Valentin Zieglmeier, Gabriel Loyola Daiqui, Alexander Pretschner
Employee data can be used to facilitate work, but their misusage may pose risks for individuals. Inverse transparency therefore aims to track all usages of personal data, allowing individuals to monitor them to ensure accountability for potential misusage. This necessitates a trusted log to establish an agreed-upon and non-repudiable timeline of events. The unique properties of blockchain facilitate this by providing immutability and availability. For power asymmetric environments such as the workplace, permissionless blockchain is especially beneficial as no trusted third party is required. Yet, two issues remain: (1) In a decentralized environment, no arbiter can facilitate and attest to data exchanges. Simple peer-to-peer sharing of data, conversely, lacks the required non-repudiation. (2) With data governed by privacy legislation such as the GDPR, the core advantage of immutability becomes a liability. After a rightful request, an individual's personal data need to be rectified or deleted, which is impossible in an immutable blockchain. To solve these issues, we present Kovacs, a decentralized data exchange and usage logging system for inverse transparency built on blockchain. Its new-usage protocol ensures non-repudiation, and therefore accountability, for inverse transparency. Its one-time pseudonym generation algorithm guarantees unlinkability and enables proof of ownership, which allows data subjects to exercise their legal rights regarding their personal data. With our implementation, we show the viability of our solution. The decentralized communication impacts performance and scalability, but exchange duration and storage size are still reasonable. More importantly, the provided information security meets high requirements. We conclude that Kovacs realizes decentralized inverse transparency through secure and GDPR-compliant use of permissionless blockchain.
The transformation introduced by information communication technologies in the last decades significantly impacts the economy and society concerning the digital representation of one’s identity. The economics of exploiting personal information is assisted by the more pervasive nature of today’s digital world: data are at the center of this transformation, and individuals are the primary sources of information and the ones most affected by it. The General Data Protection Regulation (GDPR) is having a significant impact on the protection of personal data. It has been designed for European Union (EU) citizens to help promote a view in favor of the interests of individuals instead of large corporations. However, at a large scale, there need to be more dedicated technologies that can help companies comply with GDPR (and similar regulations) while enabling people to exercise their rights. We argue that such a dedicated solution must address two main issues: the need for more transparency towards individuals regarding the management of their personal information and their often hindered ability to access and make interoperable personal data in a way that the exercise of one’s rights would result in straightforward and not excessively burdensome. In this work, we make the first step toward these two objectives by designing a user-centered model for managing personal data, where storage is decoupled from the data management logic. We aim to provide a system that helps to push personal data management towards the individual’s control, i.e., a personal information management system (PIMS). By using distributed storage and decentralized computing networks to control online services, users’ personal information could be shifted towards those directly concerned, i.e., the data subjects. The use of Distributed Ledger Technologies (DLTs) and Decentralized File Storage (DFS) as an implementation of decentralized systems is of paramount importance in this case. The structure of this dissertation follows an incremental approach to describing a set of decentralized systems and models that revolves around personal data and their subjects. Each chapter of this dissertation builds up the previous one and discusses the technical implementation of a system and its relation with the corresponding regulations. Indeed, most of the time, implementations based on decentralized systems clash with laws such as GDPR. We refer to the EU regulatory framework, including GDPR, eIDAS, and Data Governance Act, to build our final system architecture’s functional and non-functional drivers. In our PIMS design, personal data is kept in a Personal Data Space (PDS) consisting of encrypted personal data referring to the subject stored in a DFS.We use a decentralized indexing system to guarantee the integrity, verifiability, linkability, searchability, and indexing of the encrypted personal data stored in the PDS. We follow the approach to reference data and their content on a DLT, i.e., on-chain hash pointers. Then, we associate to such hash pointer reference a keyword set that