain transportation of vaccines. As vaccination users, they also own the right to know that vaccine production and transportation meet quality control. Cui et al. [5] proposed a blockchain-based vaccine tracking system to protect the entire vaccine cycle. The blockchain is used as a global, unique, and verifiable database to store all circulating databases. Antal et al. [6] used Ethernet’s smart contract technology to achieve the integrity of guaranteed vaccine data and the immutability of registration for vaccinators, avoiding identity theft and imitation. Yong et al. [7] applied machine learning techniques to analyze and process data in the vaccine blockchain.Abid’s proposed vaccine platform [8] provides a sovereign user identity that gives users full control over their data and encrypts personally identifiable information to enhance privacy. The platform also leverages W3C verifiable credential standards to facilitate instant verification of COVID-19 proofs and allow users to share selected information with trusted parties. However, the platform’s privacy is protected by hashing sensitive information and then storing it on the blockchain, which is at risk when the data are broadcasted. Haque et al. [9], the authors proposed an architectural framework of a permission blockchain-based vaccination passport for the European Union’s General Data Protection Regulations (GDPR). The scope of this regulation is broad, and any organization that collects, transfers, retains, or processes personal information involving all EU member states is subject to the regulation. Then, the double-chain structured blockchain system proposed by Qiu and Zhu [10] combines a public blockchain and a private blockchain to manage and store data information in different processes of vaccine logistics and vaccination. However, the user privacy of this system relies too much on the authorization mechanism of the private blockchain.


## 1.2. Contributions

In this study, we propose a double-chain framework with the vaccine cold chain logistics system and vaccination record system. We introduce threshold signature technology at the vaccine audit stage of public blockchain to deal with complicity between vaccine manufacturing companies and vaccine approval institutions. Second, it applies the consortium blockchain to record the information of vaccination hospitals to give vaccination to users. Its process ensures the privacy of vaccination hospitals, vaccination users, and vaccination vaccines and reserves the right to reveal and audit the vaccination information records by government departments under special circumstances.In the issuance and presenting of the vaccine passport, the use of anonymous credential, ring signature, and range proofs ensures that the validity of the vaccine passport is proven without revealing the user’s vaccination hospital and identity information during the process.


## 1.3. Paper Organization

In the subsequent content of this study, we present the entities and the system threat model in the vaccine passport system in Section2. We show the cryptographic techniques and tools used to build the system protocol in Section 3. Section 4 of this article provides the structural design of the system and the specific protocol design. We give the security analysis and proof of the protocols in this model in Section 5. We give a system evaluation in Section 6, and we finally conclude this article in Section 7.


## 2. Assumptions and Threat Model

### 2.1. Entities and Assumptions

Before presenting the system structure, we introduce the entity participants in the system.(i)
International coalition government,GV: it acts as the system’s CA to manage the authorization and authentication of each participant. It acts as a trusted third party for threshold signatures in the vaccine approval process. In exceptional cases, it can audit the encrypted information in the consortium blockchain that records vaccinations.(ii)
Hospital,HOSP: it issues a credential for the user’s vaccine passport after completion of the vaccination and uploads the information recording the vaccination to the consortium blockchain.(iii)
User: the user receives a vaccine passport after completion of vaccination at the hospital. When it is necessary to prove the legitimacy and validity of the vaccine passport to the vaccine passport checkpoint, zero-knowledge proof protocol is applied to protect their privacy.(iv)
Vaccine manufacturing company: it sends samples of the vaccine to be tested to the vaccine approval institutions in each country for approval. Once the vaccine is approved, the batch is issued a certificate of authorization.(v)
Vaccine approval institutions,AI: each country’s approval body tests the submitted vaccine samples according to its own standards. The approved vaccine approval institution signs a threshold signature for the vaccine. The GV issues a threshold signature certificate to the vaccine lot after t,n vaccine approval institutions have been met and approved simultaneously.(vi)
Vaccine passport checkpoint: it verifies the user’s identification and proof of the legitimacy and validity of the vaccine passport. It also takes the appropriate vaccination measures and policies for the fulfillment of the conditions of the user’s vaccine passport.(vii)
Vaccine transit centers: they act as a transit point for vaccine shipments connecting vaccine companies to the CDC. Information on storage and transport conditions during cold chain logistics is uploaded.(viii)
CDC: it audits the vaccine cold chain logistics process for compliance with biologics-related regulations. If so, the vaccine is held in temporary storage and eventually shipped to the hospital where it is administered.Considering the specific prerequisite assumptions for the application of the vaccine passport system to realistic scenarios and specific programs, the system provides the following reasonable assumptions.(i)
The authority of the international coalition government is recognized by every country in the world(ii)
Countries strictly adhere to the normal operation of the system(iii)
The number of corrupted institutions in vaccine approval institutions is less than half of the total number(iv)
Authorized hospitals follow the hospital code of conduct and do not conspire with users(v)
Users do not disclose or share their secret keys


### 2.2. Threat Model

In this study, we do not consider network-level security attacks, physical hardware-level damage, and software vulnerability penetration during the engineering implementation of the protocol. In this study, we only consider cryptographic attacks towards the protocol design.(i)
In the threat model of this study, we assume thatGV and auditor are completely honest. They operate according to the protocol algorithm and do not disclose the privacy parameters generated.(ii)
In the threshold signature phase, adversary is allowed to corrupt up tot<n/2AI s. GV does not disclose institutional audit signatures to vaccine manufacturing companies.(iii)
In the vaccination information record uploading consortium blockchain phase, all peers except the auditor andGV are assumed to be honest-but-curious; they try to break the privacy by passively eavesdropping on the inputs and outputs of the protocol but not actively violating the protocol process.(iv)
In the vaccine passport display phase, vaccine passport checkpoint is assumed to be honest-but-curious; it tries to get the user’s private data, but it still follows the protocols.


## 2.1. Entities and Assumptions

Before presenting the system structure, we introduce the entity participants in the system.(i)
International coalition government,GV: it acts as the system’s CA to manage the authorization and authentication of each participant. It acts as a trusted third party for threshold signatures in the vaccine approval process. In exceptional cases, it can audit the encrypted information in the consortium blockchain that records vaccinations.(ii)
Hospital,HOSP: it issues a credential for the user’s vaccine passport after completion of the vaccination and uploads the information recording the vaccination to the consortium blockchain.(iii)
User: the user receives a vaccine passport after completion of vaccination at the hospital. When it is necessary to prove the legitimacy and validity of the vaccine passport to the vaccine passport checkpoint, zero-knowledge proof protocol is applied to protect their privacy.(iv)
Vaccine manufacturing company: it sends samples of the vaccine to be tested to the vaccine approval institutions in each country for approval. Once the vaccine is approved, the batch is issued a certificate of authorization.(v)
Vaccine approval institutions,AI: each country’s approval body tests the submitted vaccine samples according to its own standards. The approved vaccine approval institution signs a threshold signature for the vaccine. The GV issues a threshold signature certificate to the vaccine lot after t,n vaccine approval institutions have been met and approved simultaneously.(vi)
Vaccine passport checkpoint: it verifies the user’s identification and proof of the legitimacy and validity of the vaccine passport. It also takes the appropriate vaccination measures and policies for the fulfillment of the conditions of the user’s vaccine passport.(vii)
Vaccine transit centers: they act as a transit point for vaccine shipments connecting vaccine companies to the CDC. Information on storage and transport conditions during cold chain logistics is uploaded.(viii)
CDC: it audits the vaccine cold chain logistics process for compliance with biologics-related regulations. If so, the vaccine is held in temporary storage and eventually shipped to the hospital where it is administered.Considering the specific prerequisite assumptions for the application of the vaccine passport system to realistic scenarios and specific programs, the system provides the following reasonable assumptions.(i)
The authority of the international coalition government is recognized by every country in the world(ii)
Countries strictly adhere to the normal operation of the system(iii)
The number of corrupted institutions in vaccine approval institutions is less than half of the total number(iv)
Authorized hospitals follow the hospital code of conduct and do not conspire with users(v)
Users do not disclose or share their secret keys


## 2.2. Threat Model

In this study, we do not consider network-level security attacks, physical hardware-level damage, and software vulnerability penetration during the engineering implementation of the protocol. In this study, we only consider cryptographic attacks towards the protocol design.(i)
In the threat model of this study, we assume thatGV and auditor are completely honest. They operate according to the protocol algorithm and do not disclose the privacy parameters generated.(ii)
In the threshold signature phase, adversary is allowed to corrupt up tot<n/2AI s. GV does not disclose institutional audit signatures to vaccine manufacturing companies.(iii)
In the vaccination information record uploading consortium blockchain phase, all peers except the auditor andGV are assumed to be honest-but-curious; they try to break the privacy by passively eavesdropping on the inputs and outputs of the protocol but not actively violating the protocol process.(iv)
In the vaccine passport display phase, vaccine passport checkpoint is assumed to be honest-but-curious; it tries to get the user’s private data, but it still follows the protocols.


## 3. Preliminaries

### 3.1. Bilinear Pairing

Lete:G1×G2⟶GT a bilinear map where G1 is a GDH group and G1≠G2 in our protocol. G1,G2 are the two multiplicative cyclic groups of prime order q. The bilinear pairing e:G1×G2⟶GT has the following three properties:(i)
Bilinear: for allg1∈G1, g2∈G2, and α,β∈ℤq, it holds that eg1α,g2β=eg1,g2αβ;(ii)
Computability: there exists an efficient algorithm to calculateeg1,g2, where g1∈G1, g2∈G2;(iii)
Nondegenerate:eg1,g2≠1 for ∃g1∈G1, g2∈G2, where 1 is the unit element in the multiplicative cyclic group.


### 3.2. q-Strong Diffie–Hellman Assumption

The q-SDH problem inG1,G2 is defined that for adversary A on input a q+2-tuple g1,g2,g2x,g2x2,…,g2xq∈G1×G2q+1(1)PrA=g11/x+c:A,c⟵Ag1,g2,g2x,g2x2,…,g2xq⩽neglλ.


### 3.3. Threshold Signature Scheme

Thet,n threshold signature scheme allows any t signers among n signers to generate a signature for a message, but less than t signers participate to generate a valid signature. The threshold signature scheme can build a robust signature system to prevent the unlawful behavior of some signers. The threshold signature scheme consists of the following four algorithms:(i)
ThresholdKeyGenλ,n,t: for distributed systems, threshold key generation algorithm is a protocol that runs interactively among many participants. With the input security parameters λ, number of users n, and threshold t, it outputs the secret share xi for each participant, such that x1,…,xn⟶t,nsk.(ii)
Signxi,m: the signers in the participants output the signature share σi based on the input secret share xi and the message m.(iii)
Reconstructionσi: the resulting signature σ can be generated by a trusted third party based on the signature share σi of not less than t signers.(vi)
Verifypk,m,σ: the verification algorithm inputs the verification public key pk, message m, and resulting signature σ and outputs 1 when the signature is successfully verified; otherwise, it outputs 0.


### 3.4. Ring Signature Scheme

A ring signature is a digital signature that can be executed by any member of a group of users that each have a pair of keys, so that a message with a ring signature is recognized by someone in a particular group. But, it is computationally infeasible to determine which group member’s key is used to generate the signature, which is one of the security properties of ring signatures. All possible signers are formed into a ring. Each possible signer is called a ring member. The ring member that generates the signature is called a signer, and each other ring member is called a nonsigner. The ring signature scheme consists of the following three algorithms:(i)
KeyGenλ,n: let ring R=R1,…,Rn. With the input security parameters λ, it outputs each user public-secret key pair ski,pki. Assume that the signing member is Rs.(ii)
Signsks,m,pkii∈1,…,n,i≠s: the signer Rs generates a ring signature σring on message m with its own secret key sks and the public keys pki of other members.(iii)
Verifypkii∈1,…,n,m,σring: the verification algorithm is with the input of public keys pkii∈1,…,n, message m, and ring signature σring and outputs 1 when the signature is successfully verified; otherwise, it outputs 0.


