Blockchain Papers

Yichen Wan, Youyang Qu, Longxiang Gao, Yong Xiang

No abstract is available for this record.

Chin‐Ling Chen, Tianyi Wang, Woei-Jiunn Tsaur, Wei Weng · 6 authors

In recent years, the attention of online cross-university courses has been increasing, and students in universities want to increase their knowledge and professional skills by taking online courses from different universities, which raises the issue of course credit verification. In the past, the credits obtained by students in online courses lack endorsement from the education department, and the students’ learning process could not be verified. Therefore, the credits of online courses in one university could not be recognized by other universities. The education departments of some countries and regions implement credit conversion rules to convert the credits obtained by students in online courses into university credits or certificates endorsed by the education department. However, these schemes rely too much on the authority of the education department, and the process of students obtaining credits cannot be verified. In addition, the centralized storage method makes the data of education departments at risk of leakage or tampering. With the emergence of blockchain technology, some researchers have proposed the use of blockchain to store students’ credits, making it possible to reach consensus among multiple parties on the blockchain while ensuring that credits are not tampered with, but these schemes cannot test the learning process of students and the recognition of credits still relies on the authority of the education department. To solve the above problems, this paper proposes a cross-university course learning system with verifiable credits based on Hyperledger Fabric consortium blockchain technology, and the consortium includes many universities. The credits obtained by students in the course and the hash value of the learning records are stored on the blockchain, and the data on the blockchain is jointly maintained by the universities in the system. One university can verify the homework and final examination of students to check the real ability of students, thus recognizing the credits from other universities, and at the same time, to protect the privacy of students, the important data of students are encrypted for transmission.

Shivam Kalra, Junfeng Wen, Jesse C. Cresswell, Maksims Volkovs · 5 authors

No abstract is available for this record.

Xuechun Mao, Lin You, Chengtang Cao, Gengran Hu · 5 authors

Biometric encryption, especially based on fingerprint, plays an important role in privacy protection and identity authentication. In this paper, we construct a privacy-preserving linkable ring signature scheme. In our scheme, we utilize a fuzzy symmetric encryption scheme called symmetric keyring encryption (SKE) to hide the secret key and use non-interactive zero-knowledge (NIZK) protocol to ensure that we do not leak any information about the message. Unlike the blind signature, we use NIZK protocol to cancel the interaction between the signer (the prover) and the verifier. The security proof shows that our scheme is secure under the random oracle model. Finally, we implement it on a personal computer and analyze the performance of the constructed scheme in practical terms. Based on the constructed scheme and demo, we give an anonymous cryptocurrency transaction model as well as mobile demonstration.

Ning Lu, Xin Xu, Chang Choi, Tianlong Fei · 5 authors

When building the large-scale distributed decision control system based on mobile terminal devices (MTDs), electronic voting (E-voting) is a necessary technique to settle the dispute among parties. Due to the inherent insecurity of Internet, it is difficult for E-voting to attain complete fairness and robustness. In this study, we argue that Bitcoin blockchain offers better options for a more practical E-voting. We first present a coin mixing-based E-voting system model, which can cut off the relationship between the voter’s real identity and its Bitcoin address to achieve strong anonymity. Moreover, we devise a secret sharing-based E-voting protocol, which can prevent voting number from being leaked ahead and further realize strong robustness. We establish the probable security theory to prove its security. In addition, we use the experimental evaluation to demonstrate its efficiency.

Hisham Ali, Pavlos Papadopoulos, Jawad Ahmad, Nikolaos Pitropakis · 6 authors

Threat information sharing is considered as one of the proactive defensive approaches for enhancing the overall security of trusted partners. Trusted partner organizations can provide access to past and current cybersecurity threats for reducing the risk of a potential cyberattack - the requirements for threat information sharing range from simplistic sharing of documents to threat intelligence sharing. Therefore, the storage and sharing of highly sensitive threat information raises considerable concerns regarding constructing a secure, trusted threat information exchange infrastructure. Establishing a trusted ecosystem for threat sharing will promote the validity, security, anonymity, scalability, latency efficiency, and traceability of the stored information that protects it from unauthorized disclosure. This paper proposes a system that ensures the security principles mentioned above by utilizing a distributed ledger technology that provides secure decentralized operations through smart contracts and provides a privacy-preserving ecosystem for threat information storage and sharing regarding the MITRE ATT\&CK framework.

