Marcela Tuler de Oliveira, Lúcio Henrik A. Reis, Ricardo C. Carrano, Flávio Luiz Seixas · 10 authors
Electronic medical records (EMRs) are highly sensitive information shared among peers to keep up-to-date patient history. Providing security, privacy, and availability to these sensitive data is a challenge because, typically, after data publication the patient loses control over them. In this paper, we propose a blockchain-based approach to secure EMR for healthcare applications, where access control is patient-centric. Our proposal keeps encrypted EMRs in the blockchain, and the patient shares the decryption key only with healthcare professionals in which he/she trusts. Blockchain allows untrusted node, in a distributed peer-to-peer network to correctly and verifiably interact with each other, without any reliable intermediary. We investigate the scalability of our approach through simulations. Results show that it scales well since increasing the number of nodes in the network implies a linear increase in the size of the stored chain. Results also reveal that the time for inserting a new EMR in the blockchain remains low even when the number of nodes in the network increases.
The main objective of the paper is to provide an answer to the question whether new technologies such as blockchain that enter various spheres of public life are safe for users and what impact they have on national legislations. Cryptocurrencies, which are based on blockchain technology, can be used as a means of payment, investment or capital accumulation. Therefore, blockchain becomes more and more popular. The main research method used in the paper consists of the analysis of legislation and jurisprudence as well as linguistic and purposive interpretation which affects the functioning of blockchain and cryptocurrencies. The introductory part of the paper contains a general historical outline and basic principles related to blockchain technology. Real and potential threats posed by the discussed technology are also discussed in the paper as well as the question whether governments or, more broadly, the international community, offer sufficient level of protection against risks related to the use of new technologies such as blockchain and cryptocurrencies. Using blockchain to streamline logistic activities or to speed up transactions is useful in itself, but in the hands of private entities the technology may pose a risk of losing funds if not properly secured. The financial market is and should be supervised and controlled by the state which is the guarantor of economic freedom. Another vital question is whether legislators keep up with the advances in technology. It seems that the development of blockchain technology triggers development of new legal regulations. The more blockchain technology enters everyday life, the more legal documents appear in the form of case law, legal provisions, opinions etc. The role of these documents is to regulate, define and specify new technologies as they appear.
Dirk van Bokkem, Rico Hageman, Gijs Koning, Luat Nguyen · 5 authors
With the advancement of technology and subsequently the age of digital information, online trustworthy identification has become increasingly more important. With respect to the various data breaches and privacy regulations, the current identity solutions are not fully optimized. In this paper, we will take a look at several Self-Sovereign Identity solutions which are already available. Some of them are built upon blockchain technology as this already provides decentralised persistent data and consensus. We will explore the emerging landscape of Self-Sovereign Identity solutions and dissect their implementations under multiple aspect criteria to determine the necessity of blockchain technology in this field. We conclude that blockchain technology is not explicitly required for a Self-Sovereign Identity solution but it is a good foundation to build up on, due to various technical advantages that the blockchain has to offer.
While most of humanity is suddenly on the net, the value of this singularity is hampered by the lack of credible digital identities: Social networking, person-to-person transactions, democratic conduct, cooperation and philanthropy are all hampered by the profound presence of fake identities, as illustrated by Facebook's removal of 5.4Bn fake accounts since the beginning of 2019. Here, we introduce the fundamental notion of a \emph{genuine personal identifier}---a globally unique and singular identifier of a person---and present a foundation for a decentralized, grassroots, bottom-up process in which every human being may create, own, and protect the privacy of a genuine personal identifier. The solution employs mutual sureties among owners of personal identifiers, resulting in a mutual-surety graph reminiscent of a web-of-trust. Importantly, this approach is designed for a distributed realization, possibly using distributed ledger technology, and does not depend on the use or storage of biometric properties. For the solution to be complete, additional components are needed, notably a mechanism that encourages honest behavior and a sybil-resilient governance system.