### 3.5. Zero-Knowledge Proof

A zero-knowledge proof is a protocol that the proverP can convince the verifier V that an argument is correct without providing any useful information to the verifier. A zero-knowledge proof is essentially an agreement involving two or more parties, i.e., a series of steps that two or more parties need to take to accomplish a task. The prover convinces the verifier that he or she knows or has a certain message, but the proof process cannot divulge any information about the proven message to the verifier. In our system protocol design, we focus on zero-knowledge proof for NP language LR=y|∃ωs.t.y,ω∈R, where ω is a witness for statement y. A zero-knowledge proof protocol between P and V satisfies the following three properties:(i)
Completeness: ify∈LR, prover P convinces V that his statement is true with probability 1−neglλ.(ii)
Soundness: if the prover’s statementy∉LR, then any malicious prover P∗ convinces an honest verifier of his statement with probability neglλ.(iii)
Honest verifier zero-knowledge (HVZK): after the proof is executed, the verifier only knows whether the statement of the verifier is true or not, but he does not have access to any other information during the proof. It can also be said that there exists a simulator algorithmSim that simulates interaction scripts that are nondistinguishable with the real interaction scripts between P and V.Range proof: range proof is proof that a secret valuex, which is encrypted or committed to, lies in a certain interval a,b. In this study, the secret value x is hidden by Pedersen commitment, such that C=gxhr. Range proof does not leak any information about the secret value other than the fact that they lie in the interval. The prover needs to provide zero-knowledge proof to the verifier PKx,r:C=gxhr∧x∈a,b.


## 3.1. Bilinear Pairing

Lete:G1×G2⟶GT a bilinear map where G1 is a GDH group and G1≠G2 in our protocol. G1,G2 are the two multiplicative cyclic groups of prime order q. The bilinear pairing e:G1×G2⟶GT has the following three properties:(i)
Bilinear: for allg1∈G1, g2∈G2, and α,β∈ℤq, it holds that eg1α,g2β=eg1,g2αβ;(ii)
Computability: there exists an efficient algorithm to calculateeg1,g2, where g1∈G1, g2∈G2;(iii)
Nondegenerate:eg1,g2≠1 for ∃g1∈G1, g2∈G2, where 1 is the unit element in the multiplicative cyclic group.


## 3.2. q-Strong Diffie–Hellman Assumption

The q-SDH problem inG1,G2 is defined that for adversary A on input a q+2-tuple g1,g2,g2x,g2x2,…,g2xq∈G1×G2q+1(1)PrA=g11/x+c:A,c⟵Ag1,g2,g2x,g2x2,…,g2xq⩽neglλ.


## 3.3. Threshold Signature Scheme

Thet,n threshold signature scheme allows any t signers among n signers to generate a signature for a message, but less than t signers participate to generate a valid signature. The threshold signature scheme can build a robust signature system to prevent the unlawful behavior of some signers. The threshold signature scheme consists of the following four algorithms:(i)
ThresholdKeyGenλ,n,t: for distributed systems, threshold key generation algorithm is a protocol that runs interactively among many participants. With the input security parameters λ, number of users n, and threshold t, it outputs the secret share xi for each participant, such that x1,…,xn⟶t,nsk.(ii)
Signxi,m: the signers in the participants output the signature share σi based on the input secret share xi and the message m.(iii)
Reconstructionσi: the resulting signature σ can be generated by a trusted third party based on the signature share σi of not less than t signers.(vi)
Verifypk,m,σ: the verification algorithm inputs the verification public key pk, message m, and resulting signature σ and outputs 1 when the signature is successfully verified; otherwise, it outputs 0.


## 3.4. Ring Signature Scheme

A ring signature is a digital signature that can be executed by any member of a group of users that each have a pair of keys, so that a message with a ring signature is recognized by someone in a particular group. But, it is computationally infeasible to determine which group member’s key is used to generate the signature, which is one of the security properties of ring signatures. All possible signers are formed into a ring. Each possible signer is called a ring member. The ring member that generates the signature is called a signer, and each other ring member is called a nonsigner. The ring signature scheme consists of the following three algorithms:(i)
KeyGenλ,n: let ring R=R1,…,Rn. With the input security parameters λ, it outputs each user public-secret key pair ski,pki. Assume that the signing member is Rs.(ii)
Signsks,m,pkii∈1,…,n,i≠s: the signer Rs generates a ring signature σring on message m with its own secret key sks and the public keys pki of other members.(iii)
Verifypkii∈1,…,n,m,σring: the verification algorithm is with the input of public keys pkii∈1,…,n, message m, and ring signature σring and outputs 1 when the signature is successfully verified; otherwise, it outputs 0.


## 3.5. Zero-Knowledge Proof

A zero-knowledge proof is a protocol that the proverP can convince the verifier V that an argument is correct without providing any useful information to the verifier. A zero-knowledge proof is essentially an agreement involving two or more parties, i.e., a series of steps that two or more parties need to take to accomplish a task. The prover convinces the verifier that he or she knows or has a certain message, but the proof process cannot divulge any information about the proven message to the verifier. In our system protocol design, we focus on zero-knowledge proof for NP language LR=y|∃ωs.t.y,ω∈R, where ω is a witness for statement y. A zero-knowledge proof protocol between P and V satisfies the following three properties:(i)
Completeness: ify∈LR, prover P convinces V that his statement is true with probability 1−neglλ.(ii)
Soundness: if the prover’s statementy∉LR, then any malicious prover P∗ convinces an honest verifier of his statement with probability neglλ.(iii)
Honest verifier zero-knowledge (HVZK): after the proof is executed, the verifier only knows whether the statement of the verifier is true or not, but he does not have access to any other information during the proof. It can also be said that there exists a simulator algorithmSim that simulates interaction scripts that are nondistinguishable with the real interaction scripts between P and V.Range proof: range proof is proof that a secret valuex, which is encrypted or committed to, lies in a certain interval a,b. In this study, the secret value x is hidden by Pedersen commitment, such that C=gxhr. Range proof does not leak any information about the secret value other than the fact that they lie in the interval. The prover needs to provide zero-knowledge proof to the verifier PKx,r:C=gxhr∧x∈a,b.


## 4. Our Proposed System

Before showing the overview of our system model, we present the reasons for choosing the double chain as the basis of the system. The generation of the vaccine passport and the vaccine itself are indivisible. Given the biomedical properties of the vaccine itself, we need a public blockchain to store the production and logistics information of the vaccine. The choice of the consortium blockchain is that vaccination records are information with privacy properties and are required to be privacy protected and regulated. So, it is uncomplicated to achieve the intended effect in a blockchain under authorization.


### 4.1. Overview

Our system consists of three main phases in the vaccine cold chain logistics phase, as shown in Figure1.Figure 1
Vaccine cold chain logistics phase.Step 1.
It is for the vaccine manufacturing company to send a batch of vaccine samples that need to be checked to ensure quality to the vaccine approval institutions in each country.Step 2.
It consists of each country’s vaccine approval institution passing its review results through at,n threshold (if a total of n vaccine approval institutions are satisfied with the approval of t vaccine approval institutions, then the batch of vaccine is approved). If the batch meets the audit requirements, a certificate is issued for the batch through the threshold signature.Step 3.
It is that the vaccine manufacturing company entrusts the cold chain logistics company with the approved batch of vaccine to send to the target hospital. The sender is the vaccine production company. The receiver is the first vaccine transit center. The transported goods are batches of vaccines. The logistics information is uploaded to the public blockchain after the logistics are completed.Step 4.
It is the uploading of cold chain logistics information between vaccine transfer centers. The sender is the previous vaccine transfer center. The receiver is the next vaccine transfer center. The transported goods are batches of vaccines with the environmental conditions of the temporary storage of vaccines and the signature of the person in charge.Step 5.
It is when the vaccine is delivered at the last logistics transit center; the CDC under whose jurisdiction the target hospital is located audits the entire cold chain logistics storage and transportation for compliance with the logistics requirements for biologics. If the batch of the vaccine cold chain logistics process meets the requirements, the CDC issues a certificate of conformity signature to the batch of vaccine.Step 6.
It is to upload the logistics information between the last vaccine transfer center and the CDC to the public blockchain after the approval of the vaccine cold chain logistics. The sender is the last vaccine transfer center. The receiver is the local CDC, and the transported goods are batches of vaccines with the CDC’s certificate for vaccine cold chain logistics.Step 7.
It is to upload the logistics information of the final vaccine delivery from the local CDC to the target hospital to the public blockchain. The sender is the local CDC, and the receiver is the target vaccination hospital. The transported goods are batch of vaccines with a certificate from the CDC for the cold chain logistics of the vaccine and a threshold signature certificate from the vaccine approval institutions. Users are given the right and ability to know the approval results of vaccinations and vaccine cold chain logistics information by viewing the information recorded on the public blockchain before vaccination in hospitals. This helps to achieve openness and transparency of vaccine information to vaccination users.
In the vaccination phase shown in Figure2, the local hospital completes the uploading of vaccination information to the consortium blockchain while protecting the privacy of the vaccination information.Figure 2
Vaccination and vaccine passport phase.Step 8.
It is after the last injection of the user’s vaccine at the local hospital, the hospital creates vaccination information signed by it and sends the vaccination information to the endorser. The sender of the vaccination information is the local hospital. The receiver is the vaccination user. The information transmitted is the details of the vaccine.Step 9.
It is for the endorser to verify the uploaded vaccination information and generate an endorsement signature.Step 10.
It is that the submitting local hospital broadcasts the collected endorsement signatures and the vaccination information itself to the orderers.Step 11.
It is for orderers to broadcast the sorted set of vaccination information to all peers.Step 12.
It is for the committing peer to check if the vaccination information submitted by the orderers has a legitimate certificate issued by the endorser. The committing peer also detects malicious cases where the same vaccination is included in the vaccination information more than once. In this case, the first valid vaccination information will be accepted. Once the uploaded vaccination information is verified by the committing peer, the vaccination information is submitted and the committing peer maintains the state and a copy of the ledger. For the privacy-preserving vaccination information on the consortium blockchain, it is necessary to audit it in case of special circumstances. Auditors have the ability to open the encrypted vaccination information on the consortium blockchain to audit the vaccination details, such as the time of vaccination and vaccine production date.
In the vaccine passport phase in Figure2.Step 13.
It is where the local hospital opens the vaccination user’s commitment to the vaccine production date, vaccine shelf life, vaccine immunity lasting time, and vaccination date. After the hospital confirms that the commitment is correct, a ring signature is generated for the commitment and the international coalition government-issued user identity card. Finally, the ring signature, commitment, and user identity certificate together form the vaccine passport and are sent to the user.Step 14.
It is for the user to first present the vaccine passport to the passport checkpoint. The passport checkpoint verifies the legitimacy of the user’s identity and vaccine passport. Next, the user proves the validity of the vaccine passport to the passport checkpoint. This includes the following three items:(i)
The vaccine injected by the user is within the shelf life. If the vaccine injected by the user does not meet this condition, then first, the passport checkpoint needs to report this medical issue to a government authority. This requires a request for an audit of the vaccination information for the batch (including the local vaccination hospital) and a traceability audit of the vaccine batch. Also, the user needs to be reimbursed for the corresponding vaccination.(ii)
The user produces high titers of antibodies to create effective protection. This corresponds to the last date of vaccination plus 14 days [11], which needs to be greater than the current date. If the user’s vaccination information does not meet this condition, the passport checkpoint needs to take a quarantine for 14 days before allowing the user to pass.(iii)
The vaccinated user is in the duration of immunization for the vaccine. This is equivalent to the last date of vaccination plus the vaccine immunity lasting time that needs to be less than the current date. If the user’s vaccination information does not meet this condition, the passport control point will need to adopt the vaccine again to stimulate an effective antibody prevention strategy.
None of the above proofs will reveal any information about the user’s vaccination, including the production date and shelf life of the vaccine.


