The state-of-the-art centralized Internet of Things (IoT) data flow pipeline has started aging since it cannot cope with the vast number of newly connected IoT devices. As a result, the community begins the transition to a decentralized pipeline to encourage data and resource sharing. However, the move is not trivial. With many instances allocating data or service arbitrarily, how can we guarantee the correctness of IoT data or processes that other parties offer. Furthermore, in case of dispute, how can the IoT data assist in determining which party is guilty of faulty behavior. Finally, the number of Service Level Agreement (SLA) increases as the number of sharing grows. The problem then becomes how we can provide a natural SLA generation and verification that we can automate instead of going through a manual and tedious legalization process through a trusted third party. In this paper, we explore blockchain solutions to answer those issues and propose continued data integrity services for IoT big data management. Specifically, we design five integrity protocols across three phases of IoT operations—during the transmission of IoT data (data in transit), when we physically store the data in the database (data at rest), and at the time of data processing (data in process). In each phase, we first lay out our motivations and survey the related blockchain solutions from the literature. We then use curated papers from our surveys as building blocks in designing the protocol. Using our proposal, we augment the overall value of IoT data and commands, generated in the IoT system, as they are now tamper-proof, verifiable, non-repudiable, and more robust.
Nick Baumann, Samuel Steffen, Benjamin Bichsel, Petar Tsankov · 5 authors
Recent work introduces zkay, a system for specifying and enforcing data privacy in smart contracts. While the original prototype implementation of zkay (v0.1) demonstrates the feasibility of the approach, its proof-of-concept implementation suffers from severe limitations such as insecure encryption and lack of important language features. In this report, we present zkay v0.2, which addresses its predecessor's limitations. The new implementation significantly improves security, usability, modularity, and performance of the system. In particular, zkay v0.2 supports state-of-the-art asymmetric and hybrid encryption, introduces many new language features (such as function calls, private control flow, and extended type support), allows for different zk-SNARKs backends, and reduces both compilation time and on-chain costs.
The COVID19 Pandemic has highlighted our dependence on online services (from government, e-commerce/retail, and entertainment), often hosted over external cloud computing infrastructure. The users of these services interact with a web interface rather than the larger distributed service provisioning chain that can involve an interlinked group of providers. The data and identity of users are often provided to service provider who may share it (or have automatic sharing agreement) with backend services (such as advertising and analytics). We propose the development of compliance-aware cloud application engineering, which is able to improve transparency of personal data use -- particularly with reference to the European GDPR regulation. Key compliance operations and the perceived implementation challenges for the realization of these operations in current cloud infrastructure are outlined.
Christina Muller, Marcus Brandenburger, Christian Cachin, Pascal Felber · 6 authors
Blockchain technology promises to revolutionize manufacturing industries. For example, several supply-chain use-cases may benefit from transparent asset tracking and automated processes using smart contracts. Several real-world deployments exist where the transparency aspect of a blockchain is both an advantage and a disadvantage at the same time. The exposure of assets and business interaction represent critical risks. However, there are typically no confidentiality guarantees to protect the smart contract logic as well as the processed data. Trusted execution environments (TEE) are an emerging technology available in both edge or mobile-grade processors (e.g., Arm TrustZone) and server-grade processors (e.g., Intel SGX). TEEs shield both code and data from malicious attackers. This practical experience report presents TZ4Fabric, an extension of Hyperledger Fabric to leverage Arm TrustZone for the secure execution of smart contracts. Our design minimizes the trusted computing base executed by avoiding the execution of a whole Hyperledger Fabric node inside the TEE, which continues to run in untrusted environment. Instead, we restrict it to the execution of only the smart contract. The TZ4Fabric prototype exploits the open-source OP-TEE framework, as it supports deployments on cheap low-end devices (e.g., Raspberry Pis). Our experimental results highlight the performance trade-off due to the additional security guarantees provided by Arm TrustZone. TZ4Fabric will be released as open-source.
