Nowadays, academic certificates are still widely issued in paper format. Traditional certificate verification is a lengthy, manually intensive, and sometimes expensive process. In this paper, we propose a novel NFT-based certificate framework called NFTCert, which enables the establishment of links between a legitimate certificate and its owner through a Blockchain. In this paper, we describe the implementation of the NFTCert framework, including schema definition, minting, verification, and revocation of NFT-based certificates. We also introduce a payment gateway into the minting process, which enables NFTCert to be used by a wider audience. Therefore, participants of NFTCerts do not need to rely on cryptocurrency for transactions. All in all, the proposed framework is designed to achieve usability, authenticity, confidentiality, transparency, and availability properties when it is compared to existing Blockchain-based systems.
Cloud Infrastructure as a Service (IaaS) Service Level Agreements (SLAs) assessment constitutes the de facto area of interest and applications in the public cloud infrastructure. However, the domination of colossal corporations tends to monopolize the way metrics and Key Performance Indicators (KPIs) are measured and determined, leading to governed environments where the clientele is unable to obtain accurate and unbiased assessment of SLAs. Leaning toward SLA self-assessment, this paper provides a fair SLA consensus approach with innate transparency and privacy by leveraging permissioned blockchains that are equipped with Trusted Execution Environments (TEEs). The SLA assessment intelligence is performed inside enclaved smart contracts isolated from the on-chain entities views. The result constitutes a permissioned blockchain ecosystem where the IaaS and their clientele commonly agree on all the respective SLA monitoring and computation rules beforehand, as defined in any SLA assessment process, while the SLA consensus scheme constantly audits the SLA metrics based on these pre-approved regulations.
Audit logs are a critical component in today’s enterprise business systems as they provide several benefits such as records transparency and integrity and security of sensitive information by creating a layer of evidential support. However, current implementations are vulnerable to attacks on data integrity or availability. This paper presents a Blockchain-based audit trail mechanism that leverages the security features of Blockchain to enable secure and reliable audit trails and to address the aforementioned vulnerabilities. The architecture design and specific implementation are described in detail, resulting in a real prototype of a reliable, secure, and user-friendly audit trail mechanism.
Group signature can provide the privacy-preserving authentication mechanism for the blockchain. In the traditional blockchain privacy-preserving scheme based on the group signature, there is only one group manager to revoke the anonymity. Thus, the traditional scheme will have single point of failure and key escrow problems. To solve these problems, we propose a privacy-preserving scheme in the blockchain based on the group signature with multiple managers. Our scheme is constructed based on bilinear pairing and the technique of distributed key generation. Finally, we analyze the application of the proposed scheme in the field of blockchain-based provable data possession (PDP), as well as the correctness and security of the scheme.
Yage Cheng, Bei Gong, Zhijuan Jia, Yanyan Yang · 6 authors
In this article, we analysed the problems of electronic medical records (EMRs) and found that the EMRs generated by different hospitals for the same patient are mutually independent and duplication and data sharing are difficult among hospitals. In order to solve this problem, this paper proposes an efficient and secure cross-domain sharing scheme of EMRs based on edge computing. The program allows the doctor to access the personal history EMRs through the patient’s authorization so that the doctor can understand the patient’s history of illness and, on this basis, generate a new medical record for the patient. Then, the doctor sends the EMRs to the edge server, and the server calculates the ciphertext and adds it to the patient’s personal medical record to complete the case update. Analysis shows that this solution can effectively prevent data tampering and forgery through blockchain and avoid privacy leakage problems in plaintext sharing by using searchable encryption and by relying on edge servers to solve nearby computing tasks and divert the computing capacity of cloud servers to improve efficiency. The security proof shows that the scheme satisfies the complex problem of the BDH assumption. Performance analysis shows that the scheme is feasible and efficient.
