Muhamed Turkanović, Marko Hölbl, Kristjan Košič, Marjan Heričko · 5 authors
Blockchain technology enables the creation of a decentralized environment, where transactions and data are not under the control of any third party organization. Any transaction ever completed is recorded in a public ledger in a verifiable and permanent way. Based on the blockchain technology, we propose a global higher education credit platform, named EduCTX. This platform is based on the concept of the European Credit Transfer and Accumulation System (ECTS). It constitutes a globally trusted, decentralized higher education credit, and grading system that can offer a globally unified viewpoint for students and higher education institutions (HEIs), as well as for other potential stakeholders, such as companies, institutions, and organizations. As a proof of concept, we present a prototype implementation of the environment, based on the open-source Ark Blockchain Platform. Based on a globally distributed peer-to-peer network, EduCTX will process, manage, and control ECTX tokens, which represent credits that students gain for completed courses, such as ECTS. HEIs are the peers of the blockchain network. The platform is a first step toward a more transparent and technologically advanced form of higher education systems. The EduCTX platform represents the basis of the EduCTX initiative, which anticipates that various HEIs would join forces in order to create a globally efficient, simplified, and ubiquitous environment in order to avoid language and administrative barriers. Therefore, we invite and encourage HEIs to join the EduCTX initiative and the EduCTX blockchain network.
In this letter we propose Meta-key, a data-sharing mechanism that enables users share their encrypted data under a blockchain-based decentralized storage architecture. All the data-encryption keys are encrypted by the owner's public key and put onto the blockchain for safe and secure storage and easy key-management. Encrypted data are stored in dedicated storage nodes and proxy re-encryption mechanism is used to ensure secure data-sharing in the untrusted environment. Security analysis of our model shows that the proxy re-encryption adopted in our system is naturally free from collusion-attack due to the specific architecture of Meta-key.
We summarize the results and perspectives from a companion article, where we presented and evaluated an alternative architecture for data storage in distributed networks. We name the bio-inspired architecture RAIN, and it offers file storage service that, in contrast with current centralized cloud storage, has privacy by design, is open source, is more secure, is scalable, is more sustainable, has community ownership, is inexpensive, and is potentially faster, more efficient, and more reliable. We propose that a RAIN-style architecture could form the backbone of the Internet of Things that likely will integrate multiple current and future infrastructures ranging from online services and cryptocurrency to parts of government administration.
David Froelicher, Patricia Egger, João Sá Sousa, Jean Louis Raisaro · 8 authors
Abstract Current solutions for privacy-preserving data sharing among multiple parties either depend on a centralized authority that must be trusted and provides only weakest-link security (e.g., the entity that manages private/secret cryptographic keys), or leverage on decentralized but impractical approaches (e.g., secure multi-party computation). When the data to be shared are of a sensitive nature and the number of data providers is high, these solutions are not appropriate. Therefore, we present U n L ynx , a new decentralized system for efficient privacy-preserving data sharing. We consider m servers that constitute a collective authority whose goal is to verifiably compute on data sent from n data providers. U n L ynx guarantees the confidentiality, unlinkability between data providers and their data, privacy of the end result and the correctness of computations by the servers. Furthermore, to support differentially private queries, U n L ynx can collectively add noise under encryption. All of this is achieved through a combination of a set of new distributed and secure protocols that are based on homomorphic cryptography, verifiable shuffling and zero-knowledge proofs. U n L ynx is highly parallelizable and modular by design as it enables multiple security/privacy vs. runtime tradeoffs. Our evaluation shows that U n L ynx can execute a secure survey on 400,000 personal data records containing 5 encrypted attributes, distributed over 20 independent databases, for a total of 2,000,000 ciphertexts, in 24 minutes.
Blockchain technology has evolved from being an immutable ledger of\ntransactions for cryptocurrencies to a programmable interactive the environment\nfor building distributed reliable applications. Although, blockchain technology\nhas been used to address various challenges, to our knowledge none of the\nprevious work focused on using blockchain to develop a secure and immutable\nscientific data provenance management framework that automatically verifies the\nprovenance records. In this work, we leverage blockchain as a platform to\nfacilitate trustworthy data provenance collection, verification, and\nmanagement. The developed system utilizes smart contracts and open provenance\nmodel (OPM) to record immutable data trails. We show that our proposed\nframework can efficiently and securely capture and validate provenance data,\nand prevent any malicious modification to the captured data as long as the\nmajority of the participants are honest.\n
Secret sharing is an important component of cryptography protocols and has a wide range of practical applications. However, the existing secret sharing schemes cannot apply to computationally weak devices and cannot efficiently guarantee fairness. In this study, a novel outsourcing secret sharing scheme is proposed. In the setting of outsourcing secret sharing, clients only need a small amount of decryption and verification operations, while the expensive reconstruction computation and verifiable computation can be outsourced to cloud service providers (CSP). The scheme does not require complex interactive argument or zero‐knowledge proof. The malicious behaviour of clients and CSP can be detected in time. Moreover, the CSP cannot get any useful information about the secret, and it is fair for every client to obtain the secret. At the end of this study, the authors prove the security of the proposed scheme and compare it with other secret sharing schemes.
