assword has been the major vulnerability and challenge in cloud computing environment due to adversarial threat sources. Zero-Knowledge Proof (ZKP) becomes the excellent optional strategy and current anticipation for Cloud Data security and assurance as it gives the server zero knowledge of passwords. However, the VERIFIER, despite having no knowledge of the password must verify that the password entered by the PROVER is correct. A major challenge that occurs is when the user disremembers the password, the cloud environment becomes inaccessible and the cloud service provider has no any replica of the password as a backup. Eavesdropping/snooping is a major threat which provides full access to the cloud environment. Adding Time-based One-time Password (TOTP) will be an elucidation to password delinquency as it expires after a certain splits of seconds or minutes which would render the password unserviceable to the snooped. This research examined cloud services in relation to the security challenges faced by organizations and proposed the hybridization of the Zero-Knowledge Proof and Time- Based One-Time Password algorithms for a better security of the cloud environment.
Data in healthcare domain is highly sensitive in nature. Besides, there is need for maintaining integrity of such data. Blockchain technology has emerged to solve the problem of data integrity and non-repudiation with immutable storage in distributed repository. Thus secure data storage and retrieval in cloud environments is made possible using blockchain implementation. There are many existing healthcare systems with blockchain integration found in the literature. However, there is need for a system that supports complete set of operations that are governed by smart contracts. Another important consideration is that end users should be able to operate healthcare system without the need for knowledge of blockchain technology. Towards this end, in this paper, we proposed a Blockchain based secure healthcare data storage and retrieval system known as HealthBlock for cloud computing environments. We defined smart contract with underlying structures and functions using Solidity language for Ethereum blockchain platform. We also proposed and implemented an algorithm known as Healthcare Transactions over Blockchain (HToB). This algorithm supports secure blockchain based data storage and retrieval governed by smart contracts. Our system is evaluated using user-friendly web based client application. The experimental results showed that our system is able to ensure data integrity and non-repudiation besides reaping all benefits of blockchain technology.
Verifiable Credential (VC) is a new standard proposed by the W3C association to facilitate the expression and verification of third-party-verified credentials on the Internet, such as passports or diplomas. However, the current VC data model lacks an explicit revocation design that guarantees the secure operations of the system, which limits its application. In this paper, we specify the requirements for a tamper-evident and privacy-preserving revocation mechanism, based on which we compare existing solutions and propose our revocation mechanism that satisfies all the requirements. Our design combines a cryptographic accumulator and a role-based blockchain. With zero-knowledge proof, the verifier can operate off-chain computation of the revocation status while ensuring the correctness of revocation information published on the blockchain. Our analysis shows that the proposed revocation mechanism can prevent fraud using forged and revoked credentials and relieve privacy concerns caused by the correlation of digital data. Our proof-of-concept implementation demonstrates that our revocation mechanism adds only 42.86 ms overhead in the presentation and 31.36 ms overhead in the verification of verifiable credentials. We also provide scalability analysis, which illustrates that the throughput of our blockchain can meet real-world needs.
Blockchain has emerged as a prevailing paradigm for decentralized applications due to its reliability and transparency. To scale up retrieval services, a common strategy is to use a hybrid storage model, where on-chain storage is responsible for small metadata and off-chain storage is for outsourced raw data. However, data security and result authenticity are ongoing challenges in this scenario, and little work has been done due to the difficulty of combining result verification and privacy preservation, especially for dynamic updates while supporting forward privacy. In this paper, we formally define the problem of efficient, verifiable, and secure conjunctive keyword search in hybrid-storage blockchains (vsChain) and propose a novel hybrid index that achieves efficient query and verification while supporting dynamic updates with forward privacy guarantee. We also design two optimized schemes to improve query and verification performance by using a partition-based method and an obfuscated counting Bloom filter mechanism. Finally, we provide a theoretical security analysis and empirical evaluations using real and synthetic datasets to demonstrate the feasibility of our proposed schemes.