is exploited to lookup for specific kinds of contents. On top of that, a network of authorization servers acts as a data intermediary to provide access to potential data recipients. Access to the data stored on a PDS can be allowed by the data holder through smart contracts. These maintain a data structure to record eligible data recipients, i.e., those to whom to issue the keys needed to access the encrypted data. Also, in this case, the GDPR tensions with DLTs drove the architecture to be multi-DLT. Authorization servers use a “tightly controlled” permissioned DLT to handle personal data, while a permissionless “audit” DLT is used for system security and only holds non-personal data. After describing the design of a decentralized PIMS, we focus on enriching the expressiveness of the access control mechanism through privacy policies. These let data subjects and/or holders express privacy policies aligned with the GDPR legal bases to be enforced through smart contracts. We use a set of Semantic Web technologies and standards for this aim. Finally, we present a Self-Sovereign Identity (SSI) model for providing, requesting, and obtaining qualified data to negotiate and/or execute electronic transactions with a focus on the legal and operational context. RESUMEN La transformación introducida por las tecnologías de la información y las comunicaciones en las últimas décadas repercute signifcativamente en la economía y la sociedad en lo que respecta a la representación digital de la identidad personal. La explotación económica de la información personal se ve favorecida por la naturaleza omnipresente del mundo digital actual: los datos están en el centro de esta transformación, y los individuos son las principales fuentes de información y los más afectados por ella. El Reglamento General de Protección de Datos (RGPD) está teniendo un impacto signifcativo en la protección de los datos personales. Ha sido diseñado para los ciudadanos de la Unión Europea (UE) con el f n de ayudar a promover una visión a favor de los intereses de los individuos en lugar de las grandes corporaciones. Sin embargo, a gran escala, es necesario que existan más tecnologías dedicadas que puedan ayudar a las empresas a cumplir con el RGPD (y reglamentos similares) al tiempo que permiten a las personas ejercer sus derechos. Sostenemos que una solución específca de este tipo debe abordar dos cuestiones principales: la necesidad de una mayor transparencia hacia las personas en lo que respecta a la gestión de su información personal y su capacidad, a menudo obstaculizada, de acceder a los datos personales y hacerlos interoperables de forma que el ejercicio de los derechos propios resulte sencillo y no excesivamente oneroso. En este trabajo, damos el primer paso hacia estos dos objetivos diseñando un modelo de gestión de datos personales centrado en el usuario, en el que el almacenamiento se desvincula de la lógica de gestión de datos. Pretendemos ofrecer un sistema que ayude a impulsar la gestión de datos personales hacia el control del individuo, es decir, un sistema de gestión de información personal (PIMS). Al utilizar el almacenamiento distribuido y las redes de computación descentralizadas para controlar los servicios online, la información personal de los usuarios podría desplazarse hacia los directamente interesados, es decir, los interesados. El uso de las Distributed Ledger Technologies (DLT) y del Decentralized File Storage (DFS) como implementación de sistemas descentralizados es de vital importancia en este caso. La estructura de esta disertación sigue un método incremental para describir un conjunto de sistemas y modelos descentralizados que gira en torno a los datos personales y sus sujetos. Cada capítulo de esta disertación se basa en el anterior y analiza la implementación técnica de un sistema y su relación con la normativa correspondiente. De hecho, la mayoría de las veces, las implementaciones basadas en sistemas descentralizados chocan con leyes como el RGPD. Nos referimos al marco normativo de la UE, incluidos el RGPD, el eIDAS y la Data Governance Act, para construir los impulsores funcionales y no funcionales de nuestra arquitectura fnal del sistema. En nuestro diseño de PIMS, los datos personales se guardan en un Espacio de Datos Personales (PDS) que consiste en datos personales cifrados referentes al sujeto almacenados en un DFS. Utilizamos un sistema de indexación descentralizado para garantizar la integridad, verifcabilidad, vinculabilidad, capacidad de búsqueda e indexación de los datos personales cifrados almacenados en el PDS. Seguimos el enfoque para referenciar datos y su contenido en una DLT, es decir, on-chain hash pointers. A continuación, asociamos a dicha referencia de hash pointer un conjunto de palabras clave que se explota para buscar tipos específcos de contenidos. Además, una red de servidores de autorización actúa como intermediaria para facilitar el acceso a los posibles destinatarios de los datos. El acceso a los datos almacenados en un PDS puede ser permitido