With the wide application of cloud storage, cloud security has become a crucial concern. Related works have addressed security issues such as data confidentiality and integrity, which ensure that the remotely stored data are well maintained by the cloud. However, how to define zero-knowledge proof algorithms for stored data integrity check has not been formally defined and investigated. We believe that it is important that the cloud server is unable to reveal any useful information about the stored data. In this paper, we introduce a novel definition of data privacy for integrity checks, which describes very high security of a zero-knowledge proof. We found that all other existing remote integrity proofs do not capture this feature. We provide a comprehensive study of data privacy and an integrity check algorithm that captures data integrity, confidentiality, privacy, and soundness.
The agent based approach is a well established methodology to model distributed intelligent systems. Multi-Agent Systems (MAS) are increasingly employed in applications dealing with safety and information critical tasks (e.g., in eHealth, financial, and energy domains). Therefore, transparency and the trustworthiness of the agents and their behaviors must be enforced. For example, employing reputation based mechanisms can promote the development of trust. Nevertheless, besides recent early stage studies, the existing methods and systems are still unable to guarantee the desired accountability and transparency adequately. In line with the recent trends, we advocate that combining blockchain technology (BCT) and MAS can achieve the distribution of the trust, removing the need for trusted third parties (TTP), potential single points of failure. This paper elaborates on the notions of trust, BCT, MAS, and their integration. Furthermore, to attain a trusted environment, this manuscript details the design and implementation of a system reconciling MAS (based on the Java Agent DEvelopment Framework (JADE)) and BTC (based on Hyperledger Fabric). In particular, the agents’ interactions, computation, tracking the reputation, and possible policies for disagreement-management are implemented via smart contracts and stored on an immutable distributed ledger. The results obtained by the presented system and similar solutions are also discussed. Finally, ethical implications (i.e., opportunities and challenges) are elaborated before concluding the paper.
Danilo Francati, Giuseppe Ateniese, Abdoulaye Faye, Andrea Maria Milazzo · 7 authors
The cloud changed the way we manage and store data. Today, cloud storage services offer clients an infrastructure that allows them a convenient source to store, replicate, and secure data online. However, with these new capabilities also come limitations, such as lack of transparency, limited decentralization, and challenges with privacy and security. And, as the need for more agile, private and secure data solutions continues to grow exponentially, rethinking the current structure of cloud storage is mission-critical for enterprises. By leveraging and building upon blockchain's unique attributes, including immutability, security to the data element level, distributed (no single point of failure), we have developed a solution prototype that allows data to be reliably stored while simultaneously being secured, with tamper-evident auditability, via blockchain. The result, Audita, is a flexible solution that assures data protection and solves challenges such as scalability and privacy. Audita works via an augmented blockchain network of participants that include storage-nodes and block-creators. In addition, it provides an automatic and fair challenge system to assure that data is distributed and reliably and provably stored. While the prototype is built on Quorum, the solution framework can be used with any blockchain platform. The benefit is a system that is built to grow along with the data needs of enterprises, while continuing to build the network via incentives and solving for issues such as auditing and outsourcing.
Eman Daraghmi, Yousef‐Awwad Daraghmi, Shyan‐Ming Yuan
Although blockchain technology was first introduced through Bitcoin, extending its usage to non-financial applications, such as managing academic records, is a new mission for recent research to balance the needs for increasing data privacy and the regular interaction among students and universities. In this paper, a design for a blockchain-based system, namely UniChain, for managing Electronic Academic Records (EARs) is proposed. UniChain is designed to improve the current management systems as it provides interoperable, secure, and effective access to EARs by students, universities, and other third parties, while keeping the students’ privacy. UniChain employs timed-based smart contracts for governing transactions and controlling access to EARs. It adopts advanced encryption techniques for providing further security. This work proposes a new incentive mechanism that leverages the degree of universities regarding their efforts on maintaining academic records and creating new blocks. Extensive experiments were conducted to evaluate the UniChain performance, and the results indicate the efficiency of the proposal in handling a large dataset at low latency.
