Increased collaborative production and dynamic selection of production partners within industry 4.0 manufacturing leads to ever-increasing automatic data exchange between companies. Automatic and unsupervised data exchange creates new attack vectors, which could be used by a malicious insider to leak secrets via an otherwise considered secure channel without anyone noticing. In this paper we reflect upon approaches to prevent the exposure of secret data via blockchain technology, while also providing auditable proof of data exchange. We show that previous blockchain based privacy protection approaches offer protection, but give the control of the data to (potentially not trustworthy) third parties, which also can be considered a privacy violation. The approach taken in this paper is not utilize centralized data storage for data. It realizes data confidentiality of P2P communication and data processing in smart contracts of blockchains.
Murshedul Arifeen, Abdullah Al Mamun, M. Shamim Kaiser, Mufti Mahmud
Contact tracing has become an indispensable tool of various extensive measures to control the spread of COVID-19 pandemic due to novel coronavirus. This essential tool helps to identify, isolate and quarantine the contacted persons of a COVID-19 patient. However, the existing contact tracing applications developed by various countries, health organizations to trace down the contacts after identifying a COVID-19 patient suffers from several security and privacy concerns. In this work, we have identified those security and privacy issues of several leading contact tracing applications and proposed a blockchain-based framework to overcome the major security and privacy challenges imposed by the applications. We have discussed the security and privacy measures that are achieved by the proposed framework to show the effectiveness against the security and privacy issues raised by the existing mobile contact tracing applications.
Driverless parking, an influential application of Mobility as a Service (MaaS) model, is one of the clear early benefits for autonomous vehicles, given often narrow spaces and multiple potential hazards (such as pedestrians stepping out from in between other vehicles). In recent years, real momentum has been building up for designing automated parking models for vehicles. However, in such an autonomous parking design, location privacy and identity privacy issues are always overlapping due to the improper sharing of data. Most existing studies barely investigate and poorly address such privacy issues. Motivated by this, we develop (and evaluate) an experience-driven, secure and privacy-aware framework of parking reservations for automated cars. Our idea of using differential privacy with zero-knowledge proof provides both security and privacy guarantees to users. Furthermore, the performance of the developed model is enhanced by exploiting reinforcement learning approach such that the utility of the system and the parking reservation rate can be maximized. Extensive evaluation demonstrates the superiority of the proposed model.
Financial technology (FinTech) has been playing an increasingly critical role in driving modern economies, society, technology, and many other areas. Smart FinTech is the new-generation FinTech, largely inspired and empowered by data science and new-generation AI and (DSAI) techniques. Smart FinTech synthesizes broad DSAI and transforms finance and economies to drive intelligent, automated, whole-of-business and personalized economic and financial businesses, services and systems. The research on data science and AI in FinTech involves many latest progress made in smart FinTech for BankingTech, TradeTech, LendTech, InsurTech, WealthTech, PayTech, RiskTech, cryptocurrencies, and blockchain, and the DSAI techniques including complex system methods, quantitative methods, intelligent interactions, recognition and responses, data analytics, deep learning, federated learning, privacy-preserving processing, augmentation, optimization, and system intelligence enhancement. Here, we present a highly dense research overview of smart financial businesses and their challenges, the smart FinTech ecosystem, the DSAI techniques to enable smart FinTech, and some research directions of smart FinTech futures to the DSAI communities.
Jiaqi Wang, Ning Lu, Qingfeng Cheng, Lu Zhou · 5 authors
With the development of communication 5G networks and technologies, spectrum resources are increasingly scarce. The scarcity of the spectrum resource makes market-driven spectrum auction become an important means of spectrum allocation, and due to the complexity of the network environment, the security of spectrum auctions can not be ignored. Most existing secure spectrum auction schemes introduce a semi-honest agent to complete spectrum auction. However, the hypothetical semi-honest model does not guarantee the security of spectrum auction in the actual application scenario, which may lead to potential security threats: the agent may reveal the privacy of bidders, agent or auctioneer may collude with the bidder to manipulate the spectrum auction, and so on. In this paper, a secure spectrum auction scheme without a trusted party is proposed based on the smart contract technology, and the smart contract written into the blockchain replaces the traditional semi-honest agent to cooperate with the auctioneer server to complete the auction. In order to ensure the security of our scheme, a secure spectrum auction protocol is designed, in which the Software Guard Extensions (SGX) technology and Paillier cryptosystem are used to protect the privacy of bidders. Public verification is provided in our protocol by using extensive Pedersen commitment, which prevents the auctioneer server and the bidder from colluding with each other and verifies group bid sum values. Finally, the security analysis is given to propose several types of attacks that can be defended. Besides, theoretical analysis and simulation experiments of our protocol are also provided.