Abstract—As data is having an increasingly relevant role<br> in dierent business fields, ensuring integrity has become<br> fundamental. Modern databases rely on transaction history<br> written on redo logs to allow for data restore. However, if<br> redo logs are (maliciously) forged, data can actually be lost or<br> altered. Due its strong data integrity guarantees, blockchain<br> technology can be employed to ensure log integrity, but its<br> current performance limitations hinder actual exploitations.<br> In previous work, we proposed a layered blockchain-based<br> architecture for distributed (federated) database redo logs: a<br> fast first layer blockchain, anchored to a secure second layer<br> blockchain, based on proof-of-work to achieve strong integrity.<br> Here, we present an implementation and an experimental<br> evaluation of a prototype of that architecture, which employs a<br> total consensus algorithm on the first layer blockchain. Finally,<br> to improve availability and scalability, we refine our solution<br> by investigating, respectively, a Byzantine Fault Tolerant consensus<br> and a Distributed Hash Table solution to shard the first<br> layer blockchain ledger among available nodes.
Carlos Oliver, Alessandro Ricottone, Pericles Philippopoulos
We propose a proof-of-work algorithm that rewards blockchain miners for using computational resources to solve NP-complete puzzles. The resulting blockchain will publicly store and improve solutions to problems with real world applications while maintaining a secure and fully functional transaction ledger.
Anand Kumar Mishra, Shrikant Tiwari, Kanchan Naithani, Amit Kumar Tyagi
Blockchain has drawn attention as the next-generation financial technology due to its security that suits the informatization era. In particular, it provides security through the authentication of peers that share virtual cash, encryption, and the generation of hash value. According to the global financial industry, the market for security-based blockchain technology is expected to grow to about USD 20 billion by 2020. In addition, blockchain can be applied beyond the Internet of Things (IoT) environment; its applications are expected to expand. Cloud computing has been dramatically adopted in all IT environments for its efficiency and availability. In this paper, we discuss the concept of blockchain technology and its hot research trends. In addition, we will study how to adapt blockchain security to cloud computing and its secure solutions in detail.
Open access
2 source records
Blockchain Technology Applications and Security
IoT and Edge/Fog Computing
Advanced Steganography and Watermarking Techniques
The Intelligent vehicle (IV) is experiencing revolutionary growth in research and industry, but it still suffers from many security vulnerabilities. Traditional security methods are incapable to provide secure IV communication. The major issues in IV communication, are trust, data accuracy and reliability of communication data in the communication channel. Blockchain technology works for the crypto currency, Bit-coin, which is recently used to build trust and reliability in peer-to-peer networks having similar topologies as IV Communication. In this paper, we are proposing, Intelligent Vehicle-Trust Point (IV-TP) mechanism for IV communication among IVs using Blockchain technology. The IVs communicated data provides security and reliability using our proposed IV-TP. Our IV-TP mechanism provides trustworthiness for vehicles behavior, and vehicles legal and illegal action. Our proposal presents a reward based system, an exchange of some IV-TP among IVs, during successful communication. For the data management of the IV-TP, we are using blockchain technology in the intelligent transportation system (ITS), which stores all IV-TP details of every vehicle and is accessed ubiquitously by IVs. In this paper, we evaluate our proposal with the help of intersection use case scenario for intelligent vehicles communication.
The Intelligent vehicle (IV) is experiencing revolutionary growth in research and industry, but it still suffers from many security vulnerabilities. Traditional security methods are incapable to provide secure IV data sharing. The major issues in IV data sharing are trust, data accuracy and reliability of data sharing data in the communication channel. Blockchain technology works for the crypto currency, Bit-coin, which is recently used to build trust and reliability in peer-to-peer networks having similar topologies as IV Data sharing. In this paper, we have proposed Intelligent Vehicle data sharing we are proposing a trust environment based Intelligent Vehicle framework. In proposed framework, we have use the blockchain technology as backbone of the IV data-sharing environment. The blockchain technology is provide the trust environment between the vehicles with the based on proof of driving.