Abdullah Ayub Khan, Asif Ali Laghari, Aftab Ahmed Shaikh, Sami Bourouis · 6 authors
Degree attestation verification and traceability are complex one-to-one processes between the Higher Education Commission (HEC) and universities. The procedure shifted to the digitalized manner, but still, on a certain note, manual authentication is required. In the initial process, the university verified the degree and stamp seal first. Then, a physical channel of degree submission to the receiving ends is activated. After that, the degree is attested while properly examining and analyzing the tamper records related to degree credentials through e-communication with the university for verification and validation. This issue poses a serious challenge to educational information integrity and privacy. Potentially, blockchain technology could become a standardized platform to perform tasks including issuing, verifying, auditing, and tracing immutable records, which would enable the HEC, universities, and Federal Education Ministry (FEM) to quickly and easily get attested and investigate the forge proof versions of certificates. Besides, decentralized distributed data blocks in chronological order provide high security between distributed ledgers, consensus engine, digital signature, smart contracts, permissioned application, and private network node transactions that guarantee degree record validation and traceability. This paper presents an architecture (HEDU-Ledger) and detail design of blockchain-enabled hyperledger fabric applications implementation for degree attestation verification and traceable direct channel design between HEC and universities. The hyperledger fabric endorses attestation records first, and then validates (committer) the degree and maintains the secure chain of tracing between stakeholder peer nodes. Furthermore, this HEDU-Ledger architecture avoids language and administrative barriers. It also provides robustness in terms of security and privacy of records and maintains integrity with secure preservation as compared to that of the other state-of-the-art methods.
Gang Xu, Yibo Cao, Shiyuan Xu, Ke Xiao · 7 authors
In recent decades, log system management has been widely studied for data security management. System abnormalities or illegal operations can be found in time by analyzing the log and provide evidence for intrusions. In order to ensure the integrity of the log in the current system, many researchers have designed it based on blockchain. However, the emerging blockchain is facing significant security challenges with the increment of quantum computers. An attacker equipped with a quantum computer can extract the user's private key from the public key to generate a forged signature, destroy the structure of the blockchain, and threaten the security of the log system. Thus, blind signature on the lattice in post-quantum blockchain brings new security features for log systems. In our paper, to address these, firstly, we propose a novel log system based on post-quantum blockchain that can resist quantum computing attacks. Secondly, we utilize a post-quantum blind signature on the lattice to ensure both security and blindness of log system, which makes the privacy of log information to a large extent. Lastly, we enhance the security level of lattice-based blind signature under the random oracle model, and the signature size grows slowly compared with others. We also implement our protocol and conduct an extensive analysis to prove the ideas. The results show that our scheme signature size edges up subtly compared with others with the improvement of security level.
Andrea Lisi, Prateeti Mukherjee, Laura De Santis, Lei Wu · 6 authors
The disclosure of security vulnerabilities plays an important role in notifying vendors and the public about flaws in digital systems. Among the proposed disclosure approaches, the most utilized is Responsible Disclosure, which unfortunately suffers from several disadvantages such as fostering a false sense of security among the end-users, allowing arbitrary delays in the disclosure process, and forcing the party reporting a vulnerability to identify themselves, which has been exploited by vendors in the past through intimidation and malpractice. To address these issues, this paper presents an improved version of the Responsible Disclosure approach called Automated Responsible Disclosure (ARD) - a solution that leverages distributed ledgers and interledger technologies to automate the disclosure process while offering increased security, privacy, and transparency. A prototype implementation has been released as open-source software, and the evaluation of the solution shows that ARD is capable of addressing the key shortcomings in existing solutions and fostering more transparent vulnerability disclosure practices.
Blockchain technologies have been boosting the development of data-driven decentralized services in a wide range of fields. However, with the spirit of full transparency, many public blockchains expose all types of data to the public such as Ethereum. Besides, the on-chain persistence of large data is significantly expensive technically and economically. These issues lead to the difficulty of sharing fairly large private data while preserving attractive properties of public blockchains. Although direct encryption for on-chain data persistence can introduce confidentiality, new challenges such as key sharing, access control, and legal rights proving are still open. Meanwhile, cross-chain collaboration still requires secure and effective protocols, though decentralized storage systems such as IPFS bring the possibility for fairly large data persistence. In this paper, we propose Sunspot, a decentralized framework for privacy-preserving data sharing with access control on transparent public blockchains, to solve these issues. We also show the practicality and applicability of Sunspot by MyPub, a decentralized privacy-preserving publishing platform based on Sunspot. Furthermore, we evaluate the security, privacy, and performance of Sunspot through theoretical analysis and experiments.
