Jiaheng Zhang, Zhiyong Fang, Yupeng Zhang, Dawn Song
Machine learning has become increasingly prominent and is widely used in various applications in practice. Despite its great success, the integrity of machine learning predictions and accuracy is a rising concern. The reproducibility of machine learning models that are claimed to achieve high accuracy remains challenging, and the correctness and consistency of machine learning predictions in real products lack any security guarantees. In this paper, we initiate the study of zero knowledge machine learning and propose protocols for zero knowledge decision tree predictions and accuracy tests. The protocols allow the owner of a decision tree model to convince others that the model computes a prediction on a data sample, or achieves a certain accuracy on a public dataset, without leaking any information about the model itself. We develop approaches to efficiently turn decision tree predictions and accuracy into statements of zero knowledge proofs. We implement our protocols and demonstrate their efficiency in practice. For a decision tree model with 23 levels and 1,029 nodes, it only takes 250 seconds to generate a zero knowledge proof proving that the model achieves high accuracy on a dataset of 5,000 samples and 54 attributes, and the proof size is around 287 kilobytes.
5G communications proposed significant improvements over 4G in terms of efficiency and security. Among these novelties, the 5G Network Slicing seems to have a prominent role: deploy multiple virtual network slices, each providing a different service with different needs and features. Like this, a Slice Operator (SO) ruling a specific slice may want to offer a service for users meeting some requirements. It is of paramount importance to provide a robust authentication protocol, able to ensure that users meet the requirements, but providing at the same time a privacy-by-design architecture. This makes even more sense having a growing density of Internet of Things (IoT) devices exchanging private information over the network. In this paper, we improve the 5G network slicing authentication using a Self-Sovereign Identity (SSI) scheme: granting users full control over their data. We introduce an approach to allow a user to prove his right to access a specific service without leaking any information about him. Such an approach is SANS, a protocol that provides non-linkable protection for any issued information, preventing an SO or an eavesdropper from tracking users' activity and relating it with their real identities. Furthermore, our protocol is scalable and can be taken as a framework for improving related technologies in similar scenarios, like authentication in the 5G Radio Access Network (RAN) or other wireless networks and services. Such features can be achieved using cryptographic primitives called Zero-Knowledge Proofs (ZKP). Upon implementing our solution using a state-of-the-art ZKP library and performing several experiments, we provide benchmarks demonstrating that our approach is affordable in speed and memory consumption.
The Bitcoin P2P network is at the core of all communications between clients.\nThe reachable part of this network has been explored and analyzed by numerous\nstudies. Unreachable nodes, however, are, in most part, overlooked.\nNonetheless, they are a relevant part of the network and play an essential role\nin the propagation of messages. In this paper, we focus on transaction\npropagation and show that increasing the participation of unreachable nodes can\npotentially improve the robustness and efficiency of the network. In order to\ndo that, we propose a few changes to the network protocol. Additionally, we\ndesign a novel transaction propagation protocol that explicitly involves\nunreachable nodes to provide better protection against deanonymization attacks.\nOur solutions are simple to implement and can effectively bring immediate\nbenefits to the Bitcoin network.\n
The on-demand mobility market, including ridesharing, is becoming increasingly important with e-hailing fares growing at a rate of approximately 130% per annum since 2013. By increasing utilization of existing vehicles and empty seats, ridesharing can provide many benefits including reduced traffic congestion and environmental impact from vehicle usage and production. However, the safety of riders and drivers has become of paramount concern and a method for privacy-preserving identity verification between untrusted parties is essential for protecting users. To this end, we propose a novel privacy-preserving identity verification system, extending zero-knowledge proof (ZKP) and blockchain for use in ridesharing applications. We design a permissioned blockchain network to perform the ZKP verification of a driver's identity, which also acts as an immutable ledger to store ride logs and ZKP records. For the ZKP module, we design a protocol to facilitate user verification without requiring the exchange of any private information. We prototype the proposed system on the Hyperledger Fabric platform, with the Hyperledger Ursa cryptography library, and conduct extensive experimentation. To measure the prototype's performance, we utilize the Hyperledger Caliper benchmark tool to perform extensive analysis and the results show that our system is suitable for use in real-world ridesharing applications.