Joshua Lind, Christian Priebe, Divya Muthukumaran, Dan O’Keeffe · 12 authors
Trusted execution support in modern CPUs, as offered by Intel SGX enclaves , can protect applications in untrusted environments. While prior work has shown that legacy applications can run in their entirety inside enclaves, this results in a large trusted computing base (TCB). Instead, we explore an approach in which we partition an applica- tion and use an enclave to protect only security-sensitive data and functions, thus obtaining a smaller TCB. We describe Glamdring , the first source-level parti- tioning framework that secures applications written in C using Intel SGX. A developer first annotates security- sensitive application data. Glamdring then automatically partitions the application into untrusted and enclave parts: (i) to preserve data confidentiality, Glamdring uses dataflow analysis to identify functions that may be ex- posed to sensitive data; (ii) for data integrity, it uses back- ward slicing to identify functions that may affect sensitive data. Glamdring then places security-sensitive functions inside the enclave, and adds runtime checks and crypto- graphic operations at the enclave boundary to protect it from attack. Our evaluation of Glamdring with the Mem- cached store, the LibreSSL library, and the Digital Bitbox bitcoin wallet shows that it achieves small TCB sizes and has acceptable performance overheads.
Mutual Distributed Ledger (MDL, aka blockchain) technology is in an emergent phase. New applications are under development; new uses are being researched; new consortia are being formed to explore MDL applications. Considering appropriate governance structures has had a lower priority so far, but trust in the increasingly popular systems will depend on their incorporating good governance principles. It was the aim of this study to identify those principles, in order to provide a roadmap for developers and users alike.
An analysis of the material collected through desktop research, as well as several discussions with practitioners and stakeholders including a conference and webinar on the subject, has revealed that effective governance in MDL systems relies on people rather than software and rests on three pillars:
Architecture: The role of the governance structure, its composition, remit, powers, responsibilities, and its relationship with users, is a critical component.
Accountability: Effective governance of MDLs enhances trust. Trust is enhanced when a governance structure is accountable to its stakeholders, transparent in its decision-making, and subject to periodic audit and third party review.
Action: The governance structure must develop strategic and risk management plans, which are delivered through effective performance management frameworks. Trust can be further enhanced through the use of the voluntary standards market to independently verify performance metrics and the systems established to compile them.
The recent approval of the General Data Protection Regulation (GDPR) imposes new data protection requirements on data controllers and processors with respect to the processing of European Union (EU) residents' data. These requirements consist of a single set of rules that have binding legal status and should be enforced in all EU member states. In light of these requirements, we propose in this paper the use of a blockchain-based approach to support data accountability and provenance tracking. Our approach relies on the use of publicly auditable contracts deployed in a blockchain that increase the transparency with respect to the access and usage of data. We identify and discuss three different models for our approach with different granularity and scalability requirements where contracts can be used to encode data usage policies and provenance tracking information in a privacy-friendly way. From these three models we designed, implemented, and evaluated a model where contracts are deployed by data subjects for each data controller, and a model where subjects join contracts deployed by data controllers in case they accept the data handling conditions. Our implementations show in practice the feasibility and limitations of contracts for the purposes identified in this paper.
Christoph Prybila, Stefan Schulte, Christoph Hochreiner, Ingo Weber
The usage of process choreographies and decentralized Business Process Management Systems has been named as an alternative to centralized business process orchestration. In choreographies, control over a process instance is shared between independent parties, and no party has full control or knowledge during process runtime. Nevertheless, it is necessary to monitor and verify process instances during runtime for purposes of documentation, accounting, or compensation. To achieve business process runtime verification, this work explores the suitability of the Bitcoin blockchain to create a novel solution for choreographies. The resulting approach is realized in a fully-functional software prototype. This software solution is evaluated in a qualitative comparison. Findings show that our blockchain-based approach enables a seamless execution monitoring and verification of choreographies, while at the same time preserving anonymity and independence of the process participants. Furthermore, the prototype is evaluated in a performance analysis.
Igor Zikratov, Alexander Kuzmin, Vladislav Akimenko, Viktor Niculichev · 5 authors
Blockchain is a relatively new technology that has shown a lot of possibilities. It emerged in 2009 as a public ledger of all Bitcoin transactions. Blockchain technology is finding applications in wide range of areas: digital assets and stocks, smart contracts, record keeping, ID systems, cloud storage, ride sharing, etc. We investigate the blockchains' activity in terms of how to store, retrieve and share files in decentralized network.