Apr 20, 2019·MaxEnt 2019 - Proceedings of the 39th International Workshop on Bayesian Inference and Maximum Entropy Methods in Science and Engineering, Garching, Germany, 30 June - 5 July 2019
Randomization is an integral part of well-designed statistical trials, and is also a required procedure in legal systems. Implementation of honest, unbiased, understandable, secure, traceable, auditable and collusion resistant randomization procedures is a mater of great legal, social and political importance. Given the juridical and social importance of randomization, it is important to develop procedures in full compliance with the following desiderata: (a) Statistical soundness and computational efficiency; (b) Procedural, cryptographical and computational security; (c) Complete auditability and traceability; (d) Any attempt by participating parties or coalitions to spuriously influence the procedure should be either unsuccessful or be detected; (e) Open-source programming; (f) Multiple hardware platform and operating system implementation; (g) User friendliness and transparency; (h) Flexibility and adaptability for the needs and requirements of multiple application areas (like, for example, clinical trials, selection of jury or judges in legal proceedings, and draft lotteries). This paper presents a simple and easy to implement randomization protocol that assures, in a formal mathematical setting, full compliance to the aforementioned desiderata for randomization procedures.
Marco Alessi, Alessio Camillò, Enza Giangreco, Marco Matera · 6 authors
Sharing personal data with service providers is a fundamental resource for the times we live in. But data sharing represents an unavoidable issue, due to improper data treatment, lack of users' awareness to whom they are sharing with, wrong or excessive data sharing from end users who ignore they are exposing personal information. The problem becomes even more complicate if we try to consider the devices around us: how to share devices we own, so that we can receive pervasive services, based on our contexts and device functionalities. The European Authority has provided the General Data Protection Regulation (GDPR), in order to implement protection of sensitive data in each EU member, throughout certification mechanisms (according to Art. 42 GDPR). The certification assures compliance to the regulation, which represent a mandatory requirement for any service which may come in contact with sensitive data. Still the certification is an open process and not constrained by strict rule. In this paper we describe our decentralized approach in sharing personal data in the era of smart devices, being those considered sensitive data as well. Having in mind the centrality of users in the ownership of the data, we have proposed a decentralized Personal Data Store prototype, which stands as a unique data sharing endpoint for third party services. Even if blockchain technologies may seem fit to solve the issue of data protection, because of the absence of a central authority, they lay to additional concerns especially relating such technologies with specifications described in the regulation. The current work offers a contribution in the advancements of personal data sharing management systems in a distributed environment by presenting a real prototype and an architectural blueprint, which advances the state of the art in order to meet the GDPR regulation. Address those arisen issues, from a technological perspective, stands as an important challenge, in order to empower end users in owning their personal data for real.
Yang Xiao, Ning Zhang, Jin Li, Wenjing Lou · 5 authors
The abundance and rich varieties of data are enabling many transformative applications of big data analytics that have profound societal impacts. However, there are also increasing concerns regarding the improper use of individual data owner's private data. In this paper, we propose PrivacyGuard, a system that leverages blockchain smart contract and trusted execution environment (TEE) to enable individual's control over the access and usage of their private data. Smart contracts are used to specify data usage policy, i.e., who can use what data under which conditions and what analytics to perform, while the distributed blockchain ledger is used to keep an irreversible and non-repudiable data usage record. To address the efficiency problem of on-chain contract execution and to prevent exposing private data on the publicly viewable blockchain, PrivacyGuard incorporates a novel TEE-based off-chain contract execution engine along with a protocol to securely commit the execution result onto blockchain. We have built and deployed a prototype of PrivacyGuard with Ethereum and Intel SGX. Our experiment result demonstrates that PrivacyGuard fulfills the promised privacy goal and supports analytics on data from a considerable number of data owners.
Nguyen B. Truong, Kai Sun, Gyu Myoung Lee, Yike Guo
The General Data Protection Regulation (GDPR) gives control of personal data back to the owners by appointing higher requirements and obligations on service providers who manage and process personal data. As the verification of GDPR-compliance, handled by a supervisory authority, is irregularly conducted; it is challenging to be certified that a service provider has been continuously adhering to the GDPR. Furthermore, it is beyond the data owner's capability to perceive whether a service provider complies with the GDPR and effectively protects her personal data. This motivates us to envision a design concept for developing a GDPR-compliant personal data management platform leveraging the emerging blockchain and smart contract technologies. The goals of the platform are to provide decentralised mechanisms to both service providers and data owners for processing personal data; meanwhile, empower data provenance and transparency by leveraging advanced features of the blockchain technology. The platform enables data owners to impose data usage consent, ensures only designated parties can process personal data, and logs all data activities in an immutable distributed ledger using smart contract and cryptography techniques. By honestly participating in the platform, a service provider can be endorsed by the blockchain network that it is fully GDPR-compliant; otherwise, any violation is immutably recorded and is easily figured out by associated parties. We then demonstrate the feasibility and efficiency of the proposed design concept by developing a profile management platform implemented on top of the Hyperledger Fabric permissioned blockchain framework, following by valuable analysis and discussion.