por el titular de los datos a través de smart contracts. Estos mantienen una estructura de datos para registrar los destinatarios de datos elegibles, es decir, aquellos a quienes expedir las claves necesarias para acceder a los datos cifrados. Además, en este caso, las tensiones del RGPD con las DLT impulsaron a que la arquitectura fuera multi-DLT. Los servidores de autorización utilizan una permissioned DLT “estrechamente controlada” para manejar datos personales, mientras que una “audit” permissionless DLT se utiliza para la seguridad del sistema y sólo contiene datos no personales. Tras describir el diseño de un PIMS descentralizado, nos centramos en enriquecer la expresividad del mecanismo de control de acceso mediante políticas de privacidad. Éstas permiten a los titulares y /o sujetos de los datos expresar políticas de privacidad alineadas con las bases legales del RGPD que se aplicarán a través de smart contracts. Para ello utilizamos un conjunto de tecnologías y estándares de la Web Semántica. Por último, presentamos un modelo de Self-Sovereign Identity (SSI) para proporcionar, solicitar y obtener datos cualifcados para negociar y /o ejecutar transacciones electrónicas con un enfoque en el contexto legal y operativo.
Abstract With the rapid development of cloud computing technology, how to achieve secure access to cloud data has become a current research hotspot. Attribute-based encryption technology provides the feasibility to achieve the above goal. However, most of the existing solutions have high computational and trust costs. Furthermore, the fairness of access authorization and the security of data search can be difficult to guarantee. To address these issues, we propose a novel access control scheme based on blockchain and attribute-based searchable encryption in cloud environment. The proposed scheme achieves fine-grained access control with low computation consumption by implementing proxy encryption and decryption, while supporting policy hiding and attribute revocation. The encrypted file is stored in the IPFS and the metadata ciphertext is stored on the blockchain, which ensures data integrity and confidentiality. Simultaneously, the scheme enables the secure search of ciphertext keyword in an open and transparent blockchain environment. Additionally, an audit contract is designed to constrain user access behavior to dynamically manage access authorization. Security analysis proves that our scheme is resistant to chosen-plaintext attacks and keyword-guessing attacks. Theoretical analysis and experimental results show that our scheme has high computational and storage efficiency, which is more advantageous than other schemes.
Purpose Privacy scholars appear to struggle in conceptualizing blockchain from a privacy perspective: is it a privacy-enhancing mechanism like differential privacy, a privacy-intruding tool like third-party cookies or a technology orthogonal to the issue of privacy? Blockchain does not seem to neatly fit into any of these buckets that we traditionally use to gauge the privacy implications of information technologies. In this article, the authors argue that blockchain transcends the extant conceptualization of privacy because it modifies the nature of data flow upon which the modern concept of privacy is based. Design/methodology/approach The authors introduce a conceptualization of blockchain as a new mechanism for data management. Then, following this conceptualization, the authors present a functional review of blockchain, summarizing the features it provides for the data it manages. This review sets up the discussion of how blockchain redefines data flow by separating the power of collection, access and query of data to different entities. After illustrating how this change regrounds privacy concerns in a blockchain system, the authors conclude with a discussion of the recommendations for future privacy research on blockchain. Findings The authors demonstrate that blockchain, by design, separates three core data-centric operations that are assumed to be inextricably linked in the canonical conceptualization of privacy: the collection, access and query of data. Collection means to capture and then store the data; access means to modify or augment the data and query means the ability to test or verify certain properties of the data (e.g. whether a bank account has a zero balance). Traditionally, any entities that collect data can evidently read, modify or query the same data as they wish. With blockchain, however, an entity that stores the data may not be able to modify the data, yet an entity that cannot even read the data may be able to verify certain properties of the data. Originality/value Privacy scholars appear to struggle in conceptualizing blockchain from a privacy perspective: is it a privacy-enhancing mechanism like differential privacy, a privacy-intruding tool like third-party cookies or a technology orthogonal to the issue of privacy? In this article, the authors aim to respond to this important question.