Rajesh Kumar, Abdullah Aman Khan, Zhang, Sinmin, Jay Kumar · 10 authors
With the increase of COVID-19 cases worldwide, an effective way is required to diagnose COVID-19 patients. The primary problem in diagnosing COVID-19 patients is the shortage and reliability of testing kits, due to the quick spread of the virus, medical practitioners are facing difficulty in identifying the positive cases. The second real-world problem is to share the data among the hospitals globally while keeping in view the privacy concerns of the organizations. Building a collaborative model and preserving privacy are the major concerns for training a global deep learning model. This paper proposes a framework that collects a small amount of data from different sources (various hospitals) and trains a global deep learning model using blockchain-based federated learning. Blockchain technology authenticates the data and federated learning trains the model globally while preserving the privacy of the organization. First, we propose a data normalization technique that deals with the heterogeneity of data as the data is gathered from different hospitals having different kinds of Computed Tomography (CT) scanners. Secondly, we use Capsule Network-based segmentation and classification to detect COVID-19 patients. Thirdly, we design a method that can collaboratively train a global model using blockchain technology with federated learning while preserving privacy. Additionally, we collected real-life COVID-19 patients' data open to the research community. The proposed framework can utilize up-to-date data which improves the recognition of CT images. Finally, we conducted comprehensive experiments to validate the proposed method. Our results demonstrate better performance for detecting COVID-19 patients.
Open access
3 source records
COVID-19 diagnosis using AI
Artificial Intelligence in Healthcare and Education
Academic publication of latest research results are crucial to advance the development of all disciplines. However, the current academic publication procedure lacks transparency in the review process, and reviewers do not have strong incentives to provide quality reviews for their peers. This may lead to misconducts in the review process, e.g. an anonymous reviewer may give biased comments to a paper without being noticed since the comments are seldom published for evaluation. In addition, it is ironic that the research community has to pay a lot to access papers reviewed by the community for free, though free sharing of research results is important for research advances.To address the above problems, we propose Open-Pub, a decentralized, transparent yet privacy-preserving academic publication scheme based on the blockchain technology. The blockchain promises transparency in the review process and provides an incentive mechanism based on cryptocurrency, but the privacy requirement in the double-blind review process still needs to be fulfilled. To this end, we first design a threshold identity-based group signature (TIBGS) using verifiable secret sharing to protect identity confidentiality. Then we develop a strong double-blind procedure to protect the identities of authors and reviewers. With this strong double-blind procedure, authors can choose to submit papers anonymously, and validators distribute papers anonymously to reviewers on the blockchain according to their research interests. This process is publicly recorded and traceable on the blockchain so as to realize transparent peer preview. To evaluate its efficiency, we implement Open-Pub based on Ethereum and conduct comprehensive experiments to evaluate its performance, including computation costs and processing delay. The experiment results show that Open-Pub is highly efficient in computation and processing anonymous transactions.
Sylvain Chatel, Apostolos Pyrgelis, Juan Ramón Troncoso-Pastoriza, Jean‐Pierre Hubaux
In the digital era, users share their personal data with service providers to obtain some utility, e.g., access to high-quality services. Yet, the induced information flows raise privacy and integrity concerns. Consequently, cautious users may want to protect their privacy by minimizing the amount of information they disclose to curious service providers. Service providers are interested in verifying the integrity of the users' data to improve their services and obtain useful knowledge for their business. In this work, we present a generic solution to the trade-off between privacy, integrity, and utility, by achieving authenticity verification of data that has been encrypted for offloading to service providers. Based on lattice-based homomorphic encryption and commitments, as well as zero-knowledge proofs, our construction enables a service provider to process and reuse third-party signed data in a privacy-friendly manner with integrity guarantees. We evaluate our solution on different use cases such as smart-metering, disease susceptibility, and location-based activity tracking, thus showing its versatility. Our solution achieves broad generality, quantum-resistance, and relaxes some assumptions of state-of-the-art solutions without affecting performance.
