Prototype Blockchain Architecture Detects Learning Record Tampering in Simulated Testing

A proof-of-concept architecture named PleAuth demonstrated that writing cryptographic hashes of standardized learning interactions to a public testnet blockchain can successfully expose unauthorized record alterations in personalized learning environments, according to a technical evaluation published in Discover Computing. Personalized learning platforms routinely collect fine-grained behavioral traces, including completed quizzes, video views, and assignment submissions, to construct data-driven profiles and adapt instructional material. However, conventional educational systems typically store these dynamic learning trails inside centralized databases where records remain vulnerable to unauthorized administrative modifications, database breaches, or silent data manipulation without leaving an independent audit trail. While prior educational blockchain deployments have primarily emphasized the verification of static post-hoc credentials, micro-credentials, and institutional degree certificates, the researchers sought to determine whether distributed ledger technology could instead provide continuous, tamper-evident anchoring for ongoing learning interactions while activity is actively unfolding. Across a series of simulated evaluations and controlled tamper tests, the prototype confirmed that anchoring serialized interaction statements to an external ledger provides an effective detection mechanism against unauthorized off-chain database alterations, while highlighting acute database write bottlenecks during high-volume concurrent traffic.

To establish a systematic security baseline, the investigative team structured the system around the comprehensive CIAAN model, which evaluates information security across five interdependent dimensions: confidentiality, integrity, availability, authenticity, and non-repudiation. Educational data systems present unique security challenges because weaknesses in one dimension frequently degrade others; for instance, unauthorized credential access can lead directly to record tampering, while catastrophic availability failures render adaptive instruction impossible. Conventional personalized learning systems often depend on centralized access controls and database encryption that fail to guard against compromised internal database accounts, rogue administrators, or coordinated infrastructure attacks. To address these vulnerabilities, the researchers formulated an explicit threat model identifying primary operational assets, including learner identities, authentication credentials, and Personally Identifiable Information, alongside learning interaction statements. Potential adversaries analyzed within the threat model encompassed learners seeking to modify personal marks or replay previous activity statements, instructors attempting unauthorized access, compromised database administrators possessing direct write access, and external attackers executing brute-force login attempts or denial-of-service floods against the platform. In response, PleAuth mapped each distinct security requirement to dedicated architectural mechanisms, deliberately keeping personal identities off the ledger while leveraging cryptographic hashes for independent verification.

The technical implementation of the PleAuth platform was built as a multi-service, decoupled architecture designed to interface seamlessly with existing institutional learning management systems such as Moodle. The frontend was developed using Next.js 14.2, offering a responsive interface for user single sign-on authentication, activity visualization, and learning record queries. The backend service was engineered with NestJS 10.3 to handle core application logic, identity management, OAuth 2.0 authorization flows, and communication with the blockchain. Activity tracking was standardized using the Experience API, or xAPI, which formats learning events into a structured actor-verb-object syntax accompanied by rigorous timestamps, such as an entry recording that a specific student completed an assigned quiz. The platform stored comprehensive interaction statements and user profiles off-chain within a MongoDB 7.0 database configured as a dedicated Learning Record Store. Simultaneously, the system serialized each incoming xAPI statement into canonical JSON format with sorted keys and stripped whitespace before generating a SHA-256 cryptographic digest. This digest was anchored to the Ethereum Sepolia public test network via Solidity 0.8.24 smart contracts compiled with Hardhat 2.22, providing an immutable reference point while keeping sensitive personal information strictly off-chain.