### 4.2. Vaccine Cold Chain Logistics

This study adds Boldyreva’s [12] threshold signature technique to other blockchain-based vaccine distribution management systems. Vaccine approval institutions in each country that adopt different standards act as participants in the threshold signature. The international coalition government acts as a trusted third party as the group administrator in the threshold signature group. This vaccine approval protocol effectively prevents collusion and corruption between vaccine approval institutions and vaccine manufacturing companies. The vaccine approval institutions approve samples of vaccines to be submitted for review in a distributed structure on a per-share basis. The distributed protocol allows for up to half of the vaccine approval institutions to be malicious. Once the approval of the submitted vaccine is complete, the vaccine manufacturer receives only the results of whether the submitted vaccine batch was approved or not and does not know the respective review opinions of the individual vaccine approval institutions. This prevents the vaccine manufacturing company from influencing the outcome of the approval, thereby, achieving fairness and equity in vaccine approval. Details are outlined as follows.Setup1λ: on input 1λ, where λ∈ℕ is a security parameter, let e:G1×G2⟶GT, a bilinear map, where G1 is a GDH group and g is the generator of G1. G2 and GT are the cyclic groups. The participants in our scheme are the set of n vaccine approval institutions Aℐ1,…,Aℐn. All AIs are connected by a broadcast channel as well as by secure point-to-point channels including the international coalition government GV. Let H:0,1∗⟶G2 be collision-resistant hash function.Generatingxfiy,fi′y:Aℐi chooses ai0,…,ait⟵Rℤp and ai0′,…,ait′⟵Rℤp to form the polynomials fiy and fi′y of degree t: fiy=ai0+ai1y+⋯+aityt and fi′y=ai0′+ai1′y+⋯+ait′yt. Aℐi broadcasts commitment to polynomial coefficients Cik=gaikhait′ mod p for k∈0,…,t. Aℐi computes sij=fij and sij′=fi′j mod q for j∈1,…,n and sends sij and sij to Aℐj to verify. Then, each Aℐj verifies if(2)gaikhait′=∏k=0tCikjk.If the above equation is not satisfied,Aℐj will broadcast the complaint against Aℐi. According to the conditions satisfied by the distributed key generation protocol DKG for discrete-log based systems of Gennaro et al. [13], each Aℐi sets his share of the secret as xi=∑j∈QUALsij mod q. The distributed secret value x equals x=∑i∈QUALai0 mod q from the distributed secret polynomial:(3)Fy=∑i∈QUALai0+∑i∈QUALai1y+⋯+∑i∈QUALaityt.Vaccine approvalxi:Aℐi decides whether to approve the batch of vaccine according to the criteria. If Aℐi approves it, a signature σi=Hvaccinexi and pki=gxi are generated and sent to GV. GV verifies the signature by eg,σi=epki,Hvaccine. If the verification passes, Aℐi is assigned to the set APPR.Threshold signatureσi: if the number of Aℐis in set APPR is greater than t,(4)LBjy=∏k=0,k!=jty−yk/yj−yk,is public Lagrange coefficient for the set APPR according to the Lagrange interpolation method [13].(5)x=∑i∈QUALai0=∑i∈QUAL∑j∈APPRLBj0⋅sij=∑j∈APPRLBj0⋅xj.According to the above equation, the resulting signature is thatσvaccine=∏i∈APPRσiLBi0=Hvaccinex and public key is that pk=∏i∈APPRpkiLBi0=gx.User verificationσvaccine,pk,vaccine: the user checks that eg,σvaccine=?epk,Hvaccine for the vaccine. The user accepts the signature if eg,σvaccine=epk,Hvaccine holds or rejects it otherwise.Logistics consignmentσvaccine,vaccine: structure of vaccine includes the following attributes: ID =  Hmanufacturer,batch number,serial number, manufacturer, batch number, serial number, vaccine certificate σvaccine, production date xp, shelf life xs, and the duration of immunization xd. The vaccine manufacturing company broadcasts the vaccine properties, the entrusted logistics company, and the certification certificate σvaccine as a package to the public blockchain.Cold chain logistics transitσvaccine,vaccine,σr: the responsible person for the cold chain logistics staging area broadcasts to the public blockchain the vaccine, the vaccine storage environment, its signature σr, and the logistics destination package.Distribution of CDCpublic blockchain,skCDC: after checking that the cold chain logistics on the public blockchain meets the standards for transporting biologics, the CDC attaches a signature σCDC and broadcasts the distribution to the destination vaccination hospital to the public blockchain.


### 4.3. Vaccination Record

The framework of the vaccination record system is based on Hyperledger Fabric [14], which is a permissioned blockchain. The privacy protections of the identity of the vaccination hospitals and vaccination users in the vaccine record system are referred to the technique of one-time sender and receiver public key in PAChain [15]. The certificate of authority for the long-term public key (representing the identity of the hospital and the user) of the vaccination hospital and the vaccination user uses the BBS + signature [16] issued by the international joint government. However, in the vaccination record system of this study, the identity of the user and hospital is anonymous to the endorsement node. The endorsement of the vaccination record by the endorsing node uses the anonymous credential technique based on the Boneh-Boyen signature [17]. Vaccination information is encrypted with the auditor’s public key using ElGamal encryption [18] to ensure that the information is hidden. If necessary, the auditor can reveal the encrypted vaccination information with his or her secret key. Details are outlined as follows.param⟵Setup1λ: on input 1λ, where λ∈ℕ is a security parameter. Suppose H1:0,1∗⟶0,1128∈ℤp and H2:G1⟶ℤp are collision-resistant hash functions. It randomly picks generators g0,g1,g2,g3,g4,g5,g6,g7,g8,gu,gh∈G1,g^1,g^2,g^e∈G2.skvc,skre,sksd,pkvc,pkre,pksd⟵AuditorKeyGen(): auditor picks random secret keys skvc,skre,sksd⟵Rℤp and outputs their public keys pkvc=g1skvc,pkre=g2skre,pksd=g3sksd.skCA,U,pkCA,U,skCA,H,pkCA,H⟵CAKeyGen(): CA picks random secret keys skCA,U,skCA,H⟵Rℤp and outputs their public keys pkCA,U=g^1skCA,U,pkCA,H=g^2skCA,H.ske,pke⟵EndorserKeyGen(): endorser picks random a secret key ske⟵Rℤp and outputs its public key pke=g^eske.skU,1,skU,2,pkU,1,pkU,2⟵UserKeyGen(): the user randomly picks a pair of long-term secret keys skU,1,skU,2⟵Rℤp and computes a pair of long-term public keys pkU,1=g4skU,1,pkU,2=g4skU,2. HOSP is also a type of user, so it follows the same algorithm to generate skH,1,skH,2,pkH,1,pkH,2.CertCA,U⟵CACertIssueskCA,pkU,1: first, the user needs proof to CA: PoKskU,1:pkU,1=gskU,1. After passing CA verification, CA computes ACA,U=gu⋅pkU,1⋅g5su1/skCA,U+ωu using randomly selected su,ωu⟵Rℤp and its own skCA,U. Then, CA issues a certificate CertCA,U=ACA,U,su,ωu to the user’s pkU,1. HOSP is also a type of user, so it follows the same algorithm to generate CertCA,H=ACA,H=gh⋅pkH,1⋅g5sh1/skCA,H+ωh,sh,ωh⟵CACertIssueskCA,H,pkH,1.Ei,Ri,E,Rv,πenc⟵VaccInfoEnc(vaccination,pkvc): vaccination information includes ID =  Hmanufacturer,batch number,serial number, vaccine certificate σvaccine, production date xp, shelf life xs, the date of vaccination xv, and the duration of immunization xd. Let M=H1vaccination, and it divides 128-bit M into 8 segments of 16-bit messages mi by M=∑i=07mi⋅216i. It encrypts each mi into Ei=g0mipkvcrv,i and Ri=g6rv,i, where rv,i⟵Rℤp. The encryption E on M can be generated by E=∏i=07Ei216i=g0Mpkvcrv and Rv=g6rv, where rv=∑i=07rv,i⋅216i. The user sends Ei to the auditor. Then, it proves in zero-knowledge proof that the knowledge of mi,rv,i and M,rv: PoKmi,rv,ii∈0,…,7,M,rvEi=g0mipkvcrv,i∧Ri=g6rv,i∧E=g0Mpkvcrv∧Rv=g6rv.Details of the zero-knowledge proof is as follows:(1)
TheHOSP randomly picks ai,bi∈ℤp for i∈0,…,7 and a,b∈ℤp and then computes commitments: Cv,i=g0aipkvcbi,Dv,i=g6bi and Cv=g0apkvcb,Dv=g6b.(2)
It computesc=HEi,Ri,Cv,i,Dv,ii∈0,…,E,Rv,Cv,Dv and for i∈0,…7 computes challenge response: z1,i=ai+cmi,z2,i=bi+crv,i, z1=a+cM,z2=b+crv.(3)
Then, it outputsπenc=Cv,i,Dv,i,z1,i,z2,ii∈0,…7,Cv,Dv,z1,z2,cotpkU,RU⟵OTpkGenpkU,1,pkU,2: HOSP randomly picks ru⟵Rℤp and outputs otpkU=pkU,1⋅g4H2pkU,2ru,RU=g4ru. HOSP uses the same algorithm to generate otpkH=pkH,1⋅g4H2pkH,2rh,RH=g4rh⟵OTpkGenpkH,1,pkH,2. HOSP encrypts user’s long-term public key pkU,1 and long-term public key pkH,1 of HOSP to the auditor by picking random rre,rsd⟵Rℤp and computing Ere=pkU,1⋅pkrerre,Rre=g2rre and Esd=pkH,1⋅pksdrsd,Rsd=g3rsd. Then, HOSP runs the following proof of knowledge for ensuring:(i)
pkU,1 and pkH,1 are issued a valid certificate of identity by CA.(ii)
otpkU is generated by pkU,1. otpkH is generated by pkH,1. otpkU is the one-time public key identity of the user whose public key is pkU,1. otpkH is the one-time public key identity of HOSP whose public key is pkH,1.(iii)
The user’s long-term public keypkU,1 and HOSP’s long-term public key pkU,1 are encrypted by the auditor’s public key pkre and pksd.HOSP needs to use proof of knowledge to endorser:(6)PoKACA,U,su,ωu,pkU,1,rre,H2pkU,2ru:eACA,U,g^1ωu⋅pkCA=egu⋅pkU,1⋅g5su,g^1∧otpkU=pkU,1⋅g4H2pkU,2ru∧RU=g4ru∧Ere=pkU,1⋅pkrerre.The details of the zero-knowledge proof is as follows:(1)
HOSP randomly picks ra,rb,rc,rd,re,rα,rβ⟵Rℤp and makes θ=ACA,Ura. It computes commitments: CU,1=egu⋅Erereg5rβθ−rcpkre−rd,g^1, CU,2=grerα,CU,3=Rreregre−rd, CU,4=pkrerαg4−rb.(2)
It computes challengec=HEre,Rre,θ,CU,1,CU,2,CU,3,CU,4 and computes challenge response: zb=rb+c⋅H2pkU,2ru,zc=rc+c⋅ωu, zd=rd+c⋅rfra,ze=re+c⋅ra, zα=rα+c⋅rre,zβ=rβ+c⋅rasu.(3)
It outputsπre=otpkU,Ere,Rre,c,θ,zb,zc,zd,ze,zα,zβLikewise,HOSP proofs the above relationship to the endorser. The proof process πsd is very similar to that of the user, so it will not be explained in detail here.otskH⟵OTskGenskH,1,skH,2,RH: with skH,1, skH,2, and RH, HOSP calculates otskH=skH,1+H2RHskH,2 and lets otpkH=g4otskH. At the same time, HOSP sends RU to the vaccination user over a secure channel. The user then generates his own one-time secret key otskU=skU,1+H2RUskU,2.0/1⟵EndorserVerifyπre,πsd,πenc: the endorser verifies the legitimacy of the vaccination information and the legitimacy of the one-time public key of the sender HOSP and the receiver (user).The details of the zero-knowledge proof is as follows:(1)
FirstHOSP needs proof to endorser: PoKotskH:otpkH=g4otskH.(2)
On inputπenc, for i∈0,…,7, endorser computes c=HEi,Ri,Cv,i,Dv,ii∈0,…7,E,Rv,Cv,Dv and checks Cv,i=?Eicg0z1,ipkvcz2,i,Dv,i=?Ricg1z2,i, Cv=?Ecg0z1pkvcz2,Dv=?Rvcg1z2.It outputs 1 if the above equation holds or 0 otherwise.(3)
On inputπre, endorser computes CU,1′=egu⋅Erezeg5zβθ−zcpkre−zd,g^1⋅eθ,pkCAc, CU,2′=grezαRre−c,CU,3′=Rrezegre−zd, CU,4′=pkrezαg4−zbotpkU/Erec.Then, endorser computesc′=HEre,Rre,θ,CU,1′,CU,2′,CU,3′,CU,4′ and checks c′=?c. It outputs 1 if c′=c holds or 0 otherwise.(4)
On inputπsd, endorser does same as (3). The initiator of the vaccine record upload operation can only be the hospital. Therefore, at this step, the endorser needs to verify that the initiator of the upload operation has a valid hospital identification credential.If all four of the above verifications output 1, then1⟵EndorserVerifyπre,πsd,πenc.Certe⟵EndorserCredIssueotpkH,E,ske: after verifying the legitimacy of the vaccine information commitment and the legitimacy of the one-time public key of HOSP and the user, the endorser generates a certificate Certe by endorsing the vaccination record (otpkH and E). The endorser picks some random l,k⟵Rℤp and uses secret key ske to compute Certe=Ae=g7⋅g8l⋅E⋅otpkH1/ske+k,l,k to HOSP.1/0⟵EndorserCredProofCerte,otskH,M,rv: after obtaining the endorser’s certificate Certe, HOSP needs zero-knowledge proof to the verifier that the vaccination record has a valid certificate. First, HOSP computes the tag T=fotskH for detecting double recording. HOSP needs to use proof of knowledge to verifier:(7)PoKotskU,M,rv,Ae,l,k:eAe,pke⋅g^ek=eg7⋅g8l⋅g0M⋅pkvcrv⋅g4otskH,g^e∧T=fotskH.The details of the zero-knowledge proof are as follows:(1)
HOSP randomly picks ra,rb,rc,rd,re,rs,rα,rβ⟵Rℤp and makes S1=Ae⋅u1ra,S2=g8ra. It computes commitments: Ce,1=eu1rd⋅S1−re⋅g8rβ⋅g0rs⋅pkvcrα⋅g4rb,g^e⋅eu1,pke, Ce,2=g8rc,Ce,3=S2reg8−rd,Ce,4=frb.(2)
It computes challengec=HT,S1,S2,Ce,1,Ce,2,Ce,3,Ce,4 and computes challenge response zb=rb+c⋅otskH,zc=rc+c⋅ra, ze=re+c⋅k,zd=rd+c⋅ra⋅k, zα=rα+c⋅rv,zβ=rβ+c⋅l, zs=rs+c⋅M.(3)
It outputsπe=Certe,c,S1,S2,zb,zc,zd,ze,zszα,zβ(4)
On inputπe and pke, verifier computes Ce,1′=eu1zdS1−zeg8zβg0zspkvczαg8abg7c,g⋅eu1zcS1−c,pke, Ce,2′=g8zcS2−c,Ce,3′=S2zeg8−zd, Ce,4′=fzbT−c.Then, verifier computesc′=HT,S1,S2,Ce,1′,Ce,2′,Ce,3′,Ce,4′ and checks c′=?c. It outputs 1 if c′=c holds or 0 otherwise.1/0⟵LinkT1,T2: on input, two vaccination records with two tags T1,T2. If T1=T2, it outputs 1. Otherwise, it outputs 0.1/0⟵AuditEre,Rre,Esd,Rsd,Ei,Rii∈0,…,7: on input a ciphertext Ere,Rre,Esd,Rsd and skre,sksd, auditor has the ability to reveal long-term public keys of users and HOSP by computing pkU,1=Ere/Rreskre,pkH,1=Esd/Rsdsksd. On input a ciphertext Ei,Rii∈0,…,7 and skvc, auditor has the ability to reveal vaccination information by computing gmi=Ei/Riskvc. The auditor uses a precomputation table containing g0,g1,…,g216−1 to find out the message of mi and reveal vaccination information M=m7…m0. The auditor uses the secret keys skre,sksd to reveal the long-term public key pkH,1=Esd/Rsdsksd of the vaccination hospital and the long-term public key pkU,1=Ere/Rreskre of the vaccination user.


