Currently, many companies and institutions use centralized or distributed databases to store massive amounts of data. However, the use of untrusted centralized third-party auditors can result in security issues because these auditors may be malicious and tamper with or delete user data. This poses a significant challenge for ensuring the reliability of the data verification results. Although introducing a third-party auditor can help address this issue, it may also be untrustworthy and collude with the database service provider to forge false data verification results. In this study, we propose a data integrity verification scheme using smart contracts (DIV-SC) to address this challenge in a centralized database environment. Our approach utilizes blockchain technology as a decentralized third-party auditor, ensuring that the information stored on the blockchain is immutable and cannot be tampered with maliciously. In addition, smart contracts deployed on the blockchain can ensure that the verification procedures are correct and are not affected by any malicious party. We also leverage game theory to improve the reliability of multiple verifications, reduce verification time and improve overall performance. Our proposed scheme reduces the total verification time consumption by up to 53.44% while increasing the number of verifiable times by nearly 3.8 times, compared to conventional data integrity verification schemes.
We present a general purpose, privacy-preserving framework for verifying user attributes. The framework is designed for users (e.g., a job candidate) to allow a challenger (e.g., a prospective employer) to verify whether the usermeets a particular requirement (e.g., does the candidate hold a valid driving license?), without leaking any other information about the user. Importantly, the user is an active part of the challenge-verification process, which ensures that challenges cannot be made without the user’s full knowledge and participation. The framework is decentralized and requires a public blockchain. A smart contract is used to manage the challenge-verification process, and zero-knowledge proofs are used to verify challenges in a privacy-preserving manner. We implement a simplified version of the framework using smart contracts deployed on the Ethereum blockchain, and we simulate some simple use cases. All simulation code is available open-source (https://github.com/lifeisbeer/BlockVerify).
Blockchains are a new approach to creating distributed networks that were first introduced in 2008. It allows the formation of peer-to-peer networks based on consensus, forming chains from accepted blocks without requiring a central authority or centralized controller. A prominent application of this technology is its use in decentralized storage systems. Individuals in decentralized storage networks rent unused hardware storage space to other individuals. A decentralized network utilizing end-to-end encryption eliminates the risk of data loss associated with centralized data control by enabling clients to transmit their files securely. The storage providers must prove that they have kept unaltered files in this network for this time. Many studies have been conducted in this specific domain, most targeting storage capacity and efficiency, but a security, integrity and privacy loophole need to be addressed. This paper presents an overview of blockchain-based storage systems and how they work, followed by a comparison with cloud-based storage networks and a survey of various decentralized storage networks like SIA, File coin, and Storj available on the market. Next, we discuss the advantages and disadvantages of blockchain-based storage. In our final discussion, we examine the security problems of decentralized storage networks and explore potential solutions and research directions for the future.
This paper delves into two legal models for zero-knowledge proof protocols in the context of the eIDAS 2.0 Regulation: a trust service or a software product. The ARIES: reliAble euRopean Identity EcoSystem EU project highlighted the need for a legal framework for stakeholders to accept proof of the existence of user data with legal certainty, while Hyperledger Indy shows that ZKP solutions are currently commercialized, stressing deficiencies in the eIDAS 2.0. An overview of ZKP applied to identity, its relationship to the European Digital Identity Wallet and the electronic attestations of attributes, both introduced by the eIDAS 2.0, and Self-Sovereign Identity systems, leads to the central question of proof of the existence of user-held data as a trust service or as a software product and its data privacy implications for each approach. Finally, we outline a possible solution based on the product approach for future work. Our findings reveal that ZKP technology must have legal value and a presumption system to be effective. However, the path we take could lead us either to develop a system of surveillance and control in electronic environments or to build an environment where we share not the data itself but proof of its existence.