Mohamed El Ghazouani, My Ahmed El Kiram, Latifa Er-Rajy, Yassine El Khanboubi
With the rapid development of cloud storage, more and more cloud clients can store and access their data anytime, from anywhere and using any device. Data deduplication may be considered an excellent choice to ensure data storage efficiency. Although cloud technology offers many advantages for storage service, it also introduces security challenges, especially with regards to data integrity, which is one of the most critical elements in any system. A data owner should thus enable data integrity auditing mechanisms. Much research has recently been undertaken to deal with these issues. In this paper, we propose a novel blockchain-based method, which can preserve cloud data integrity checking with data deduplication. In our method, a mediator performs data deduplication on the client side, which permits a reduction in the amount of outsourced data and a decrease in the computation time and the bandwidth used between the enterprise and the cloud service provider. This method supports private and public auditability. Our method also ensures the confidentiality of a client's data against auditors during the auditing process.
In most practical cloud computing applications such as e-voting, auctions, health, and financial applications or cloud services in common, to prove the exactness of outsourced data is one of the major needs today. Most of the time, third party auditing is employed for this task. This auditing work is controlled by assigning the secret inputs to an entity trusted third party, or worker, who is liable for performing computations and hand over the result of the computation to the cloud users or clients. To verify the integrity of computations using traditional cryptographic techniques, the time required to generate and validate the proof is a major computation issue. This paper proposes an improved public auditing technique for multi-party computation to check the integrity of outsourced data using a cryptographic solution. Many researchers have given auditing protocols that generate and verify proof using a cryptographic solution. Most of these scheme uses Non-Interactive Zero-Knowledge Proof (NIZK) which are basically built on bilinear map technology. The verification time using these existing technique is computationally expensive which affect the performance of the auditing system. We propose an efficient protocol that verifies the result correctness using modern cryptographic technique Indistinguishability Obfuscation. The proposed system works in two phases, (i) auction and (ii) audit. During the auction phase, multiple clients share their encrypted bid value to the worker. The worker generates auction result and proof using Pedersen Commitment Scheme. The audit phase starts only after the completion of the auction phase which results in reduced verification time. During the Audit phase, clients can verify the integrity of results using NIZK with the IO technique. The results for reduced verification time in auction system have been presented. It is found that the performance of the proposed system has improved compared to the pertinent NIZK Proof technique. In our setting, we assumed that a worker is one of the trusted entity. By this notion, our protocol also guarantees privacy to the clients during the audit phase.
Laurens Van Hoye, Tim Wauters, Filip De Turck, Bruno Volckaert
Summary Organizations share data in a cross‐organizational context when they have the goal to derive additional knowledge by aggregating different data sources. The collaborations considered in this article are short‐lived and ad hoc, that is, they should be set up in a few minutes at most (e.g., in emergency scenarios). The data sources are located in different domains and are not publicly accessible. When a collaboration is finished, it is however unclear which exchanges happened. This could lead to possible disputes when dishonest organizations are present. The receipt of requests/responses could be falsely denied or their content could be point of discussion. In order to prevent such disputes afterwards, a logging mechanism is needed which generates a replicated irrefutable proof of which exchanges have happened during a single collaboration. Distributed database solutions can be taken from third parties to store the generated logs, but it can be difficult to find a party which is trusted by all participating organizations. Permissioned blockchains provide a solution for this as each organization can act as a consensus participant. Although the consensus mechanism of the permissioned blockchain Hyperledger Fabric (versions 1.0–1.4) is not fully decentralized, which clashes with the fundamental principle of blockchain, the framework is used in this article as an enabler to set up a distributed database, and a proposal for a logging mechanism is presented which does not require the third party to be fully trusted. A proof of concept is implemented which can be used to experiment with different data exchange setups. It makes use of generic web APIs and behaves according to a Markov chain in order to create a fully automated data exchange scenario where the participants explore their APIs dynamically. The resulting mechanism allows a data‐delivering organization to detect missing logs and to take action, for example, (temporarily) suspend collaboration. Furthermore, each organization is incentivized to follow the steps of the logging mechanism as it may lose access to data of others, otherwise. The created proof of concept is scaled to 10 organizations, which autonomously exchange different data types for 10 min, and evaluation results are presented accordingly.
This paper discusses the opportunities and challenges of applying blockchain technologies in the education sector. The key blockchain-in-education applications discussed are the digitalization and decentralization of educational certifications and the enhancement and motivation for lifelong learning. Some of the key challenges explored are data protection laws such as the General Data Protection Regulation and the California Consumer Protection Act, which pose impediments for application developers and scalability challenges that arise because of slow-speed blockchain transactions and the Scaling Trilemma. Additionally, market adoption and innovation challenges highlight that blockchain-in-education is a relatively immature innovation that governance bodies within educational institutions often disregard or perceive cautiously.