Dick Carrillo, Lam Duc Nguyen, Pedro H. J. Nardelli, Evangelos Pournaras · 14 authors
In this paper, we propose a global digital platform to avoid and combat epidemics by providing relevant real-time information to support selective lockdowns. It leverages the pervasiveness of wireless connectivity while being trustworthy and secure. The proposed system is conceptualized to be decentralized yet federated, based on ubiquitous public systems and active citizen participation. Its foundations lie on the principle of informational self-determination. We argue that only in this way it can become a trustworthy and legitimate public good infrastructure for citizens by balancing the asymmetry of the different hierarchical levels within the federated organization while providing highly effective detection and guiding mitigation measures toward graceful lockdown of the society. To exemplify the proposed system, we choose a remote patient monitoring as use case. This use case is evaluated considering different numbers of endorsed peers on a solution that is based on the integration of distributed ledger technologies and NB-IoT (narrowband IoT). An experimental setup is used to evaluate the performance of this integration, in which the end-to-end latency is slightly increased when a new endorsed element is added. However, the system reliability, privacy, and interoperability are guaranteed. In this sense, we expect active participation of empowered citizens to supplement the more usual top-down management of epidemics.
Activity-tracking applications and location-based services using short-range communication (SRC) techniques have been abruptly demanded in the COVID-19 pandemic, especially for automated contact tracing. The attention from both public and policy keeps raising on related practical problems, including1) how to protect data security and location privacy? 2) how to efficiently and dynamically deploy SRC Internet of Thing (IoT) witnesses to monitor large areas?To answer these questions, in this paper, we propose a decentralized and permissionless blockchain protocol, namedBychain. Specifically, 1) a privacy-preserving SRC protocol for activity-tracking and corresponding generalized block structure is developed, by connecting an interactive zero-knowledge proof protocol and the key escrow mechanism. As a result, connections between personal identity and the ownership of on-chain location information are decoupled. Meanwhile, the owner of the on-chain location data can still claim its ownership without revealing the private key to anyone else. 2) An artificial potential field-based incentive allocation mechanism is proposed to incentivize IoT witnesses to pursue the maximum monitoring coverage deployment. We implemented and evaluated the proposed blockchain protocol in the real-world using the Bluetooth 5.0. The storage, CPU utilization, power consumption, time delay, and security of each procedure and performance of activities are analyzed. The experiment and security analysis is shown to provide a real-world performance evaluation.
Andrea Tesei, Domenico Lattuca, Marco Luise, Paolo Pagano · 6 authors
The widespread adoption of Cooperative, Connected, and Automated Mobility (CCAM) applications requires the implementation of stringent security mechanisms to minimize the surface of cyber attacks. Authentication is an effective process for validating user identity in vehicular networks. However, authentication alone is not enough to prevent dangerous attack situations. Existing security mechanisms are not able to promptly revoke the credentials of misbehaving vehicles, thus tolerate malicious actors to remain trusted in the system for a long time. The resulting vulnerability window allows the implementation of complex attacks, thus posing a substantial impairment to the security of the vehicular ecosystem. In this paper we propose a Distributed Ledger-based Vehicular Revocation Scheme that improves the state of the art by providing a \textit{vulnerability window} lower than 1 second, reducing well-behaved vehicles exposure to sophisticated and potentially dangerous attacks. The proposed scheme harnesses the advantages of the underlying Distributed Ledger Technology (DLT) to implement a privacy-aware revocation process while being fully transparent to all participating entities. Furthermore, it meets the critical message processing times defined by EU and US standards, thus closing a critical gap in the current international standards. Theoretical analysis and experimental validation demonstrate the effectiveness and efficiency of the proposed scheme, where DLT streamlines the revocation operation overhead and delivers an economically viable yet scalable solution against cyber attacks on vehicular systems.