Identity management and user authorization were implemented through a combination of enhanced single-factor password hashing and standardized role-based token frameworks. During user registration and login, PleAuth secured credentials using bcrypt with a high cost factor of 12, generating salted password hashes stored in MongoDB to prevent rainbow table attacks and credential harvesting. To protect data in transit against interception, all network communications across frontend interfaces, backend endpoints, and third-party learning integrations were encrypted using Transport Layer Security version 1.3, while sensitive profile metadata at rest in MongoDB was encrypted using AES-256. For access control, the system incorporated OAuth 2.0 in compliance with RFC 6749, utilizing RSA-signed JSON Web Tokens following RFC 7519. Tokens carried specific role-based scopes defining access tiers for students, teachers, and system administrators. Access tokens were configured with short expiration windows ranging from 15 to 30 minutes, supported by refresh tokens and server-side session invalidation upon user logout. Through this structure, external platforms such as Moodle could authenticate users via an integrated plugin without receiving raw authentication credentials, thereby preventing unauthorized privilege escalation and preserving role boundaries across integrated educational environments.

Experimental evaluation of the PleAuth architecture was conducted within a controlled cloud deployment intended to approximate the financial and computational resources of a modest college server environment. The core application services were deployed on an Amazon Web Services Elastic Compute Cloud t3.medium virtual machine equipped with two virtual central processing units and four gigabytes of random-access memory, complemented by Vercel frontend hosting and a MongoDB Atlas free-tier database cluster. To evaluate operational feasibility, the researchers generated an experimental dataset using 1,000 simulated student profiles producing continuous xAPI activity streams. The experimental protocol evaluated the system across three distinct scenarios: authentication resilience, tamper detection mechanics, and scalability under varying concurrent request volumes. In the first experimental scenario, the platform processed 462 authentication attempts, including 50 scripted malicious attacks such as automated brute-force credential stuffing. The system successfully blocked every attack attempt and recorded an overall authentication success rate of 96.97 percent, representing 448 successful logins out of 462 total attempts, with a Wilson 95 percent confidence interval spanning from 94.98 percent to 98.19 percent.

A comparative baseline was examined by deploying a standard Moodle learning environment running on a traditional LAMP stack consisting of Linux, Apache, MySQL, and PHP on an identical AWS EC2 t3.medium cloud instance. Under matching authentication test conditions, the traditional Moodle baseline achieved a 100 percent authentication success rate across 346 attempts, with a Wilson 95 percent confidence interval from 98.90 percent to 100.00 percent. The researchers documented that the 14 failed authentication attempts observed in PleAuth stemmed entirely from transient network connection issues along the multi-hop OAuth redirection and token exchange pathway rather than underlying security flaws. Consequently, the authors emphasized that this observed discrepancy reflects an operational usability and availability trade-off introduced by the additional token verification layers rather than superior authentication enforcement in the baseline. Across a broader operational testing sample of 33,672 access events, PleAuth logged and blocked 202 unauthorized access events, yielding an unauthorized attempt rate of 0.60 percent with a Wilson 95 percent confidence interval between 0.52 percent and 0.69 percent, with zero successful breaches observed across all access attempts, corresponding to a Wilson confidence interval between 0.00 percent and 0.01 percent.

Data integrity verification was evaluated through a controlled demonstration designed to prove the mechanical viability of the dual-storage comparison pipeline rather than to calculate an empirical detection percentage across repeated trials. Within the MongoDB Learning Record Store containing 1,000 simulated learning statements, researchers executed deliberate off-chain modifications on selected records, such as surreptitiously switching a recorded quiz submission status from incorrect to correct. During subsequent integrity audits, the verification module retrieved the altered off-chain record, recomputed its canonical SHA-256 digest, and queried the corresponding hash anchored inside the Ethereum Sepolia smart contract. In every examined case, the comparison revealed a definitive hash mismatch, immediately generating a system tamper alert confirming that the underlying record had been modified after its initial ledger commitment. Because the experimental environment was subsequently decommissioned without retaining the exact tally of scripted tamper trials, the authors explicitly noted that this finding validates the architectural detection mechanism itself rather than an empirical statistical detection rate. Furthermore, the gas expenditure required to store a single SHA-256 hash digest on Ethereum Sepolia was observed to range consistently between 45,000 and 55,000 gas units per transaction.