Distributed ledger technology offers numerous desirable attributes to\napplications in the enterprise context. However, with distributed data and\ndecentralized computation on a shared platform, privacy and confidentiality\nchallenges arise. Any design for an enterprise system needs to carefully cater\nfor use case specific privacy and confidentiality needs. With the goal to\nfacilitate the design of enterprise solutions, this paper aims to provide a\nguide to navigate and aid in decisions around common requirements and\nmechanisms that prevent the leakage of private and confidential information. To\nfurther contextualize key concepts, the design guide is then applied to three\nenterprise DLT protocols: Hyperledger Fabric, Corda, and Quorum.\n
Wouter Lueks, Bogdan Kulynych, Jules Fasquelle, Simon Le Bail-Collet · 5 authors
Zero-knowledge proofs are an essential building block in many privacy-preserving systems. However, implementing these proofs is tedious and error-prone. In this paper, we present zksk, a well-documented Python library for defining and computing sigma protocols: the most popular class of zero-knowledge proofs. In zksk, proofs compose: programmers can convert smaller proofs into building blocks that then can be combined into bigger proofs. zksk features a modern Python-based domain-specific language. This makes possible to define proofs without learning a new custom language, and to benefit from the rich Python syntax and ecosystem. The library is available at https://github.com/spring-epfl/zksk
We present a new primitive supporting file replication in distributed storage networks (DSNs) called a Public Incompressible Encoding (PIE). PIEs operate in the challenging public DSN setting where files must be encoded and decoded with public randomness-i.e., without encryption-and retention of redundant data must be publicly verifiable. They prevent undetectable data compression, allowing DSNs to use monetary rewards or penalties in incentivizing economically rational servers to properly replicate data. Their definition also precludes critical, demonstrated attacks involving parallelism via ASICs and other custom hardware. Our PIE construction is the first to achieve experimentally validated near-optimal performance-within a factor of 4 of optimal by one metric. It also allows decoding orders of magnitude faster than encoding, unlike other comparable constructions. We achieve this high security and performance using a graph construction called a Dagwood Sandwich Graph (DSaG), built from a novel interleaving of depth-robust graphs and superconcentrators. PIEs' performance makes them appealing for DSNs, such as the proposed Filecoin system and Ethereum data sharding. Conversely, their near-optimality establishes concerning bounds on the practical financial and energy costs of DSNs allowing arbitrary data.
The adoption of permissioned blockchain networks in enterprise settings has seen an increase in growth over the past few years. While encouraging, this is leading to the emergence of new data, asset and process silos limiting the potential value these networks bring to the broader ecosystem. Mechanisms for enabling network interoperability help preserve the benefits of independent sovereign networks, while allowing for the transfer or sharing of data, assets and processes across network boundaries. However, a naive approach to interoperability based on traditional point-to-point integration is insufficient for preserving the underlying trust decentralized networks provide. In this paper, we lay the foundation for an approach to interoperability based on a communication protocol that derives trust from the underlying network consensus protocol. We present an architecture and a set of building blocks that can be adapted for use in a range of network implementations and demonstrate a proof-of-concept for trusted data-sharing between two independent trade finance and supply-chain networks, each running on Hyperledger Fabric. We show how existing blockchain deployments can be adapted for interoperation and discuss the security and extensibility of our architecture and mechanisms.
Blockchain is an emerging technology that promises many exciting applications in various fields, including financial, medical, energy, and logistics management. However, there are still some limitations in the existing blockchain framework that prevents its widespread adoption in the commercial world. One important limitation is the storage requirement, wherein each blockchain node has to store a copy of the distributed ledger. Thus, as the number of transactions increases, this storage requirement grows quadratically, eventually limiting the scalability of a blockchain system. Moreover, the public ledger in a blockchain framework allows anyone in the network to audit the transaction, which may not be favourable in some privacy-sensitive applications. In this paper, a secret-sharing scheme is proposed to reduce the size of the blockchain transactions. Each transaction block is divided into t parts, and the size of each part is 1/ t size of transaction block. We use the secret-sharing mechanism to share t parts into n shares. Hence, each node stores not one transaction but one share in the blockchain system. The proposed scheme can eventually reduce the storage cost of a blockchain transaction by 1/ t without introducing an additional recovery communication cost; however, robustness is reduced in node failure as a tradeoff. Meanwhile, the proposed scheme was more efficient and secure compared to other state-of-the-art schemes that aim to reduce blockchain storage for industrial big data.
