Traditional centralized databases represent a single point of failure. While blockchain technology offers an immutable, distributed ledger that eliminates this vulnerability, it introduces a “Scalability-Privacy Trilemma” in the context of healthcare:

Decentralization: Ensuring no single entity controls the patient records.

To resolve this conflict, researchers have turned to Zero-Knowledge Proofs (ZKPs), specifically zk-SNARKs. ZKPs allow a Prover (the patient’s device) to convince a Verifier (the medical system) that data is valid without revealing the actual data values (Groth, 2016). While ZKPs solve the privacy aspect, they historically exacerbate the scalability issue due to the immense computational overhead required to generate proofs. Generating a proof for a complex medical circuit on a resource-constrained IoMT device can take seconds to minutes, creating a latency bottleneck that is dangerous in critical care scenarios (Rahman and Al-Shaer, 2020).

Existing solutions like MedBlock (Fan et al., 2018) and ZeroMed (Rahman and Al-Shaer, 2020) have attempted to integrate these technologies but often rely on expensive Layer-1 verification or centralized authorities for key management, failing to achieve true decentralization or cost-efficiency. There is a distinct lack of frameworks that simultaneously address the high throughput required by IoMT and the strict privacy required by HIPAA, without incurring the high costs of L1 execution.

To bridge this gap, this paper proposes TeleZK-L2, a cohesive architecture designed to resolve the Scalability-Privacy Trilemma. Our specific contributions are:

Layer-2 Integration: We migrate verification logic to the Polygon zkEVM, leveraging rollups to decrease transaction costs by orders of magnitude compared to Ethereum L1.

Collectively, these technical advancements address the critical friction between blockchain immutability and the GDPR “Right to be Forgotten.” By ensuring that no plaintext patient data is ever committed on-chain and instead utilizing off-chain storage with cryptographic commitments, TeleZK-L2 provides a technological framework that supports the data privacy and minimization requirements of regulations like HIPAA and GDPR, without claiming to replace the necessary administrative and physical safeguards required for full legal compliance.

Organization of the Paper: The remainder of this paper is organized as follows. Section 2 reviews the related work in blockchain-based healthcare, zero-knowledge proofs, and Layer-2 scaling, highlighting the gaps in current state-of-the-art solutions. Section 3 establishes the mathematical preliminaries, including bilinear pairings and the Groth16 proving scheme, which form the foundation of our privacy engine. Section 4 presents the proposed TeleZK-L2 system architecture, detailing the data lifecycle, regulatory compliance mechanisms, and the interaction between the Edge, Proving, and Settlement layers. Section 5 describes the methodology and implementation, focusing on the optimized circuit construction, distributed task scheduling, and the formal construction of the optimistic proof aggregation algorithm. Section 6 analyzes the experimental results, offering a comparative evaluation of gas costs and throughput, followed by a discussion on trust assumptions and security implications. Finally, Section 7 concludes the paper and outlines directions for future research.

Early implementations of blockchain in healthcare focused on decentralizing Electronic Health Records (EHR) to eliminate single points of failure. Frameworks like MedBlock (Fan et al., 2018) utilized permissioned blockchain architectures to manage access control lists (ACLs) for patient records. While effective for administrative data, these systems often face scalability hurdles when handling high-frequency data from the Internet of Medical Things (IoMT). Similarly, architectures such as PatientChain attempted to incentivize data sharing through tokenomics. However, these solutions typically rely on recording data hashes directly on Layer-1 blockchains, leading to prohibitive storage costs.

To address the privacy conflicts between public ledgers and regulations like HIPAA and GDPR, recent research has integrated Zero-Knowledge Proofs (ZKPs).

zk-SNARKs: The Groth16 protocol (Groth, 2016) became the industry standard for succinct non-interactive arguments due to its small proof size and fast verification. However, the computational overhead remains a bottleneck for edge devices.

The scalability limitations of Layer-1 (L1) blockchains have led to the widespread adoption of Layer-2 (L2) scaling solutions. L2 protocols, such as Rollups, execute transactions off-chain and post only the state root and validity proof to the L1 mainnet. The Polygon zkEVM (Polygon Labs, 2023) represents the state-of-the-art in this domain, offering Ethereum Virtual Machine (EVM) compatibility with the scalability benefits of ZK-Rollups. TeleZK-L2 leverages Polygon’s architecture to achieve instant finality and low transaction costs.

Despite significant progress, a comparative analysis reveals critical gaps in current methodologies:

High Operational Costs: Systems like ZeroMed (Rahman and Al-Shaer, 2020) deploy verification logic on Ethereum L1. With gas fees fluctuating, the cost to verify a single heart-rate anomaly can exceed $50.