### 4.4. Vaccine Passport

The signing of the vaccine passport is accomplished by the vaccination hospital. This process uses ring signature [19] to ensure the anonymity of the vaccination hospital when issuing the authorization. During the presentation of the vaccine passport, the vaccination properties are proven using the Bulletproofs scheme [20] in range proofs to guarantee the validity of the vaccine without exposing the vaccine information. Before using Bulletproofs, it uses interactions to transform the relationships of vaccine attributes into relationships suitable for Bulletproofs range proofs [21]. The identity privacy of the owner of the vaccine passport is protected using the same one-time public key technique as that used to protect the identity of the user in the previous vaccination record system.After the user received the last vaccination at the hospital, the hospital uploads the vaccination record information to the consortium blockchain. The hospital then issues a vaccine passport to the user.


#### 4.4.1. Vaccine Passport Issue

(1)
The user commits the date of vaccinationxv, production date xp, shelf life xs, and the duration of immunization xd by selecting rv,rp,rs,rd⟵Rℤp and generates commitments Cv=gxvhrv,Cp=gxphrp,Cs=gxshrs,Cd=gxdhrd. The user sends Cv,Cp,Cs,Cd,rv,rp,rs,rd to the vaccination hospital. For the user identity certificate CertCA,U=ACA,U=gu⋅pkU,1⋅g5su1/skCA+ωu,su,ωu issued by the CA, the user randomly selects ra⟵Rℤp to send ACA,Ura to HOSP.(2)
HOSP receives the user information and opens the commitment and checks:(8)Cv=?Commitxv′,rv,Cp=?Commitxp′,rp,Cs=?Commitxs′,rs,Cd=?Commitxd′,rd.If one of the equations does not hold,HOSP refuses to issue a vaccine passport to its user. Otherwise, HOSP accepts to issue a vaccine passport for the user.(3)
HOSP generates a ring signature σring for the vaccine passport information Cv,Cp,Cs,Cd,ACA,Ura. First, it lets m=HCv,Cp,Cs,Cd,ACA,Ura and selects n−1 public keys of other hospitals. Then, it randomly picks seed α⟵Rℤp and xi⟵Rℤp. Suppose that f is a trapdoor one-way function such as RSA. It computes yi=fxi,pki and vis+1=Hm‖α to go along the ring from signer index is. It closes the ring by computing vis=Hm‖yis−1⊕⋯⊕Hm‖yis+1⊕Hm‖α and uses secret key skH of signing HOSP to compute xis=f−1vis⊕α. HOSP randomly selects an index i0 and outputs the ring signature σring=i0,vi0,x1,…xn,pk1,…,pkn.(4)
HOSP outputs vaccine passport Cv,Cp,Cs,Cd,ACA,Ura,σring


#### 4.4.2. Vaccine Passport Proof

(1)
User generates new one-time public and secret keys pair byotpkU′,RU′⟵OTpkGenpkU,1,pkU,2 and otskU′⟵OTskGenskU,1,skU,2,RU′. The user needs proof to vaccine passport checkpoint: (9)PoKotskU′:otpkU′=gotskU′,(10)PoKACA,U,su,ωu,pkU,1,rre,H2pkU,2ru:eACA,U,g5ωu⋅pkCA=egu⋅pkU,1⋅g5su,g^1∧otpkU′=pkU,1⋅g4H2pkU,2ru∧RU′=g4ru∧Ere=pkU,1⋅pkrerre.(2)
Vaccine passport checkpoint verifies the legitimacy of the ring signatureσring. The verification is straightforward; the vaccine passport checkpoint starts at index i0 with value vi0. If vi0=Hm‖yi0−1⊕⋯⊕Hm‖vi0⊕yi0, it verifies that the vaccine passport has the hospital’s valid ring signature.(3)
The vaccine injected by the user is within the shelf life. It requires that the inequalityxv−xp−xs>0 be satisfied.The user produces high titers of antibodies to create effective protection. This corresponds to the last date of vaccination plus 14 days [11], which needs to be greater than the current date. It requires that the inequality xv+xd<t be satisfied, where t is the current date.The vaccinated user is in the duration of immunization for the vaccine. This is equivalent to the last date of vaccination plus the vaccine immunity lasting time needs to be less than the current date. It requires that the inequalityxv>t−14 be satisfied.(11)PoKxp,xs,xd,xv,rp,rs,rd,rv,Cp,Cs,Cd,Cv:Cp=gxphrp,Cs=gxshrs,Cd=gxdhrd,Cv=gxvhrv∧xv−xp−xs>0,xv+xd<t1,xv>t−14.(4)
After vaccine passport checkpoint returnsgt,gt−14,g2l, the above range proof translates to(12)PoKxp,xs,xd,xv,rp,rs,rd,rv,A1=Cv/CpCs,A2=CvCdg2l/gt,A3=Cv/gt−14:A1=gxv−xp−xshrv−rp−rs,A2=gxv+xd−t+2lhrv+rd,A3=gxv−t+14hrv∧xv−xp−xs∈0,2l,xv+xd−t+2l∈0,2l,xv−t+14∈0,2l.