This paper investigates the problem of distributed storage of electronic documents (both metadata and files) in decentralized blockchain-based b2b systems (DApps). The need to reduce the cost of implementing such systems and the insufficient elaboration of the issue of storing big data in DLT are considered. An approach for building such systems is proposed, which allows optimizing the size of the required storage (by using Erasure coding) and simultaneously providing secure data storage in geographically distributed systems of a company, or within a consortium of companies. The novelty of this solution is that we are the first who combine enterprise DLT with distributed file storage, in which the availability of files is controlled. The results of our experiment demonstrate that the speed of the described DApp is comparable to known b2c torrent projects, and subsequently justify the choice of Hyperledger Fabric and Ethereum Enterprise for its use. Obtained test results show that public blockchain networks are not suitable for creating such a b2b system. The proposed system solves the main challenges of distributed data storage by grouping data into clusters and managing them with a load balancer, while preventing data tempering using a blockchain network. The considered DApps storage methodology easily scales horizontally in terms of distributed file storage and can be deployed on cloud computing technologies, while minimizing the required storage space. We compare this approach with known methods of file storage in distributed systems, including central storage, torrents, IPFS, and Storj. The reliability of this approach is calculated and the result is compared to traditional solutions based on full backup.
Blockchain technology is one of the most important and disruptive technologies in the world. Nowadays the healthcare center needs to share patient databases over all departments of the healthcare centers. Although, electronic healthcare records overcome several problems compared with manual records, but still suffer from many issues such as security, the privacy of patient data overall as we should transfer over a database from a central database to a decentralized database. In this paper, we proposed a good security system to manage the data of patients based on blockchain technology and a decentralized database. Depending on decentralized database and blockchain. Our proposed system provides the secure exchange of patient data, reliability, and high efficiency in sharing data during transaction data network equivalence checking to perform this validation of patient information in the blockchain and healthcare centers.
James A. Cunningham, Gail Davidge, Nigel Davies, Sarah Devaney · 9 authors
Data providers holding sensitive medical data often need to exchange data pertaining to patients for whom they hold particular data. This involves requesting information from other providers to augment the data they hold. However, revealing the superset of identifiers for which a provider requires information can, in itself, leak sensitive private data. Data linkage services exist to facilitate the exchange of anonymized identifiers between data providers. Reliance on third parties to provide these services still raises issues around the trust, privacy and security of such implementations. The rise and use of blockchain and distributed ledger technologies over the last decade has, alongside innovation and disruption in the financial sphere, also brought to the fore and refined the use of associated privacy-preserving cryptographic protocols and techniques. These techniques are now being adopted and used in fields removed from the original financial use cases. In this paper we present a combination of a blockchain-native auditing and trust-enabling environment alongside a query exchange protocol. This allows the exchange of sets of patient identifiers between data providers in such a way that only identifiers lying in the intersection of sets of identifiers are revealed and shared, allowing further secure and privacy-preserving exchange of medical information to be carried out between the two parties. We present the design and implementation of a system demonstrating the effectiveness of these exchange protocols giving a reference architecture for the implementation of such a system.
The current medical cyber physical systems involve a wide range of institutions and a large number of participants. Data sharing among distributed medical institutions is already a development trend. However, the security is worrying; e.g., the access to medical data lacks uniformity and standardization. What is more, data is easy to be tampered with and leaked. This has a very negative impact on the medical industry. Therefore, a strict and reliable access control mechanism for data in the medical cyber physical systems is a prerequisite for ensuring the implementation of modern medical functions. We deal with how to design effective access control in medical cyber physical systems. Combined with blockchain technology, we design the medical cyber physical systems based on blockchain data access control mechanism and unite data in the chain of union Fabric network resources access control. We qualitatively classify medical data, define the weight level of different data, design a medical data access framework based on blockchain, build an applicable model, formulate access control strategy, and specify the role assignment and access task matching of users, so as to achieve secure and effective data access control. The Hyperledger Fabric network is established as the alliance chain for managing access control rights distribution through smart contracts so as to achieve case-based medical data access control under the blockchain.