Our system utilizes elliptic curve pairings over the Barreto-Naehrig, BN254 (Alt-BN128) curve, which allows for efficient on-chain verification via precompiled contracts on the Polygon zkEVM. Let G 1 , G 2 , and G T be cyclic groups of large prime order r . A bilinear pairing is an efficiently computable map e : G 1 × G 2 → G T satisfying two fundamental properties:

Bilinearity: For all u ∈ G 1 , v ∈ G 2 and scalars a , b ∈ F r , the pairing satisfies:

To generate a zero-knowledge proof, the computational logic (e.g., “Is 60 < HeartRate < 100 ?“) must be flattened into an Arithmetic Circuit. We formally express this as a Rank-1 Constraint System (R1CS). An R1CS is defined by a triplet of matrices ( A , B , C ) ∈ F m × n , where m is the number of gates and n is the size of the witness vector. A witness vector w ∈ F n satisfies the R1CS if and only if: A ⋅ w ◦ B ⋅ w = C ⋅ w (2) where ◦ denotes the Hadamard (element-wise) product. In TeleZK-L2, floating-point health metrics are mapped into this finite field F r using fixed-point arithmetic scaling.

To prove the correctness of the R1CS without revealing the witness w , we transform the matrices into polynomials using Lagrange Interpolation as shown in Equations 3, 4. A QAP of degree d over a field F consists of a set of polynomials { A i ( x ) , B i ( x ) , C i ( x ) } i = 0 n .

The statement is satisfied if, for a valid witness, the linear combination of these polynomials satisfies the divisibility check: P x = ∑ i = 0 n w i A i x ⋅ ∑ i = 0 n w i B i x − ∑ i = 0 n w i C i x (3) P x = H x ⋅ Z x (4) where Z ( x ) = ∏ j = 1 m ( x − r j ) is the vanishing polynomial over the target domain roots r j . The Prover’s goal is to compute the quotient polynomial H ( x ) = P ( x ) / Z ( x ) . Since the degree of P ( x ) can be large (e.g., 1 0 5 constraints for complex medical logic), computing H ( x ) requires Fast Fourier Transforms (FFT), which justifies our use of a Distributed Prover Network (DPN) to parallelize this operation.

TeleZK-L2 utilizes the Groth16 scheme for its succinctness (constant proof size of 3 group elements). The proof consists of three elements ( π A , π B , π C ) computed as three group elements (Equations 5–7): π A = α + ∑ i = 0 n w i A i τ + r δ δ ∈ G 1 (5) π B = β + ∑ i = 0 n w i B i τ + s δ δ ∈ G 2 (6) π C = ∑ i = l + 1 n w i β A i τ + α B i τ + C i τ + H τ Z τ δ + π A s δ + π B r δ − r δ s δ δ ∈ G 1 (7) where τ , α , β , γ , δ are parameters from the trusted setup.

Formal security of the framework relies on three properties:

Completeness: For every valid health data witness w , the honest prover can always generate a proof π that the Verifier accepts.

The system data flow is visualized in Figure 1. It follows a “Commit-Prove-Verify” lifecycle. The heavy lifting of cryptographic generation is offloaded from the Edge devices to a Distributed Prover Network (DPN), ensuring that wearable devices preserve battery life while maintaining security address the limitations found in existing frameworks (Table 1).

The Edge Layer consists of IoMT sensors (e.g., smartwatches, ECG monitors). Since these devices lack the computational power to generate full zk-SNARK proofs (requiring gigabytes of RAM for large circuits), they perform only lightweight cryptographic commitments:

Data Acquisition: The sensor captures raw physiological data D (e.g., vitals).

This layer is the core innovation of TeleZK-L2, hosting the Distributed Prover Network (DPN) and Aggregation Module.

Immutable “Trust Anchor” on Polygon zkEVM (Solidity-compatible, low-fee L2 rollup):

Verification Smart Contract (VSC): Stores V K (trusted setup); exposes ‘verifyBatch()’.

The complete data lifecycle is straightforward:

Sensing: IoMT device captures raw data D (e.g., Heart Rate = 120 bpm).

To resolve the tension between blockchain immutability and the GDPR “Right to be Forgotten,” (European Union, 2016) TeleZK-L2 implements a strictly defined Key Shredding Protocol (KSP). Although IPFS CIDs are anchored on the Polygon zkEVM, the data D associated with a CID is encrypted as E k ( D ) using a unique symmetric key k per record.

Cryptographic Erasure: When a user requests data deletion, the system destroys the specific key k managed by the Key Management Service (KMS). While the ciphertext E k ( D ) remains on IPFS and the CID remains on-chain, the destruction of k renders the data mathematically unrecoverable. This process, known as crypto-shredding, is recognized by data protection authorities as an effective method for digital erasure.

HIPAA Control Matrix: We map our architecture to specific HIPAA constraints:

Integrity Controls (164.312(c)(1)): Satisfied by the zk-SNARK proof π , which mathematically guarantees that the on-chain hash matches the off-chain data without modification.