Federated learning enables the development of a machine learning model among\ncollaborating agents without requiring them to share their underlying data.\nHowever, malicious agents who train on random data, or worse, on datasets with\nthe result classes inverted, can weaken the combined model. BlockFLow is an\naccountable federated learning system that is fully decentralized and\nprivacy-preserving. Its primary goal is to reward agents proportional to the\nquality of their contribution while protecting the privacy of the underlying\ndatasets and being resilient to malicious adversaries. Specifically, BlockFLow\nincorporates differential privacy, introduces a novel auditing mechanism for\nmodel contribution, and uses Ethereum smart contracts to incentivize good\nbehavior. Unlike existing auditing and accountability methods for federated\nlearning systems, our system does not require a centralized test dataset,\nsharing of datasets between the agents, or one or more trusted auditors; it is\nfully decentralized and resilient up to a 50% collusion attack in a malicious\ntrust model. When run on the public Ethereum blockchain, BlockFLow uses the\nresults from the audit to reward parties with cryptocurrency based on the\nquality of their contribution. We evaluated BlockFLow on two datasets that\noffer classification tasks solvable via logistic regression models. Our results\nshow that the resultant auditing scores reflect the quality of the honest\nagents' datasets. Moreover, the scores from dishonest agents are statistically\nlower than those from the honest agents. These results, along with the\nreasonable blockchain costs, demonstrate the effectiveness of BlockFLow as an\naccountable federated learning system.\n
Mohammad Hossein Chinaei, Hassan Habibi Gharakheili, Vijay Sivaraman
Verification of data generated by wearable sensors is increasingly becoming of concern to health service providers and insurance companies. These devices are typically vulnerable to a wide range of cybersecurity attacks, attempting to manipulate sensing data. Most of these disastrous attacks would remain undetected since neither healthcare servers nor Internet-of-Things (IoT) sensors are aware of the existence of attackers in the middle of communication. Thus, there is a need for a verification framework that various authorities can request a verification service for the local network data of a target IoT device. In this article, we leverage blockchain as a distributed platform to realize an on-demand verification scheme. This allows authorities to automatically transact with connected devices for witnessing services. A public request is made for witness statements on the data of a target IoT that is transmitted on its local network, and subsequently, devices (in close vicinity of the target IoT) offer witnessing service. Our contributions are threefold: 1) we develop a system architecture based on blockchain and smart contract that enables authorities to dynamically avail a verification service for data of a subject device from a distributed set of witnesses which are willing to provide (in a privacy-preserving manner) their local wireless measurement in exchange of monetary return; 2) we then develop a method to optimally select witnesses in such a way that the verification error is minimized subject to monetary cost constraints; and 3) finally, we evaluate the efficacy of our scheme using real Wi-Fi session traces collected from a five-storeyed building with more than thirty access points, representative of a hospital. According to the current pricing schedule of the Ethereum public blockchain, our scheme enables healthcare authorities to verify data transmitted from a typical wearable device with the verification error of the order 0.01% at cost of less than $ 2 for 1-hr witnessing service.
Proliferation of IoT devices in society demands a renewed focus on securing the use and maintenance of such systems. IoT-based systems will have a great impact on society and therefore such systems must have guaranteed resilience. We introduce cryptographic-based building blocks that strive to ensure that distributed IoT networks remain in a healthy condition throughout their lifecycle. Our presented solution utilizes deterministic and interlinked smart contracts on the Ethereum blockchain to enforce secured management and maintenance for hardened IoT devices. A key issue investigated is the protocol development for securing IoT device deployments and means for communicating securely with devices. By supporting values of openness, automation, and provenance, we can introduce novel means that reduce the threats of surveillance and theft, while also improving operator accountability and trust in IoT technology.