## 4.1. Overview

Our system consists of three main phases in the vaccine cold chain logistics phase, as shown in Figure1.Figure 1
Vaccine cold chain logistics phase.Step 1.
It is for the vaccine manufacturing company to send a batch of vaccine samples that need to be checked to ensure quality to the vaccine approval institutions in each country.Step 2.
It consists of each country’s vaccine approval institution passing its review results through at,n threshold (if a total of n vaccine approval institutions are satisfied with the approval of t vaccine approval institutions, then the batch of vaccine is approved). If the batch meets the audit requirements, a certificate is issued for the batch through the threshold signature.Step 3.
It is that the vaccine manufacturing company entrusts the cold chain logistics company with the approved batch of vaccine to send to the target hospital. The sender is the vaccine production company. The receiver is the first vaccine transit center. The transported goods are batches of vaccines. The logistics information is uploaded to the public blockchain after the logistics are completed.Step 4.
It is the uploading of cold chain logistics information between vaccine transfer centers. The sender is the previous vaccine transfer center. The receiver is the next vaccine transfer center. The transported goods are batches of vaccines with the environmental conditions of the temporary storage of vaccines and the signature of the person in charge.Step 5.
It is when the vaccine is delivered at the last logistics transit center; the CDC under whose jurisdiction the target hospital is located audits the entire cold chain logistics storage and transportation for compliance with the logistics requirements for biologics. If the batch of the vaccine cold chain logistics process meets the requirements, the CDC issues a certificate of conformity signature to the batch of vaccine.Step 6.
It is to upload the logistics information between the last vaccine transfer center and the CDC to the public blockchain after the approval of the vaccine cold chain logistics. The sender is the last vaccine transfer center. The receiver is the local CDC, and the transported goods are batches of vaccines with the CDC’s certificate for vaccine cold chain logistics.Step 7.
It is to upload the logistics information of the final vaccine delivery from the local CDC to the target hospital to the public blockchain. The sender is the local CDC, and the receiver is the target vaccination hospital. The transported goods are batch of vaccines with a certificate from the CDC for the cold chain logistics of the vaccine and a threshold signature certificate from the vaccine approval institutions. Users are given the right and ability to know the approval results of vaccinations and vaccine cold chain logistics information by viewing the information recorded on the public blockchain before vaccination in hospitals. This helps to achieve openness and transparency of vaccine information to vaccination users.
In the vaccination phase shown in Figure2, the local hospital completes the uploading of vaccination information to the consortium blockchain while protecting the privacy of the vaccination information.Figure 2
Vaccination and vaccine passport phase.Step 8.
It is after the last injection of the user’s vaccine at the local hospital, the hospital creates vaccination information signed by it and sends the vaccination information to the endorser. The sender of the vaccination information is the local hospital. The receiver is the vaccination user. The information transmitted is the details of the vaccine.Step 9.
It is for the endorser to verify the uploaded vaccination information and generate an endorsement signature.Step 10.
It is that the submitting local hospital broadcasts the collected endorsement signatures and the vaccination information itself to the orderers.Step 11.
It is for orderers to broadcast the sorted set of vaccination information to all peers.Step 12.
It is for the committing peer to check if the vaccination information submitted by the orderers has a legitimate certificate issued by the endorser. The committing peer also detects malicious cases where the same vaccination is included in the vaccination information more than once. In this case, the first valid vaccination information will be accepted. Once the uploaded vaccination information is verified by the committing peer, the vaccination information is submitted and the committing peer maintains the state and a copy of the ledger. For the privacy-preserving vaccination information on the consortium blockchain, it is necessary to audit it in case of special circumstances. Auditors have the ability to open the encrypted vaccination information on the consortium blockchain to audit the vaccination details, such as the time of vaccination and vaccine production date.
In the vaccine passport phase in Figure2.Step 13.
It is where the local hospital opens the vaccination user’s commitment to the vaccine production date, vaccine shelf life, vaccine immunity lasting time, and vaccination date. After the hospital confirms that the commitment is correct, a ring signature is generated for the commitment and the international coalition government-issued user identity card. Finally, the ring signature, commitment, and user identity certificate together form the vaccine passport and are sent to the user.Step 14.
It is for the user to first present the vaccine passport to the passport checkpoint. The passport checkpoint verifies the legitimacy of the user’s identity and vaccine passport. Next, the user proves the validity of the vaccine passport to the passport checkpoint. This includes the following three items:(i)
The vaccine injected by the user is within the shelf life. If the vaccine injected by the user does not meet this condition, then first, the passport checkpoint needs to report this medical issue to a government authority. This requires a request for an audit of the vaccination information for the batch (including the local vaccination hospital) and a traceability audit of the vaccine batch. Also, the user needs to be reimbursed for the corresponding vaccination.(ii)
The user produces high titers of antibodies to create effective protection. This corresponds to the last date of vaccination plus 14 days [11], which needs to be greater than the current date. If the user’s vaccination information does not meet this condition, the passport checkpoint needs to take a quarantine for 14 days before allowing the user to pass.(iii)
The vaccinated user is in the duration of immunization for the vaccine. This is equivalent to the last date of vaccination plus the vaccine immunity lasting time that needs to be less than the current date. If the user’s vaccination information does not meet this condition, the passport control point will need to adopt the vaccine again to stimulate an effective antibody prevention strategy.
None of the above proofs will reveal any information about the user’s vaccination, including the production date and shelf life of the vaccine.


## 4.2. Vaccine Cold Chain Logistics

This study adds Boldyreva’s [12] threshold signature technique to other blockchain-based vaccine distribution management systems. Vaccine approval institutions in each country that adopt different standards act as participants in the threshold signature. The international coalition government acts as a trusted third party as the group administrator in the threshold signature group. This vaccine approval protocol effectively prevents collusion and corruption between vaccine approval institutions and vaccine manufacturing companies. The vaccine approval institutions approve samples of vaccines to be submitted for review in a distributed structure on a per-share basis. The distributed protocol allows for up to half of the vaccine approval institutions to be malicious. Once the approval of the submitted vaccine is complete, the vaccine manufacturer receives only the results of whether the submitted vaccine batch was approved or not and does not know the respective review opinions of the individual vaccine approval institutions. This prevents the vaccine manufacturing company from influencing the outcome of the approval, thereby, achieving fairness and equity in vaccine approval. Details are outlined as follows.Setup1λ: on input 1λ, where λ∈ℕ is a security parameter, let e:G1×G2⟶GT, a bilinear map, where G1 is a GDH group and g is the generator of G1. G2 and GT are the cyclic groups. The participants in our scheme are the set of n vaccine approval institutions Aℐ1,…,Aℐn. All AIs are connected by a broadcast channel as well as by secure point-to-point channels including the international coalition government GV. Let H:0,1∗⟶G2 be collision-resistant hash function.Generatingxfiy,fi′y:Aℐi chooses ai0,…,ait⟵Rℤp and ai0′,…,ait′⟵Rℤp to form the polynomials fiy and fi′y of degree t: fiy=ai0+ai1y+⋯+aityt and fi′y=ai0′+ai1′y+⋯+ait′yt. Aℐi broadcasts commitment to polynomial coefficients Cik=gaikhait′ mod p for k∈0,…,t. Aℐi computes sij=fij and sij′=fi′j mod q for j∈1,…,n and sends sij and sij to Aℐj to verify. Then, each Aℐj verifies if(2)gaikhait′=∏k=0tCikjk.If the above equation is not satisfied,Aℐj will broadcast the complaint against Aℐi. According to the conditions satisfied by the distributed key generation protocol DKG for discrete-log based systems of Gennaro et al. [13], each Aℐi sets his share of the secret as xi=∑j∈QUALsij mod q. The distributed secret value x equals x=∑i∈QUALai0 mod q from the distributed secret polynomial:(3)Fy=∑i∈QUALai0+∑i∈QUALai1y+⋯+∑i∈QUALaityt.Vaccine approvalxi:Aℐi decides whether to approve the batch of vaccine according to the criteria. If Aℐi approves it, a signature σi=Hvaccinexi and pki=gxi are generated and sent to GV. GV verifies the signature by eg,σi=epki,Hvaccine. If the verification passes, Aℐi is assigned to the set APPR.Threshold signatureσi: if the number of Aℐis in set APPR is greater than t,(4)LBjy=∏k=0,k!=jty−yk/yj−yk,is public Lagrange coefficient for the set APPR according to the Lagrange interpolation method [13].(5)x=∑i∈QUALai0=∑i∈QUAL∑j∈APPRLBj0⋅sij=∑j∈APPRLBj0⋅xj.According to the above equation, the resulting signature is thatσvaccine=∏i∈APPRσiLBi0=Hvaccinex and public key is that pk=∏i∈APPRpkiLBi0=gx.User verificationσvaccine,pk,vaccine: the user checks that eg,σvaccine=?epk,Hvaccine for the vaccine. The user accepts the signature if eg,σvaccine=epk,Hvaccine holds or rejects it otherwise.Logistics consignmentσvaccine,vaccine: structure of vaccine includes the following attributes: ID =  Hmanufacturer,batch number,serial number, manufacturer, batch number, serial number, vaccine certificate σvaccine, production date xp, shelf life xs, and the duration of immunization xd. The vaccine manufacturing company broadcasts the vaccine properties, the entrusted logistics company, and the certification certificate σvaccine as a package to the public blockchain.Cold chain logistics transitσvaccine,vaccine,σr: the responsible person for the cold chain logistics staging area broadcasts to the public blockchain the vaccine, the vaccine storage environment, its signature σr, and the logistics destination package.Distribution of CDCpublic blockchain,skCDC: after checking that the cold chain logistics on the public blockchain meets the standards for transporting biologics, the CDC attaches a signature σCDC and broadcasts the distribution to the destination vaccination hospital to the public blockchain.