Mirko Koscina, David Manset, Claudia Negri-Ribalta, Octavio Pérez Kempner
We propose a new healthcare data exchange platform for research centers, hospitals and healthcare institutions. Our model is based on a federated blockchain network that interconnect the healthcare institutions and orchestrate the data life cycle from the data publication to the data consumption. The blockchain is responsabible to keep the traceability of the whole process and we use a specially designed smart contract to control the data sharing process. Moreover, we provide the means to enforce GDPR and thus achieve a GDPR compliant model.
Cloud computing has made the software development process fast and flexible but on the other hand it has contributed to increasing security attacks. Employees who manage the data in cloud companies may face insider attack, affecting their reputation. They have the advantage of accessing the user data by interacting with the authentication mechanism. The primary aim of this research paper is to provide a novel secure authentication mechanism by using Blockchain technology for cloud databases. Blockchain makes it difficult to change user login credentials details in the user authentication process by an insider. The insider is not able to access the user authentication data due to the distributed ledger-based authentication scheme. Activity of insider can be traced and cannot be changed. Both insider and outsider user's are authenticated using individual IDs and signatures. Furthermore, the user access control on the cloud database is also authenticated. The algorithm and theorem of the proposed mechanism have been given to demonstrate the applicability and correctness.The proposed mechanism is tested on the Scyther formal system tool against denial of service, impersonation, offline guessing, and no replay attacks. Scyther results show that the proposed methodology is secure cum robust.
Open access
Blockchain Technology Applications and Security
Cloud Data Security Solutions
Advanced Steganography and Watermarking Techniques
With the wide-spread use of blockchain technology, Byzantine fault-tolerant (BFT) protocols are explored as a means to achieve consensus on which transactions should be processed next. BFT protocols are not a one-size-fits-all solution: they should be chosen according to the blockchain's use case, which can range from supply chain management to decentralised storage, requiring specialisation e.g. regarding throughput, latency, or level of decentralisation. Previously, consensus protocols were usually hardcoded into the blockchain infrastructure and could not be exchanged, therefore inhibiting flexible use of an otherwise generic blockchain infrastructure. Hyperledger Fabric claims to provide modular consensus and support for crash-fault and Byzantine fault tolerant protocols. However, integrating a BFT protocol has shown that Fabric's architecture is currently not well-suited for this fault model as it requires substantial changes and thereby breaks Fabric's modularity. This also has to be repeated for each integrated BFT protocol. In this paper, we present Bloxy, a blockchain-aware trusted proxy running on the replica that encapsulates all BFT client functionality. Bloxy enables transparent access to generic BFT frameworks and preserves Fabric's modularity even for the Byzantine fault model. It runs inside a trusted execution environment based on Intel's Software Guard Extensions. Bloxy offers blockchain-specific communication mechanisms as well as short-term block storage to handle crashes or disconnects to ensure that all nodes receive block updates. We implemented two Bloxy-based ordering services based on PBFT and the hybrid BFT protocol Hybster. Our evaluation shows that our approach increases throughput by up to 71% compared to directly integrated BFT protocols.