Jan Lánský, Amir Masoud Rahmani, Saqib Ali, Nasour Bagheri · 7 authors

In this paper, targeting efficient authentication and key agreement in an IoT environment, we propose an Elliptic Curve Cryptography-(ECC) based lightweight authentication protocol called BCmECC which relies on a public blockchain to validate the users’ public key to provide desired security. We evaluate the security of the proposed protocol heuristically and validate it formally, which demonstratse the high level of the security. For the formal verification we used the widely accepted formal methods, i.e., BAN logic and the Scyther tool. In this paper we also analyse the security of recently proposed blockchain-based authentication protocols and show that this protocol does not provide the desired security against known session-specific temporary information attacks in which the adversary has access to the session’s ephemeral values and aims to retrieve the shared session key. In addition, the protocol lacks forward secrecy, in which an adversary with access to the server’s long-term secret key can retrieve the previous session keys, assuming that the adversary has already eavesdropped the transferred messages over a public channel in the target session. The proposed attacks are very efficient and their success probability is ‘1’, while the time complexity of each attack could be negligible. Besides, we show that BCmECC is secure against such attacks.

Sankarshan Damle, Boi Faltings, Sujit Gujar

AI applications find widespread use in a variety of domains. For further acceptance, mostly when multiple agents interact with the system, we must aim to preserve the privacy of participants information in such applications. Towards this, the Yao’s Millionaires’ problem (YMP), i.e., to determine the richer among two millionaires’ privately, finds relevance. This work presents a novel, practical, and verifiable solution to YMP, namely, Secure Comparison Protocol (SCP). We show that SCP achieves this comparison in a constant number of rounds, without using encryption and not requiring the participants’ continuous involvement. SCP uses semi-trusted third parties - which we refer to as privacy accountants - for the comparison, who do not learn any information about the values. That is, the probability of information leak is negligible in the problem size. In SCP, we also leverage the Ethereum network for pseudo-anonymous communication, unlike computationally expensive secure channels such as Tor. We present a Secure Truthful cOmbinatorial aUction Protocol (STOUP) for single-minded bidders to demonstrate SCP’s significance. We show that STOUP, unlike previous works, preserves the privacies relevant to an auction even from the auctioneer. We demonstrate the practicality of STOUP through simulations.

Razieh Nokhbeh Zaeem, Kai Chih Chang, Teng-Chieh Huang, David Liau · 10 authors

Identity is at the heart of digital transformation. Successful digital transformation requires confidence in and protection of digital identities. On the Internet, however, there is no unique and standard identity layer. Consequently, a variety of digital identities have emerged over years, leading to privacy risks, security vulnerabilities, risks for identity owners, and liability for identity issuers and those relying on digital identities to grant access to goods and services. Self-Sovereign Identity (SSI) and similar forms of identity management on the blockchain distributed ledger are novel technologies that recognize the need to keep user identity privately stored in user-owned devices, securely verified by identity issuers, and only revealed to verifiers as needed. There is limited academic literature defining the prerequisite SSI functional and non-functional requirements and comparing SSI technologies. Often those SSI technologies reviewed in the literature lack behind current advances. We present the first work that compiles a comprehensive list of functional and non-functional requirements of SSI and compares an extensive number of existing SSI/blockchain-based identity management solutions with respect to these requirements. Our work sheds light on the state-of-the-art SSI development and paves the way for future, more informed analysis and development of novel identity management and SSI solutions.

А. В. Богданов, Vladimir Korkhov, Nadezhda Shchegoleva, Vasilii M. Khvatov · 8 authors

Potential benefits of implementation of distributed ledger technology are widely discussedamong different business actors and governmental structures. Within the last decade, with growingpopularity of blockchain-based payment systems and cryptocurrencies, these discussions considerablysharpened. Therefore, an extensive body of research has emerged on this soil. The goal of this study isto attempt to make a comparative analysis of several existing blockchain-based distributed ledgerplatforms. Besides that, authors overview the most commonly used consensus algorithms and designapproaches, as for any blockchain product, consensus algorithm is a crucial part which determines theperformance of the overall system. Choosing the right algorithm would ensure high reliability andthroughput, while the wrong choice could cause fatal malfunctions for the application. A suitablealgorithm usually should be chosen according to the task in consideration, e.g. Nakamoto-styleprotocols could be considered better for public networks, while multiround voting protocols are moresuitable for private and secure systems. The highest attention is paid to consensus algorithms based onthe solution of the Byzantine Fault Tolerance problem (BFT).