We define the security of our system based on the following adversary models:

Honest-but-Curious Cloud Provider: The IPFS nodes and the DPN worker nodes are assumed to follow the protocol instructions but may attempt to analyze the data flow to infer sensitive patient information. TeleZK-L2 mitigates this via strict encryption of the payload ( E k ( D ) ) and the zero-knowledge property of the proofs, ensuring no witness data leaks during computation.

The core of our privacy engine is the arithmetic circuit implemented in ‘circom’. A typical medical data verification circuit validates vital signs and data integrity.

To address the computational overhead highlighted in the gap analysis, TeleZK-L2 strictly employs the Poseidon hash function ( H P ) for cryptographic commitments, replacing the standard SHA-256 used in legacy systems.

While a standard SHA-256 compression function requires approximately 25,000 R1CS constraints per block, Poseidon is designed specifically for Zero-Knowledge friendliness, operating directly over the scalar field F r of the BN254 curve. Our implementation utilizes a width-3 Poseidon sponge construction ( t = 3 ) with full and partial rounds optimized for 128-bit security. This reduces the circuit complexity to approximately 160 constraints per hash input.

For a witness W , the circuit enforces the relationship shown in Equation 10: H public = = = Poseidon W (10)

This substitution reduces the proving time for the commitment component by a factor of roughly 150 × , ensuring that the circuit remains lightweight enough for the Distributed Prover Network to process batches efficiently.

To formalize the security of Algorithm 1, we define the underlying pairing checks. Standard Groth16 verification requires checking the validity equation (Equation 11): e A , B = e α , β ⋅ e L , γ ⋅ e C , δ (11) where L corresponds to the public input encoding. In our aggregated scheme, verifying n proofs individually would require 3 n pairings. We reduce this to a constant number using a random linear combination protocol.

Let { π i } i = 1 n be a batch of proofs where π i = ( A i , B i , C i ) . The verifier samples a random challenge r ∈ F via the Fiat-Shamir transcript (Algorithm 1, Step 2). The aggregated proof π agg is constructed as a random linear combination (Equation 12): A agg = ∑ i = 1 n r i − 1 A i , B agg = B 1 , … (12)

However, simply summing A and C elements is insufficient due to the bilinear property. We employ an inner product argument to prove that the aggregated witness satisfies the aggregated polynomial constraints. The final on-chain verification equation (Equation 13): e A agg , B p k ⋅ e C agg , δ p k = e L agg , γ p k ⋅ e α p k , β p k (13)

Soundness Argument: The security relies on the Schwartz-Zippel lemma. If any proof π i in the batch is invalid, the probability that the random linear combination satisfies the pairing equation is bounded by d / | F | , where d is the degree of the polynomials. For the BN254 curve, | F | ≈ 2 254 , rendering the soundness error negligible ( < 2 − 100 ) .

The DPN utilizes a customized scheduler to decompose the Fast Fourier Transform (FFT) operations across the network (Figure 2).

The Master Node acts as an orchestrator. It receives the witness W and the Proving Key P K . It splits the polynomial evaluation domain into k shards. Worker nodes compute the evaluations on their respective sub-domains and return the results. The Master then performs an inverse FFT (iFFT) to recover the coefficients. This map-reduce pattern allows us to scale horizontally.

VSC on testnet Chain ID 2442 optimized:

Calldata vs. Memory: We force the public inputs to remain in “calldata” rather than copying them to ‘memory’, saving approximately 200 gas per input.

We implement an optimistic proof aggregation protocol using the **Fiat-Shamir heuristic** to generate a random linear combination of individual proofs. This replaces naive batch verification loops with a constant-time check.

Algorithm 1

Require: Batch of Proofs Π = { π 1 , … , π n } , Public Inputs X = { x 1 , … , x n }

The simulation environment consisted of a 16-node high-performance cluster deployed on AWS.

Cluster: 16 × AWS c5.4xlarge (16 vCPU, 32 GB RAM/node); 10Gbps LAN.

We benchmarked TeleZK-L2 vs. baselines (client-side Groth16, standard Polygon L2):

Ethereum L1 (Baseline): Standard Groth16 verification on the Ethereum Mainnet, representing the highest security but highest cost verification standard.

A crucial, often overlooked aspect of IoMT security is energy consumption. Wearable devices operate on small batteries. Running a full Groth16 prover on a Raspberry Pi Zero (simulating a smart hub) consumes approximately 150 Joules per proof. In TeleZK-L2, the edge device only performs symmetric encryption (AES) and hashing (SHA-256). Our measurements show this consumes less than 5 Joules. This 30x reduction in energy consumption significantly extends the operational lifespan of battery-powered medical sensors, making the framework practical for continuous 24/7 monitoring.

The results indicate that TeleZK-L2 effectively solves the scalability bottleneck that has hindered the adoption of blockchain in healthcare. The transition from linear gas growth to constant gas cost is the most significant finding. This “amortization of trust” means that as the network grows, the cost per user actually decreases, making it economically viable for national-scale healthcare systems.