The term “smart contracts” has become ubiquitous to describe an enormous number of programs uploaded to the popular Ethereum blockchain system. Despite rapid growth of the smart contract ecosystem, errors and exploitations have been constantly reported from online contract systems, which has put financial stability at risk with losses totaling millions of US dollars. Most existing research focuses on pinpointing specific types of vulnerabilities using known patterns. However, due to the lack of awareness of the inherent nondeterminism in the Ethereum blockchain system and how it affects the funds transfer of smart contracts, there can be unknown vulnerabilities that may be exploited by attackers to access numerous online smart contracts. \n \nIn this paper, we introduce a methodical approach to understanding the inherent nondeterminism in the Ethereum blockchain system and its (unwanted) influence on contract payments. We show that our new focus on nondeterminism-related smart contract payment bugs captures the root causes of many common vulnerabilities without relying on any known patterns and also encompasses recently disclosed issues that are not handled by existing research. To do so, we introduce techniques to systematically model components in the contract execution context and to expose various nondeterministic factors that are not yet fully understood. We further study how these nondeterministic factors impact contract funds transfer using information flow tracking. The technical challenge of detecting nondeterministic payments lies in discovering the contract global variables subtly affected by read-write hazards because of unpredictable transaction scheduling and external callee behavior. We show how to augment and instrument a contract program into a representation that simulates the execution of a large subset of the contract behavior. The instrumented code is then analyzed to flag nondeterministic global variables using off-the-shelf model checkers. \n \nWe implement the proposed techniques as a practical tool named NPChecker (Nondeterministic Payment Checker) and evaluate it on 30K online contracts (3,075 distinct) collected from the Ethereum mainnet. NPChecker has successfully detected nondeterministic payments in 1,111 online contracts with reasonable cost. Further investigation reports high precision of NPChecker (only four false positives in a manual study of 50 contracts). We also show that NPChecker unveils contracts vulnerable to recently-disclosed attack vectors. NPChecker can identify all six new vulnerabilities or variants of common smart contract vulnerabilities that are missed by existing research relying on a “contract vulnerability checklist.”
The intelligent vehicle (IV) has become a promising technology that could revolutionize our life in smart cities sooner or later. However, it yet suffers from many security vulnerabilities. Traditional security methods are incapable to secure the IV data sharing against malicious attacks. Blockchain, as expected by both research and industry communities, has emerged as a good solution to address these issues. The major issues in IV data sharing are trust, data accuracy and reliability of data sharing in the communication channel. Blockchain technology, previously working for the cryptocurrency, has recently applied to build trust and reliability in peer-to-peer networks with similar topologies of IV data sharing. In this chapter, we present a new framework, namely biometric blockchain (BBC), for secure IV data sharing. In our new scheme, biometric information is exploited as a cue to record who is responsible in the data sharing activities, while the proposed BBC technology serves as the backbone of the IV data-sharing architecture. Hence, the proposed BBC technology provides a more reliable trust environment between the vehicles while personal identities are traceable in the proposed new scheme.
Marcos Vinicius M. R. Souza, Hélio Crestana Guardia
Advances in ubiquitous computing and in the Internet of things (IoT) bring new challenges to access control systems, such as not having to rely on a centralized trusted party, and the ability to use contextual data. Such characteristics may be required to enable IoT services in smart homes and cities, and in electronic health systems. In these environments, service-based device to device interactions reinforce the need for flexible and scalable authenticity and confidentiality mechanisms. This work presents an access control model to address such challenges using a blockchain infrastructure. In the proposed model, services and contextual data are defined using smart contracts, and blockchain logs are used for reliable information management. Assets are associated with permissions, and their transfers prove access control rights in service invocation requests. A reference implementation on Hyperledger shows the viability of the model.