Ke Yuan, Yingjie Yan, Tong Xiao, Wenchao Zhang · 6 authors

In response to the rapid growth of credit-investigation data, data redundancy among credit-investigation agencies, privacy leakages of credit-investigation data subjects, and data security risks have been reported. This study proposes a privacy-protection scheme for a credit-investigation system based on blockchain technology, which realizes the secure sharing of credit-investigation data among multiple entities such as credit-investigation users, credit-investigation agencies, and cloud service providers. This scheme is based on blockchain technology to solve the problem of islanding of credit-investigation data and is based on zero-knowledge-proof technology, which works by submitting a proof to the smart contract to achieve anonymous identity authentication, ensuring that the identity privacy of credit-investigation users is not disclosed; this scheme is also based on searchable-symmetric-encryption technology to realize the retrieval of the ciphertext of the credit-investigation data. A security analysis showed that this scheme guarantees the confidentiality, the availability, the tamper-proofability, and the ciphertext searchability of credit-investigation data, as well as the fairness and anonymity of identity authentication in the credit-investigation data query. An efficiency analysis showed that, compared with similar identity-authentication schemes, the proof key of this scheme is smaller, and the verification time is shorter. Compared with similar ciphertext-retrieval schemes, the time for this scheme to generate indexes and trapdoors and return search results is significantly shorter.

Léo Robert, Daiki Miyahara, Pascal Lafourcade, Luc Libralesso · 5 authors

Suguru is a paper and pencil puzzle invented by Naoki Inaba. The goal of the game is to fill a grid with numbers between 1 and 5 while respecting three simple constraints. We first prove the NP-completeness of Suguru puzzle. For this we design gadgets to encode the PLANAR-CIRCUIT-SAT in a Suguru grid. We then design a physical Zero-Knowledge Proof (ZKP) protocol for Suguru. This ZKP protocol allows a prover to prove that he knows a solution of a Suguru grid to a verifier without leaking any information on the solution. To construct such a physical ZKP protocol, we only rely on a few physical cards and adapted encoding. For a Suguru grid with n cells, we only use 5n+5 cards. Moreover, we prove the three classical security properties of a ZKP: completeness, extractability, and zero-knowledge.

Yong Wang, Aiqing Zhang, Peiyun Zhang, Youyang Qu · 5 authors

With the fast boom of Internet of Medical Things (IoMT) devices and an increasing focus on personal health, personal health data are extensively collected by IoMT and stored as personal health records (PHRs). PHRs are frequently shared for accurate diagnosis, prognosis prediction, health advice consulting, etc. Since PHRs are highly private, the data-sharing process leads to wide-ranging concerns on privacy leakage and security compromise. Existing research has shown that the centralized systems, as the mainstream mode, are under the great risks. Motivated by this, we propose a consortium blockchain-based PHR management and sharing scheme, which is both security aware and privacy preserving. We adopt the interplanetary file system (IPFS) to store the PHR ciphertext of IoMT. Then, zero-knowledge proof can provide evidence for verifying keyword index authentication on blockchain. Moreover, the scheme jointly leverages modified attribute-based cryptographic primitives and tailor-made smart contracts to achieve secure search, privacy preservation, and personalized access control in IoMT scenarios. Security analysis is conducted to show that the designed protocols attain the expected design goals. This is followed by extensive evaluation results derived from real-world data sets, which demonstrate the superiority of the proposed scheme over current leading ones.

Rashmi Agrawal, Ji Yang, Haris Javaid

As enterprises embrace blockchain technology, many real-world applications have been developed and deployed using permissioned blockchain platforms (access to network is controlled and given to only nodes with known identities). Such blockchain platforms heavily depend on cryptography to provide a layer of trust within the network, thus verification of cryptographic signatures often becomes the bottleneck. The Elliptic Curve Digital Signature Algorithm (ECDSA) is the most commonly used cryptographic scheme in permissioned blockchains. In this paper, we propose an efficient implementation of ECDSA signature verification on an FPGA, in order to improve the performance of permissioned blockchains that aim to use FPGA-based hardware accelerators. We propose several optimizations for modular arithmetic (e.g., custom multipliers and fast modular reduction) and point arithmetic (e.g., reduced number of point double and addition operations, and optimal width NAF representation). Based on these optimized modular and point arithmetic modules, we propose an ECDSA verification engine that can be used by any application for fast verification of ECDSA signatures. We further optimize our ECDSA verification engine for Hyperledger Fabric (one of the most widely used permissioned blockchain platforms) by moving carefully selected operations to a precomputation block, thus simplifying the critical path of ECDSA signature verification. From our implementation on Xilinx Alveo U250 accelerator board with target frequency of 250MHz, our ECDSA verification engine can perform a single verification in $760μs$ resulting in a throughput of 1,315 verifications per second, which is ~2.5x faster than state-of-the-art FPGA-based implementations. Our Hyperledger Fabric-specific ECDSA engine can perform a single verification in $368μs$ with a throughput of 2,717 verifications per second.