## 4.3. Vaccination Record

The framework of the vaccination record system is based on Hyperledger Fabric [14], which is a permissioned blockchain. The privacy protections of the identity of the vaccination hospitals and vaccination users in the vaccine record system are referred to the technique of one-time sender and receiver public key in PAChain [15]. The certificate of authority for the long-term public key (representing the identity of the hospital and the user) of the vaccination hospital and the vaccination user uses the BBS + signature [16] issued by the international joint government. However, in the vaccination record system of this study, the identity of the user and hospital is anonymous to the endorsement node. The endorsement of the vaccination record by the endorsing node uses the anonymous credential technique based on the Boneh-Boyen signature [17]. Vaccination information is encrypted with the auditor’s public key using ElGamal encryption [18] to ensure that the information is hidden. If necessary, the auditor can reveal the encrypted vaccination information with his or her secret key. Details are outlined as follows.param⟵Setup1λ: on input 1λ, where λ∈ℕ is a security parameter. Suppose H1:0,1∗⟶0,1128∈ℤp and H2:G1⟶ℤp are collision-resistant hash functions. It randomly picks generators g0,g1,g2,g3,g4,g5,g6,g7,g8,gu,gh∈G1,g^1,g^2,g^e∈G2.skvc,skre,sksd,pkvc,pkre,pksd⟵AuditorKeyGen(): auditor picks random secret keys skvc,skre,sksd⟵Rℤp and outputs their public keys pkvc=g1skvc,pkre=g2skre,pksd=g3sksd.skCA,U,pkCA,U,skCA,H,pkCA,H⟵CAKeyGen(): CA picks random secret keys skCA,U,skCA,H⟵Rℤp and outputs their public keys pkCA,U=g^1skCA,U,pkCA,H=g^2skCA,H.ske,pke⟵EndorserKeyGen(): endorser picks random a secret key ske⟵Rℤp and outputs its public key pke=g^eske.skU,1,skU,2,pkU,1,pkU,2⟵UserKeyGen(): the user randomly picks a pair of long-term secret keys skU,1,skU,2⟵Rℤp and computes a pair of long-term public keys pkU,1=g4skU,1,pkU,2=g4skU,2. HOSP is also a type of user, so it follows the same algorithm to generate skH,1,skH,2,pkH,1,pkH,2.CertCA,U⟵CACertIssueskCA,pkU,1: first, the user needs proof to CA: PoKskU,1:pkU,1=gskU,1. After passing CA verification, CA computes ACA,U=gu⋅pkU,1⋅g5su1/skCA,U+ωu using randomly selected su,ωu⟵Rℤp and its own skCA,U. Then, CA issues a certificate CertCA,U=ACA,U,su,ωu to the user’s pkU,1. HOSP is also a type of user, so it follows the same algorithm to generate CertCA,H=ACA,H=gh⋅pkH,1⋅g5sh1/skCA,H+ωh,sh,ωh⟵CACertIssueskCA,H,pkH,1.Ei,Ri,E,Rv,πenc⟵VaccInfoEnc(vaccination,pkvc): vaccination information includes ID =  Hmanufacturer,batch number,serial number, vaccine certificate σvaccine, production date xp, shelf life xs, the date of vaccination xv, and the duration of immunization xd. Let M=H1vaccination, and it divides 128-bit M into 8 segments of 16-bit messages mi by M=∑i=07mi⋅216i. It encrypts each mi into Ei=g0mipkvcrv,i and Ri=g6rv,i, where rv,i⟵Rℤp. The encryption E on M can be generated by E=∏i=07Ei216i=g0Mpkvcrv and Rv=g6rv, where rv=∑i=07rv,i⋅216i. The user sends Ei to the auditor. Then, it proves in zero-knowledge proof that the knowledge of mi,rv,i and M,rv: PoKmi,rv,ii∈0,…,7,M,rvEi=g0mipkvcrv,i∧Ri=g6rv,i∧E=g0Mpkvcrv∧Rv=g6rv.Details of the zero-knowledge proof is as follows:(1)
TheHOSP randomly picks ai,bi∈ℤp for i∈0,…,7 and a,b∈ℤp and then computes commitments: Cv,i=g0aipkvcbi,Dv,i=g6bi and Cv=g0apkvcb,Dv=g6b.(2)
It computesc=HEi,Ri,Cv,i,Dv,ii∈0,…,E,Rv,Cv,Dv and for i∈0,…7 computes challenge response: z1,i=ai+cmi,z2,i=bi+crv,i, z1=a+cM,z2=b+crv.(3)
Then, it outputsπenc=Cv,i,Dv,i,z1,i,z2,ii∈0,…7,Cv,Dv,z1,z2,cotpkU,RU⟵OTpkGenpkU,1,pkU,2: HOSP randomly picks ru⟵Rℤp and outputs otpkU=pkU,1⋅g4H2pkU,2ru,RU=g4ru. HOSP uses the same algorithm to generate otpkH=pkH,1⋅g4H2pkH,2rh,RH=g4rh⟵OTpkGenpkH,1,pkH,2. HOSP encrypts user’s long-term public key pkU,1 and long-term public key pkH,1 of HOSP to the auditor by picking random rre,rsd⟵Rℤp and computing Ere=pkU,1⋅pkrerre,Rre=g2rre and Esd=pkH,1⋅pksdrsd,Rsd=g3rsd. Then, HOSP runs the following proof of knowledge for ensuring:(i)
pkU,1 and pkH,1 are issued a valid certificate of identity by CA.(ii)
otpkU is generated by pkU,1. otpkH is generated by pkH,1. otpkU is the one-time public key identity of the user whose public key is pkU,1. otpkH is the one-time public key identity of HOSP whose public key is pkH,1.(iii)
The user’s long-term public keypkU,1 and HOSP’s long-term public key pkU,1 are encrypted by the auditor’s public key pkre and pksd.HOSP needs to use proof of knowledge to endorser:(6)PoKACA,U,su,ωu,pkU,1,rre,H2pkU,2ru:eACA,U,g^1ωu⋅pkCA=egu⋅pkU,1⋅g5su,g^1∧otpkU=pkU,1⋅g4H2pkU,2ru∧RU=g4ru∧Ere=pkU,1⋅pkrerre.The details of the zero-knowledge proof is as follows:(1)
HOSP randomly picks ra,rb,rc,rd,re,rα,rβ⟵Rℤp and makes θ=ACA,Ura. It computes commitments: CU,1=egu⋅Erereg5rβθ−rcpkre−rd,g^1, CU,2=grerα,CU,3=Rreregre−rd, CU,4=pkrerαg4−rb.(2)
It computes challengec=HEre,Rre,θ,CU,1,CU,2,CU,3,CU,4 and computes challenge response: zb=rb+c⋅H2pkU,2ru,zc=rc+c⋅ωu, zd=rd+c⋅rfra,ze=re+c⋅ra, zα=rα+c⋅rre,zβ=rβ+c⋅rasu.(3)
It outputsπre=otpkU,Ere,Rre,c,θ,zb,zc,zd,ze,zα,zβLikewise,HOSP proofs the above relationship to the endorser. The proof process πsd is very similar to that of the user, so it will not be explained in detail here.otskH⟵OTskGenskH,1,skH,2,RH: with skH,1, skH,2, and RH, HOSP calculates otskH=skH,1+H2RHskH,2 and lets otpkH=g4otskH. At the same time, HOSP sends RU to the vaccination user over a secure channel. The user then generates his own one-time secret key otskU=skU,1+H2RUskU,2.0/1⟵EndorserVerifyπre,πsd,πenc: the endorser verifies the legitimacy of the vaccination information and the legitimacy of the one-time public key of the sender HOSP and the receiver (user).The details of the zero-knowledge proof is as follows:(1)
FirstHOSP needs proof to endorser: PoKotskH:otpkH=g4otskH.(2)
On inputπenc, for i∈0,…,7, endorser computes c=HEi,Ri,Cv,i,Dv,ii∈0,…7,E,Rv,Cv,Dv and checks Cv,i=?Eicg0z1,ipkvcz2,i,Dv,i=?Ricg1z2,i, Cv=?Ecg0z1pkvcz2,Dv=?Rvcg1z2.It outputs 1 if the above equation holds or 0 otherwise.(3)
On inputπre, endorser computes CU,1′=egu⋅Erezeg5zβθ−zcpkre−zd,g^1⋅eθ,pkCAc, CU,2′=grezαRre−c,CU,3′=Rrezegre−zd, CU,4′=pkrezαg4−zbotpkU/Erec.Then, endorser computesc′=HEre,Rre,θ,CU,1′,CU,2′,CU,3′,CU,4′ and checks c′=?c. It outputs 1 if c′=c holds or 0 otherwise.(4)
On inputπsd, endorser does same as (3). The initiator of the vaccine record upload operation can only be the hospital. Therefore, at this step, the endorser needs to verify that the initiator of the upload operation has a valid hospital identification credential.If all four of the above verifications output 1, then1⟵EndorserVerifyπre,πsd,πenc.Certe⟵EndorserCredIssueotpkH,E,ske: after verifying the legitimacy of the vaccine information commitment and the legitimacy of the one-time public key of HOSP and the user, the endorser generates a certificate Certe by endorsing the vaccination record (otpkH and E). The endorser picks some random l,k⟵Rℤp and uses secret key ske to compute Certe=Ae=g7⋅g8l⋅E⋅otpkH1/ske+k,l,k to HOSP.1/0⟵EndorserCredProofCerte,otskH,M,rv: after obtaining the endorser’s certificate Certe, HOSP needs zero-knowledge proof to the verifier that the vaccination record has a valid certificate. First, HOSP computes the tag T=fotskH for detecting double recording. HOSP needs to use proof of knowledge to verifier:(7)PoKotskU,M,rv,Ae,l,k:eAe,pke⋅g^ek=eg7⋅g8l⋅g0M⋅pkvcrv⋅g4otskH,g^e∧T=fotskH.The details of the zero-knowledge proof are as follows:(1)
HOSP randomly picks ra,rb,rc,rd,re,rs,rα,rβ⟵Rℤp and makes S1=Ae⋅u1ra,S2=g8ra. It computes commitments: Ce,1=eu1rd⋅S1−re⋅g8rβ⋅g0rs⋅pkvcrα⋅g4rb,g^e⋅eu1,pke, Ce,2=g8rc,Ce,3=S2reg8−rd,Ce,4=frb.(2)
It computes challengec=HT,S1,S2,Ce,1,Ce,2,Ce,3,Ce,4 and computes challenge response zb=rb+c⋅otskH,zc=rc+c⋅ra, ze=re+c⋅k,zd=rd+c⋅ra⋅k, zα=rα+c⋅rv,zβ=rβ+c⋅l, zs=rs+c⋅M.(3)
It outputsπe=Certe,c,S1,S2,zb,zc,zd,ze,zszα,zβ(4)
On inputπe and pke, verifier computes Ce,1′=eu1zdS1−zeg8zβg0zspkvczαg8abg7c,g⋅eu1zcS1−c,pke, Ce,2′=g8zcS2−c,Ce,3′=S2zeg8−zd, Ce,4′=fzbT−c.Then, verifier computesc′=HT,S1,S2,Ce,1′,Ce,2′,Ce,3′,Ce,4′ and checks c′=?c. It outputs 1 if c′=c holds or 0 otherwise.1/0⟵LinkT1,T2: on input, two vaccination records with two tags T1,T2. If T1=T2, it outputs 1. Otherwise, it outputs 0.1/0⟵AuditEre,Rre,Esd,Rsd,Ei,Rii∈0,…,7: on input a ciphertext Ere,Rre,Esd,Rsd and skre,sksd, auditor has the ability to reveal long-term public keys of users and HOSP by computing pkU,1=Ere/Rreskre,pkH,1=Esd/Rsdsksd. On input a ciphertext Ei,Rii∈0,…,7 and skvc, auditor has the ability to reveal vaccination information by computing gmi=Ei/Riskvc. The auditor uses a precomputation table containing g0,g1,…,g216−1 to find out the message of mi and reveal vaccination information M=m7…m0. The auditor uses the secret keys skre,sksd to reveal the long-term public key pkH,1=Esd/Rsdsksd of the vaccination hospital and the long-term public key pkU,1=Ere/Rreskre of the vaccination user.


## 4.4. Vaccine Passport

The signing of the vaccine passport is accomplished by the vaccination hospital. This process uses ring signature [19] to ensure the anonymity of the vaccination hospital when issuing the authorization. During the presentation of the vaccine passport, the vaccination properties are proven using the Bulletproofs scheme [20] in range proofs to guarantee the validity of the vaccine without exposing the vaccine information. Before using Bulletproofs, it uses interactions to transform the relationships of vaccine attributes into relationships suitable for Bulletproofs range proofs [21]. The identity privacy of the owner of the vaccine passport is protected using the same one-time public key technique as that used to protect the identity of the user in the previous vaccination record system.After the user received the last vaccination at the hospital, the hospital uploads the vaccination record information to the consortium blockchain. The hospital then issues a vaccine passport to the user.


### 4.4.1. Vaccine Passport Issue

(1)
The user commits the date of vaccinationxv, production date xp, shelf life xs, and the duration of immunization xd by selecting rv,rp,rs,rd⟵Rℤp and generates commitments Cv=gxvhrv,Cp=gxphrp,Cs=gxshrs,Cd=gxdhrd. The user sends Cv,Cp,Cs,Cd,rv,rp,rs,rd to the vaccination hospital. For the user identity certificate CertCA,U=ACA,U=gu⋅pkU,1⋅g5su1/skCA+ωu,su,ωu issued by the CA, the user randomly selects ra⟵Rℤp to send ACA,Ura to HOSP.(2)
HOSP receives the user information and opens the commitment and checks:(8)Cv=?Commitxv′,rv,Cp=?Commitxp′,rp,Cs=?Commitxs′,rs,Cd=?Commitxd′,rd.If one of the equations does not hold,HOSP refuses to issue a vaccine passport to its user. Otherwise, HOSP accepts to issue a vaccine passport for the user.(3)
HOSP generates a ring signature σring for the vaccine passport information Cv,Cp,Cs,Cd,ACA,Ura. First, it lets m=HCv,Cp,Cs,Cd,ACA,Ura and selects n−1 public keys of other hospitals. Then, it randomly picks seed α⟵Rℤp and xi⟵Rℤp. Suppose that f is a trapdoor one-way function such as RSA. It computes yi=fxi,pki and vis+1=Hm‖α to go along the ring from signer index is. It closes the ring by computing vis=Hm‖yis−1⊕⋯⊕Hm‖yis+1⊕Hm‖α and uses secret key skH of signing HOSP to compute xis=f−1vis⊕α. HOSP randomly selects an index i0 and outputs the ring signature σring=i0,vi0,x1,…xn,pk1,…,pkn.(4)
HOSP outputs vaccine passport Cv,Cp,Cs,Cd,ACA,Ura,σring


### 4.4.2. Vaccine Passport Proof

(1)
User generates new one-time public and secret keys pair byotpkU′,RU′⟵OTpkGenpkU,1,pkU,2 and otskU′⟵OTskGenskU,1,skU,2,RU′. The user needs proof to vaccine passport checkpoint: (9)PoKotskU′:otpkU′=gotskU′,(10)PoKACA,U,su,ωu,pkU,1,rre,H2pkU,2ru:eACA,U,g5ωu⋅pkCA=egu⋅pkU,1⋅g5su,g^1∧otpkU′=pkU,1⋅g4H2pkU,2ru∧RU′=g4ru∧Ere=pkU,1⋅pkrerre.(2)
Vaccine passport checkpoint verifies the legitimacy of the ring signatureσring. The verification is straightforward; the vaccine passport checkpoint starts at index i0 with value vi0. If vi0=Hm‖yi0−1⊕⋯⊕Hm‖vi0⊕yi0, it verifies that the vaccine passport has the hospital’s valid ring signature.(3)
The vaccine injected by the user is within the shelf life. It requires that the inequalityxv−xp−xs>0 be satisfied.The user produces high titers of antibodies to create effective protection. This corresponds to the last date of vaccination plus 14 days [11], which needs to be greater than the current date. It requires that the inequality xv+xd<t be satisfied, where t is the current date.The vaccinated user is in the duration of immunization for the vaccine. This is equivalent to the last date of vaccination plus the vaccine immunity lasting time needs to be less than the current date. It requires that the inequalityxv>t−14 be satisfied.(11)PoKxp,xs,xd,xv,rp,rs,rd,rv,Cp,Cs,Cd,Cv:Cp=gxphrp,Cs=gxshrs,Cd=gxdhrd,Cv=gxvhrv∧xv−xp−xs>0,xv+xd<t1,xv>t−14.(4)
After vaccine passport checkpoint returnsgt,gt−14,g2l, the above range proof translates to(12)PoKxp,xs,xd,xv,rp,rs,rd,rv,A1=Cv/CpCs,A2=CvCdg2l/gt,A3=Cv/gt−14:A1=gxv−xp−xshrv−rp−rs,A2=gxv+xd−t+2lhrv+rd,A3=gxv−t+14hrv∧xv−xp−xs∈0,2l,xv+xd−t+2l∈0,2l,xv−t+14∈0,2l.