Kazi Masum Sadique, Rahim Rahmani, Paul Johannesson
The Internet of Things (IoT) paradigm aims to enhance human society and living standards with the vast deployment of smart and autonomous devices, which requires seamless collaboration. The number of connected devices increases daily, introducing identity management requirements for edge IoT devices. Due to IoT devices' heterogeneity and resource-constrained configuration, traditional identity management systems are not feasible. As a result, identity management for IoT devices is still an open issue. Distributed Ledger Technology (DLT) and blockchain-based security solutions are becoming popular in different application domains. This paper presents a novel DLT-based distributed identity management architecture for edge IoT devices. The model can be adapted with any IoT solution for secure and trustworthy communication between devices. We have comprehensively reviewed popular consensus mechanisms used in DLT implementations and their connection to IoT research, specifically identity management for Edge IoT devices. Our proposed location-based identity management model is generic, distributed, and decentralized. The proposed model is verified using the Scyther formal verification tool for security performance measurement. SPIN model checker is employed for different state verification of our proposed model. The open-source simulation tool FobSim is used for fog and edge/user layer DTL deployment performance analysis. The results and discussion section represents how our proposed decentralized identity management solution should enhance user data privacy and secure and trustworthy communication in IoT.
Nazar Waheed, Ateeq Ur Rehman, Anushka Nehra, Mahnoor Farooq · 9 authors
The rapid adoption of Internet of Things (IoT) devices in healthcare has introduced new challenges in preserving data privacy, security and patient safety. Traditional approaches need to ensure security and privacy while maintaining computational efficiency, particularly for resource-constrained IoT devices. This paper proposes a novel hybrid approach by combining federated learning and blockchain technology to provide a secured and privacy-preserved solution for IoT-enabled healthcare applications. Our approach leverages a public-key cryptosystem that provides semantic security for local model updates, while blockchain technology ensures the integrity of these updates and enforces access control and accountability. The federated learning process enables a secure model aggregation without sharing sensitive patient data. We implement and evaluate our proposed framework using EMNIST datasets, demonstrating its effectiveness in preserving data privacy and security while maintaining computational efficiency. The results suggest that our hybrid approach can significantly enhance the development of secure and privacy-preserved IoT-enabled healthcare applications, offering a promising direction for future research in this field.
Yang Liu, Liangjie Lin, Lin Jiang, Weizhe Zhang · 9 authors
Abstract In the era of digital marketing, advertisements have become an indispensable part. One of the central challenges is advertising attribution which explains the amount of contribution every publisher has with the conversions. However, through observation, we have found that current advertising platforms attribution, advertisers attribution, or third‐party platforms attribution all have the problems of trust, data leakage, and data forgery. To fill the gap, our work's main contribution is combining blockchain with advertising attribution to propose an architecture for improving the privacy‐preserving degree and amount. In the proposed architecture, publishers, and advertisers can store real‐time data on a blockchain. The attribution results are credible because blockchain is decentralized, tamper‐proof, and traceable. We combine privacy set intersection and zero‐knowledge proof technology to increase the privacy of flowing data. In addition, we describe a preliminary prototype in which publishers, advertisers, and advertising platforms can get the corresponding attribution details. To show its effectiveness, we analyze it from different perspectives, including communication cost, attribution accuracy, and time cost. The results show that our communication cost has significantly reduced compared to the recent studies.
Smart cities are data driven and collect data from a variety of sources. Certain types of data such as building data is under-represented and remains harder to find despite its value. Our goal is to incentivise the stakeholders to make building data easier to avail by turning it into an asset. We use tokenized building data assets on a blockchain to improve data accessibility. This is achieved by connecting building data owners with the consumers of building information via tokens (fungible and non-fungible), which serves the purpose of coordinating the activities of the built ecosystem. Further, we present our system architecture designed to sustain the economic incentives for interested parties and individuals.
