The cloud computing technology has emerged, developed, and matured in recent years, consequently commercializing remote outsourcing storage services. An increasing number of companies and individuals have chosen the cloud to store their data. However, accidents, such as cloud server downtime, cloud data loss, and accidental deletion, are serious issues for some applications that need to run around the clock. For some mission and business-critical applications, the continuous availability of outsourcing storage services is also necessary to protect users' outsourced data during downtime. Nevertheless, ensuring the continuous availability of data in public cloud data integrity auditing protocols leads to data privacy issues because auditors can obtain the data content of users by a sufficient number of storage proofs. Therefore, protecting data privacy is a burning issue. In addition, existing data integrity auditing schemes that rely on semi-trusted third-party auditors have several security problems, including single points of failure and performance bottlenecks. To deal with these issues, we propose herein a blockchain-based continuous data integrity checking protocol with zero-knowledge privacy protection. We realize a concrete construction by using a verifiable delay function with high efficiency and proof of retrievability, and prove the security of the proposal in a random oracle model. The proposed construction supports dynamic updates for the outsourced data. We also design smart contracts to ensure fairness among the parties involved. Finally, we implement the protocols, and the experimental results demonstrate the efficiency of the proposed protocol.
Tanusree Sharma, Zhixuan Zhou, Andrew Miller, Yan Wang
Smart contracts are self-executing programs that run on blockchains (e.g., Ethereum). 680 million US dollars worth of digital assets controlled by smart contracts have been hacked or stolen due to various security vulnerabilities in 2021. Although security is a fundamental concern for smart contracts, it is unclear how smart contract developers approach security. To help fill this research gap, we conducted an exploratory qualitative study consisting of a semi-structured interview and a code review task with 29 smart contract developers with diverse backgrounds, including 10 early stage (less than one year of experience) and 19 experienced (2-5 years of experience) smart contract developers. Our findings show a wide range of smart contract security perceptions and practices including various tools and resources they used. Our early-stage developer participants had a much lower success rate (15%) of identifying security vulnerabilities in the code review task than their experienced counterparts (55%). Our hierarchical task analysis of their code reviews implies that just by accessing standard documentation, reference implementations and security tools is not sufficient. Many developers checked those materials or used a security tool but still failed to identify the security issues. In addition, several participants pointed out shortcomings of current smart contract security tooling such as its usability. We discuss how future education and tools could better support developers in ensuring smart contract security.
The publicly accessible feature of edge servers leads to the threat of malicious access to the data stored on the server and a series of security problems such as the leakage of user data privacy and the destruction of integrity. Data custody causes the separation of user ownership and management rights and brings potential security risks of data theft and destruction. Among them, for the integrity of the data uploaded by the terminal, the current protection mechanism mostly verifies the identity of the visitor or encrypts the data, but the role of verification is mostly assumed by the server, and it is impossible to avoid the collusion of edge servers with malicious intruders. In this paper, a distributed virtual machine agent (VMA) is designed and implemented, an edge cloud data integrity monitoring framework is built, and the verification protocol based on blockchain is proposed, which achieves trusted verification without relying on a trusted third party. Also, a prototype system of edge cloud data integrity protection based on blockchain is constructed to prevent data corruption. The results of security proof and experimental verification show that the mechanism based on blockchain technology can defend against three attacks of cloud service providers, has superior computation, and reduces the storage costs to protect the integrity of user data.
Storage is a promising application for permission-less blockchains. Before blockchain, cloud storage was hosted by a trusted service provider. The centralized system controls the permission of the data access. In web3, users own their data. Data must be encrypted in a permission-less decentralized storage network, and the permission control should be pure cryptographic. Proxy re-encryption (PRE) is ideal for cryptographic access control, which allows a proxy to transfer Alice’s ciphertext to Bob with Alice’s authorization. The encrypted data are stored in several copies for redundancy in a permission-less decentralized storage network. The redundancy suffers from the outsourcing attack. The malicious resource provider may fetch the content from others and respond to the verifiers. This harms data integrity security. Thus, proof-of-replication (PoRep) must be applied to convince the user that the storage provider is using dedicated storage. PoRep is an expensive operation that encodes the original content into a replication. Existing PRE schemes cannot satisfy PoRep, as the cryptographic permission granting generates an extra ciphertext. A new ciphertext would result in several expensive replication operations. We searched most of the PRE schemes for the combination of the cryptographic methods to avoid transforming the ciphertext. Therefore, we propose a new PRE scheme. The proposed scheme does not require the proxy to transfer the ciphertext into a new one. It reduces the computation and operation time when allowing a new user to access a file. Furthermore, the PRE scheme is CCA (chosen-ciphertext attack) security and only needs one key pair.