With the ongoing advancement and widespread adoption of blockchain technology, Ethereum has established itself as the foremost platform for executing smart contracts.As a focal point of the industry, the security and stability of the Ethereum ecosystem have become crucial. Ethereum Improvement Proposals (EIPs) play a vital role in promoting the technological progress of Ethereum and providing direction for innovation in the blockchain field. ERCs, as a type of EIP, define application-level standards and conventions that are crucial for promoting innovation and ensuring the scalability and maintainability of the system. In particular, some ERCs, such as the ERC-20 token standard, have become the foundation of the Ethereum ecosystem. However, if EIPs have security issues, any security vulnerabilities or design flaws can have severe consequences, including financial losses, data leaks, and damage to the reputation of the entire Ethereum network. This paper primarily focuses on the security analysis of application standard proposals (ERC). We conducted research on the current state of EIP security, performed case studies, and provided security recommendations. The goal is to gain a comprehensive understanding of the security features and potential risks of these proposals, and to propose practical solutions to enhance the security of EIPs.
Many institutions and organizations require nostrification and verification of qualification as a prerequisite for hiring. The idea is to recognize the authenticity of a copy or digital document issued by an institution in a foreign country and detect forgeries. Certificates, financial records, health records, official papers and others are often required to be attested from multiple entities in distinct locations. However, in this digital era where most applications happen online, and document copies are uploaded, the traditional signature and seal methods are obsolete. In a matter of minutes and with a simple photo editor, a certificate or document copy may be plagiarized or forged. Blockchain technology offers a decentralized approach to record and verify transactions without the need for huge infrastructure investment. In this paper, we propose a blockchain based nostrification system, where awarding institutions generate a digital certificate, store in a public but permissioned blockchain, where students and other stakeholders may verify. We present a thorough discussion and formal evaluation of the proposed system.
In the healthcare system, electronic medical records are very critical, and they must be authenticated and verified. During the medical check-up, a large amount of patient medical data is generated which includes reports related to blood, life-threatening diseases, and personal information such as credit card numbers and addresses. Any privacy breach in patient medical records will bring various risks. A simple blockchain (Ethereum) can be effective to validate and authenticate stored data by deploying an immutable ledger. However, the main challenge in the simple blockchain is that its data can be easily accessible. In this paper, the authors create a business network for healthcare using Hyperledger fabric, which ensures that data is only available to the concerned person and its access rights are granted and revoked by the concerned participant. Additionally, the authors tested different scenarios to access blockchain security and its benefits.
Gautham Narayan, Pavitra Haveri, B H Rashmi, Yashwardhan Deewan
Ensuring secure data provenance is crucial for maintaining accountability and confidentiality in cloud environments. Cloud data provenance involves recording the history of creation and operations performed on cloud data objects. However, establishing trust between cloud customers and service providers remains a challenge, highlighting the need for assured data provenance models in cloud storage. Blockchain technology has emerged as a solution for designing data provenance assurance mechanisms. It provides a decentralized and distributed ledger to record the provenance of digital assets. In this context, we present a blockchain-based framework for ensuring data provenance in cloud storage. Initially, we develop a cloud storage application using OpenStack swift storage. This application caters to the storage needs of university students and faculty while providing data provenance capabilities. Subsequently, we design a data provenance assurance framework for confidential files of users using the Ethereum blockchain. To evaluate the scalability and performance of the proposed framework, we analyze various factors such as transaction throughput, latency, network size, and load on the blockchain network. The performance of the system is compared under two consensus algorithms: Proof of Work and Proof of Authority. By conducting this analysis, we aim to assess the effectiveness and efficiency of the blockchain-based solution in ensuring data provenance in cloud storage environments.