Zoltán Lux, Felix Beierle, Sebastian Zickau, Sebastian Göndör
Self-sovereign Identity (SSI) powered by distributed ledger technologies\nenables more flexible and faster digital identification workflows, while at the\nsame time limiting the control and influence of central authorities. However, a\nglobal identity solution must be able to handle myriad credential types from\nmillions of issuing organizations. As metadata about types of digital\ncredentials is readable by everyone on the public permissioned ledger with\nHyperledger Indy, anyone could find relevant and trusted credential types for\ntheir use cases by looking at the records on the blockchain. To this date, no\nefficient full-text search mechanism exists that would allow users to search\nfor credential types in a simple and efficient fashion tightly integrated into\ntheir applications. In this work, we propose a full-text search framework based\non the publicly available metadata on the Hyperledger Indy ledger for\nretrieving matching credential types. The proposed solution is able to find\ncredential types based on textual input from the user by using a full-text\nsearch engine and maintaining a local copy of the ledger. Thus, we do not need\nto rely on information about credentials coming from a very large candidate\npool of third parties we would need to trust, such as the website of a company\ndisplaying its own identifier and a list of issued credentials. We have also\nproven the feasiblity of the concept by implementing and evaluating a prototype\nof the full-text credential metadata search service.\n
Asma Lahbib, Khalifa Toumi, Anis Laouiti, Steven Martin
While smart factories are becoming widely recognized as a fundamental concept of Industry 4.0, their implementation has posed several challenges insofar that they generate, process, and exchange vast amounts of security critical and privacy sensitive data, which makes them attractive targets of attacks and unauthorized access. Security requirements in such scenario include integrity, confidentiality, traceability and notarization of exchanged data in the one hand plus access control, privacy and trust in the other one. In this context, we design a distributed resource management framework using the emerging smart contracts technology for Industry 4.0 applications and more specifically for smart factories environments. This last, named DRMF, utilizes three Ethereum smart contracts specifically a Governance Contract (GC), an Access Contract (AC) and a Lookup Contract (LC) that are respectively responsible for the registration of new joining entities as well as those requesting consensus partaking permissions, second the dynamic access authorization and third the mapping between the required services and contracts ensuring their management. Using the blockchain technology, this framework is expected to achieve distributed, flexible, verifiable and trustworthy access control in addition to a transparent, traceable and notarized resource usage and sharing. Results from a real implementation plus performance evaluation prove the proposed concept and demonstrate its feasibility.
Huan Zhou, Xue Ouyang, Jinshu Su, Cees de Laat · 5 authors
There lacks trust between the cloud customer and provider to enforce traditional cloud SLA (Service Level Agreement) where the blockchain technique seems a promising solution. However, current explorations still face challenges to prove that the off-chain SLO (Service Level Objective) violations really happen before recorded into the on-chain transactions. In this paper, a witness model is proposed implemented with smart contracts to solve this trust issue. The introduced role, "Witness", gains rewards as an incentive for performing the SLO violation report, and the payoff function is carefully designed in a way that the witness has to tell the truth, for maximizing the rewards. This fact that the witness has to be honest is analyzed and proved using the Nash Equilibrium principle of game theory. For ensuring the chosen witnesses are random and independent, an unbiased selection algorithm is proposed to avoid possible collusions. An auditing mechanism is also introduced to detect potential malicious witnesses. Specifically, we define three types of malicious behaviors and propose quantitative indicators to audit and detect these behaviors. Moreover, experimental studies based on Ethereum blockchain demonstrate the proposed model is feasible, and indicate that the performance, ie, transaction fee, of each interface follows the design expectations.
Hamza Baqa, Nguyen B. Truong, Noël Crespi, Gyu Myoung Lee · 5 authors
The emerging Blockchain (BC) and Distributed Ledger technologies have come to impact a variety of domains, from capital market sectors to digital asset management in the Internet of Things (IoT). As a result, more and more BC-based decentralized applications for numerous cross-domain services have been developed. These applications implement specialized decentralized computer programs called Smart Contracts (SCs) which are deployed into BC frameworks. Although these SCs are open ato public, it is challenging to discover and utilize such SCs for a wide range of usages from both systems and end-users because such SCs are already compiled in form of byte-codes without any associated meta-data. This motivates us to propose a solution called Semantic SC (SSC) which integrates RESTful semantic web technologies in SCs, deployed on the Ethereum Blockchain platform, for indexing, browsing and annotating such SCs. The solution also exposes the relevant distributed ledgers as Linked Data for enhancing the discovery capability. To achieve this goal, the OWL-S service ontology is extended by incorporating some domain specific terminologies, which are used in the development of the proposed SSCs. As a result, SSC can be utilized to enrich queries for a domain-specific terms across multiple distributed ledgers, which greatly increases the discovery capability of decentralized IoT applications and services. Contribution in standardization is also discussed. We believe that our research work takes the first steps towards connecting BC-based decentralized services with semantic web services in order to provide better IoT ecosystems.