The sum of Big Data generated from different sources is increasing significantly with each passing day to extent that it is becoming challenging for traditional storage methods to store this massive amount of data. For this reason, most organizations have resolved to use third-party cloud storage to store data. Cloud storage has advanced in recent times, but it still faces numerous challenges with regard to security and privacy. This paper discusses Big Data security and privacy challenges and the minimum requirements that must be provided by future solutions. The main objective of this paper is to propose a new technical framework to control and manage Big Data security and privacy risks. A design science research methodology is used to carry out this project. The proposed framework takes advantage of Blockchain technology to provide secure storage of Big Data by managing its metadata and policies and eliminating external parties to maintain data security and privacy. Additionally, it uses mobile agent technology to take advantage of the benefits related to system performance in general. We present a prototype implementation for our proposed framework using the Ethereum Blockchain in a real data storage scenario. The empirical results and framework evaluation show that our proposed framework provides an effective solution for secure data storage in a Big Data environment.
Rabimba Karanjai, Lei Xu, Lin Chen, Fengwei Zhang · 6 authors
Modern computer systems tend to rely on large trusted computing bases (TCBs) for operations. To address the TCB bloating problem, hardware vendors have developed mechanisms to enable or facilitate the creation of a trusted execution environment (TEE) in which critical software applications can execute securely in an isolated environment. Even under the circumstance that a host OS is compromised by an adversary, key security properties such as confidentiality and integrity of the software inside the TEEs can be guaranteed. The promise of integrity and security has driven developers to adopt it for use cases involving access control, PKS, IoT among other things. Among these applications include blockchain-related use cases. The usage of the TEEs doesn't come without its own implementation challenges and potential pitfalls. In this paper, we examine the assumptions, security models, and operational environments of the proposed TEE use cases of blockchain-based applications. The exercise and analysis help the hardware TEE research community to identify some open challenges and opportunities for research and rethink the design of hardware TEEs in general.
Viraaji Mothukuri, Sai S. Cheerla, Reza M. Parizi, Qi Zhang · 5 authors
Hadoop Distributed File System (HDFS) is one of the widely used distributed file systems in big data analysis for frameworks such as Hadoop. HDFS allows one to manage large volumes of data using low-cost commodity hardware. However, vulnerabilities in HDFS can be exploited for nefarious activities. This reinforces the importance of ensuring robust security to facilitate file sharing in Hadoop as well as having a trusted mechanism to check the authenticity of shared files. This is the focus of this paper, where we aim to improve the security of HDFS using a blockchain-enabled approach (hereafter referred to as BlockHDFS). Specifically, the proposed BlockHDFS uses the enterprise-level Hyperledger Fabric platform to capitalize on files' metadata for building trusted data security and traceability in HDFS.
Young-Hoon Park, Yejin Kim, Shin-Ok Lee, Kwangman Ko
The security and privacy of electronic health records (EHRs) have received considerable attention from healthcare workers and researchers. To ensure security, various encryption and decryption schemes as well as key management protocols have been developed. However, owing to sharing and scalability issues, additional security technologies have been proposed. Nonetheless, these technologies cause other problems, such as efficiency issues. Blockchain-based EHR management systems have been proposed to overcome computational overhead. However, because most blockchain systems are installed by outsourcing companies, EHRs may be leaked to the company. Hence, we herein propose a blockchain-based EHR management scheme with proxy re-encryption. In this scheme, we set a proxy server that re-encrypts the ciphertext between file servers, thereby solving EHR sharing issues. Furthermore, because the server is separated from the blockchain system, the outsourcing company cannot manipulate the server or access the records. In addition, the blockchain assists in access control by using smart contracts, thereby enabling secure and efficient EHR sharing. By performing security analysis, we prove that our proposed scheme solves the aforementioned security problems. In addition, we experimentally demonstrate the efficient operation of the proposed system.