Mahmoud Abbasi, Javier Prieto, Amin Shahraki, Juan M. Corchado
The Internet of Things (IoT) devices utilized in manufacturing industries produce vast volumes of valuable data that can revolutionize productivity and sustainability. While existing centralized data marketplaces facilitate data trading, they are often marred by trust issues, a single point of failure, and significant security and privacy vulnerabilities. Addressing these critical shortcomings, this paper introduces a blockchain-based industrial data trading system that not only ensures secure and transparent data trading but also offers advantages over conventional systems. Unlike traditional marketplaces, our proposed system emphasizes trustworthiness by mitigating third-party risks, enhancing data integrity through decentralized storage, and employing graph technology for efficient blockchain querying. Further, with integrated access control, our system elevates security standards. Preliminary evaluations reveal the system’s potential to offer a more secure, transparent, auditable, and trustworthy data trading environment, distinctly outpacing the capabilities of current marketplaces.
Blockchain technology has altered the way transactions are conducted since its introduction. It offers a risk-free and secure way to exchange digital currency that is impervious to manipulation by those with bad intentions. In blocks that store the data, it stores all transactional data. The best example of decentralized, systematic data collection is blockchain technology. By storing the block in many locations across a distributed network arrangement, it offers a public ledger system that combines public key encryption of all transactions to solve the double spending problem, making change impossible and therefore more secure. This article explores the usefulness and benefits of Blockchain technology compared to traditional data management by outlining its fundamental concepts and how it has been adopted in different industries. The writers also discuss the factors that led to the adoption of Bitcoin and other cryptocurrencies as well as the shift to a decentralized crypto ledger. In-depth information on this technology's potential hazards, drawbacks, security features, threats, and vulnerabilities is also included in the article.
AI has found widespread application across various sectors, including security, healthcare, finance, and national defense. However, alongside its transformative advancements, there has been an unfortunate trend of malicious exploitation of AI capabilities. Concurrently, the rapid evolution of cloud computing technology has introduced cloud-based AI systems. Regrettably, vulnerabilities inherent in cloud computing infrastructure also pose risks to the security of AI services. We observe that the integrity of training data is pivotal, as any compromise therein directly impacts the efficacy of AI systems. Against this backdrop, we assert the paramount importance of preserving data integrity within AI systems. To address this imperative, we propose a data integrity architecture guided by the National Institute of Standards and Technology (NIST) cyber security framework. Leveraging block chain technology and smart contracts emerges as a fitting solution to tackle integrity challenges, owing to their characteristics of shared and decentralized ledgers. Smart contracts facilitate automated policy enforcement, enable continuous monitoring of data integrity, and mitigate the risk of data tampering.
Financial organizations are adopting an Open Bankings (OB) pattern for creativity in services and incorporation. OB permits Third-Party Servicing Providers (TSPs) to entry consumer financial data to identify optimal offers and enhance customer service. The reliance on third parties essential for the functioning of the OB environment prompts inquiries about digital identity incorporation, information exchange, and the safeguarding of secrets. Distributed Applications (DApps) for data classification and secret protection, user consent capturing, tracking TSP accessibility actions, controlling Applications Programming Interfaces (APIs), and maintaining Self-Sovereign Identity (SSI) are available; however, they have not yet been incorporated into a functional three-phase OB strategy. Upon evaluating the principal needs of main OB users, the research formulated a Blockchain-oriented Identity Managing and Access Controlling System (BIMACS) that incorporates benefits from both conventional banking and blockchain-based technologies. The BIMACS facilities utilize smart agreements and an undocumented authenticating system to establish a transaction security management system, which provides features such as distributed Third-Party Logins (TPL), OB account creation, information authorization, incorporated transactions, and TSP access tracking. The system efficiency study's findings demonstrate that the suggested structure's frequently executed functions incur a lower computational price than the median operations price on open Ethereum.