In current healthcare systems, electronic medical records (EMRs) are always located in different hospitals and controlled by a centralized cloud provider. However, it leads to single point of failure as patients being the real owner lose track of their private and sensitive EMRs. Hence, this article aims to build an access control framework based on smart contract, which is built on the top of distributed ledger (blockchain), to secure the sharing of EMRs among different entities involved in the smart healthcare system. For this, we propose four forms of smart contracts for user verification, access authorization, misbehavior detection, and access revocation, respectively. In this framework, considering the block size of ledger and huge amount of patient data, the EMRs are stored in cloud after being encrypted through the cryptographic functions of elliptic curve cryptography (ECC) and Edwards-curve digital signature algorithm (EdDSA), while their corresponding hashes are packed into blockchain. The performance evaluation based on a private Ethereum system is used to verify the efficiency of proposed access control framework in the real-time smart healthcare system.
Federated learning(FL) is a rapidly growing field and many centralized and decentralized FL frameworks have been proposed. However, it is of great challenge for current FL frameworks to improve communication performance and maintain the security and robustness under malicious node attacks. In this paper, we propose Galaxy Federated Learning Framework(GFL), a decentralized FL framework based on blockchain. GFL introduces the consistent hashing algorithm to improve communication performance and proposes a novel ring decentralized FL algorithm(RDFL) to improve decentralized FL performance and bandwidth utilization. In addition, GFL introduces InterPlanetary File System(IPFS) and blockchain to further improve communication efficiency and FL security. Our experiments show that GFL improves communication performance and decentralized FL performance under the data poisoning of malicious nodes and non-independent and identically distributed(Non-IID) datasets.
The pervasive adoption of Internet-connected digital services has led to a growing concern in the personal data privacy of their customers. On the other hand, machine learning (ML) techniques have been widely adopted by digital service providers to improve operational productivity and customer satisfaction. ML inevitably accesses and processes users' personal data, which could potentially breach the relevant privacy protection regulations if not performed carefully. The situation is exacerbated by the cloud-based implementation of digital services when user data are captured and stored in distributed locations, hence aggregation of the user data for ML could be a serious breach of privacy regulations. In this backdrop, Federated Learning (FL) is an emerging area that allows ML on distributed data without the data leaving their stored location. However, depending on the nature of the digital services, data captured at different locations may carry different significance to the business operation, hence a weighted aggregation will be highly desirable for enhancing the quality of the FL-learned model. Furthermore, to prevent leakage of user data from the aggregated gradients, cryptographic mechanisms are needed to allow secure aggregation of FL. In this paper, we propose a privacy-enhanced FL scheme for supporting secure weighted aggregation. Besides, by devising a verification protocol based on Zero-Knowledge Proof (ZKP), the proposed scheme is capable of guarding against fraudulent messages from FL participants. Experimental results show that our scheme is practical and secure. Compared to existing FL approaches, our scheme achieves secure weighted aggregation with an additional security guarantee against fraudulent messages with an affordable 1.2 times runtime overheads and 1.3 times communication costs.
Currently, the outbreak of COVID-19 pandemic has caused catastrophic effect on every aspect of our lives, globally. The entire human race of all countries and regions has suffered devastating losses. With its high infectiousness and mortality rate, it is of great significance to carry out effective precautions and prevention of COVID-19. Specifically, the transportation system has been confirmed as one of the crucial spreading routes. Hence, enhancing healthcare monitoring and infection tracking for high-mobility transportation system is infeasible for pandemic control. Meanwhile, due to the promising advantages in the emerging intelligent transportation system (ITS), vehicular ad hoc networks (VANETs) is able to collect and process relevant vehicular data for improving the driving experience and road safety, which provide a way for non-contact automatic healthcare monitoring. Furthermore, the proliferating cloud computing and blockchain techniques enable sufficient processing and storing capabilities, along with decentralized remote auditing towards heterogenous vehicular data. In this case, the automated infection tracking for pandemic control could be achieved accordingly. For the above consideration, in this paper we develop a practical homomorphic authentication scheme for cloud-assisted VANETs, where the healthcare monitoring for all involving passengers is provided. Notably, the integrated cloud-assisted VANET infrastructure is utilized, where the hybrid medical data acquisition module is attached. In this way, timely, non-contact measurement on all passengers’ physical status can be remotely done by vehicular cloud (VC), which could also drastically improve the efficiency and guarantee safety. Vulnerabilities of the employed dedicated-short-range-communication (DSRC) technique could be properly addressed with the applied homomorphic encryption design. Additionally, the decentralized blockchain-based vehicle recording mechanism is cooperatively performed by VC and edge units. Infection tracking on specific vehicle and individual can be offered in this way. Each signature sequence is collaboratively maintained and verified by the current roadside unit (RSU) and its neighbor RSUs. The security analysis demonstrates that the proposed scheme is secure against major attacks, while the performance comparison with the state-of-the-arts relevant methods are presented for efficiency discussion.