Consensus protocols are critical for any blockchain technology, and Proof-of- Stake (PoS) protocols have gained popularity due to their advantages over Proof-of- Work (PoW) protocols in terms of scalability and efficiency. However, existing PoS mechanisms, such as delegated and bonded PoS, suffer from security and usability issues. Pure PoS (PPoS) protocols provide a stronger decentralization and offer a potential solution to these problems. Algorand, a well-known cryptocurrency, employs a PPoS protocol that utilizes a new Byzantine Agreement (BA) mechanism for consensus and Verifiable Random Functions (VRFs) to securely scale the protocol to accommodate many participants, making it possible to handle a growing number of clients with ease. In this research, we explore, implement, and document all the essential steps of the algorithm for any given round that leads to publishing a block, and we evaluate the performance and stability of Algorand using various numbers of users, their stakes, and network settings. To simulate the protocol, we extend the Spar- tanGold blockchain framework, which currently uses a PoW protocol, and convert it into a PoS model. Our results show that the PPoS protocol developed by Algorand is highly scalable, achieving consensus quickly and efficiently, even in the presence of malicious users or network partitions and offers higher security and Byzantine fault tolerance compared to traditional PoW and other PoS-based protocols.
Zero-Knowledge Proof (ZKP) is a useful tools for proving that a prover possesses a secret without revealing it to the verifier. Designated Verifier Proof (DVP) is a special type of ZKP that adds the ability to restrict the identity of verifiers so that only pre-determined authorized verifiers can verify. However, DVP and other similar schemes do not work if the verifier provides some additional information to indicate the provenance of the proof. Since this information may be stored on the blockchain, the proof can be accepted by third parties even if the verifier is willing to protect the privacy of the prover. In this paper, we propose the concept of Blockchain Designated Verifier Proof (BDVP), and design a BDVP scheme suitable for blockchain applications. The key technique behind our BDVP scheme is that the verifier can forge a fake secret to simulate the proof. Therefore, a third party cannot determine whether the prover possesses the secret. This enables the verifier to protect the privacy of the prover, which is required by law or regulation. We also address the quantum attack problem and propose a post-quantum solution. We evaluate and compare the performances of the proposed protocol with other related protocols.
Cryptography is one of the most important approaches to keep digital communication in lock and key and therefore guarantees the privacy, integrity and authenticity of the data by means of complex coding. Cryptographic techniques have arisen centuries ago and the old techniques have continued to evolve as today’s challenges are cloud computing, data storage and retrieval as well as authenticated users. With the widespread spread of cloud environments, trust-enabling systems with cutting-edge technologies such as Zero Knowledge Proofs and blockchain emerged to increase privacy and security. By examining the notion of trust localization, this study draws attention to a use of Gateways as access control points to sensitive information reducing the dependence on the central cloud infrastructures. Additionally, source authentication and authorization provided by Acaras and PKI is studied regarding their integration and effectiveness. The research examines the current challenges in cryptographic security and current findings of cryptographic security and investigates what the future of cryptographic security to build trust and security in modern digital systems..
As more and more data is produced, finding a secure and efficient data access structure has become a major research issue. The centralized systems used by medical institutions for the management and transfer of Electronic Medical Records (EMRs) can be vulnerable to security and privacy threats, often lack interoperability, and give patients limited or no access to their own EMRs. In this paper, we first propose a privilege-based data access structure and incorporates it into an attribute-based encryption mechanism to handle the management and sharing of big data sets. Our proposed privilege-based data access structure makes managing healthcare records using mobile healthcare devices efficient and feasible for large numbers of users. We then propose a novel distributed multilevel EMR (d-EMR) management scheme, which uses blockchain to address security concerns and enables selective sharing of medical records among staff members that belong to different levels of a hierarchical institution. We deploy smart contracts on Ethereum blockchain and utilize a distributed storage system to alleviate the dependence on the record-generating institutions to manage and share patient records. To preserve privacy of patient records, our smart contract is designed to allow patients to verify attributes prior to granting access rights. We provide extensive security, privacy, and evaluation analyses to show that our proposed scheme is both efficient and practical.
Blockchain (BC) has recently paved the way for developing Decentralized Identity Management (IdM) systems for different information systems. Researchers widely use it to develop decentralized IdM systems for the Health Internet of Things (HIoT). HIoT is considered a vulnerable system that produces and processes sensitive data. BC-based IdM systems have the potential to be more secure and privacy-aware than centralized IdM systems. However, many studies have shown potential security risks to using BC. A Systematic Literature Review (SLR) conducted by the authors on BC-based IdM systems in HIoT systems showed a lack of comprehensive security and risk management frameworks for BC-based IdM systems in HIoT. Conducting a further SLR focusing on risk management and supplemented by Grey Literature (GL), in this paper, a security taxonomy, security framework, and cybersecurity risk management framework for the HIoT BC-IdM systems are identified and proposed. The cybersecurity risk management framework will significantly assist developers, researchers, and organizations in developing a secure BC-based IdM to ensure HIoT users' data privacy and security.