We present the concept of leveraging Blockchain technology, for the management and security of information related to the Internet Of Things. Here, we put forth a model for the intercommunication of smart devices, their identity management and information security, with Blockchain posing as the backbone. The model proposes to serve as a robust and scalable solution, in order to address the security and identity concerns, arising due to the distributed nature of the Internet of Things. The proposed model is further compared to the existing ones in practice.
Data is nowadays an invaluable resource, indeed it guides all business decisions in most of the computer-aided human activities. Threats to data integrity are thus of paramount relevance, as tampering with data may maliciously affect crucial business decisions. This issue is especially true in cloud computing environments, where data owners cannot control fundamental data aspects, like the physical storage of data and the control of its accesses. Blockchain has recently emerged as a fascinating technology<br> which, among others, provides compelling properties about data integrity. Using the blockchain to face data integrity threats seems to be a natural choice, but its current limitations of low throughput, high latency, and weak stability hinder the practical feasibility of any blockchain-based solutions.<br> In this paper, by focusing on a case study from the European SUNFISH project, which concerns the design of a secure by-design cloud federation platform for the public sector, we precisely delineate the actual data integrity needs of cloud computing environments and the research questions to be tackled to adopt blockchain-based databases. First, we detail the open research questions and the difficulties inherent in addressing them. Then, we outline a preliminary design of an effective blockchain-based database for cloud computing environments.
This thesis presents an extension to Hyperledger Fabric, a private blockchain system, allowing historic transactions to be pruned without peer coordination. The feature is facilitated via pruning predicate functions, provided along any smart contracts a given system is desired to host. An evaluation of the extension demonstrates its impact, in terms of memory saved, for a specific asset delivery use case. It is concluded that the gains of pruning historic transactions from blockchain systems could yield significantly reduced storage requirements for some categories of applications, especially such with low transaction interdependency. It is also suggested that the deterministic consensus algorithms used by Hyperledger Fabric makes the transaction histories it may maintain not strictly required, meaning that the particular set of transactions that must survive pruning depend on what properties a blockchain is expected to maintain.
With the rise of Bitcoin, blockchain which is the core technology of Bitcoin has received increasing attention. Privacy preserving and performance on blockchain are two research points in academia and business, but there are still some unresolved issues in both respects. An aggregate signature scheme is a digital signature that supports making signatures on many different messages generated by many different users. Using aggregate signature, the size of the signature could be shortened by compressing multiple signatures into a single signature. In this paper, a new signature scheme for transactions on blockchain based on the aggregate signature was proposed. It was worth noting that elliptic curve discrete logarithm problem and bilinear maps played major roles in our signature scheme. And the security properties of our signature scheme were proved. In our signature scheme, the amount will be hidden especially in the transactions which contain multiple inputs and outputs. Additionally, the size of the signature on transaction is constant regardless of the number of inputs and outputs that the transaction contains, which can improve the performance of signature. Finally, we gave an application scenario for our signature scheme which aims to achieve the transactions of big data on blockchain.
With the rise of Bitcoin, cryptographic currencies have attracted more and more attention. Subsequently, other cryptographic currencies were gradually created, such as Zcash, Moreno, Dash and so on. In cryptographic currency, privacy preserving and expansion are two key technical points. In terms of privacy preserving, more effective solutions were proposed in Zcach, Moreno, Dash and other cryptographic currencies systems, in which ring signature, zero knowledge proof and other cryptographic techniques played important roles. But these schemes mainly considered protecting the addresses of both sides of the transaction. In terms of expansion, lightning network and other projects also give solutions. But most of these projects will bring other problems. In this paper, a signature scheme based on the aggregate signature and the elliptic curve algorithm is proposed to hide the transaction value of a single sender and receiver in the transactions which contain multiple inputs and outputs. This signature scheme achieves the purpose of privacy preserving from the transaction value. Further, the correctness proof and security analysis are given in this paper. In addition to that, another signature scheme that combines aggregation signature with bilinear ring signature is proposed. This aggregate ring signature scheme gives another attempt to solve the problem of expansion in the cryptographic currency system only using cryptographic technologies. At the same time, the sender's addresses can be hidden. Similarly, we also confirmed the correctness of this signature scheme.
