Federated Sovereign Transport Protocol (FSTP): Verifiable Coordination Without Disclosure
Source: arXiv:2607.00213 · Published 2026-06-30 · By Ramón Soto C., Liz Soto
TL;DR
The Federated Sovereign Transport Protocol (FSTP) addresses a fundamental gap in existing federation protocols by embedding data confinement as a structural property of the protocol rather than relying on operator policy. In federated systems where nodes maintain heterogeneous privacy requirements and sensitive internal data such as membership, deliberations, and votes, existing protocols like ActivityPub fail to prevent exposure of raw internal data. FSTP introduces a synchronization agent implemented in Rust which enforces, at compile time via the type system, that only a formally closed set of cryptographic artifacts (no raw data) can cross the node boundary, guaranteeing confinement. The protocol also employs a contextual identity model to prevent identity linkability across federation relationships and a tamper-evident Blocklace event substrate enabling partial ordering, efficient synchronization, and compatibility with data erasure regulations.
Key findings
- Raw internal data (Draw) never appears in federation messages; enforced at compile time via Rust's exhaustive matching of a closed enum (FstpMessage) spanning Dpub types only.
- Contextual identities (cii) are unlinkable across federation relationships due to one-way derivation from global identities (gii), preventing context collapse structurally.
- Blocklace synchronization cost scales as O(Δ), proportional to the symmetric difference between node states, validated empirically with the reference implementation.
- Blocklace structure separates event content from hash pointers enabling data erasure without breaking tamper-evident hash chains (dangling pointers mechanism).
- Credential presentations expose exactly the claims authorized and contextual identity per relationship, nothing more (minimum disclosure property).
- The synchronization agent’s five-state lifecycle (idle, validating, composing, transmitting, logging) ensures confinement violations or network failures terminate with an audit log entry and no protocol violation.
- Security guarantees include data confidentiality via AES-256-GCM encryption at rest, event integrity through Ed25519 signatures, and credential unforgeability based on W3C Verifiable Credentials standards.
- The protocol interoperates with institutional governance platforms like Velyzor, supporting cross-organizational certified decision-making without exposing underlying deliberations.
Threat model
The adversary is an honest-but-curious federation peer or infrastructure operator who follows the protocol but attempts to infer information by observing conforming messages exchanged across the federation. They cannot break cryptographic primitives such as SHA-256, AES-256-GCM encryption, or Ed25519 signatures, nor gain unauthorized access to node internal data stores. Network-level passive interception does not allow plaintext recovery. The protocol does not defend against malicious node administrators or cryptographic breaks.
Methodology — deep read
The threat model assumes honest-but-curious federation peers and infrastructure operators who follow protocol but attempt maximal information inference from messages, as well as passive network interceptors with no cryptographic breaking ability. Malicious insider compromises or cryptanalysis are out of scope.
Data partition at each node divides raw internal data (Draw) such as membership or deliberation records, from published cryptographic artifacts (Dpub) like event hashes, signatures, and verifiable credentials. Draw elements never cross the node boundary.
The architecture centers on a Rust-based synchronization agent (sa) implemented as the node's exclusive interface to the federation. The sa outputs messages of type FstpMessage, a Rust enum closed to specified variants (IdentityEvent, EventHash, VerifiableCredential, FederationControl). The Rust compiler enforces Traw ∩ Tpub = ∅ at compile time via exhaustive pattern matching, preventing any Draw type from becoming an output.
The sa lifecycle has five states: idle (awaiting trigger), validating (checking confinement), composing (building Dpub artifacts), transmitting (sending messages), and logging (writing audit records). Violation or network failure causes error transitions terminating with audit logs.
The contextual identity model derives per-relationship Contextual Identities (cii) from the global DID (gii) using one-way functions, preventing cross-context correlation without cooperation.
The Blocklace event substrate stores node event histories as tamper-evident directed acyclic graphs of signed blocks containing hash pointers to parents, allowing partial order representation consistent with genuine concurrency. Synchronization occurs via frontier exchange, determining missing blocks in O(|frontier|) time; this yields synchronization cost O(Δ) in symmetric difference size.