Kuljeet Kaur, Sahil Garg, Georges Kaddoum, François Gagnon · 5 authors
With the increasing development of advanced communication technologies, vehicles are becoming smarter and more connected. Due to the tremendous growth of various vehicular applications, a huge amount of data is generated through advanced on-board devices and is deemed critical to improve driving safety and enhance vehicular services. However, cloud based models often fall short in applications where latency and mobility are critical. In order to fully realize the potential of vehicular networks, the challenges of efficient communication and computation need to be addressed. In this direction, vehicular fog computing (VFC) has emerged which extends the concept of fog computing to conventional vehicular networks. It is a geographically distributed paradigm that has the potential to conduct time-critical and data-intensive tasks by pushing intelligence (i.e. computing resources, storage, and application services) in the vicinity of end vehicles. However secure and reliable transmission are of significant importance in highly-mobile vehicular networks in order to ensure the optimal Quality of Service (QoS). In this direction, several authentication mechanisms have been proposed in the literature but most of them are found unfit due to absence of decentralization, anonymity, and trust characteristics. Thus, an effective cross-datacenter authentication and key-exchange scheme based on blockchain and elliptic curve cryptography (ECC) is proposed in this paper. Here, the distributed ledger of blockchain is used for maintaining the network information while the highly secure ECC is employed for mutual authentication between vehicles and road side units (RSUs). Additionally, the proposed scheme is lightweight and scalable for the considered VFC setup. The performance evaluation results against the existing state-of-the-art reveal that the proposed scheme accomplishes enhanced security features with reduced computational and communicational overheads. Further, its extensive evaluation on the widely applicable Automated Validation of Internet Security Protocols and Applications (AVISPA) tool guarantee its safeness against different attack vectors.
The developments of Narrow Band Internet of Things have attracted much attention from both academia and industry nowadays. While Narrow Band Internet of Things is gradually designed for commercial applications, it also confronts with several security concerns such as identification and privacy. Blockchain technique is equipped with authentication, auditing, and accountability, and thus it can serve as a promising tool for providing secure data communication on the network. To enhance the security level and achieve reliable data authentication and accountability for Narrow Band Internet of Things system, in this article, we combine the merits of blockchain technique and propose a blockchain-based architecture for Narrow Band Internet of Things. The presented architecture consists of three layers which are sensing layer, transport layer, and transaction layer. We describe the interaction processes between each layer in detail and construct the algorithms which are used to conduct data authentication and blockchain generation. By evaluation, our scheme is demonstrated to obtain favorable performances in terms of privacy, authentication, accountability, and efficiency, which makes it an appropriate method to be applied for secure data communication in Narrow Band Internet of Things systems.
With the rapid development of medical information services, the construction of intelligent hospitals is opening up a new mode of medical treatment in the health care industry. Medical data is gradually becoming more and more important, while it also faces some challenges, among which the most urgent problem to be solved is data security and privacy protection. In the construction of intelligent hospitals, the safety issues among the basic information of patients, the protection of medical information and inter-institutional information sharing have become the focus at this stage. Blockchain technology, with highly security, reliable architecture and algorithm design have operated stably in the financial industry for more than seven years. The related innovative technologies such as distributed ledgers, smart contracts, symmetric encryptions and consensus mechanisms are used widely in many fields. This paper will take the demonstration construction of Chongqing Intelligent Hospital as an example, which tries to combine the blockchain, homomorphic encryption and zero-knowledge proof technology to carry out the research on the security construction and data privacy protection of intelligent hospitals.