In the last decades, we have witnessed an exploding growth of the Internet. The massive adoption of distributed systems on the Internet allows users to offload their computing intensive work to remote servers, e.g. cloud. In this context, distributed systems are pervasively used in a number of difference scenarios, such as web-based services that receive and process data, cloud nodes where company data and processes are executed, and softwarised networks that process packets. In these systems, all the computing entities need to trust each other and co-operate in order to work properly. While the communication channels can be well protected by protocols like TLS or IPsec, the problem lies in the expected behaviour of the remote computing platforms, because they are not under the direct control of end users and do not offer any guarantee that they will behave as agreed. For example, the remote party may use non-legitimate services for its own convenience (e.g. illegally storing received data and routed packets), or the remote system may misbehave due to an attack (e.g. changing deployed services). This is especially important because most of these computing entities need to expose interfaces towards the Internet, which makes them easier to be attacked. Hence, software-based security solutions alone are insufficient to deal with the current scenario of distributed systems. They must be coupled with stronger means such as hardware-assisted protection. In order to allow the nodes in distributed system to trust each other, their integrity must be presented and assessed to predict their behaviour. The remote attestation technique of trusted computing was proposed to specifically deal with the integrity issue of remote entities, e.g. whether the platform is compromised with bootkit attacks or cracked kernel and services. This technique relies on a hardware chip called Trusted Platform Module (TPM), which is available in most business class laptops, desktops and servers. The TPM plays as the hardware root of trust, which provides a special set of capabilities that allows a physical platform to present its integrity state. With a TPM equipped in the motherboard, the remote attestation is the procedure that a physical node provides hardware-based proof of the software components loaded in this platform, which can be evaluated by other entities to conclude its integrity state. Thanks to the hardware TPM, the remote attestation procedure is resistant to software attacks. However, even though the availability of this chip is high, its actual usage is low. The major reason is that trusted computing has very little flexibility, since its goal is to provide strong integrity guarantees. For instance, remote attestation result is positive if and only if the software components loaded in the platform are expected and loaded in a specific order, which limits its applicability in real-world scenarios. For such reasons, this technique is especially hard to be applied on software services running in application layer, that are loaded in random order and constantly updated. Because of this, current remote attestation techniques provide incomplete solution. They only focus on the boot phase of physical platforms but not on the services, not to mention the services running in virtual instances. This work first proposes a new remote attestation framework with the capability of presenting and evaluating the integrity state not only of the boot phase of physical platforms but also of software services at load time, e.g. whether the software is legitimate or not. The framework allows users to know and understand the integrity state of the whole life cycle of the services they are interacting with, thus the users can make informed decision whether to send their data or trust the received results. Second, based on the remote attestation framework this thesis proposes a method to bind the identity of secure channel endpoint to a specific physical platform and its integrity state. Secure channels are extensively adopted in distributed systems to protect data transmitted from one platform to another. However, they do not convey any information about the integrity state of the platform or the service that generates and receives this data, which leaves ample space for various attacks. With the binding of the secure channel endpoint and the hardware TPM, users are protected from relay attacks (with hardware-based identity) and malicious or cracked platform and software (with remote attestation). Third, with the help of the remote attestation framework, this thesis introduces a new method to include the integrity state of software services running in virtual containers in the evidence generated by the hardware TPM. This solution is especially important for softwarised network environments. Softwarised network was proposed to provide dynamic and flexible network deployment which is an ever complex task nowadays. Its main idea is to switch hardware appliances to softwarised network functions running inside virtual instances, that are full-fledged computational systems and accessible from the Internet, thus their integrity is at stake. Unfortunately, currently remote attestation work is not able to provide hardware-based integrity evidence for software services running inside virtual instances, because the direct link between the internal of virtual instances and hardware root of trust is missing. With the solution proposed in this thesis, the integrity state of the softwarised network functions running in virtual containers can be presented and evaluated with hardware-based evidence, implying the integrity of the whole softwarised network. The proposed remote attestation framework, trusted channel and trusted softwarised network are implemented in separate working prototypes. Their performance was evaluated and proved to be excellent, allowing them to be applied in real-world scenarios. Moreover, the implementation also exposes various APIs to simplify future integration with different management platforms, such as OpenStack and OpenMANO.
Generally scarce computational and memory resource availability is a well known problem for the IoT, whose intrinsic volatility makes complex applications unfeasible. Noteworthy efforts in overcoming unpredictability (particularly in case of large dimensions) are the ones integrating Knowledge Representation technologies to build the so-called Semantic Web of Things (SWoT). In spite of allowed advanced discovery features, transactions in the SWoT still suffer from not viable trust management strategies. Given its intrinsic characteristics, blockchain technology appears as interesting from this perspective: a semantic resource/service discovery layer built upon a basic blockchain infrastructure gains a consensus validation. This paper proposes a novel Service-Oriented Architecture (SOA) based on a semantic blockchain for registration, discovery, selection and payment. Such operations are implemented as smart contracts, allowing distributed execution and trust. Reported experiments early assess the sustainability of the proposal.