Blocklace decouples event content from the hash pointers, permitting deletion of events (“dangling pointers”) without invalidating the hash chain.
The protocol evaluation includes correctness proofs of confinement from Rust’s compile-time guarantees, security audits of identity isolation and minimum disclosure properties, and empirical synchronization benchmarks (Section 7) validating O(Δ) cost in Velyzor deployments. The open-source Rust code ensures reproducibility of the confinement guarantees, though the dataset is internal institutional data inaccessible publicly.
A detailed three-node federated decision case study illustrates provenance and verification steps without exposure of internal data.
Overall, the methodology tightly integrates protocol design, implementation leveraging Rust's type system, cryptographic foundations, and practical benchmarking within a privacy-sensitive institutional federation context.
Technical innovations
- Compile-time enforcement of data confinement via Rust type system using a closed enum to statically exclude internal data from federation messages, avoiding runtime checks.
- Contextual identity derivation isolating user identities per federation relationship by one-way functions, preventing cross-context identity linkability.
- Blocklace event substrate combining partially ordered tamper-evident logs with an erasure-compatible dangling pointer mechanism, structurally resolving the blockchain erasure vs integrity conflict.
- Synchronization protocol with frontier exchange achieving O(Δ) communication cost proportional to symmetric state differences between nodes, validated empirically.
Datasets
- Velyzor governance platform data — internal institution governance records, encrypted and private — not publicly available
Baselines vs proposed
- ActivityPub: no structural data confinement (policy only) vs FSTP: compile-time enforced structural confinement
- Matrix protocol: global identity linkability vs FSTP: contextual unlinkable identities
- Linear blockchain audit logs: full data replication, no data erasure compatibility vs FSTP Blocklace: partial order with erasure-compatible hash chains
- Synchronization cost in full replication (O(n)) vs synchronization via frontier exchange O(Δ) demonstrated empirically in Section 7
Limitations
- Threat model excludes malicious node administrators and cryptographic primitive compromises; these adversarial vectors are non-addressed and left for future mitigation.
- No formal quantification of information leakage from traffic metadata (timing and frequency) under passive observers; pattern analysis leakage remains an open issue.
- Data erasure compliance depends on external jurisdictional analysis; Blocklace structural compatibility does not guarantee full regulatory compliance alone.
- Empirical results focus on information exchanged (synchronization cost) but lack detailed wall-clock latency or bandwidth benchmarking in diverse network conditions.
- The full security analysis of cross-node trust assumptions and interoperability with diverse federation implementations remains future work.
Open questions / follow-ons
- Can formal leakage quantification of traffic metadata under traffic analysis attacks be integrated into FSTP’s threat model?
- What mechanisms can be layered atop FSTP to address malicious insider threats or compromised nodes without sacrificing protocol guarantees?
- How does FSTP integrate with other decentralized identity frameworks broadly, and can its contextual identity model be generalized or standardized?
- What performance trade-offs arise when deploying FSTP at Internet scale with diverse and intermittent connectivity?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, FSTP offers a compelling paradigm for privacy-preserving coordination across federated nodes without exposing sensitive internal state or identity linkability. Its compile-time enforced data confinement principles and contextual identity isolation could inspire design of defense mechanisms requiring strong privacy and integrity guarantees at protocol layers rather than trusted operator assumptions. The Blocklace substrate’s efficient and tamper-evident partial ordering aligns with audit trail requirements common in bot detection frameworks. Deploying similar structural constraints in CAPTCHA challenge/response protocols or distributed attestation mechanisms could minimize data leakage and thwart correlation attacks. However, integrating FSTP requires adopting new transport and synchronization protocols, and might necessitate co-design with existing CAPTCHA infrastructure for practical deployment.
Cite
@article{arxiv2607_00213,
title={ Federated Sovereign Transport Protocol (FSTP): Verifiable Coordination Without Disclosure },
author={ Ramón Soto C. and Liz Soto },
journal={arXiv preprint arXiv:2607.00213},
year={ 2026 },
url={https://arxiv.org/abs/2607.00213}
}