Open access
Privacy-Preserving Technologies in Data
Blockchain Technology Applications and Security
Artificial Intelligence in Healthcare and Education
Traditional cloud Service Level Agreement (SLA) suffers from lacking a trustworthy platform for automatic enforcement. The emerging blockchain technique brings in an immutable solution for tracking transactions among business partners. However, it is still very challenging to prove the credibility of possible violations in the SLA before recording them onto the blockchain. To tackle this challenge, we propose a witness model using game theory and the smart contract techniques. The proposed model extends the existing service model with a new role called “witness” for detecting and reporting service violations. Witnesses gain revenue as an incentive for performing these duties, and the payoff function is carefully designed in a way that trustworthiness is guaranteed: in order to get the maximum profit, the witness has to always tell the truth. This is analyzed and proved through game theory using the Nash equilibrium principle. In addition, an unbiased sortition algorithm is proposed to ensure the randomness of the independent witnesses selection from the decentralized witness pool, to avoid possible unfairness or collusion. An auditing mechanism is also introduced in the paper to detect potential irrational or malicious witnesses. We have prototyped the system leveraging the smart contracts of Ethereum blockchain. Experimental results demonstrate the feasibility of the proposed model and indicate good performance in accordance with the design expectations.
Transaction privacy is a hard problem on an account-based blockchain such as Ethereum. While Ben-Sasson et al. presented the Zerocash protocol [BCG+14] as a decentralized anonymous payment (DAP) scheme standing on top of Bitcoin, no study about the integration of such DAP on top of a ledger defined in the account model was provided. In this paper we aim to fill this gap and propose ZETH, an adaptation of Zerocash that can be deployed on top of Ethereum without making any change to the base layer. Our study shows that not only ZETH could be used to transfer Ether, the base currency of Ethereum, but it could also be used to transfer other types of smart contract-based digital assets. We propose an analysis of ZETH's privacy promises and argue that information leakages intrinsic to the use of this protocol are controlled and well-defined, which makes it a viable solution to support private transactions in the context of public and permissioned chains.
Anik Islam, Md. Fazlul Kader, Md Mofijul Islam, Soo Young Shin
In order to stay up to date with world issues and cutting-edge technol-ogies, the newspaper plays a crucial role. However, collecting news is not a very easy task. Currently, news publishers are collecting news from their correspond-ents through social networks, email, phone call, fax etc. and sometimes they buy news from the agencies. However, the existing news sharing networks may not provide security for data integrity and any third party may obstruct the regular flow of news sharing. Moreover, the existing news schemes are very vulnerable in case of disclosing the identity. Therefore, a universal platform is needed in the era of globalization where anyone can share and trade news from anywhere in the world securely, without the interference of third-party, and without disclosing the identity of an individual. Recently, blockchain has gained popularity because of its security mechanism over data, identity, etc. Blockchain enables a distrib-uted way of managing transactions where each participant of the network holds the same copy of the transactions. Therefore, with the help of pseudonymity, fault-tolerance, immutability and the distributed structure of blockchain, a scheme (termed as NEWSTRADCOIN) is presented in this paper in which not only news can be shared securely but also anyone can earn money by selling news. The proposed NEWSTRADCOIN can provide a universal platform where publishers can directly obtain news from news-gatherers in a secure way by main-taining data integrity, without experiencing the interference of a third-party, and without disclosing the identity of the news gatherer and publishers.
R. Sangeetha, B Harshini, A Shanmugapriya, Rajagopal T.K.P.
This paper deals with the Electronic Health Records for storing information of the patient which consist of the medical reports. Electronic Health Records (EHRs) are entirely controlled by Hospitals instead of patients, which complicates seeking medical advices from different hospitals. In the existing system of storing details of the patients are very dependent on the servers of the organization. In the proposed all the information of the patient are stored in the blockchain by using the Metamask and these details are stored in the block chain as a blocks of data. Each block consists of the data which is encrypted data. Electronic Health Record (EHR) systems record health-related information on an individual so that it can be consulted by clinicians or staff for patient care. The data is encrypted by the algorithm known as SHA-256 which is used to encrypt all the data of the patients into a single line 256 bit encrypted text which will be stored in the block at etherscan. These records for not only useful for the consultation but also for creation of historic family health information tree that keeps track of genetic health issues and diseases it can also be used for any health service with the authorization from both the patient and medical organization.