## 4.4.1. Vaccine Passport Issue

(1)
The user commits the date of vaccinationxv, production date xp, shelf life xs, and the duration of immunization xd by selecting rv,rp,rs,rd⟵Rℤp and generates commitments Cv=gxvhrv,Cp=gxphrp,Cs=gxshrs,Cd=gxdhrd. The user sends Cv,Cp,Cs,Cd,rv,rp,rs,rd to the vaccination hospital. For the user identity certificate CertCA,U=ACA,U=gu⋅pkU,1⋅g5su1/skCA+ωu,su,ωu issued by the CA, the user randomly selects ra⟵Rℤp to send ACA,Ura to HOSP.(2)
HOSP receives the user information and opens the commitment and checks:(8)Cv=?Commitxv′,rv,Cp=?Commitxp′,rp,Cs=?Commitxs′,rs,Cd=?Commitxd′,rd.If one of the equations does not hold,HOSP refuses to issue a vaccine passport to its user. Otherwise, HOSP accepts to issue a vaccine passport for the user.(3)
HOSP generates a ring signature σring for the vaccine passport information Cv,Cp,Cs,Cd,ACA,Ura. First, it lets m=HCv,Cp,Cs,Cd,ACA,Ura and selects n−1 public keys of other hospitals. Then, it randomly picks seed α⟵Rℤp and xi⟵Rℤp. Suppose that f is a trapdoor one-way function such as RSA. It computes yi=fxi,pki and vis+1=Hm‖α to go along the ring from signer index is. It closes the ring by computing vis=Hm‖yis−1⊕⋯⊕Hm‖yis+1⊕Hm‖α and uses secret key skH of signing HOSP to compute xis=f−1vis⊕α. HOSP randomly selects an index i0 and outputs the ring signature σring=i0,vi0,x1,…xn,pk1,…,pkn.(4)
HOSP outputs vaccine passport Cv,Cp,Cs,Cd,ACA,Ura,σring


## 4.4.2. Vaccine Passport Proof

(1)
User generates new one-time public and secret keys pair byotpkU′,RU′⟵OTpkGenpkU,1,pkU,2 and otskU′⟵OTskGenskU,1,skU,2,RU′. The user needs proof to vaccine passport checkpoint: (9)PoKotskU′:otpkU′=gotskU′,(10)PoKACA,U,su,ωu,pkU,1,rre,H2pkU,2ru:eACA,U,g5ωu⋅pkCA=egu⋅pkU,1⋅g5su,g^1∧otpkU′=pkU,1⋅g4H2pkU,2ru∧RU′=g4ru∧Ere=pkU,1⋅pkrerre.(2)
Vaccine passport checkpoint verifies the legitimacy of the ring signatureσring. The verification is straightforward; the vaccine passport checkpoint starts at index i0 with value vi0. If vi0=Hm‖yi0−1⊕⋯⊕Hm‖vi0⊕yi0, it verifies that the vaccine passport has the hospital’s valid ring signature.(3)
The vaccine injected by the user is within the shelf life. It requires that the inequalityxv−xp−xs>0 be satisfied.The user produces high titers of antibodies to create effective protection. This corresponds to the last date of vaccination plus 14 days [11], which needs to be greater than the current date. It requires that the inequality xv+xd<t be satisfied, where t is the current date.The vaccinated user is in the duration of immunization for the vaccine. This is equivalent to the last date of vaccination plus the vaccine immunity lasting time needs to be less than the current date. It requires that the inequalityxv>t−14 be satisfied.(11)PoKxp,xs,xd,xv,rp,rs,rd,rv,Cp,Cs,Cd,Cv:Cp=gxphrp,Cs=gxshrs,Cd=gxdhrd,Cv=gxvhrv∧xv−xp−xs>0,xv+xd<t1,xv>t−14.(4)
After vaccine passport checkpoint returnsgt,gt−14,g2l, the above range proof translates to(12)PoKxp,xs,xd,xv,rp,rs,rd,rv,A1=Cv/CpCs,A2=CvCdg2l/gt,A3=Cv/gt−14:A1=gxv−xp−xshrv−rp−rs,A2=gxv+xd−t+2lhrv+rd,A3=gxv−t+14hrv∧xv−xp−xs∈0,2l,xv+xd−t+2l∈0,2l,xv−t+14∈0,2l.


## 5. Security Analysis

Definition 1.
Threshold signature scheme is called secure robust threshold signature scheme if the following two conditions hold:(i)
Unforgeability: for every PPT adversary A, it is allowed to corrupt up tot participants in the threshold system and is given the oracle channel to ask a finite number of messages mi and threshold signatures σi. Eventually, it forges with negligible probability a valid m,σ, and m is not in the set of previous queries mi,σi.(ii)
Robustness: for every PPT adversary A, it is allowed to corrupt up tot participants in the threshold system, and threshold signature protocol runs successfully.Theorem 1.
t,n-threshold signature scheme under the GDH group is a secure threshold signature scheme in the random oracle model against an adversary which is allowed to corrupt any t<n/2 participants.Definition 2.
(Soundness). The vaccination information privacy protocol is sound if for all PPT adversaryA with oracle to query polynomial level times Ei,Ri,E,Rv⟵VaccInfoEncvaccination,pkvc, and then,(13)Pr1⟵EndorserVerifyπenc:πenc⟵AEi,Ri,E,Rv⩽neglλ.Theorem 2.
The vaccination information privacy protocol is sound if DLP is hard, and the protocol provides knowledge of soundness.Proof.
It rewindsc′=HEi,Ri,Cv,i′,Dv,i′i∈0,…,7,E,Rv,Cv′,Dv′, where c≠c′ and computes z1,i′,z2,i′i∈0,…,7,z1′, z2′. It extracts the knowledge of(14)mi=z1,i′−z1,i/c′−c,rv,i=z2,i′−z2,i/c′−c,M=z1′−z1/c′−c,rv=z2′−z2/c′−c.Definition 3.
(Privacy). The vaccination information is private in the protocol if for all PPT adversaryA:(15)Prb=b′:πenc0,1⟵VaccInfoEncvaccination0,1,b⟵R0,1,b′⟵Aπencb−1/2≤neglλ.Theorem 3.
The vaccination information is private in the protocol if DDH is hard inG1, and the protocol is HVZK.Proof.
The encryptionEi=g0mipkvcrv,i,Ri=g6rv,i used in this protocol is the ElGamal encryption algorithm. The security of this encryption is based on the DDH assumption. If the DDH assumption is difficult on G1, the vaccination information of this protocol is private during transmission.
The simulator of this protocol randomly picksEi,Ri,z1,i,z2,ii∈0,…,7,c′,z1,z2⟵Rcorresponding domain. Then, it computes(16)Cv,i=Eic′g0z1,ipkvcz2,i,Dv,i=Ric′g1z2,i,Cv=Ec′g0z1pkvcz2,Dv=Rvc′g1z2,where they are indistinguishable from real protocol interactions. The simulator sets c′ as HEi,Ri,Cv,i,Dv,ii∈0,…,7,E,Rv,Cv,Dv in the random oracle model. Therefore, this protocol provides zero-knowledge of vaccination information.Definition 4.
(Soundness). The users (including hospitals and vaccination users) privacy protocol is sound if for all PPT adversaryA with oracle to query polynomial level times CertCA,U⟵CACertIssuepkU,1, and then,(i)
The public key of the user (including hospital and vaccination user) is issued a valid certificateACA,U,su,ωu:(17)Pr1⟵EndorserVerifyπreorπsd:CertCA,U′⟵ApkU,1whereCertCA,U′,pkU,1∉oracle queries,otpkU,πreorπsd⟵OTpkGenpkU,1,pkU,2⩽neglλ.(ii)
otpkU is computed from a public key pkU,1 and the public key pkU,1 is encrypted to the auditor:(18)Pr1⟵EndorserVerifyπre′orπsd′:CertCA,U⟵CACertIssuepkU,1,otpkU′,πre′orπsd′⟵ApkU,1′,pkU,2′wherepkU,1′≠pkU,1⩽neglλ.Theorem 4.
The users (including hospitals and vaccination users) privacy protocol is sound if the q-SDH assumption holds inG1,G2 in the random oracle model, where q is the maximum number of CACertIssue oracle queries, and the protocol provides knowledge of soundness.Proof.
It rewindsc′=HEre,Rre,θ,CU,1′,CU,2′,CU,3′,CU,4′, where c≠c′, and computes zb′,zc′,zd′,ze′,zα′,zβ′. It extracts the knowledge of(19)ra=ze′−ze/c′−c,su=zβ′−zβ/rac′−cωu=zc′−zc/c′−c,rre=zα′−zα/c′−c,H2pkU,2ru=zb′−zb/c′−c,pkU,1=otpk/g4H2pkU,2ruACA,U=θ1/ra.
BBS + signature is unforgeable against adaptively chosen message attack under the q-SDH assumption.Definition 5.
(Anonymity). The anonymity of users (including hospitals and vaccination users) is enabled in the protocol if for all PPT adversaryA,(20)Prb=b′:otpkU,RU0,1⟵OTpkGenpkU,1,b⟵R0,1,b′⟵AotpkU,RUb−1/2⩽neglλ.Theorem 5.
The anonymity of users (including hospitals and vaccination users) is enabled in the protocol if CDH is hard inG1, and the protocol is HVZK.Proof.
The encryptionsEre=pkU,1⋅pkrerre,Rre=g2rre and Esd=pkH,1⋅pksdrsd,Rsd=g3rsd used in this protocol are the ElGamal encryption algorithm. The security of this encryption is based on the DDH assumption. The one-time public key otpkU=pkU,1⋅gH2pkU,2ru,RU=g4ru and otpkH=pkH,1⋅gH2pkH,2rh,RH=g4rh generation algorithm is based on the CDH assumption. If the CDH assumption is difficult on G1, the anonymity of users (including hospitals and vaccination users) is enabled during transmission.
The simulator of this protocol randomly picksc′,θ,zb,zc,zd,ze,zα,zβ⟵Rcorresponding domain. Then, it computes(21)CU,1=egu⋅Erezeg5zβθ−zcpkre−zd,g^1⋅eθ,pkCAc,CU,2=grezαRre−c,CU,3=Rrezegre−zd,CU,4=pkrezαg4−zbotpkU/Erec,where they are indistinguishable from real protocol interactions. The simulator sets c′ as HEre,Rre,θ,CU,1,CU,2,CU,3,CU,4 in the random oracle model. Therefore, this protocol provides zero-knowledge of CA certificate for the user’s long-term public key and the user’s long-term public key.Definition 6.
(Soundness). The vaccination information endorsement protocol is sound if for all PPT adversaryA with oracle to query polynomial level times Certe⟵EndorserCertIssueotpkH,E, and then, this vaccination information E=g0Mpkvcrv and otpkH is issued a valid certificate Ae,l,k by the endorsement nodes:(22)Pr1⟵EndorserCredProofCerte′,otpkH,E∨1⟵EndorserCredProofCerte,otpkH′,E′:Certe′⟵AotpkH,E∨Certe⟵EndorserCredIssueotpkH,EwhereotpkH′,E′≠otpkH,E⩽neglλ.Theorem 6.
The vaccination information endorsement protocol is sound if the q-SDH assumption holds inG1,G2 in the random oracle model, where q is the maximum number of EndorserCredIssue oracle queries, and the protocol provides knowledge of soundness.Proof.
It rewindsc′=HT,S1,S2,Ce,1′,Ce,2′,Ce,3′,Ce,4′, where c≠c′, and computes zb′,zc′,zd′,ze′,zα′,zβ′,zs′. It extracts the knowledge of (23)ra=zc′−zc/c′−c,l=zβ′−zβ/c′−c,k=ze′−ze/c′−c,M=zs′−zs/c′−c,rv=zα′−zα/c′−c,otskH=zb′−zb/c′−c,Ae=S1/u1ra.
BBS + signature is unforgeable against adaptively chosen message attack under the q-SDH assumption.Definition 7.
(Privacy). The vaccination information is private in the protocol if for all PPT adversaryA,(24)Prb=b′:Certe0,1⟵EndorserCredIssueE,otpkH0,1,b⟵R0,1,b′⟵AE,otpkHb−1/2⩽neglλ.Theorem 7.
The vaccination information is private in the protocol if the protocol is HVZK.Proof.
The simulator of this protocol randomly picksc′,S1,S2,zb,zc,zd,ze,zszα,zβ⟵Rcorrespondingdomain. Then, it computes(25)Ce,1=eu1zd⋅S1−ze⋅g8zβ⋅g0zs⋅pkvczα⋅g8abg7c′,g⋅eu1zcS1−c′,pke,Ce,2=g8zcS2−c′,Ce,3=S2zeg8−zd,Ce,4=fzbT−c′,where they are indistinguishable from real protocol interactions. The simulator sets c′ as HT,S1,S2,Ce,1,Ce,2,Ce,3,Ce,4 in the random oracle model. Therefore, this protocol provides zero-knowledge of vaccination information.Lemma 1.
(Ring lemma). Ring signature is unforgeable if the DL assumption holds. The anonymity of the ring signature is unconditional.Lemma 2.
The Bulletproof has perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation.