Mahmood K. Mohammed, Alharith A. Abdullah, Zaid A. Abod
In general, health records include important information like the patient’s history, findings of examinations and assessments, diagnosis reports, documentation of consent, and treatment plans. Sharing this information has grown to be a challenge concerning data security, as it could result in compromising patient privacy. Therefore, the patient's information should not be misused or tampered with. In this paper, a full process of storing and retrieving medical records is proposed using a decentralized system through the integration of two emerging technologies: Blockchain and Inter-Planetary File System (IPFS). The system provides solutions for the major security concerns associated with medical files, including authentication and authorization, database breaches, data integrity of local and cloud storage, and data availability. The obtained results indicate a high level of safety by adding security layers such as confidentiality, authentication, authorization and access control, based on different factors. All these aspects contribute to reaching the aim of the proposed system, which is storing and retrieving medical records in a decentralized and safe manner.
The lack of data outsourcing in healthcare management systems slows down the intercommunication and information sharing between different entities. A standard solution is outsourcing the electronic health record (EHR) to a cloud service provider (CSP). The outsourcing of the EHR should be performed securely without compromising the CSP functionalities. Searchable encryption would be a viable approach to ensure the confidentiality of the data without compromising searchability and accessibility. However, most existing searchable encryption solutions use centralised architecture. These systems have trust issues as not all the CSPs are fully trusted or honest. To address these problems, we explore blockchain technology with smart contract applications to construct a decentralised system with auditable yet immutable data storage and access. First, we propose a blockchain-based searchable encryption scheme for EHR storage and updates in a decentralised fashion. The proposed scheme supports confidentiality of the outsourced EHR, keyword search functionalities, verifiability of the user and the server, storage immutability, and dynamic updates of EHRs. Next, we implement a prototype using JavaScript and Solidity on the Ethereum platform to demonstrate the practicality of the proposed solution. Finally, we compare the performance and security of the proposed scheme against existing solutions. The result indicates that the proposed scheme is practical while providing the desired security features and functional requirements.
With the explosive growth of data, cloud storage has become a widely used storage method. To protect the integrity and availability of data in cloud storage systems, multireplica provable data possession has gradually become a research hotspot. This paper uses smart contracts to replace traditional third-party auditor (TPA) and proposes a noninteractive multireplica provable data possession scheme based on smart contracts, making the verification process public, immutable, traceable, and able to be carried out periodically and automatically. This paper introduces the concept of noninteractivity to reduce the transaction fees caused by the frequent operation of blockchain in the verification process. By stipulating payment rules in the smart contract, we can ensure the fairness of all parties. Finally, we give the correctness proof of the scheme and the security proof in the random oracle model, comparing it with other schemes and verifying the practicability of our scheme through experiments.
Jien Song, Yang Yang, Jie Mei, Gaofeng Zhou · 12 authors
The need to accelerate the innovation and application of the supply chain has been suggested by the State Council of China. To solve the problem of data isolation caused by privacy protection in the power material supply chain, a data traceability and sharing mechanism based on blockchain is designed in this paper. Firstly, the existing problems of the power material supply chain are introduced, and the applicability of blockchain in the power material supply chain in view of these problems is analyzed. Secondly, blockchain-based power material supply deployment and application structures are proposed. Then, considering the problem of data isolation in the material inspection and distribution links between suppliers and the material company, a data traceability mechanism based on blockchain is designed to provide evidence for the data authenticity and a proxy re-encryption method is used to ensure security and privacy in data sharing. Finally, the effectiveness of the proposed data traceability and sharing mechanism is verified using the Hyperledger Fabric platform for power material case studies. The simulation results show that the combination of proxy re-encryption and blockchain technology in the power material supply chain can confirm the validity of the historical data and keep the private data of the material company confidential, so as to realize the traceability and sharing of the power material supply data.