Harsh Desai, Mustafa Safa Özdayi, Murat Kantarcıoğlu
Federated Learning (FL) is a distributed, and decentralized machine learning protocol. By executing FL, a set of agents can jointly train a model without sharing their datasets with each other, or a third-party. This makes FL particularly suitable for settings where data privacy is desired. At the same time, concealing training data gives attackers an opportunity to inject backdoors into the trained model. It has been shown that an attacker can inject backdoors to the trained model during FL, and then can leverage the backdoor to make the model misclassify later. Several works tried to alleviate this threat by designing robust aggregation functions. However, given more sophisticated attacks are developed over time, which by-pass the existing defenses, we approach this problem from a complementary angle in this work. Particularly, we aim to discourage backdoor attacks by detecting, and punishing the attackers, possibly after the end of training phase. To this end, we develop a hybrid blockchain-based FL framework that uses smart contracts to automatically detect, and punish the attackers via monetary penalties. Our framework is general in the sense that, any aggregation function, and any attacker detection algorithm can be plugged into it. We conduct experiments to demonstrate that our framework preserves the communication-efficient nature of FL, and provide empirical results to illustrate that it can successfully penalize attackers by leveraging our novel attacker detection algorithm.
A Large-Scale Heterogeneous Network (LS-HetNet) integrates different networks into one uniform network system to provide seamless one-world network coverage. In LS-HetNet, various devices use different technologies to access heterogeneous networks and generate a large amount of data. For dealing with a large number of access requirements, these data are usually stored in the HetNet Domain Management Server (HDMS) of the current domain, and HDMS uses a centralized Authentication/Authorization/Auditing (AAA) scheme to protect the data. However, this centralized method easily causes the data to be modified or disclosed. To address this issue, we propose a blockchain-empowered AAA scheme for accessing data of LS-HetNet. Firstly, the account address of the blockchain is used as the identity authentication, and the access control permission of data is redesigned and stored on the blockchain, then processes of AAA are redefined. Finally, the experimental model on Ethereum private chain is built, and the results show that the scheme is not only secure but also decentral, without tampering and trustworthiness.
Digital identity is the key element of digital transformation in representing any real-world entity in the digital form. To ensure a successful digital future the requirement for an effective digital identity is paramount, especially as demand increases for digital services. Several Identity Management (IDM) systems are developed to cope with identity effectively, nonetheless, existing IDM systems have some limitations corresponding to identity and its management such as sovereignty, storage and access control, security, privacy and safeguarding, all of which require further improvement. Self-Sovereign Identity (SSI) is an emerging IDM system which incorporates several required features to ensure that identity is sovereign, secure, reliable and generic. It is an evolving IDM system, thus it is essential to analyse its various features to determine its effectiveness in coping with the dynamic requirements of identity and its current challenges. This paper proposes numerous governing principles of SSI to analyse any SSI ecosystem and its effectiveness. Later, based on the proposed governing principles of SSI, it performs a comparative analysis of the two most popular SSI ecosystems uPort and Sovrin to present their effectiveness and limitations.
Adam Ibrahim Abdi, Fathy Eassa, Kamal Jambi, Khalid Ali Almarhabi · 5 authors
The Internet of Things paradigm is growing rapidly. In fact, controlling this massive growth of IoT globally raises new security and privacy issues. The traditional access control mechanisms provide security to IoT systems such as DAC (discretionary access control) and mandatory access control (MAC). However, these mechanisms are based on central authority management, which raises some issues such as absence of scalability, single point of failure, and lack of privacy. Recently, the decentralized and immutable nature of blockchain technology integrated with access control can help to overcome privacy and security issues in the IoT. This paper presents a review of different access control mechanisms in IoT systems. We present a comparison table of reviewed access control mechanisms. The mechanisms’ scalability, distribution, security, user-centric, privacy and policy enforcing are compared. In addition, we provide access control classifications. Finally, we highlight challenges and future research directions in developing decentralized access control mechanisms for IoT systems.