Performance profiling revealed distinct operational boundaries between local application interfaces and multi-user database write operations. When measuring latency from the Next.js frontend to the NestJS backend prior to asynchronous blockchain submission, the average application programming interface response time for authentication and xAPI submission was 3.0 ± 0.5 milliseconds. However, automated stress testing conducted with the K6 benchmarking utility demonstrated that database throughput constraints significantly affected response times under heavy traffic loads. During stress testing across sustained one-minute intervals of concurrent requests, the system maintained an error rate of 0.0 percent but exhibited substantial latency increases: mean response times measured 1.68 seconds at 100 concurrent requests with a maximum of 4.01 seconds, 4.04 seconds at 200 concurrent requests with an 8.00-second maximum, 11.25 seconds at 500 concurrent requests with a 19.76-second maximum, and 24.41 seconds at 1,000 concurrent requests with a peak latency of 37.07 seconds. Throughout these high-concurrency conditions, system throughput remained constrained between 19 and 21 transactions per second, an operational ceiling consistent with the write limitations of the free-tier MongoDB Atlas deployment rather than blockchain consensus delays.

The study also gathered exploratory qualitative feedback through an online survey administered to a purposive sample of 90 educational stakeholders, evenly divided between 45 students and 45 educators. Rather than utilizing standardized psychometric instruments or computing statistical reliability metrics such as Cronbach alpha or confirmatory factor analysis, the survey captured open-ended qualitative impressions regarding system usability and design. Within these unstructured responses, approximately 31 percent of participants highlighted enhanced data security, about 24 percent praised record transparency, and roughly 19 percent voiced concerns regarding authentication complexity and multi-step login friction. The authors cautioned that these descriptive figures represent unstructured mention frequencies rather than validated attitude scales. Importantly, the researchers explicitly retracted earlier statistical claims from preliminary drafts that had asserted statistically significant superiority across CIAAN dimensions using Student t-tests, noting that applying t-tests to non-normal count data and proportions without reporting effect sizes or degrees of freedom was mathematically inappropriate. All operational comparisons against the baseline Moodle instance were therefore classified as purely descriptive indicators obtained from unmatched cloud configurations rather than definitive proofs of superior performance over established production systems.

Several critical architectural limitations and governance challenges were documented that delineate the boundaries of the current proof-of-concept. Because the prototype anchors deterministic SHA-256 hashes without incorporating cryptographic salting, peppering, or keyed-hash message authentication codes, the public presence of timestamps and activity types on Ethereum Sepolia leaves open theoretical risks of linkage attacks and learner re-identification. Furthermore, the permanent immutability of on-chain hashes creates fundamental friction with data privacy frameworks such as the European Union General Data Protection Regulation, specifically regarding the statutory right to be forgotten. While deleting off-chain MongoDB records renders isolated on-chain hashes unresolvable, the unalterable existence of historical behavioral records could generate psychological chilling effects that inhibit experimental learning. Technically, the evaluation excluded full on-chain confirmation latencies, which routinely span several seconds on public blockchains and would introduce unacceptable latency if integrated synchronously into real-time feedback loops. Future investigations must focus on implementing keyed hashing algorithms, evaluating lightweight Byzantine fault-tolerant consensus mechanisms, assessing layer-two rollups to alleviate network delays, and conducting matched-infrastructure trials in live classroom settings.

Subject of Research: Evaluating a blockchain-based architecture for secure personalized learning environments

Article Title: Evaluating a proof-of-concept blockchain-based architecture for secure personalized learning environments using the CIAAN framework

Article References: Wang, X., Dong, X., Zhang, Y., Chen, Y., & Xu, X. (2026). Evaluating a proof-of-concept blockchain-based architecture for secure personalized learning environments using the CIAAN framework. Discover Computing, 29(1), Article 887. https://doi.org/10.1007/s10791-026-10811-9

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10811-9

Keywords: Blockchain in education, Personalized Learning Environments, PleAuth architecture, Ethereum Sepolia, Experience API, xAPI canonicalization, Learning Record Store, OAuth 2.0 authorization, CIAAN framework, Data integrity verification, SHA-256 digest, Role-based access control, MongoDB Atlas, System scalability, Load testing, Educational technology, Tamper-evident records, Information security