The digital ecosystems have experienced a paradigm shift as there is a growing level of integration of Artificial Intelligence (AI), distributed computing apparatus, and robotic policy enforcement strategies. Governance structures are faced with the difficult task of negotiating the vagaries of privacy laws and decentralized data processing and the use of algorithmic decision-making with the migration of data-intensive applications to web-based environments. The increasing regulatory environment, such as GDPR, CCPA, and industry-specific data protection requirements, have significant forces on the requirement to have strong policy-driven governance infrastructures that entrench privacy and security at every layer of the web application stack. Although cloud platforms and microservice architectures have been developed, modern governance solutions have weaknesses in terms of scalability, being context-aware and dynamically adapting to changes in policy constraints. The research paper presents the AI-Enabled Policy-Driven Web Governance Framework that has been developed on the Full-Stack Java ecosystem which involves spring boot, Jakarta EE, containerized deployment platforms and intelligent agents which are rule-based. The framework incorporates machine learning-related policy interpretation, semantic arguments engines, as well as automated monitoring applications that regulate user interactions, data activities, service coordination, and cross-layer correspondence. AI agents will adapt legal and organizational privacy requirements into dynamic policies that are explicitly and dynamically implemented in real-time at the front-end, API, middleware, and database tiers. These challenges in digital governance that are solved are minimization of data, contextual privacy, verification of compliance, detection of anomalies, and fine-grained access control. The given architecture proposes a Multi-Layer Governance Orchestration Model (MGOM) that divides the governance issues into policy ingestion, AI interpretation, runtime enforcement, auditability, and compliance reporting. The framework also includes three levels of privacy shield with a static code analysis, user behavior analytics (UBA), and encrypted data pipelines. Through an extensive assessment analysis, it is evident that the framework has the ability to be highly precise in automated policy enforcement, decreases the latency of governance and enhances consistency of compliance over the traditional rule-based systems. The findings of the experiments point out that AI-enabled governance engine helps to improve the accuracy of policy compliance by 27.8 percent, minimize privacy invasions by 42.1 percent, and decrease administrative workload by 34.6 percent. A combination of a supervised learning, the natural language processing (NLP) and the symbolic rule mining allow the system to be autonomously adapted to new regulatory conditions without being reconfigured by human operators. Security benchmarks also indicate resiliency to partial attack vectors, such as inference attacks, unauthorized data elevation, and access patterns analysis. The paper will add value to the digital governance field by offering a holistic, scalable, and future-proof implementation that can assist with current web environments of many services including medicine, finance, online commerce, and smarter cities. The framework ensures the creation of a novel model of transparent, compliant, and privacy-conscious digital ecosystems by entrenching AI at the core of policy interpretation and enforcement. The publication contributes to the discussion of intelligent governance systems and offers a reference design to the developers, policymakers, and researchers, who seek to develop trustful and ethically aligned digital spaces
The journey towards Industry 4.0 have driven the workforce with the need for continuous competency development to stay on top of their profession and remain attractive to their employers. In this context, E-Portfolio has been conceived as a promising tool for both professionals and employers, in assessing and providing guidance for further workplace learning. Nevertheless, the challenges in implementing E-Portfolio are daunting, particularly with regard to lack of interoperability while collecting and sharing the competency evidences across multiple organizations and institutions. The increasing move towards professional (learner)-centered interoperability poses additional challenges that needs to be addressed to realize the full potential of E-Portfolio in the context of Industry 4.0. This work puts emphasize on realization of professional-centered interoperability and proposes a framework leveraging the advantage of blockchain, decentralized storage system interplanetary file system, smart contract and session management for E-Portfolio creation and sharing evidences across multiple organizations without comprising the confidentiality, integrity and availability of the shared evidences. The proof of concept simulation on Ethereum official test network Rinkeby demonstrates the feasibility of proposed framework in practice. In addition, the evaluation of the proposed framework demonstrates its effectiveness from the aspects of cost and security as a potential solution for implementing E-Portfolio and helping the professional to remain competitive in global labor market.
Dan Bogdanov, Joosep Jääger, Peeter Laud, Härmel Nestra · 10 authors
We present ZK-SECREC, a domain-specific language for zero-knowledge (ZK) proofs. We focus on its type system, making the point that this is the most appropriate mechanism for tracking information flows in a statement that is meant to be proved using a zero-knowledge protocol. The appropriateness stems from the necessary distinctions between the two involved parties and between the computations made locally or on top of the protocol. The appropriateness also stems from how the types match with the major steps of typical ZK protocols, including the generation of Common Reference Strings. We compare the type system of ZK-SECREC with those of the previously proposed languages for ZK proofs and privacy-preserving computations, and show how ZK-SECREC handles certain aspects better.