In this paper, we present Zecale, a general purpose SNARK proof aggregator that uses recursive composition of SNARKs. We start by introducing the notion of recursive composition of SNARKs, before introducing Zecale as a privacy preserving scalability solution. Then, we list application types that can emerge and be built with Zecale. Finally, we argue that such scalability solutions for privacy preserving state transitions are paramount to emulate "cash" on blockchain systems.
Context: Smart contracts and DApps are becoming increasingly important and widespread. DApps are often business-critical, and strong security guarantees must be ensured. However, developing safe and reliable smart contracts remains a challenging task. Despite growing literature, simple and actionable tools to address security issues are still lacking. Objective: This study identifies design patterns and best practices for DApp security. We categorize them into twelve critical areas based on their security goals and map them to the architecture of decentralized applications. For each item, we define concrete actions to support secure implementation. These are further structured into three security assurance checklists. Method: We analyze existing literature and manually review 224 security items, consolidating duplicates and harmonizing terminology. This process results in 84 unique items, divided into 36 design patterns and 48 best practices, further grouped into 12 categories. We also map the items into three checklists based on the development phase of DApp lifecycle. Finally, for each pattern and practice, we derive 374 actionable security tasks to guide secure development. Results: To the best of our knowledge, this is the most comprehensive and structured collection of DApp security items to date. The proposed framework and checklists help developers ensure the consistent and complete application of secure design principles. Conclusion: Focusing on Ethereum and Solidity, we present a comprehensive framework for improving DApp security. Our work supports ongoing efforts to reduce vulnerabilities in decentralized applications and provides developers with practical tools to build safer, more reliable systems.
In a fog computing environment, lots of devices need to be authenticated in order to keep the platform being secured. To solve this problem, we turn to blockchain techniques. Unlike the identification cryptographic scheme based on elliptic curves, the proposed 2-adic ring identity authentication scheme inherits the high verification efficiency and high key distribution of sequence ciphers of 2-adic ring theory, and this algorithm adds identity hiding function and trading node supervision function by design. The main designed application scenario of this solution is applicable to the consortium blockchain, and the master nodes are mutually trusting cooperative relations. The node transaction verification and block generation consensus algorithm designed in this solution can be implemented in a set of algorithms, which has higher verification efficiency and easier to be deployed than other solutions. This scheme can be widely used in the fog computing environment.
Open access
advanced mathematical theories
Advanced Steganography and Watermarking Techniques
An identity management including authentication and authorization in a network environment is a critical security factor. Various models for identity management have been developed continually, from the silo model to the federated model and to the recently introduced self-sovereign identity (SSI) model. In particular, SSI makes users manage their own information by themselves independently of any organizations. SSI utilizes the newly emerged blockchain technology and many studies of it are in progress. However, SSI has not had wide public use because of its low compatibility and inconvenience. This is because it involves an unfamiliar user experience and an immature process. To solve this problem, this paper proposes a new blockchain-based SSI model that complies with the popular and mature standard of OAuth 2.0. Using blockchain, the proposed model secures users’ data sovereignty where users can use and control their own information in a decentralized manner, instead of depending on a specific monopolistic service-providers. Users and clients who are familiar with the existing OAuth can easily accept the proposed model and apply it, which makes both usability and scalability of the model excellent. This paper confirmed the feasibility of the proposed model by implementing it and a security analysis was performed. The proposed model is expected to contribute to the expansion of both blockchain technology and SSI.
T. Rama Reddy, P. V. G. D. Prasad Reddy, Rayudu Srinivas, Ch. V. Raghavendran · 6 authors
Abstract Education acts as a soul in the overall societal development, in one way or the other. Aspirants, who gain their degrees genuinely, will help society with their knowledge and skills. But, on the other side of the coin, the problem of fake certificates is alarming and worrying. It has been prevalent in different forms from paper-based dummy certificates to replicas backed with database tampering and has increased to astronomic levels in this digital era. In this regard, an overlay mechanism using blockchain technology is proposed to store the genuine certificates in digital form and verify them firmly whenever needed without delay. The proposed system makes sure that the certificates, once verified, can be present online in an immutable form for further reference and provides a tamper-proof concealment to the existing certification system. To confirm the credibility of the proposed method, a prototype of blockchain-based credential securing and verification system is developed in ethereum test network. The implementation and test results show that it is a secure and feasible solution to online credential management system.