Farida Habib Semantha, Sami Azam, Bharanidharan Shanmugam, Kheng Cher Yeo
Privacy in Electronic Health Records (EHR) has become a significant concern in today’s rapidly changing world, particularly for personal and sensitive user data. The sheer volume and sensitive nature of patient records require healthcare providers to exercise an intense quantity of caution during EHR implementation. In recent years, various healthcare providers have been hit by ransomware and distributed denial of service attacks, halting many emergency services during COVID-19. Personal data breaches are becoming more common day by day, and privacy concerns are often raised when sharing data across a network, mainly due to transparency and security issues. To tackle this problem, various researchers have proposed privacy-preserving solutions for EHR. However, most solutions do not extensively use Privacy by Design (PbD) mechanisms, distributed data storage and sharing when designing their frameworks, which is the emphasis of this study. To design a framework for Privacy by Design in Electronic Health Records (PbDinEHR) that can preserve the privacy of patients during data collection, storage, access and sharing, we have analysed the fundamental principles of privacy by design and privacy design strategies, and the compatibility of our proposed healthcare principles with Privacy Impact Assessment (PIA), Australian Privacy Principles (APPs) and General Data Protection Regulation (GDPR). To demonstrate the proposed framework, ‘PbDinEHR’, we have implemented a Patient Record Management System (PRMS) to create interfaces for patients and healthcare providers. In addition, to provide transparency and security for sharing patients’ medical files with various healthcare providers, we have implemented a distributed file system and two permission blockchain networks using the InterPlanetary File System (IPFS) and Ethereum blockchain. This allows us to expand the proposed privacy by design mechanisms in the future to enable healthcare providers, patients, imaging labs and others to share patient-centric data in a transparent manner. The developed framework has been tested and evaluated to ensure user performance, effectiveness, and security. The complete solution is expected to provide progressive resistance in the face of continuous data breaches in the patient information domain.
As part of vehicle to everything (V2X) environments, intelligent connected vehicles (ICVs) generate a large amount of data, which can be exploited securely and effectively through decentralized techniques such as federated learning (FL). Existing FL systems, however, are vulnerable to attacks and barely meet the security requirements for real-world applications. If malicious or compromised ICVs upload inaccurate or low-quality local model updates to the central aggregator, they may reduce the accuracy of the global model, thereby reducing drivers safety and efficiency. This paper aims to alleviate these concerns by presenting BV-ICVs, a blockchain-enabled and privacy-preserving FL framework for ICVs in an edge-envisioned V2X environment. This system uses Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zkSNARKs) verification that is compiled as smart contracts to prevent malicious, compromised or even rational ICVs from uploading unreliable, erroneous or low-quality model updates. The verification process is embedded within the consensus of the underlying permissioned blockchain, which maximizes both the efficiency of the process and the utilization of computer resources. As demonstrated by discussions, security analysis, and numerical results, BV-ICVs reduced data poisoning attacks and increased the privacy protection and accuracy of FL.
Social recovery schemes enable the recovery of decentralized digital assets like Bitcoin and Ethereum through a social network. These schemes suffer from security issues and limitations including centralization, a conspiracy of one's network, large transaction fees for the user and network, and verifiable connections between the user and the network. To mitigate these issues, the work proposes and implements a novel social recovery scheme based on verifiable secret sharing, smart contract code, encrypted communication, and biometric encryption. The security and performance analysis versus key existing implementations is evaluated in terms of security features and gas fees.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Since the concern of privacy leakage extremely discourages user participation in sharing data, federated learning has gradually become a promising technique for both academia and industry for achieving collaborative learning without leaking information about the local data. Unfortunately, most federated learning solutions cannot efficiently verify the execution of each participant's local machine learning model and protect the privacy of user data, simultaneously. In this article, we first propose a Zero-Knowledge Proof-based Federated Learning (ZKP-FL) scheme on blockchain. It leverages zero-knowledge proof for both the computation of local data and the aggregation of local model parameters, aiming to verify the computation process without requiring the plaintext of the local data. We further propose a Practical ZKP-FL (PZKP-FL) scheme to support fraction and non-linear operations. Specifically, we explore a Fraction-Integer mapping function, and use Taylor expansion to efficiently handle non-linear operations while maintaining the accuracy of the federated learning model. We also analyze the security of PZKP-FL. Performance analysis demonstrates that the whole running time of the PZKP-FL scheme is approximately less than one minute in parallel execution.