<strong>Abstract: </strong><em>Strategic management is an important part of an entity’s resources to achieve its goals. Involving the manager and the management team, knowing the context in which they act, setting goals, identifying trends in the field of activity, technological upgrade, identifying directions of action, global policies in the area, legislation and alignment with the online environment, make the organization’s target easier to reach. This study is a review of the literature and articles, to help managers have a complete picture and to be a potential tool to help make decisions in the use or acceptance of cryptocurrencies. The world of cryptocurrencies is developing at a dizzying pace and it is imperative to ask ourselves if it can be a viable alternative to the classic payment methods for Romanian companies as well.</em> <strong>Keywords:<em> </em></strong><em>cryptocurrencies, strategic management, blockchain, management strategies</em> <strong>JEL Classification:</strong><em> G23, G24, G28</em>
The data outsourcing services provided by cloud storage have greatly reduced the headache of data management for users, but the issue of remote data integrity poses further security concerns and computing burdens. The introduction of a third-party auditor (TPA) frees data owners from the auditing burden and alleviates disputes over the audit results between data owners and cloud storage providers. However, malicious cloud servers may collude with TPAs to deceive users for financial profits. Hiring multiple auditors in a single audit assignment appears to be a method to address the above problem, but the ensuing voting issues need to be further explored. In this paper, we proposed a smart contract-based outsourced data integrity auditing scheme for multiauditor scenarios. Unlike some existing schemes using reputation like factors as their voting weights, auditors in our scheme vote equally and audit as they go, without any maintenance. This mechanism not only frees auditors from trivia not related to the auditing but also avoids the drawbacks of centralization associated with over-high voting weights. The challenge used to check the integrity of the outsourced data is jointly generated by each involved auditor. Any collusion would be detected as long as there exists more than one honest auditor in the audit. We implement and deploy the scheme as Ethereum smart contracts. With the help of blockchain, the entire auditing process is public and transparent. Both the generated data and the obtained results are persisted with immutability, which ensures the traceability of all historical audits. The comprehensive theoretical and experimental analyses demonstrate that our scheme meets the claimed targets with high efficiency and low gas costs.
Digital document communication between an enterprise and a customer is becoming a primary form of communication rather than the traditional physical document communication. A PDF document, the most popular document format, provides an identical document layout regardless of OS or device and has a content integrity verification feature with a digital signature. However, it has a bad user experience, such as low readability on a mobile device. On the other hand, an HTML document has a weakness in verifying the content integrity even though it is the primary document format and provides a good user experience on mobile devices. There are certified document services using blockchain technology, but it is still vulnerable to verifying content integrity. Furthermore, research on the document HTML has proposed the trusted document generation technique by HTML conformance and digital signature; however, this research does not provide content delivery verification, and there is a file size overhead. In this paper, we have developed the chained document HTML by defining HTML conformance, digital signature, and blockchain technology. First, the chained document HTML has to embed all resources and does not allow loading content on-demand. Second, the file is signed by a digital signature, and the signature value is added in the file header. Lastly, the metadata to verify the content integrity is inserted in a blockchain node. We have created the chained document HTML generation and verification experiment environment by Ethereum and Python. We have confirmed that the chained document HTML provides content and delivery integrity verification in the research. We expect the chained document HTML will be widely used in document communication between an enterprise and a customer, especially if the document has sensitive personal information that might have a legal dispute.
As increasing clients tend to outsource massive multimedia data generated by Internet of Things (IoT) devices to the cloud, data auditing is becoming crucial, as it enables clients to verify the integrity of their outsourcing data. However, most existing data auditing schemes cannot guarantee 100% data integrity and cannot meet the security requirement of practical multimedia services. Moreover, the lack of fair arbitration leads to clients not receiving compensation in a timely manner when the outsourced data is corrupted by the cloud service provider (CSP). In this work, we propose an arbitrable data auditing scheme based on the blockchain. In our scheme, clients usually only need to conduct private audits, and public auditing by a smart contract is triggered only when verification fails in private auditing. This hybrid auditing design enables clients to save audit fees and receive compensation automatically and in a timely manner when the outsourced data are corrupted by the CSP. In addition, by applying the deterministic checking technique based on a bilinear map accumulator, our scheme can guarantee 100% data integrity. Furthermore, our scheme can prevent fraudulent claims when clients apply for compensation from the CSP. We analyze the security strengths and complete the prototype’s implementation. The experimental results show that our blockchain-based data auditing scheme is secure, efficient, and practical.
The Industrial Internet of Things (IIoT) plays an important role in Industry 4.0, but the existing IIoT systems could be vulnerable to a single point of failure and malicious attacks, failing to provide reliable services. IIoT devices have some particularities, such as mobility, limited performance, and distributed deployment, which are challenging to traditional centralized access control methods in the large-scale IIoT environment. To resolve the challenges, we propose an access control system for the Industrial Internet of Things. The system contains three smart contracts: device contract (DC), policy contract (PC), and access contract (AC). The device contract provides a method of storing the URL of the resource data generated by the equipment and a query method. The policy contract provides the function of managing the attribute-based access control (ABAC) of the administrator user. The access contract is the core program that implements the access control method for ordinary users. Combining ABAC and blockchain technology provides decentralized, fine-grained, and dynamic access control management for IIoT.