Open access
2 source records
Blockchain Technology Applications and Security
Retinal Imaging and Analysis
Advanced Steganography and Watermarking Techniques
With an increasing penetration of ubiquitous connectivity, the amount of data describing the actions of end-users has been increasing dramatically, both within the domain of the Internet of Things (IoT) and other smart devices. This has led to more awareness of users in terms of protecting personal data. Within the IoT, there is a growing number of peer-to-peer (P2P) transactions, increasing the exposure to security vulnerabilities, and the risk of cyberattacks. Blockchain technology has been explored as middleware in P2P transactions, but existing solutions have mainly focused on providing a safe environment for data trade without considering potential changes in interaction topologies. we present EdgeBoT, a proof-of-concept smart contracts based platform for the IoT built on top of the ethereum blockchain. With the Blockchain of Things (BoT) at the edge of the network, EdgeBoT enables a wider variety of interaction topologies between nodes in the network and external services while guaranteeing ownership of data and end users' privacy. in EdgeBoT, edge devices trade their data directly with third parties and without the need of intermediaries. This opens the door to new interaction modalities, in which data producers at the edge grant access to batches of their data to different third parties. Leveraging the immutability properties of blockchains, together with the distributed nature of smart contracts, data owners can audit and are aware of all transactions that have occurred with their data. we report initial results demonstrating the potential of EdgeBoT within the IoT. we show that integrating our solutions on top of existing IoT systems has a relatively small footprint in terms of computational resource usage, but a significant impact on the protection of data ownership and management of data trade.
Abstract Cloud computing based on OpenStack is widely used as a distributed computing platform. OpenStack has progressed at a rapid pace, incorporating a variety of service modules; it is supported by many companies, has a community of active developers, and a diverse user base. OpenStack uses message queue to coordinate and exchange operation and status information between services. OpenStack supports various message queue services including RabbitMQ, Qpid, and ZeroMQ, whereas its distribution architecture uses RabbitMQ. As an OpenStack’s message queue service, RabbitMQ runs on a controller node as a centralized service. In case of the centralized service, increased usage may cause slowed response times and security vulnerability. This paper proposes a Hybrid decentralized Practical byzantine fault tolerance Blockchain Framework with two-step verification for OpenStack message queue service. When compared to existing OpenStack message queue service, OpenStack with the proposed framework demonstrates identical reliability a faster response time by approximately 46.75% with a two-step verification process and decentralization approach. Additionally, a reduction in the security vulnerability in the OpenStack message queue information with saving the message queue information into each node by blockchain-based decentralized data duplication approach.
The need for data trading promotes the emergence of data market. However, in conventional data markets, both data buyers and data sellers have to use a centralized trading platform which might be dishonest. A dishonest centralized trading platform may steal and resell the data seller's data, or may refuse to send data after receiving payment from the data buyer. It seriously affects the fair data transaction and harm the interests of both parties to the transaction. To address this issue, we propose a novel blockchain-based data trading framework with Trusted Execution Environment (TEE) to provide a trusted decentralized platform for fair data trading. In our design, a blockchain network is proposed to realize the payments from data buyers to data sellers, and a trusted exchange is built by using a TEE for the first time to achieve fair data transmission. With these help, data buyers and data sellers can conduct transactions directly. We implement our proposed framework on Ethereum and Intel SGX, security analysis and experimental results have demonstrated that the framework proposed can effectively guarantee the fair completion of data tradings.
Artificial intelligence (AI) has a limitation in that it is only in the passive cognition area, so its operating process is not transparent; therefore, the technology relies on learning data. Since raw data for AI learning are processed and inspected manually to assure high quality for sophisticated AI learning, human errors are inevitable, and damaged and incomplete data and differences from the original data may lead to unexpected outputs of AI learning for which processed data are used. In this context, this research examines cases where AI learning data were inaccurate, in terms of cybersecurity, and the need for learning data management before machine learning through analysis of cybersecurity attack techniques, and we propose the direction of establishing a data-preserving AI system, which is a blockchain-based learning data environment model to verify the integrity of learning data. The data-preserving AI learning environment model is expected to prevent cyberattacks and data deterioration that may occur when data are provided and utilized in an open network for the processing and collection of raw data.