Guzmán Llambías, Bruno Bradach, Juan J. Nogueira, Laura González · 5 authors
Blockchain is a distributed ledger technology (DLT) to manage data in a decentralised way. During the last years, interoperability has become one of the main challenges within blockchain research as blockchains increasingly require integration between each other. Indeed, blockchains work by design in silos of information as interoperability is not a native feature. The main efforts in the field are focused on blockchains, such as Bitcoin and Ethereum. However, interoperability in DLT remains as an almost untouched area of work as they introduce additional requirements focusing on privacy and identity. Although there are some interoperability solutions for DLT, they are either high-level design proposals not providing concrete implementations or focus on interoperability issues between business applications and blockchain platforms. In this paper we propose a gateway-based platform-to-platform interoperability solution for DLT, which comprises a detailed solution design and a reference implementation. The proposal was assessed through the development of a social security case scenario and the evaluation through two interoperability frameworks. A reference implementation was built using two DLT: Hyperledger Fabric and Corda. The experimental results shows that it is possible to achieve technical interoperability between two heterogeneous DLT platforms using a gateway-based interoperability solution, relaxing decentralisation, data privacy, identity and authorisation management properties.
Fog computing composes of neighboring devices, which are connected as cluster to collect and compute data via given algorithms. Compared with cloud computing, it collects and processes data at the edge of device layer, instead of remote data transmission and task scheduling. Fog computing reduces the communication and computation overhead in networking and data aggregating, while preserves data privacy against the cloud center. However, due to the different devices capacities, trust relations, security settings, the concerns are that, if the given data is real and sufficient for analyzing program as input, whether the data processing is done as appointed, and how to prevent secret leakage during the computation. This paper proposes a trustless layer for secure data computing in fog network, where the function accepts “hidden” data as input and generates zero-knowledge computing proof which can be easily verified by public. The combination of secure computing functions and blockchain systems escort trustful business in fog environment.
Abstract Blockchain is employed as a technology holding a solutionist promise, while at the same time, it is hard for the promissory blockchain applications to become realized. Not only is the blockchain protocol itself not foolproof, but when we move from “blockchain in general” to “blockchain in particular,” we see that new governance structures and ways of collaborating need to be developed to make blockchain applications work /become real . The qualities ascribed to (blockchain) technology in abstracto are not to be taken for granted in blockchain applications in concreto . The problem of trust, therefore, does not become redundant simply through the employment of “trustless” blockchain technology. Rather, on different levels, new trust relations have to be constituted. In this article, we argue that blockchain is a productive force, even if it does not solve the problem of trust, and sometimes regardless of blockchain technology not implemented after all. The values that underpin this seemingly “trustless technology” such as control , efficiency , and privacy and the story that is told about these values co‐shape the actions of stakeholders and, to a certain extent, pre‐sort the path of application development. We will illustrate this by presenting a case study on the Red Button ( De Rode Knop ), a Dutch pilot to develop a blockchain‐based solution that enables people who are in debt to communicate to their creditors that they are, together with the municipality, working on improving their situation, thereby requesting a temporary suspension from debt collection.
Tariq Bontekoe, Dimka Karastoyanova, Fatih Türkmen
Privacy-preserving computation (PPC) methods, such as secure multiparty computation (MPC) and homomorphic encryption (HE), are deployed increasingly often to guarantee data confidentiality in computations over private, distributed data. Similarly, we observe a steep increase in the adoption of zero-knowledge proofs (ZKPs) to guarantee (public) verifiability of locally executed computations. We project that applications that are data intensive and require strong privacy guarantees, are also likely to require verifiable correctness guarantees, especially when outsourced. While the combination of methods for verifiability and privacy protection has clear benefits, certain challenges stand before their widespread practical adoption. In this work, we analyze existing solutions that combine verifiability with privacy-preserving computations over distributed data, in order to preserve confidentiality and guarantee correctness at the same time. We classify and compare 37 different schemes, regarding solution approach, security, efficiency, and practicality. Lastly, we discuss some of the most promising solutions in this regard, and present various open challenges and directions for future research.