Activity-tracking applications and location-based services using short-range communication (SRC) techniques have been abruptly demanded in the COVID-19 pandemic, especially for automated contact tracing. The attention from both public and policy keeps raising on related practical problems, including \textit{1) how to protect data security and location privacy? 2) how to efficiently and dynamically deploy SRC Internet of Thing (IoT) witnesses to monitor large areas?} To answer these questions, in this paper, we propose a decentralized and permissionless blockchain protocol, named \textit{Bychain}. Specifically, 1) a privacy-preserving SRC protocol for activity-tracking and corresponding generalized block structure is developed, by connecting an interactive zero-knowledge proof protocol and the key escrow mechanism. As a result, connections between personal identity and the ownership of on-chain location information are decoupled. Meanwhile, the owner of the on-chain location data can still claim its ownership without revealing the private key to anyone else. 2) An artificial potential field-based incentive allocation mechanism is proposed to incentivize IoT witnesses to pursue the maximum monitoring coverage deployment. We implemented and evaluated the proposed blockchain protocol in the real-world using the Bluetooth 5.0. The storage, CPU utilization, power consumption, time delay, and security of each procedure and performance of activities are analyzed. The experiment and security analysis is shown to provide a real-world performance evaluation.
Vehicular Ad Hoc Network (VANET) is a mobile network formed by vehicles, road side units, and other in-frastructures that enable communication between the nodes to improve road safety and traffic control. While this technology promises great benefits to drivers, there are many security and privacy concerns that must be addressed before it can be fully adopted. It is essential to ensure that vehicles participating in the network are authenticated and held accountable in case of misbehaviour. On the other hand, there should be adequate mechanisms for preserving the privacy of vehicles and drivers, so they are protected against unauthorized tracking and release of private information. Many current VANET technologies also depend on a central trusted authority that becomes a single point of failure for the network. In this paper, we propose a new blockchain based decentralized authentication approach for VANET. In this scheme vehicles maintain conditional anonymity in the network and their real identities can only be revealed to authorized entities. Using the blockchain technology, we create a distributed framework and maintain an immutable record of the data, strengthening the integrity of the system. We use the Hyperledger Fabric, a permissioned blockchain technology, to implement our approach and compare its performance to the traditional PKI based method for VANET authentication.
The celebrated result of Fischer, Lynch and Paterson is the fundamental lower\nbound for asynchronous fault tolerant computation: any 1-crash resilient\nasynchronous agreement protocol must have some (possibly measure zero)\nprobability of not terminating. In 1994, Ben-Or, Kelmer and Rabin published a\nproof-sketch of a lesser known lower bound for asynchronous fault tolerant\ncomputation with optimal resilience against a Byzantine adversary: if $n\\le 4t$\nthen any t-resilient asynchronous verifiable secret sharing protocol must have\nsome non-zero probability of not terminating.\n Our main contribution is to revisit this lower bound and provide a rigorous\nand more general proof. Our second contribution is to show how to avoid this\nlower bound. We provide a protocol with optimal resilience that is almost\nsurely terminating for a strong common coin functionality. Using this new\nprimitive we provide an almost surely terminating protocol with optimal\nresilience for asynchronous Byzantine agreement that has a new fair validity\nproperty. To the best of our knowledge this is the first asynchronous Byzantine\nagreement with fair validity in the information theoretic setting.\n
Yanhong Xu, Reihaneh Safavi–Naini, Khoa Nguyen, Huaxiong Wang
Policy-based signatures (PBS) were proposed by Bellare and Fuchsbauer (PKC 2014) to allow an {\em authorized} member of an organization to sign a message on behalf of the organization. The user's authorization is determined by a policy managed by the organization's trusted authority, while the signature preserves the privacy of the organization's policy. Signing keys in PBS do not include user identity information and thus can be passed to others, violating the intention of employing PBS to restrict users' signing capability. In this paper, we introduce the notion of {\em traceability} for PBS by including user identity in the signing key such that the trusted authority will be able to open a suspicious signature and recover the signer's identity should the needs arise. We provide rigorous definitions and stringent security notions of traceable PBS (TPBS), capturing the properties of PBS suggested by Bellare-Fuchsbauer and resembling the "full traceability" requirement for group signatures put forward by Bellare-Micciancio-Warinschi (Eurocrypt 2003). As a proof of concept, we provide a modular construction of TPBS, based on a signature scheme, an encryption scheme and a zero-knowledge proof system. Furthermore, to demonstrate the feasibility of achieving TPBS from concrete, quantum-resistant assumptions, we give an instantiation based on lattices.