Digital identity is one of the biggest challenges in cyberspace. This field has been evolving for many decades with a number of Identity Management (IDM) models being proposed and employed; however, few were able to solve the issue of sovereignty of an identity and storage-control of its associated personal and confidential data. Self-Sovereign Identity (SSI) was introduced to solve this crucial issue offering a user full sovereignty of their identity and storage-control of their associated personal and confidential data. Alongside ownership of an identity, it maintains all private information in a Digital Wallet which is owned and controlled by the user. However, SSI is an emerging IDM, therefore it requires careful evaluation of various aspects of SSI for it to become an operative IDM. This paper proposes several specifications to evaluate any SSI solution. Subsequently, it analyses two emerging SSI solutions uPort and Sovrin. Finally, an evaluation of uPort and Sovrin SSI is performed utilising the proposed specifications, highlighting their strengths and limitations.
Sylvain Chatel, Apostolos Pyrgelis, Juan Ramón Troncoso-Pastoriza, Jean‐Pierre Hubaux
In the digital era, users share their personal data with service providers to obtain some utility, e.g., access to high-quality services. Yet, the induced information flows raise privacy and integrity concerns. Consequently, cautious users may want to protect their privacy by minimizing the amount of information they disclose to curious service providers. Service providers are interested in verifying the integrity of the users' data to improve their services and obtain useful knowledge for their business. In this work, we present a generic solution to the trade-off between privacy, integrity, and utility, by achieving authenticity verification of data that has been encrypted for offloading to service providers. Based on lattice-based homomorphic encryption and commitments, as well as zero-knowledge proofs, our construction enables a service provider to process and reuse third-party signed data in a privacy-friendly manner with integrity guarantees. We evaluate our solution on different use cases such as smart-metering, disease susceptibility, and location-based activity tracking, thus showing its versatility. Our solution achieves broad generality, quantum-resistance, and relaxes some assumptions of state-of-the-art solutions without affecting performance.
There is a great interest in many approaches towards blockchain in providing a solution to record transactions in a decentralized way. However, there are some limitations when storing large files or documents on the blockchain. In order to meet the requirements of storing relatively large data, a decentralized storage medium is produced. IPFS is a distributed file system which is content-addressable. It works very similar to the blockchain network. There are some attempts which take advantage of the blockchain concept and IPFS to design new approaches. Unfortunately, there are some inefficiencies in sharing data using the combination of IPFS and blockchain. In this paper, we proposed a secure file sharing system that brings a distributed access control and group key management by the adoption of the IPFS proxy. The IPFS proxy which plays an important role in the design is adopted to take responsibility for the control policies. The combination of the IPFS server and the blockchain network with the adoption of the IPFS proxy make a secure file sharing system which the members on the system can create new groups or join different groups by their own choice. Although there is no access control mechanism in IPFS server and blockchain network, the secure file sharing system manages the access control policies. The members access files only belong to the group they authorized.
Conventional certificate verification, whether paper-based or backed by a centralized digital registry, remains exposed to forgery, single points of failure, and slow manual cross-checking between issuers, holders, and verifiers. This paper presents a decentralized, blockchain-based framework for issuing, storing, and verifying academic and professional certificates that addresses these weaknesses without placing the full document on-chain. Each certificate is reduced to a SHA-256 hash, signed with the issuing institution's RSA private key, and recorded through an Ethereum smart contract, while the original file is retained off-chain on IPFS and referenced by its Content Identifier. Only institutions that pass a unanimous, vote-based onboarding process administered by a validator consortium are permitted to issue certificates, which constrains the system to a trusted-issuer model while preserving decentralization across the validator set. A hash-mapped Bloom Filter sits in front of the blockchain query path and performs a fast probabilistic existence check, allowing forged or non-existent certificates to be rejected before an on-chain lookup is triggered. A prototype was implemented with Solidity smart contracts on the Ethereum Sepolia testnet, a Node.js/Web3.js application layer, and a React.js frontend with MetaMask-based authentication. Evaluation on the testnet shows that the Bloom Filter pre-check lowers the average lookup time for invalid certificates by roughly 87%, keeps verification of valid certificates under two seconds end-to-end, holds the false-positive rate below 0.5% for up to 50,000 stored certificate hashes, and reduces the gas cost of issuing a certificate to approximately 4.57 USD. These results indicate that combining consortium governance, cryptographic hashing, and probabilistic filtering yields a certificate validation pipeline that is simultaneously tamper-resistant, low-cost, and fast enough for real-time institutional use.