Blockchain technology has triggered a new round of technological innovation and industrial change. Promoting the deep integration of blockchain technology and smart water conservancy has become an essential part of the digital transformation of the Chinese smart water conservancy industry. On the basis of the analysis of the framework of the smart water conservancy system and the technology infrastructure model of the blockchain, a conceptual model of a smart water conservancy information sharing platform is established. The platform has four-in-one and multicentralized participants including government departments, water conservancy enterprises, the public, and third-party maintenance, and the design of “alliance chain + private chain” dual chain smart contract. Moreover, the multidimensional scenarios of smart water conservancy innovation applications incorporating blockchain platform technology are addressed. Then, the water rights trading market is taken as an example to propose an innovative development path with consensus mechanisms, smart contracts, asymmetric encryption, and information source tracing. Although there may be some questions and challenges related to smart water conservancy and blockchain technology, this paper can provide a reference for the sustainable development of the smart water conservancy industry due to its fundamental societal contributions.
Omi Akter, Arnisha Akther, Md. Ashraf Uddin, Md. Manowarul Islam
With the advancement in digital forensics, digital forensics has been evolved in Cloud computing.A common process of digital forensics mainly includes five steps: defining problem scenario, collection of the related data, investigation of the crime scenes, analysis of evidences and case documentation.The conduction of digital forensics in cloud results in several challenges, security, and privacy issues.In this paper, several digital forensics approaches in the context of IoT and cloud have been presented.The review focused on zone-based approach for IoT digital forensics where the forensics process is divided into three zones.Digital forensics in cloud provides the facilities of large data storage, computational capabilities and identification of criminal activities required for investigating forensics.We have presented a brief study on several issues and challenges raised in each phase of Cloud forensics process.The solution approaches as well as advancement prospects of cloud forensics have been described in the light of Blockchain technology.These studies will broaden the way to new researchers for better understanding and devising new ideas for combating the challenges.
A boardroom election is an election with a small number of voters carried out with public communications. We present BVOT, a self-tallying boardroom voting protocol with ballot secrecy, fairness (no tally information is available before the polls close), and dispute-freeness (voters can observe that all voters correctly followed the protocol). BVOT works by using a multiparty threshold homomorphic encryption system in which each candidate is associated with a masked unique prime. Each voter engages in an oblivious transfer with an untrusted distributor: the voter selects the index of a prime associated with a candidate and receives the selected prime in masked form. The voter then casts their vote by encrypting their masked prime and broadcasting it to everyone. The distributor does not learn the voter's choice, and no one learns the mapping between primes and candidates until the audit phase. By hiding the mapping between primes and candidates, BVOT provides voters with insufficient information to carry out effective cheating. The threshold feature prevents anyone from computing any partial tally---until everyone has voted. Multiplying all votes, their decryption shares, and the unmasking factor yields a product of the primes each raised to the number of votes received. In contrast to some existing boardroom voting protocols, BVOT does not rely on any zero-knowledge proof; instead, it uses oblivious transfer to assure ballot secrecy and correct vote casting. Also, BVOT can handle multiple candidates in one election. BVOT prevents cheating by hiding crucial information: an attempt to increase the tally of one candidate might increase the tally of another candidate. After all votes are cast, any party can tally the votes.