## 6. System Analysis

### 6.1. Security and Privacy

We compare the vaccine system proposed in this study with other solutions proposed in academia and platform systems that have been applied in practice, as given in Table1. The main aspects of comparison are the blockchain structure, the domain covered by the system, the properties of user privacy protection, and auditability.Table 1
Comparison of COVID-19 vaccine systems.
Blockchain structureVaccine supply chainVaccination recordUser privacyVaccination hospital privacyVaccination privacyAuditableVaccination certificate[7]Public blockchain√√√××√×[10]Public chain and private blockchain√√√√√√×[6]Public blockchain√××××√×[8]Private blockchain×√√×√×√[5]Public blockchain√××××√×[22]Consortium ethereum-based blockchain×√√×√×√[23]Consortium blockchain×√√×√?√[24]Permissioned blockchain×√√√√√√China health code systemNo blockchain×√×××√√This studyPublic blockchain and consortium blockchain√√√√√√√“√ ” represents that the privacy protection of this attribute of the vaccine system is based on stronger assumptions, such as storing the private data in a private database off-chain or increasing the restriction of database access, thus having a higher probability of privacy leakage. “?” represents that this attribute of the vaccine system is not mentioned from the open-source code or references.In terms of vaccine system structure, the nonblockchain-based vaccine system is represented by the China health code system, a digital vaccine certificate implemented by the Chinese government based on Alipay, a trusted third party. The authentication of the vaccine certificate is done by the verifier through the QR code in the Alipay wallet app. Another blockchain-based vaccine system mainly takes advantage of the immutability and decentralized property of blockchain to create a more credible and secure vaccine system, which is also the trend of vaccine system research. The main types of blockchains in vaccine systems are public blockchains, private blockchains, and consortium blockchains. In this study and [10], a double-chain structure is used. However, under the assumption of global recognition, the consortium blockchain has an advantage over the private blockchain in terms of use coverage.In terms of privacy protection, we divide user privacy into user identity privacy, vaccination hospital privacy, and privacy of vaccination records. Systems with a single public blockchain structure, for example [5, 6], are not user privacy protected. The blockchain of vaccination records in [7] keeps sensitive information of users out of the blockchain and protects user privacy to some extent. The [8, 10, 22, 23] schemes use private blockchain or consortium blockchain for participant’s identity authentication to protect user privacy. Qiu and Zhu [10] stored all the vaccination records in a private blockchain and Alabdulkarim et al. [24] stored the private data on the private database of the authorized specific peer. However, this does not guarantee the leakage of user vaccination privacy by the nodes in the private blockchain, and the storage of vaccination records would be centralized. In the study by Abid et al. [8], the vaccination certificate is issued by the healthcare provider (issuer) with a signature. Therefore, this process can expose the privacy of the user’s vaccination hospital. Also, this scheme cannot audit the vaccination information because it uses a private blockchain and a certain degree of information encryption. Both [22, 23] used consortium blockchains structure, but do not have any encryption of user privacy information, so these two schemes guarantee the privacy of user personal information only to some extent. However, the privacy of vaccination hospitals cannot be guaranteed.


### 6.2. Performance Analysis

The main objective of this study is to propose a framework for a double-chain-based vaccine passport system and to refine the design of the protocol between specific participants. This goal of this study is to provide a systematic solution to the vaccine passport which focuses more on the theoretical aspect. Therefore, only a qualitative analysis of the system’s performance is presented here.The additional performance overhead of the public blockchain-based vaccine cold chain phase is mainly in the approval phase. For each approval process of vaccines sent for review, the approval institutions in each country need to participate in the distributed setting of threshold secret sharing of the valuex. For each distributed key generation protocol, it is assumed that there are n approval institutions, and each institution needs to generate 2 random polynomials. At the same time, each approval authority broadcasts the commitment of polynomials to the other n−1 approval authorities. The communication data volume of the whole broadcast channel is On2.The permission blockchain framework for the vaccination record phase of this study is based on the Hyperledger Fabric architecture. By referring to the idea of PAChain [15], the privacy of the vaccination records is protected among the endorsers, orderers, and committing peers. This study removes the trust in the endorser compared to PAChain, thus increasing the authentication protocol. Therefore, the system latency in this phase is slightly higher than PAChain.The performance bottleneck in the passport identification phase is mainly due to the range proof of the vaccine attributes. Benefiting from the efficiency and aggregability of Bulletproofs [20], the proof size of vaccine passports in the presentation phase is Ologmn for a batch size of n users and the vaccine attribute length of m bits. For the specific case where the vaccine attribute is 64 bits m=64, the proof size for a single user is 3×675=2025 bytes; while, the aggregated proof size for 512 users is 3×1253=3759 bytes.Based on the results of the above system performance analysis, we believe that the vaccine passport system proposed in this study is feasible for development and implementation. In future implementations, sacrificing acceptable system performance loss in exchange for abundant privacy-preserving security properties is to be considered in advance.


## 6.1. Security and Privacy

We compare the vaccine system proposed in this study with other solutions proposed in academia and platform systems that have been applied in practice, as given in Table1. The main aspects of comparison are the blockchain structure, the domain covered by the system, the properties of user privacy protection, and auditability.Table 1
Comparison of COVID-19 vaccine systems.
Blockchain structureVaccine supply chainVaccination recordUser privacyVaccination hospital privacyVaccination privacyAuditableVaccination certificate[7]Public blockchain√√√××√×[10]Public chain and private blockchain√√√√√√×[6]Public blockchain√××××√×[8]Private blockchain×√√×√×√[5]Public blockchain√××××√×[22]Consortium ethereum-based blockchain×√√×√×√[23]Consortium blockchain×√√×√?√[24]Permissioned blockchain×√√√√√√China health code systemNo blockchain×√×××√√This studyPublic blockchain and consortium blockchain√√√√√√√“√ ” represents that the privacy protection of this attribute of the vaccine system is based on stronger assumptions, such as storing the private data in a private database off-chain or increasing the restriction of database access, thus having a higher probability of privacy leakage. “?” represents that this attribute of the vaccine system is not mentioned from the open-source code or references.In terms of vaccine system structure, the nonblockchain-based vaccine system is represented by the China health code system, a digital vaccine certificate implemented by the Chinese government based on Alipay, a trusted third party. The authentication of the vaccine certificate is done by the verifier through the QR code in the Alipay wallet app. Another blockchain-based vaccine system mainly takes advantage of the immutability and decentralized property of blockchain to create a more credible and secure vaccine system, which is also the trend of vaccine system research. The main types of blockchains in vaccine systems are public blockchains, private blockchains, and consortium blockchains. In this study and [10], a double-chain structure is used. However, under the assumption of global recognition, the consortium blockchain has an advantage over the private blockchain in terms of use coverage.In terms of privacy protection, we divide user privacy into user identity privacy, vaccination hospital privacy, and privacy of vaccination records. Systems with a single public blockchain structure, for example [5, 6], are not user privacy protected. The blockchain of vaccination records in [7] keeps sensitive information of users out of the blockchain and protects user privacy to some extent. The [8, 10, 22, 23] schemes use private blockchain or consortium blockchain for participant’s identity authentication to protect user privacy. Qiu and Zhu [10] stored all the vaccination records in a private blockchain and Alabdulkarim et al. [24] stored the private data on the private database of the authorized specific peer. However, this does not guarantee the leakage of user vaccination privacy by the nodes in the private blockchain, and the storage of vaccination records would be centralized. In the study by Abid et al. [8], the vaccination certificate is issued by the healthcare provider (issuer) with a signature. Therefore, this process can expose the privacy of the user’s vaccination hospital. Also, this scheme cannot audit the vaccination information because it uses a private blockchain and a certain degree of information encryption. Both [22, 23] used consortium blockchains structure, but do not have any encryption of user privacy information, so these two schemes guarantee the privacy of user personal information only to some extent. However, the privacy of vaccination hospitals cannot be guaranteed.


## 6.2. Performance Analysis

The main objective of this study is to propose a framework for a double-chain-based vaccine passport system and to refine the design of the protocol between specific participants. This goal of this study is to provide a systematic solution to the vaccine passport which focuses more on the theoretical aspect. Therefore, only a qualitative analysis of the system’s performance is presented here.The additional performance overhead of the public blockchain-based vaccine cold chain phase is mainly in the approval phase. For each approval process of vaccines sent for review, the approval institutions in each country need to participate in the distributed setting of threshold secret sharing of the valuex. For each distributed key generation protocol, it is assumed that there are n approval institutions, and each institution needs to generate 2 random polynomials. At the same time, each approval authority broadcasts the commitment of polynomials to the other n−1 approval authorities. The communication data volume of the whole broadcast channel is On2.The permission blockchain framework for the vaccination record phase of this study is based on the Hyperledger Fabric architecture. By referring to the idea of PAChain [15], the privacy of the vaccination records is protected among the endorsers, orderers, and committing peers. This study removes the trust in the endorser compared to PAChain, thus increasing the authentication protocol. Therefore, the system latency in this phase is slightly higher than PAChain.The performance bottleneck in the passport identification phase is mainly due to the range proof of the vaccine attributes. Benefiting from the efficiency and aggregability of Bulletproofs [20], the proof size of vaccine passports in the presentation phase is Ologmn for a batch size of n users and the vaccine attribute length of m bits. For the specific case where the vaccine attribute is 64 bits m=64, the proof size for a single user is 3×675=2025 bytes; while, the aggregated proof size for 512 users is 3×1253=3759 bytes.Based on the results of the above system performance analysis, we believe that the vaccine passport system proposed in this study is feasible for development and implementation. In future implementations, sacrificing acceptable system performance loss in exchange for abundant privacy-preserving security properties is to be considered in advance.


## 7. Conclusion

This study makes improvements to the vaccine approval part of the previous vaccine distribution and management system. The introduction of a threshold signature scheme in distributed vaccine approval institutions has a certain degree of deterrence against collusive corruption between vaccine approval institutions and vaccine manufacturing companies. Second, the privacy protection in the previous double-chain system is optimized. In this study, the privacy protection of vaccination hospitals, vaccine trusts, and vaccination users is added to the audit function, which increases the controllability and auditability of the vaccination record system in practice. Finally, the vaccine passport proposed in this study protects the privacy of the user’s vaccination hospital, the vaccine, and the user’s identity while proving the validity and legitimacy of the passport to the vaccine passport checkpoint. Moreover, it is possible to differentiate and adopt targeted measures and policies for different conditions of the vaccine passport. Future work in this study lies in weakening the authority of local vaccination hospitals in the system. It can increase the link between the double chains using corresponding cryptographic techniques.



---

*Source: 4769187-2022-03-21.xml*