Tridip Bhowmik, Sagir Mahmud Sefat, Aysha Akmal, Md. Ismail Jabiullah
Cryptocurrency data communications are very demanding issues in current high-speed online currency transactions. Here, a key-based AES (Advanced Encryption Standard) encryption-decryption algorithm is used to impose more security levels on cryptocurrency data communications. For this, the sender first creates a key and sends it to the intended receiver through a secured and trusted channel. Then by that key one can easily encrypt the cryptocurrency data using the AES encryption algorithm and produced the ciphertext and then send it to the destination. On the receiver’s end, the decryption process of AES is performed by using the same shared secret key that retrieved the plaintext from the received ciphertext. The security of the proposed process depends on the shared secret key and the algorithm AES and it can be applied for any financial data transactions securely. This can be used in all kinds of cryptocurrency data communication with a higher level of security.
Seunghyeon Lee, Hong‐Woo Seok, Kirim Lee, Hoh Peter In
When surveying national reference points using a global positioning system (GPS), appropriate work regulations pertaining to the surveying time must be observed. However, such data can be modified easily, so identifying non-compliance with work regulations and forgeries is challenging. If such incidents occur in cadastral surveys, it may result in financial damages to stakeholders, such as citizens and the state. Therefore, it is necessary to improve the reliability by ensuring the integrity of the GPS positioning data and allowing anyone to track them. In this study, a prototype system was developed to record GPS data and the corrections generated during survey processes using the Ethereum blockchain network. Blockchain is a distributed ledger system that prevents the manipulation of uploaded data without the need for a centralized institution by allowing anyone to check the data. Unlike in the past, the proposed system improves the data integrity and reliability for the entire survey process through blockchain, thereby ensuring transparency of the checks using smart contract addresses.
Electronic Health Records (EHRs) are essential in contemporary healthcare as they facilitate the storage and sharing of personal patient data. Traditional cloud-based EHR systems, though, are afflicted with centralized control, privacy threats, restricted interoperability, and susceptibility to data breaches. To alleviate these challenges, this paper suggests a blockchain-based, patient-centered EHR management system that uses Ethereum smart contracts, Decentralized Identifiers (DIDs), and InterPlanetary File System (IPFS) for safe, distributed, and effective handling of health data.The system put forward puts patients at the forefront of EHR access and control, allowing them to grant or withdraw permissions to healthcare providers, insurers, or researchers using fine-grained, attribute-based policies executed through smart contracts. DIDs remove the need for third-party identity providers, providing secure and verifiable user authentication directly on the blockchain. IPFS, on the other hand, provides cost-effective, tamper-proof off-chain storage of medical records, with metadata and access logs stored on-chain to minimize gas usage.Extensive testing on the Ethereum Goerli testnet proves that the system provides greater security, lower storage costs, efficient access control, and better interoperability than conventional models. This method not only solves existing shortcomings in EHR systems but also opens the door to scalable, transparent, and patient-enabled healthcare data management.
The sharing of electronic healthcare records (EHRs) is important to healthcare and medical research. However, institutions are faced with difficulties in privacy protection and efficiently secure data exchange. The main objective of this study is to propose a controllable secure blockchain-based EHRs sharing scheme. For this purpose, blockchain technologies are combined with interplanetary file systems (IPFS) to provide efficient secure EHRs sharing. Firstly, the IPFS-based EHR file system (IEFS) is designed to save and share large-size EHR files among medical institutions. With the high-throughput content-addressed block storage model and appropriate redundant backup of IPFS, IEFS is tamper-resistant and free of a single point of failure. Secondly, the blockchain is used to implement the blockchain-based EHR abstract system (BEAS) to manipulate EHR abstracts access. In BEAS, the EHR file addresses generated by IEFS are encrypted and saved in EHR abstracts for privacy protection. Since EHR abstracts are encrypted by patients' public keys, the sharing of EHR files is under the control of patients. In our experiment, a prototype system is developed to validate the proposed scheme. The experimental results showed that (1) EHRs are securely shared under the control of patients and (2) EHR files are retrieved at an acceptable speed supported by IPFS technology. In this paper, solutions to some important practical issues such as incapacitated patients, encryption key forgetting/missing, and efficient interaction of doctors with EHRs sharing scheme are also seriously discussed.