In the medical system, the verification, preservation and synchronization of electronic medical records has always been a difficult problem, and the random dissemination of patient records will bring various risks to patient privacy. Therefore, how to achieve secure data sharing on the basis of ensuring users' personal privacy becomes the key. In recent years, blockchain has been proposed to be a promising solution to achieve data sharing with security and privacy preservation due to its advantages of immutability. So, a distributed electronic medical records searchable scheme was proposed by leveraging blockchain and smart contract technology. Firstly, we perform a hash calculation on the electronic medical data and store the corresponding value on the blockchain to ensure its integrity and authenticity. Then, we encrypt the electronic medical data and store it in the interplanetary file system which is a distributed storage protocol. These operations not only can solve centralized data store of servers of several medical institutions, but also be good at lowering stress from data store and high-frequency access to blockchain. Secondly, the encrypted keyword index information of electronic medical records was stored on the Ethereum blockchain, meanwhile a smart contract deployed in the Ethereum blockchain is used to realize keyword search instead of depending on a centralized third party. Furthermore, we use attribute-based encryption scheme to ensure that only the attributes meeting the access policy can decrypt the encrypted electronic medical records. Finally, our performance analysis and security analysis show that the scheme is secure and efficient.
In recent years, the deployment of Cloud Computing (CC) has become more popular both in research and industry applications, arising form various fields including e-health, manufacturing, logistics and social networking. This is due to the easiness of service deployment and data management, and the unlimited provision of virtual resources (VR). In simple scenarios, users/applications send computational or storage tasks to be executed in the cloud, by manually assigning those tasks to the available computational resources. In complex scenarios, such as a smart city applications, where there is a large number of tasks, VRs, or both, task scheduling is exposed as an NP-Hard problem. Consequently, it is preferred and more efficient in terms of time and effort, to use a task scheduling automation technique. As there are many automated scheduling solutions proposed, new possibilities arise with the advent of Fog Computing (FC) and Blockchain (BC) technologies. Accordingly, such automation techniques may help the quick, secure and efficient assignment of tasks to the available VRs. In this paper, we propose an Ant Colony Optimization (ACO) algorithm in a Fog-enabled Blockchain-assisted scheduling model, namely PF-BTS. The protocol and algorithms of PF-BTS exploit BC miners for generating efficient assignment of tasks to be performed in the cloud’s VRs using ACO, and award miner nodes for their contribution in generating the best schedule. In our proposal, PF-BTS further allows the fog to process, manage, and perform the tasks to enhance latency measures. While this processing and managing is taking place, the fog is enforced to respect the privacy of system components, and assure that data, location, identity, and usage information are not exposed. We evaluate and compare PF-BTS performance, with a recently proposed Blockchain-based task scheduling protocol, in a simulated environment. Our evaluation and experiments show high privacy awareness of PF-BTS, along with noticeable enhancement in execution time and network load.
With the features of decentralization and trustlessness and through distributed data storage, point-to-point transmission, and encryption algorithms, blockchain has shed new light on the security and protection of medical data, and it can resolve the contradiction between data sharing and privacy protection with proper security strategies. In this paper, we integrate the strengths of both blockchain and cloud computing and build the privacy protection scheme for medical data based on blockchain and cloud computing. This scheme introduces cloud computing and provides services to blockchain nodes with cloud server computing; meanwhile, it collects, analyzes, processes, and maintains medical data in the identity authentication interface and solves the insufficient computing abilities of some nodes in blockchain so as to verify the authenticity and reliability of data. The simulation experiment proves that the proposed scheme is effective. It can achieve the secure protection and integrity verification of medical data and address the problems of high computing complexity, data sharing, and privacy protection.
Critical infrastructure systems are vital to underpin the functioning of a society and economy. Due to the ever-increasing number of Internet-connected Internet-of-Things (IoT)/Industrial IoT (IIoT), and the high volume of data generated and collected, security and scalability are becoming burning concerns for critical infrastructures in industry 4.0. The blockchain technology is essentially a distributed and secure ledger that records all the transactions into a hierarchically expanding chain of blocks. Edge computing brings the cloud capabilities closer to the computation tasks. The convergence of blockchain and edge computing paradigms can overcome the existing security and scalability issues. In this article, we first introduce the IoT/IIoT critical infrastructure in industry 4.0, and then we briefly present the blockchain and edge computing paradigms. After that, we show how the convergence of these two paradigms can enable secure and scalable critical infrastructures. Then, we provide a survey on the state of the art for security and privacy and scalability of IoT/IIoT critical infrastructures. A list of potential research challenges and open issues in this area is also provided, which can be used as useful resources to guide future research.