With the development of big data and cloud computing, ensuring authenticity and validity has become paramount issue. This paper introduces a novel verification mechanism, which is based on game theory and smart contracts, to validate the genuineness of results from cloud services given to users. It not only vouches for the veracity of these results but also promotes participation from trustworthy cloud service providers by introducing a strategically designed incentive system. The designed game-theoretical model combined with the execution sequence of the smart contracts acts as a deterrent against deceitful actions by potential malicious service entities. Experimental results prove the effectiveness and feasibility of this method.
We present an implementation of a Web3 platform that leverages the Groth16 Zero-Knowledge Proof schema to verify the validity of questionnaire results within Smart Contracts. Our approach ensures that the answer key of the questionnaire remains undisclosed throughout the verification process, while ensuring that the evaluation is done fairly. To accomplish this, users respond to a series of questions, and their answers are encoded and securely transmitted to a hidden backend. The backend then performs an evaluation of the user's answers, generating the overall result of the questionnaire. Additionally, it generates a Zero-Knowledge Proof, attesting that the answers were appropriately evaluated against a valid set of constraints. Next, the user submits their result along with the proof to a Smart Contract, which verifies their validity and issues a non-fungible token (NFT) as an attestation of the user's test result. In this research, we implemented the Zero-Knowledge functionality using Circom 2 and deployed the Smart Contract using Solidity, thereby showcasing a practical and secure solution for questionnaire validity verification in the context of Smart Contracts.
Abstract Zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) are the most efficient proof systems in terms of proof size and verification. Currently, Groth’s scheme from EUROCRYPT 2016, $$\textsf{Groth16}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>Groth</mml:mi> <mml:mn>16</mml:mn> </mml:mrow> </mml:math> , is the state-of-the-art and is widely deployed in practice. $$\textsf{Groth16}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>Groth</mml:mi> <mml:mn>16</mml:mn> </mml:mrow> </mml:math> is originally proven to achieve knowledge soundness, which does not guarantee the non-malleability of proofs. There has been considerable progress in presenting new zk-SNARKs or modifying $$\textsf{Groth16}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>Groth</mml:mi> <mml:mn>16</mml:mn> </mml:mrow> </mml:math> to efficiently achieve strong Simulation extractability, which is shown to be a necessary requirement in some applications. In this paper, we revise the Random oracle based variant of $$\textsf{Groth16}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>Groth</mml:mi> <mml:mn>16</mml:mn> </mml:mrow> </mml:math> proposed by Bowe and Gabizon, BG18, the most efficient one in terms of prover efficiency and CRS size among the candidates, and present a more efficient variant that saves 2 pairings in the verification and 1 group element in the proof. This supersedes our preliminary construction, presented in CANS 2020 (Baghery et al. in CANS 20, volume 12579 of LNCS, Springer, Heidelberg. pp 453-461, 2020), which saved 1 pairing in the verification, and was proven in the generic group model. Our new construction also improves on BG18 in that our proofs are in the algebraic group model with Random Oracles and reduces security to standard computational assumptions in bilinear groups (as opposed to using the full power of the generic group model (GGM)). We implement our proposed simulation extractable zk-SNARK (SE zk-SNARK) along with BG18 in the library, and compare the efficiency of our scheme with some related works. Our empirical experiences confirm that our SE zk-SNARK is more efficient than all previous simulation extractable (SE) schemes in most dimensions and it has very close efficiency to the original $$\textsf{Groth16}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>Groth</mml:mi> <mml:mn>16</mml:mn> </mml:mrow> </mml:math> .