William Hughes, Tobias Magnusson, Alejandro Russo, Gerardo Schneider
Smart contracts are self-executing programs running in the blockchain allowing for decentralised storage and execution without a middleman. On-chain execution is expensive, with miners charging fees for distributed execution according to a cost model defined in the protocol. In particular, transactions have a high fixed cost. We present MultiCall, a transaction-batching interpreter for Ethereum that reduces the cost of smart contract executions by gathering multiple users’ transactions into a batch. Our current implementation of MultiCall includes the following features: the ability to emulate Ethereum calls and create transactions, both from MultiCall itself and using an identity unique to the user; the ability to cheaply pay Ether to other MultiCall users; and the ability to authorise emulated transactions on behalf of multiple users in a single transaction using hash-based authorisation rather than more expensive signatures. This improves upon a previous version of MultiCall. Our experiments show that MultiCall provides a saving between 57% and 99% of the fixed transaction cost compared with the standard approach of sending Ethereum transactions directly. Besides, we also show how to prevent an economic attack exploiting the metatransaction feature, describe a generic protocol for hash-based authorisation of metatransactions, and analyse how to minimise its off-chain computational and storage cost.
Diego F. Aranha, Youssef El Housni, Aurore Guillevic
Elliptic curves have become key ingredients for instantiating zero-knowledge proofs and more generally proof systems. Recently, there have been many tailored constructions of these curves that aim at efficiently implementing different kinds of proof systems. In this survey we provide the reader with a comprehensive overview on existing work and revisit the contributions in terms of efficiency and security. We present an overview at three stages of the process: curves to instantiate a SNARK, curves to instantiate a recursive SNARK, and also curves to express an elliptic-curve related statement. We provide new constructions of curves for SNARKs and generalize the state-of-the-art constructions for recursive SNARKs. We also exhaustively document the existing work and open-source implementations.
Decentralized Storage Networks (DSNs) can gather storage resources from mutually untrusted providers and form worldwide decentralized file systems. Compared to traditional storage networks, DSNs are built on top of blockchains, which can incentivize service providers and ensure strong security. However, existing DSNs face two major challenges. First, deduplication can only be achieved at the directory-level. Missing file-level deduplication leads to unavoidable extra storage and bandwidth cost. Second, current DSNs realize file indexing by storing extra metadata while blockchain ledgers are not fully exploited. To overcome these problems, we propose FileDAG, a DSN built on DAG-based blockchain to support file-level deduplication in storing multi-versioned files. When updating files, we adopt an increment generation method to calculate and store only the increments instead of the entire updated files. Besides, we introduce a two-layer DAG-based blockchain ledger, by which FileDAG can provide flexible and storage-saving file indexing by directly using the blockchain database without incurring extra storage overhead. We implement FileDAG and evaluate its performance with extensive experiments. The results demonstrate that FileDAG outperforms the state-of-the-art industrial DSNs considering storage cost and latency.
The Ethereum blockchain’s smart contract is a programmable transaction that performs general-purpose computations and can be executed automatically on the blockchain. Leveraging this component, blockchain technology (BT) has grown beyond the scope of cryptocurrencies and can now be applicable in various industries other than finance. In this paper, we investigated the current trends in Ethereum-based decentralized applications (DApps) to be able to categorize and analyze the DApps to measure the complexity of smart contracts behind them, their level of security and their correlation to the maintainability of the DApps. We leveraged the source code analysis, security analysis, and the developmental metadata of the DApps to infer this correlation. Based on our findings, we concluded that the maintainability of Ethereum DApps is proportional to the code size, number of functions, and, most importantly, the number of outgoing invocations and statements in the smart contracts.
An optimistic rollup (ORU) scales a blockchain's throughput by delegating computation to an untrusted remote chain (L2), refereeing any state claim disagreements between mutually distrusting L2 operators via an interactive dispute resolution protocol. State-of-the-art ORUs employ a monolithic dispute resolution protocol that tightly couples an L1 referee with a specific L2 client binary--oblivious to the system's higher-level semantics. We argue that this approach (1) magnifies monoculture failure risk, by precluding trust-minimized and permissionless participation using operator-chosen client software; (2) leads to an unnecessarily large and difficult-to-audit TCB; and, (3) suffers from a frequently-triggered, yet opaque upgrade process--both further increasing auditing overhead, and broadening the governance attack surface. To address these concerns, we outline a methodology for designing a secure and resilient ORU with a minimal TCB, by facilitating opportunistic 1-of-N-version programming. Due to its unique challenges and opportunities, we ground this work concretely in the context of the Ethereum ecosystem--where ORUs have gained significant traction. Specifically, we design a semantically-aware proof system, natively targeting the EVM and its instruction set. We present an implementation in a new ORU, Specular, that opportunistically leverages Ethereum's existing client diversity with minimal source modification, demonstrating our approach's feasibility.