Healthcare information exchange is an important research topic, which can benefit both healthcare providers and patients. In healthcare data sharing, many cloud-based solutions have been proposed, but the trustworthiness of a third-party cloud service is questionable. Recently, blockchain has been introduced in healthcare record sharing, which does not rely on trusting a third party. However, existing approaches only focus on the records collected from medical examination. They are not efficient in sharing data streams continuously generated from sensors and other monitoring devices. Today, IoT devices have been widely deployed and sensors and mobile applications can monitor patients’ body conditions. The collected data are shared to laboratories and institutions for diagnosis and further study. Moreover, existing approaches are too rigid to efficiently support metadata change. In this paper, an efficient data-sharing scheme is proposed, called MedChain, which combines blockchain, digest chain, and structured P2P network techniques to overcome the above efficiency issues in the existing approaches for sharing both types of healthcare data. Based on MedChain, a session-based healthcare data-sharing scheme is devised, which brings flexibility in data sharing. The evaluation results show that MedChain can achieve higher efficiency and satisfy the security requirements in data sharing.
In the digital healthcare era, it is utmost important to harness medical information scattered across healthcare institutions to support in-depth data analysis. However, the boundaries of cyberinfrastructure of healthcare providers place obstacles on data sharing. In this position paper, we firstly identify the challenges of medical data sharing and management. Then we introduce the background and give a brief survey on the state-of-the-art. Finally, we conclude the paper by discussing a few possible research directions to cope with the challenges in current medical information sharing.
Yao Sun, Lei Zhang, Gang Feng, Bowen Yang · 6 authors
Blockchain has shown a great potential in Internet of Things (IoT) ecosystems for establishing trust and consensus mechanisms without involvement of any third party. Understanding the relationship between communication and blockchain as well as the performance constraints posing on the counterparts can facilitate designing a dedicated blockchain-enabled IoT systems. In this paper, we establish an analytical model for the blockchain-enabled wireless IoT system. By considering spatio-temporal domain Poisson distribution, i.e., node geographical distribution in spatial domain and transaction arrival rate in time domain are both modeled as Poisson point process (PPP), we first derive the distribution of signal-to-interference-plus-noise ratio (SINR), blockchain transaction successful rate as well as overall throughput. Based on the system model and performance analysis, we design an algorithm to determine the optimal full function node deployment for blockchain system under the criterion of maximizing transaction throughput. Finally, the security performance is analyzed in the proposed networks with three typical attacks. Solutions such as physical layer security are presented and discussed to keep the system secure under these attacks. Numerical results validate the accuracy of our theoretical analysis and optimal node deployment algorithm.
Blockchain offers an innovative approach to storing information, executing transactions, performing functions, and establishing trust in an open environment. Many consider blockchain as a technology breakthrough for cryptography and cybersecurity, with use cases ranging from globally deployed cryptocurrency systems like Bitcoin, to smart contracts, smart grids over the Internet of Things, and so forth. Although blockchain has received growing interests in both academia and industry in the recent years, the security and privacy of blockchains continue to be at the center of the debate when deploying blockchain in different applications. This article presents a comprehensive overview of the security and privacy of blockchain. To facilitate the discussion, we first introduce the notion of blockchains and its utility in the context of Bitcoin-like online transactions. Then, we describe the basic security properties that are supported as the essential requirements and building blocks for Bitcoin-like cryptocurrency systems, followed by presenting the additional security and privacy properties that are desired in many blockchain applications. Finally, we review the security and privacy techniques for achieving these security properties in blockchain-based systems, including representative consensus algorithms, hash chained storage, mixing protocols, anonymous signatures, non-interactive zero-knowledge proof, and so forth. We conjecture that this survey can help readers to gain an in-depth understanding of the security and privacy of blockchain with respect to concept, attributes, techniques, and systems.
Attribute-based access control makes access control decisions based on the assigned attributes of subjects and the access policies to protect objects by mediating operations from the subjects. Authority, which validates attributes of subjects, is one key component to facilitate attribute-based access control. In an increasingly decentralized society, multiple attributes possessed by subjects may need to be validated by multiple different authorities. This paper proposes a multi-authority attribute-based access control scheme by using Ethereum's smart contracts. In the proposed scheme, Ethereum smart contracts are created to define the interactions between data owner, data user, and multiple attribute authorities. A data user presents its attributes to different attribute authorities, and after successful validation of attributes, obtains attribute tokens from respective attribute authorities. After collecting enough attribute tokens, a smart contract will be executed to issue secret key to the data user to access the requested object. The smart contracts for multi-authority attribute-based access control have been prototyped in Solidity, and their performance has been evaluated on the Rinkeby Ethereum Testnet.