Distributed storage can store data in multiple devices or servers to improve data security. However, in today's explosive growth of network data, traditional distributed storage scheme is faced with some severe challenges such as insufficient performance, data tampering, and data lose. A distributed storage scheme based on blockchain has been proposed to improve security and efficiency of traditional distributed storage. Under this scheme, the following improvements have been made in this paper. This paper first analyzes the problems faced by distributed storage. Then proposed to build a new distributed storage blockchain scheme with sharding blockchain. The proposed scheme realizes the partitioning of the network and nodes by means of blockchain sharding technology, which can improve the efficiency of data verification between nodes. In addition, this paper uses polynomial commitment to construct a new verifiable secret share scheme called PolyVSS. This new scheme is one of the foundations for building our improved distributed storage blockchain scheme. Compared with the previous scheme, our new scheme does not require a trusted third party and has some new features such as homomorphic and batch opening. The security of VSS can be further improved. Experimental comparisons show that the proposed scheme significantly reduces storage and communication costs.
Jesús García-Rodríguez, Rafael Torres Moreno, Jorge Bernal Bernabé, Antonio Skármeta
Despite the latest efforts to foster the adoption of privacy-enhancing Attribute-Based Credential (p-ABC) systems in electronic services, those systems are not yet broadly adopted. The main reasons behind this are performance efficiency issues, lack of interoperability with standards, and the centralized architectural scheme that relies on a unique Identity Provider (IdP) for credential issuance. To cope with these limitations, this paper describes the first implementation of the Pointcheval–Sanders Multi-Signatures (PS-MS) crypto scheme proposed by Camenisch et al. and its integration in a distributed and privacy-preserving identity management system proposed in OLYMPUS H2020 European research project. Our efficient implementation provides remarkable privacy-preservation features for identity management in online transactions leveraging p-ABC systems, including unforgeability, minimal disclosure of personal data through zero-knowledge proofs, unlinkability in online transactions and fully distributed credential issuance across different IdPs, thereby removing the IdP as a unique point of failure. The performance of the implementation has been exhaustively analyzed and evaluated with different curves, signers and number of attributes, and compared against Identity Mixer, the best known p-ABC system, outperforming significantly the credential issuance and zero-knowledge proving and verification processes (2–4 times less execution time).
Blockchain technology appears to be the ideal solution for storing data in a transparent and decentralized manner. It also allows open access to data and enhances its immutable nature. This technology has helped prove its usefulness in several industries so far, however, distributed ledger technology does not work as a pure database. Therefore, some problems occur in accessing data. Querying data in the blockchain leads to performance and bandwidth problems. This primarily occurs because the blockchain does not have a primary query language, unlike regular databases. The distributed nature of the blockchain is in this case an obstacle. In this paper, a safe and fast method will be proposed to retrieve consistent data from the blockchain-based on the smart contract that will be opened after completing the transaction procedures. All nodes will sign the proposed transaction (by adding a special hash to each node resulting from the transaction information and node data). Upon completion of Transaction procedures, A smart contract will be opened (in which a QR is placed) resulting from converting the signatures in the transaction to QR When the smart contract data is retrieved, the QR for each transaction will be used All node signatures and transaction data will be extracted. The data will be retrieved by the QR generated for each transaction after it is stored in all nodes servers participating in the system. A new method was proposed to generate a hash for each node present in the system. The proposed method was tested in terms of time and complexity, and the algorithm was statistically analyzed, and all the results proved successful.
Following the footprints of Bitcoins, many other cryptocurrencies were developed mostly adopting the same or similar Proof-of-Work (PoW) approach. Since completing the PoW puzzle requires extremely high computing power, consuming a vast amount of electricity, PoW has been strongly criticised for its antithetic stand against the notion of green computing. Use of application-specific hardware, particularly application-specific integrated circuits (ASICs) has further fuelled the debate, as these devices are of no use once they become “legacy” and hence obsolete to compete in the mining race, thus contributing to electronics waste. Therefore, this paper surveys the currently available alternative approaches to PoW and evaluates their applicability - especially their appropriateness in terms of greenness.