Current consensus protocols for permissionless blockchain cannot balance security, performance and centralization issues. In the paper, we present a reputation based consensus, FPoR, which combines reputation, committee based consensus, PBFT, reward and penalization mechanisms. FPoR can balance scalability, security and decentralization, and promote fairness, increase participation and strengthen security. Experiment results show that FPoR is with high performance and scalability, which can be used for permissionless blockchain. FPoR can also be extended to permissioned blockchain applications.
In recent years, many frameworks and applications have been proposed to ensure tamper resistant data in supply chain using Block chain technologies. Block chain technology as a base design ensures that the content of the information is ‘tamper-resistant’. So far, no other study was presented with a low impact on the environment and minimum cost for each transaction sent by the supply chain. In order to protect the access of malicious user, we tend to propose an immutable data storage environment that is based on Algorand Blockchain. It uses the Pure Proof-of-Stake mechanism of consensus that needs less computational power, and is highly scalable and environmentally sustainable. It will make the data immutable and available in real-time for final consumers. Hence it can tolerate malicious users and achieving consensus without a central authority.
There is rising global demand for the deployment of a central bank digital currency (CBDC) system to achieve financial stability. However, striking a balance between privacy, transparency, and auditability in such a system is technically difficult. We propose a CBDC system based on a consortium blockchain that adopts a privacy-preserving, transparent unspent transaction output (UTXO) model. The proposed system satisfies the travel rule of payment, unlike existing cryptocurrencies. Unlike the conventional UTXO approach, users use wallet-linked addresses for transactions rather than their actual wallet addresses. Each transacting address is generated using two keys: a random private key computed by the sender and the recipient's public key. The final private key is known only to the recipient, and it is required to spend the UTXO received using the address. Thus, each user holds only a single authorized public key and address, which eases regulatory compliance in the network without compromising anonymity and privacy. To manage the blockchain, the central bank and several certificate authorities execute the energy-efficient Clique consensus algorithm. Only the central bank supplies money to the network. A prototype of the system was implemented using Python-Flask, and it outperformed the state-of-the-art systems by providing a smaller transaction size (665 B) and lower verification time (9 ms).
<p>Cloud storage provides convenience in managing data for users. Data integrity becomes important because data owner (DO) loses control of their data once it is uploaded to the cloud server (CS). Public auditing is used to check data integrity in cloud storage. Traditional public auditing schemes introduce a third-party auditor (TPA) to help users check their data. However, TPA is assumed to be trusted in these schemes, which may not be practical. A dishonest TPA may provide a good report to DO without executing the auditing task timely. If the data loss could not be detected timely, it may cause a great loss to DO. In this paper we aim to solve these problems using blockchain technique. In our scheme DO, TPA and CS interact with blockchain via smart contracts. We utilize a time-locked deposit smart contract to incentive TPA and CS for their fulfillment in the auditing task honestly. Otherwise, they would be amerced. We use storage smart contracts to ensure the auditing process transparency, and utilize zero-knowledge proof to protect DO&rsquo;s privacy. The scheme is extended to support batch auditing to reduce the user&rsquo;s cost. Experimental results show that our scheme is efficient and practical.</p> <p>&nbsp;</p>
Stefan More, Sebastian Ramacher, Lukas Alber, Marco Herzl
Authentication, authorization, and trust verification are central parts of an access control system. The conditions for granting access in such a system are collected in access policies. Since access conditions are often complex, dedicated languages -- policy languages -- for defining policies are in use. However, current policy languages are unable to express such conditions having privacy of users in mind. With privacy-preserving technologies, users are enabled to prove information to the access system without revealing it. In this work, we present a generic design for supporting privacy-preserving technologies in policy languages. Our design prevents unnecessary disclosure of sensitive information while still allowing the formulation of expressive rules for access control. For that we make use of zero-knowledge proofs (NIZKs). We demonstrate our design by applying it to the TPL policy language, while using SNARKs. Also, we evaluate the resulting ZK-TPL language and its associated toolchain. Our evaluation shows that for regular-sized credentials communication and verification overhead is negligible.