Abstract With the rapid advancements of the mineral industry, the data generated by this industry chain have increased dramatically. To reduce the growing pressure of data storage and security risks, we design a credible on-chain and off-chain collaborative dual storage system that integrates blockchain technology and Interplanetary file system (IPFS), also construct a traceable and revocable multi-authority ciphertext-policy attributed-based encryption (CP-ABE) algorithm to meet the demand of privacy protection and dynamic fine-grained access control. Furthermore, the multi-authority layered authorization with a central authority model distributes system overhead while enabling the platform can be regulated. More importantly, our scheme achieves accurate trace of the malicious users by white-box traceability and capable of implementing indirect immediate user and attribute revocation without requiring key or ciphertext updates. Finally, the proposed scheme is indistinguishably secure under chosen-plaintext attack (IND-CPA) in the standard model. And the performance analysis demonstrates that our scheme is feature-rich, practical and efficient.
Ricardo Martins Gonçalves, Miguel Mira da Silva, Paulo Rupino da Cunha
The immutability of data stored in a blockchain is a crucial pillar of trust in this technology, which has led to its increasing adoption in various use cases. However, there are situations where the inability to change or delete data may be illegal. European Union’s General Data Protection Regulation (GDPR)—applying to any company processing personal data from European citizens—explicitly entitles individuals to the right to rectification and the right to be forgotten. In this paper, we describe the design of a system to deploy and process survey data in a GDPR-compliant manner. It combines an Hyperledger Fabric blockchain to ensure that data cannot be tampered with and InterPlanetary File Systems (IPFS) for storage. With the proposed arrangement, we reap several security benefits enabled by blockchain’s immutability without running afoul of the regulations. Furthermore, the proof-of-concept is generic and can easily be adapted to various domains.
The traditional data-sharing model relies on a centralized third-party platform, which presents challenges such as poor transaction transparency and unsecured data security. In this article, we propose a blockchain-based traceable and secure data-sharing scheme. Firstly, we designed an attribute encryption-based method to protect data and enable fine-grained shared access. Secondly, we developed a secure data storage scheme that combines on-chain and off-chain collaboration. The InterPlanetary File System (IPFS) is used to store encrypted data off-chain, and the hash value of encrypted data is stored on the blockchain. To improve data security, elliptic curve cryptography (ECC) encryption is performed before the hash value is stored. Finally, we designed a smart contract-based log tracking mechanism. The mechanism stores data sharing records on the blockchain and displays them in a visual form to meet the identity tracking needs of both data sharing parties. Experimental results show that our scheme can effectively secure data, track the identities of both parties sharing data in real-time, and ensure high data throughput.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Sajad Meisami, Sadaf Meisami, Melina Yousefi, Mohammad Reza Aref
The emergence of the Internet of Things (IoT) has resulted in a significant increase in research on e-health. As the amount of patient data grows, it has become increasingly challenging to protect patients' privacy. Patient data is commonly stored in the cloud, making it difficult for users to control and protect their information. Moreover, the recent rise in security and surveillance breaches in the healthcare industry has highlighted the need for a better approach to data storage and protection. Traditional models that rely on third-party control over patients' healthcare data are no longer reliable, as they have proven vulnerable to security breaches. To address these issues, blockchain technology has emerged as a promising solution. Blockchain-based protocols have the potential to provide a secure and efficient system for e-health applications that does not require trust in third-party intermediaries. The proposed protocol outlined in this paper uses a blockchain-based approach to manage patient data securely and efficiently. Unlike Bitcoin, which is primarily used for financial transactions, the protocol described here is designed specifically for e-health applications. It employs a consensus mechanism that is more suitable for resource constrained IoT devices, thereby reducing network costs and increasing efficiency. The proposed protocol also provides a privacy-preserving access control mechanism that enables patients to have more control over their healthcare data. By leveraging blockchain technology, the protocol ensures that only authorized individuals can access the patient's data, which helps prevent data breaches and other security issues. Finally, the security and privacy of the proposed protocol are analysed to ensure that it meets the necessary standards for data protection. The protocol's effectiveness and efficiency are tested under different scenarios to ensure that it can perform reliably and consistently. Finally, the protocol proposed in this paper shows that how blockchain can be used to provide a secure and efficient system that empowers patients to take control of their healthcare data.