Fake news and misinformation are prevalent on the Internet in this day and age. The popularity of social media such as Facebook, Instagram, TikTok has encouraged the people to share news or information over Internet without knowing whether it is a truth or fake information. The outbreak of COVID-19 affected the social activities of all levels of society as people were asked to stay at home to self-quarantine. It indirectly encourages the growth of the social activities online. Even though COVID- 19 is no longer a big threat to the world, people already used to rely on the Internet for the daily activities. Therefore, the trustworthy of the information on the Internet is getting crucial. ETHERST is a blockchain- based PKI that implemented rewarding and punishment mechanism using Ethereum ECR-20 token named PKIToken to improve the trustworthiness of information published by the blockchain nodes. In this paper, we implement an Ethereum-based distributed application (dapp) that allowed the community members to act on trusting and untrusting on information provided by any of the members. With the ETHERST framework as the backend, the ETHERSTWEB is equipped with the rewarding and punishment mechanism to keep the community from misusing the trusting and untrusting action to maintain the trustworthiness of information of a member. With the PKIToken amount level implemented in the backend, it provides an index to the trustworthiness of a member in the community. It has the advantages over the existing rating or review systems that are commonly implemented in many traditional web applications.
Abstract A rising number of educational solutions based on blockchain technology have been designed. Students and other authorities responsible for verifying certificates are very concerned about the authenticity of academic credentials, either because the institutions that issue them no longer exist or because they do not keep adequate records. Blockchain technology has much to offer in education, including its high level of security, improved data access control, low cost, improved accountability, identity authentication, transparency, increased trust, and improved efficiency in managing student records. We proposed a decentralized blockchain‐based secure platform for the storage of academic certificates and student assessments with double encryption. Apart from speeding up the verification process, it will increase the safety of personal education data and assessments of all kinds of misuse. The data would only be accessed using a stakeholder's private key, and storing documents on a blockchain would increase security. We proposed a framework to offer a secure channel for educational resources. We are storing documents over blockchain utilizing an IPFS distributed data server. We give a thorough explanation of the system development, design, and evaluation of the suggested solution in terms of security and cost. Finally, we put the proposed framework to the test by deploying a smart contract prototype on the Ethereum TESTNET network in a Windows environment. The study's findings revealed that the proposed method is effective and feasible.
The Blockchain Organized Framework for Unified Systems (BOFUS) and the Comprehensive Ledger Assessment for Robust Interoperability and Trustworthiness (CLARITY) initiatives address the challenges of understanding, standardizing, and enabling interoperability between diverse blockchain systems. BOFUS is a comprehensive 5-layer model that systematically organizes core blockchain components, while the CLARITY assessment provides a standardized method for evaluating and comparing blockchains using the CONFIGURE acronym. Together, these initiatives aim to facilitate a deeper understanding of blockchain technology, promote effective communication and collaboration between stakeholders, and ultimately advance the development and adoption of distributed ledger technologies. This paper presents an in-depth discussion of the BOFUS architecture and the CLARITY assessment, exploring their utility in various blockchain scenarios and their potential implications for the future of blockchain technology.
Ethereum (ETH) is a popular Layer-1 blockchain platform that has been used to create decentralized applications (dApps) and smart contracts. Ethereum 2.0, or Serenity, is a significant update to the network that intends to address numerous issues with scalability, security, and energy efficiency. The Proof-of-Stake (PoS) consensus method will replace the Proof-of-Work (PoW) mechanism, which is one of the major new features of Ethereum 2.0. Given that PoS doesn’t require miners to do intensive mathematical calculations in order to validate transactions, it has the potential to be more energy-efficient than PoW. Additionally, this Ethereum upgrade will also be more secure due to the introduction of a new mechanism called “Casper” that will ensure that validators are always in agreement on the state of the blockchain. The paper begins by discussing the current issues facing Ethereum, including the limitations of the Proof of Work (PoW) consensus mechanism and the need for more efficient and scalable solutions. In this study, we peered at the major changes introduced by Ethereum 2.0, such as the new consensus method (Proof-of-Stake) and the addition of shard chains (Ethereum 2.0), as well as the associated development timelines, benefits and the community criticism on this upgrade.