Abstract South Korea invests a budget of trillions in national R&D projects every year, and has achieved excellent performance doing so each year. However, since the projects are planned, evaluated, and managed by different departments and institutions, duplicate planning and submission leads to insufficient sharing of research results. Currently, the National Technology Information Service (NTIS) inspects project duplication based on keywords, which leads to duplicate planning among departments and closed management of research results. Since the NTIS builds in centralized systems, the inspection systems supports one-way management for duplication checking and information sharing. Therefore, we propose a new platform, called the Trusted Information Project Platform (TIP-Platform), for easily checking for project duplication, sharing research results, and updating research results. TIP-Platform adopts a new concept for user authority setting, the distributed ledger structure, transaction structure, and service. For the adaption, the TIP-Platform uses blockchain technology that performs recording and management via blocks by distributing the right to record and managing transactions. This platform makes it easy for anyone to view and use project-related information such as research results and duplication review. In this paper, we describe how the TIP-Platform can achieve excellent research results through information sharing of a project. This platform needs to be based on trust, because it shares information and continually updates information.
In December 2015, a bounty emerged to establish both reliable communication and secure transfer of value between the Dogecoin and Ethereum blockchains. This prized "Dogethereum bridge" would allow parties to "lock" a DOGE coin on Dogecoin and in exchange receive a newly minted WOW token in Ethereum. Any subsequent owner of the WOW token could burn it and, in exchange, earn the right to "unlock" a DOGE on Dogecoin. We describe an efficient, trustless, and retrofitting Dogethereum construction which requires no fork but rather employs economic collateral to achieve a "lock" operation in Dogecoin. The protocol relies on bulletproofs, Truebit, and parametrized tokens to efficiently and trustlessly relay events from the "true" Dogecoin blockchain into Ethereum. The present construction not only enables cross-platform exchange but also allows Ethereum smart contracts to trustlessly access Dogecoin. A similar technique adds Ethereum-based smart contracts to Bitcoin and Bitcoin data to Ethereum smart contracts.
The Cloud Computing Paradigm simplified the IT infrastructure management thereby making the organiza-tions and enterprises to rapidly migrate from conventional model to service driven model. The service driven model allows the users to access, maintain and backup the files from remote location over the internet through the central-ized cloud service providers. Inspite of major advantages, there are some concerns for the safety and privacy risks of organizational and users sensitive information in cloud stor-age. The existing service oriented model uses distributed key management which encrypts the data and stores it in cloud servers to provide the authentication to data, but it addresses challenges in identifying ownership of data, boot-strapping problem and securing the keys. The proposed system uses block chain, a distributed ledger for user authentication in cloud server and Hash graph with asynchronous byzantine fault tolerance algorithm is proposed for replicat-ed state machines with guaranteed Byzantine fault-tolerance and it can be utilized in the IT Infrastructure envi-ronment which solves the hassles of maintaining security keys
Nadine Havelange, Michel Dumontier, Birgit Wouters, Jona Linde · 7 authors
In this paper we present our preliminary work on monitoring data License accoUntability and CompliancE (LUCE). LUCE is a blockchain platform solution designed to stimulate data sharing and reuse, by facilitating compliance with licensing terms. The platform enables data accountability by recording the use of data and their purpose on a blockchain-supported platform. LUCE allows for individual data to be rectified and erased. In doing so LUCE can ensure subjects' General Data Protection Regulation's (GDPR) rights to access, rectification and erasure. Our contribution is to provide a distributed solution for the automatic management of data accountability and their license terms.