Erik Boetto, Davide Golinelli, Gherardo Carullo, Maria Pia Fantini
Frauds and misconducts have been common in the history of science. Recent events connected to the COVID-19 pandemic have highlighted how the risks and consequences of this are no longer acceptable. Two papers, addressing the treatment of COVID-19, have been published in two of the most prestigious medical journals. In both, the authors declared to have analysed electronic records from a private corporation, which apparently collected data of tens of thousands of patients, coming from thousands of hospitals. Both papers have been retracted a few weeks later. When such events happen, the confidence of the population in scientific research is likely to be weakened. The objective of this paper is to highlight how the current system endangers not only the reliability of scientific research, but also the very foundations of the trust system on which modern healthcare is based. Having shed the light on the dangers of a system without appropriate monitoring, we propose to improve the research process using the promising aspects of the distributed ledger technology which, thanks to the characteristics of immutability, decentralization and transparency, appears among the best solutions to avoid the repetition of the mistakes linked to the recent and past history of research.
Crowdsourcing is a process wherein an individual or an organisation utilizes\nthe talent pool present over the Internet to accomplish their task. The\nexisting crowdsourcing platforms and their reputation computation are\ncentralised and hence prone to various attacks or malicious manipulation of the\ndata by the central entity. A few distributed crowdsourcing platforms have been\nproposed but they lack a robust reputation mechanism. So we propose a\ndecentralised crowdsourcing platform having an immutable reputation mechanism\nto tackle these problems. It is built on top of Ethereum network and does not\nrequire the user to trust a third party for a non malicious experience. It also\nutilizes IOTAs consensus mechanism which reduces the cost for task evaluation\nsignificantly.\n
Li Peng, Wei Feng, Zheng Yan, Yafeng Li · 6 authors
Permissionless blockchain, as a kind of distributed ledger, has gained considerable attention because of its openness, transparency, decentralization, and immutability. Currently, permissionless blockchain has shown a good application prospect in many fields, from the initial cryptocurrency to the Internet of Things (IoT) and Vehicular Ad-Hoc Networking (VANET), which is considered as the beginning of rewriting our digital infrastructure. However, blockchain confronts some privacy risks that hinder its practical applications. Though numerous surveys reviewed the privacy preservation in blockchain, they failed to reveal the latest advances, nor have they been able to conduct a unified standard comprehensive classification of the privacy protection of permissionless blockchain. Therefore, in this paper, we analyze the specific characteristics of permissionless blockchain, summarize the potential privacy threats, and investigate the unique privacy requirements of blockchain. Existing privacy preservation technologies are carefully surveyed and evaluated based on our proposed evaluation criteria. We finally figure out open research issues as well as future research directions from the perspective of privacy issues.
Gaolei Li, Mianxiong Dong, Laurence T. Yang, Kaoru Ota · 6 authors
Edge computational intelligence, integrating artificial intelligence (AI) and edge computing into Internet of Things (IoT), will generate many scattered knowledge. To enable auditable and delay-sensitive IoT services, these knowledge will be shared among decentralized intelligent network edges (DINEs), end users, and supervisors frequently. Blockchain has a promising ability to provide a traceable, privacy-preserving and tamper-resistant ledger for sharing edge knowledge. However, due to the complicated environments of network edges, knowledge sharing among DINEs still faces many challenges. Firstly, the resource limitation and mobility of DINEs impede the applicability of existing consensus tricks (e.g., Poof of Work, Proof of Stake, and Paxos) of blockchain. Secondly, the adversaries may eavesdrop the content of edge knowledge or entice the blockchain to forks using some attacking models (like man-in-the-middle attack, denial of services, etc.). In this article, an user-centric blockchain (UCB) framework is proposed for preserving edge knowledge sharing in IoT. Significant superiorities of UCB benefit from the proof of popularity (PoP) consensus mechanism, which is more energy-efficient and fast. Security analysis and experiments based on Raspberry Pi 3 Model B demonstrate its feasibility with low block generating delay and complexity.