In this paper we address the issue of identity and access control within\nshared permissioned blockchains. We propose the ChainAchor system that provides\nanonymous but verifiable identities for entities on the blockchain. ChainAchor\nalso provides access control to entities seeking to submit transactions to the\nblockchain to read/verify transactions on the the permissioned blockchain.\nConsensus nodes enforce access control to the shared permissioned blockchain by\na simple look-up to a (read-only) list of anonymous members' public-keys.\nChainAnchor also provides unlinkability of transactions belonging to an entity\non the blockchain. This allows for an entity to optionally disclose their\nidentity when a transaction is called into question (e.g. regulatory or\ncompliance requirements), but without affecting the anonymity and unlinkability\nof their remaining transactions.\n
Blockchain has created a revolution in digital networking by using distributed storage, cryptographic algorithms, and smart contracts. Many areas are benefiting from this technology, including data integrity and security, as well as authentication and authorization. Internet of Things (IoTs) networks often suffers from such security issues, which is slowing down wide-scale adoption. In this paper, we describe the employing of blockchain technology to construct a decentralized platform for storing and trading information in the air-to-ground IoT heterogeneous network. To allow both air and ground sensors to participate in the decentralized network, we design a mutual-benefit consensus process to create uneven equilibrium distributions of resources among the participants. We use a Cournot model to optimize the active density factor set in the heterogeneous air network and then employ a Nash equilibrium to balance the number of ground sensors, which is influenced by the achievable average downlink rate between the air sensors and the ground supporters. Finally, we provide numerical results to demonstrate the beneficial properties of the proposed consensus process for air-to-ground networks and show the maximum active sensor's density utilization of air networks to achieve a high quality of service.
As the Internet of Vehicle (IOV) being widely applied throughout our daily life, how to secure data privacy of each vehicle is nowadays a hot topic. Taking an aim of solving this problem, a privacy protection system on double-layered chain basis is designed to eliminate the said security risk during vehicle data communication. At the same time, the nontampering nature of the block chain is used to realize reasonable arbitration in traffic accident disputes, vehicle insurance claims, and other states of affairs. Specifically, an IOV double-layered chain model is constructed to simulate a semicentralized system that is convenient for government to supervise; also, a RSA protocol based on zero-knowledge proof (ZKP) is designed to bring safety and zero-knowledge property to the system; finally, we give the application scenario of this IOV privacy protection system based on double-layered chain that it can be widely used in vehicle-sharing industry. The communication costs, respectively, under double-layered chain and single-layered chain frameworks, are compared to prove that the double-layered structure does save cost. Thus an IOV privacy scheme that is safer and more cost-efficient is given.
Fazeel Ahmed Khan, Adamu Abubakar Ibrahim, Marwan Mahmoud, Mahmoud Ahmad Al‐Khasawneh · 5 authors
The emergence of Blockchain have revolutionize the decentralization in distributed architecture. The advances in the consensus mechanism techniques and the development of different variants of consensus algorithms gives a huge impact on its progress. These technologies allow to have a distributed peer-to-peer network in which each external entity can be able to interact with other entities without any trusted intermediary in a verifiable manner. The existing consensus algorithms are mostly concerned with public blockchain having focused on public ledgers in general. The consortium blockchain is least focused as compared with other variants of blockchain (public and private) showing the need to address this vacuum. In this paper, we proposed a consensus algorithm named Rift for consortium blockchain which works on the principle of trust mechanism for achieving consensus in a blockchain. The consensus is achieved by distributed nodes in a consortium blockchain which were controlled by consortium members to decentralize the arbitration by voting and trust metrics. In this paper, we elaborate the comprehensive idea of Rift and discuss the working model for this algorithm. We also perform simulation on the proposed algorithm and determine the performance variables to evaluate the effectiveness of Rift. The evaluated results show the improvement in the performance which is the objective requirement for the evaluation.