Prof. M. S. Kale, Ayush Gimekar, Zuveriya Tamboli, Vaishnavi Patil · 5 authors
Normal cash has developed and appears numerous downsides such as inaccessibility. It is inclined to burglary and is intensely directed by government offices. Cryptocurrencies have risen as a egotistic money related framework. They depend upon secure disseminated ledger data structure. Mining plays a critical portion in this framework. Basically, our cryptocurrency could be a conveyed database that keeps up tamper-proof information structure pieces containing his bunches of person exchanges. Blockchain innovation can be a widely emerging approach to data innovations. Bitcoin as a cryptocurrency has made several considerations since it was one of its earliest implementations. They discuss the key elements driving the development of sophisticated cryptocurrencies alongside Ethereum, a blockchain implementation with a focus on informed contracts. In its most basic form, our cryptocurrency may be thought of as a distributed database that keeps track of tamper-proof data structure blocks comprising batches of individual transactions.
Frédéric Hayek, Mirko Koscina, Pascal Lafourcade, Charles Olivier-Anclin
Private permissioned blockchains are becoming gradually more sought-after. Such systems are reachable by authorized users, and tend to be completely transparent to whoever interacts with the blockchain. In this paper, we mitigate the latter. Authorized users can now stay unlinked to the transaction they propose in the blockchain while being authenticated before being allowed to interact. As a first contribution, we developed a consensus algorithm for private permissioned blockchains based on Hyperledger Fabric and the Practical Byzantine Fault Tolerance consensus. Building on this blockchain, five additional variations achieving various client-wise privacy preserving levels are proposed. These different protocols allow for different use cases and levels of privacy control and sometimes its revocation by an authority. All our protocols guarantee the unlinkability of transactions to their issuers achieving anonymity or pseudonymity. Miners can also inherit some of the above privacy preserving setting. Naturally, we maintain liveness and safety of the system and its data.
Data access control is a crucial aspect of data management. Actors who want to share data need systems to manage consent in order to decide who can access their data. This guarantees the privacy of data, which is often sensitive. As a secure distributed ledger, the blockchain is widely used today to manage consent for data access. However, a blockchain is not ideal for storing large volumes of data due to its characteristics. Therefore, it is often coupled with off-chain systems to facilitate the storage of these kinds of data. Therefore, data located outside the blockchain require security procedures. This article proposes a securing mechanism based on data encryption to secure data in off-chain storage in blockchain-based consent systems. The protocol uses a symmetric key system, which prevents the reading of data stored outside the sphere of the blockchain by malicious actors who would have access. The mechanism’s set up allows each set of data to be encrypted with a symmetric key that is anchored in a blockchain. This key is then used by the actors who have obtained the consent of the data owner to access and read the data stored outside the blockchain.