Today, the global economy is dependent on the Internet and computational resources. Although they are tightly interconnected, it is difficult to evaluate their degree of interdependence. Keeping up with the pace of technology can be a challenging task, mainly when updating the hardware and software infrastructure. Every day, corporations and governments are faced with this issue; most have been victims of cyber attacks, security breaches, and data leaks. The consequences are significant in monetary losses; damage remediation is unattainable, even impossible, in certain circumstances. The repercussions might include reputational damage, legal responsibility, and threats to national security (when attacks are carried out against critical infrastructures to control the resources of a country), to name a few. Similarly, data has become such an integral part of many industries that it is one of the most critical targets for attackers that often is encrypted by ransomware, stolen, or corrupted. Without data, many companies are not able to continue operating as they do. The combination of all these factors complicates the ability of organizations to cooperate, trust, and share information in efforts to research and develop solutions for industry and government.This work proposes a Blockchain-based infrastructure solution provided by “Hyperledger Fabric” technology for companies to securely transmit and share information using the latest encryption and data storage technologies operating on the model of distributed systems and smart contracts. By presenting unique digital assets as Non-Fungible Tokens (NFT), the infrastructure is able to trust the integrity of the data, while protecting it from counterfeiting. Through the use of a Blockchain-based file storage system known as IPFS, and by connecting all the relevant elements together through a web-based application, it is possible to demonstrate that the implementation of such systems is feasible, highly scalable and a useful tool that many organizations can utilize to create new work systems and worktflows for digital asset management.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
With the advancement in computing power and speed, the Internet is being transformed from screen-based information to immersive and extremely low latency communication environments in web 3.0 and the Metaverse. With the emergence of the Metaverse technology, more stringent demands are required in terms of connectivity such as secure access and data privacy. Future technologies such as 6G, Blockchain, and Artificial Intelligence (AI) can mitigate some of these challenges. The Metaverse is now on the verge where security and privacy concerns are crucial for the successful adaptation of such disruptive technology. The Metaverse and web 3.0 are to be decentralized, anonymous, and interoperable. Metaverse is the virtual world of Digital Twins and non-fungible tokens (NFTs). The control and possession of users' data on centralized servers are the cause of numerous security and privacy concerns. This paper proposes a solution for the security and interoperability challenges using Self-Sovereign Identity (SSI) integrated with blockchain. The philosophy of Self-Sovereign Identity, where the users are the only holders and owners of their identity, comes in handy to solve the questions of decentralization, trust, and interoperability in the Metaverse. This work also discusses the vision of a single, open standard, trustworthy, and interoperable Metaverse with initial design and implementation of SSI concepts.
Miguel Pincheira, Elena Donini, Massimo Vecchio, Salil S. Kanhere
The data economy is based on data and information sharing and tremendously impacts society as it facilitates innovative collaborations and decision-making strategies. Nonetheless, most dataset-sharing solutions rely on a centralized authority that rules data ownership, availability, and accessibility. Recent works have explored the integration of distributed storage and blockchain to enhance decentralization, data access, and smart contracts for automating the interactions between actors and data. However, current solutions propose a smart contract design limiting the system's scalability in terms of actors and shared datasets. Furthermore, little is known about the performance of these architectures when using distributed storage instead of centralized storage approaches. This paper proposes a scalable architecture called DeBlock for data sharing in a trusted way among unreliable actors. The architecture integrates a public blockchain that provides a transparent record of datasets and interactions, with a distributed storage for data storage in a completely decentralized way. Furthermore, the architecture provides a smart-contract design for a transparent catalog of datasets, actors, and interactions with efficient search and retrieval capabilities. To assess the system's feasibility, robustness, and scalability, we implement a prototype using the Ethereum blockchain and leveraging two decentralized storage protocols, Swarm and IPFS. We evaluate the performance of our proposed system in different scenarios (e.g., varying the amount and size of the shared datasets). Our results demonstrate that our proposal outperforms benchmarks in gas consumption, latency, and resource requirements, especially when increasing the number of actors and shared datasets.