Location-based services (LBS) bring convenience to people's lives but are also accompanied with privacy leakages. To protect the privacy of LBS users, many location privacy protection algorithms were proposed. However, these algorithms often have difficulty to maintain a balance between service quality and user privacy. In this paper, we first overview the shortcomings of the existing two privacy protection architectures and privacy protection technologies, then we propose a location privacy protection method based on blockchain. Our method satisfies the principle of k-anonymity privacy protection and does not need the help of trusted third-party anonymizing servers. The combination of multiple private blockchains can disperse the user's transaction records, which can provide users with stronger location privacy protection and will not reduce the quality of service. We also propose a reward mechanism to encourage user participation. Finally, we implement our approach in the Remix blockchain to show the efficiency, which further indicates the potential application prospect for the distributed network environment.
Marten Sigwart, Michael Borkowski, Marco Peise, Stefan Schulte · 5 authors
Abstract As data collected and provided by Internet of Things (IoT) devices power an ever-growing number of applications and services, it is crucial that this data can be trusted. Data provenance solutions combined with blockchain technology are one way to make data more trustworthy by providing tamper-proof information about the origin and history of data records. However, current blockchain-based solutions for data provenance fail to take the heterogeneous nature of IoT applications and their data into account. In this work, we identify functional and non-functional requirements for a secure and extensible IoT data provenance framework, and conceptualise the framework as a layered architecture. Evaluating the framework using a proof-of-concept implementation based on Ethereum smart contracts, we conclude that our framework can be used to realise data provenance concepts for a wide range of IoT use cases. While blockchain technology generally poses constraints on scalability and privacy, we discuss multiple solutions aiming to overcome these issues.
Learning from data owned by several parties, as in federated learning, raises challenges regarding the privacy guarantees provided to participants and the correctness of the computation in the presence of malicious parties. We tackle these challenges in the context of distributed averaging, an essential building block of federated learning algorithms. Our first contribution is a scalable protocol in which participants exchange correlated Gaussian noise along the edges of a network graph, complemented by independent noise added by each party. We analyze the differential privacy guarantees of our protocol and the impact of the graph topology under colluding malicious parties, showing that we can nearly match the utility of the trusted curator model even when each honest party communicates with only a logarithmic number of other parties chosen at random. This is in contrast with protocols in the local model of privacy (with lower utility) or based on secure aggregation (where all pairs of users need to exchange messages). Our second contribution enables users to prove the correctness of their computations without compromising the efficiency and privacy guarantees of the protocol. Our verification protocol relies on standard cryptographic primitives like commitment schemes and zero knowledge proofs.
Blockchain has led to a new way of storing data and guaranteeing data integrity and transparency. However, tensions still remain between blockchain and the current legal system, especially data protection law. This paper chooses the General Data Protection Regulation (GDPR) in the European Union to identify how blockchain can be compatible with the principles of modern data protection law and if blockchain can also be a way through which to achieve legal objectives. Finally, this paper proposes standardisation as a way to mitigate blockchain’s drawbacks and to leverage its advantages.
In this note, we remark that the aggregation property of the BLS signature scheme yields an efficient Content Extraction Signature (CES). This construction can be used to build digital credentials that support selective disclosure in various settings. Interestingly, this construction is efficient and well suited to build credential issuance schemes with various applications in the client-server or in the distributed ledger models. Finally, we sketch a protocol that combines the CES with the use of a NIZK which allows to prove predicate satisfaction on claims extracted from a credential, while keeping the data secret.