The access control (AC) system in an IoT (Internet of Things) context ensures that only authorized entities have access to specific devices and that the authorization procedure is based on pre-established rules. Recently, blockchain-based AC systems have gained attention within research as a potential solution to the single point of failure issue that centralized architectures may bring. Moreover, zero-knowledge proof (ZKP) technology is included in blockchain-based AC systems to address the issue of sensitive data leaking. However, current solutions have two problems: (1) systems built by these works are not adaptive to high-traffic IoT environments because of low transactions per second (TPS) and high latency; (2) these works cannot fully guarantee that all user behaviors are honest. In this work, we propose a blockchain-based AC system with zero-knowledge rollups to address the aforementioned issues. Our proposed system implements zero-knowledge rollups (ZK-rollups) of access control, where different AC authorization requests can be grouped into the same batch to generate a uniform ZKP, which is designed specifically to guarantee that participants can be trusted. In low-traffic environments, sufficient experiments show that the proposed system has the least AC authorization time cost compared to existing works. In high-traffic environments, we further prove that based on the ZK-rollups optimization, the proposed system can reduce the authorization time overhead by 86%. Furthermore, the security analysis is presented to show the system's ability to prevent malicious behaviors.
The mobile healthcare (mHealth) is a promising and fascinating paradigm, which can dramatically improve the quality of healthcare delivery by providing remote diagnosis and medical record sharing. Now, the mHealth faces serious challenges such as data leakage and unauthorised access currently. Attribute-based encryption (ABE) which has been employed for mHealth is an excellent cryptographic primitive of securing data sharing. However, there are still some security and efficiency issues in the ABE-based data sharing scheme for mHealth. Firstly, the explicit storage of access policy may expose the privacy of users. Secondly, the computation cost is high, especially in the mHealth with IoT devices. Thirdly, the authentication of access rights to shared data is usually performed by the centralised third parties or IoT devices with limited resources. To handle the above issues, this paper presents a privacy-preserving and efficient data sharing scheme. The scheme partially hides access policy to protect user's privacy, and introduces an offline mechanism in key generation and encryption phase to improve efficiency of mHealth. Furthermore, it also provides decentralised and trusted authentication of data access right based on blockchain. The security proofs and the experiment results demonstrate that the presented scheme has better security and efficiency.
During the COVID-19 pandemic, it was necessary to validate a person’s health status along with their identity to permit travel. This was facilitated via paper-based certificates and centralized digital apps. Even after COVID-19, it is anticipated that such health status verifications will be required for travel and other purposes. As a result, there needs to be an additional credential, a “Health Passport,” that establishes whether a person satisfies the health requirements for various purposes. Digital credentials so prepared should be trustable, unforgeable, and verifiable. The Health Passport should be designed to protect the end-users’ privacy and give people control over the data they use to confirm their credentials. This article explores the requirements for a generalized Health Passport system and uses agent-oriented modeling (AOM) to design a blockchain-based self-sovereign identity (SSI) system integrated with the Personal Health Record (PHR) to address this requirement. The article demonstrates the feasibility of the solution by implementing a proof of concept on Hyperledger Indy and Aries, integrated with the PHR – MediTrans. Credential issuance and verification time were calculated, and it was observed that the time overhead was minimal. This solution allows users to verify their credentials with the verifier without revealing any significant personal information. Our solution can be integrated into any PHR solution as the SSI solution is added as a plugin to the PHR accessible via a mobile/web app.
Francesco Bruschi, Donatella Sciuto, Tommaso Paulon, Andrea Marchesi
Blockchain technology allows players to own in-game assets and to be rewarded with NFTs or tokens for their game achievements, thus can be a game changer for all the gaming industry. One central issue is how to check that conditions for achievements are met (e.g., that the player completed level 10). Current approaches open cheating backdoors (e.g. if the client checks the conditions) or introduce centralization points (if a backend checks the condition). Ideally, we would like to “run” games on chain, but so far that has not been possible due to the high computational cost, especially on Ethereum; however, the development of technologies like proofs of computation can solve this problem. Being able to run games on the blockchain, new decentralized rewarding systems can be built to ensure the fair and transparent rewarding of game achievements.