Young-Hoon Park, Yejin Kim, Junho Shim

The advances made in genome technology have resulted in significant amounts of genomic data being generated at an increasing speed. As genomic data contain various privacy-sensitive information, security schemes that protect confidentiality and control access are essential. Many security techniques have been proposed to safeguard healthcare data. However, these techniques are inadequate for genomic data management because of their large size. Additionally, privacy problems due to the sharing of gene data are yet to be addressed. In this study, we propose a secure genomic data management system using blockchain and local differential privacy (LDP). The proposed system employs two types of storage: private storage for internal staff and semi-private storage for external users. In private storage, because encrypted gene data are stored, only internal employees can access the data. Meanwhile, in semi-private storage, gene data are irreversibly modified by LDP. Through LDP, different noises are added to each section of the genomic data. Therefore, even though the third party uses or exposes the shared data, the owner’s privacy is guaranteed. Furthermore, the access control for each storage is ensured by the blockchain, and the gene owner can trace the usage and sharing status using a decentralized application in a mobile device.

Rabimba Karanjai, Lei Xu, Zhimin Gao, Lin Chen · 6 authors

In this paper, we present the design and implementation of a privacy preserving event based UTXO (Unspent Transaction Output) transaction system. Unlike the existing approaches that often depend on smart contracts where digital assets are first locked in a vault, and then released according to event triggers, the event based transaction system encodes event outcome as part of the UTXO note and safeguards event privacy by shielding it with zero-knowledge proof based protocols such that associations between UTXO notes and events are hidden from the validators. Without relying on any triggering mechanism, the proposed transaction system separates event processing from the transaction processing where confidential event based UTXO notes (event based UTXOs or conditional UTXOs) can be transferred freely with full privacy in an asynchronous manner, only with their asset values conditional to the linked event outcomes. The main advantage of such design is that it enables free trade of event based digital assets and prevents the assets from being locked. We implemented the proposed transaction system by extending the Zerocoin data model and protocols. The system is implemented and evaluated using xJsnark.

Hajar Moudoud, Soumaya Cherkaoui, Lyes Khoukhi

Federated learning (FL) is a distributed machine learning (ML) technique that enables collaborative training in which devices perform learning using a local dataset while preserving their privacy. This technique ensures privacy, communication efficiency, and resource conservation. Despite these advantages, FL still suffers from several challenges related to reliability (i.e., unreliable participating devices in training), tractability (i.e., a large number of trained models), and anonymity. To address these issues, we propose a secure and trustworthy blockchain framework (SRB-FL) tailored to FL, which uses blockchain features to enable collaborative model training in a fully distributed and trustworthy manner. In particular, we design a secure FL based on the blockchain sharding that ensures data reliability, scalability, and trustworthiness. In addition, we introduce an incentive mechanism to improve the reliability of FL devices using subjective multi-weight logic. The results show that our proposed SRB- FL framework is efficient and scalable, making it a promising and suitable solution for federated learning.

Xiongfei Zhao, Yain‐Whar Si

Nowadays, academic certificates are still widely issued in paper format. Traditional certificate verification is a lengthy, manually intensive, and sometimes expensive process. In this paper, we propose a novel NFT-based certificate framework called NFTCert, which enables the establishment of links between a legitimate certificate and its owner through a Blockchain. In this paper, we describe the implementation of the NFTCert framework, including schema definition, minting, verification, and revocation of NFT-based certificates. We also introduce a payment gateway into the minting process, which enables NFTCert to be used by a wider audience. Therefore, participants of NFTCerts do not need to rely on cryptocurrency for transactions. All in all, the proposed framework is designed to achieve usability, authenticity, confidentiality, transparency, and availability properties when it is compared to existing Blockchain-based systems.

Konstantinos Limniotis

Cryptography is traditionally considered as a main information security mechanism, providing several security services such as confidentiality, as well as data and entity authentication. This aspect is clearly relevant to the fundamental human right of privacy, in terms of securing data from eavesdropping and tampering, as well as from masquerading their origin. However, cryptography may also support several other (legal) requirements related to privacy. For example, in order to fulfil the data minimisation principle—i.e., to ensure that the personal data that are being processed are adequate and limited only to what is necessary in relation to the purposes for which they are processed—the use of advanced cryptographic techniques such as secure computations, zero-knowledge proofs or homomorphic encryption may be prerequisite. In practice though, it seems that the organisations performing personal data processing are not fully aware of such solutions, thus adopting techniques that pose risks for the rights of individuals. This paper aims to provide a generic overview of the possible cryptographic applications that suffice to address privacy challenges. In the process, we shall also state our view on the public “debate” on finding ways so as to allow law enforcement agencies to bypass the encryption of communication.

Saide Zhu, Ruinian Li, Zhipeng Cai, Donghyun Kim · 6 authors

IoT devices’ storage and computation capacities are constantly increasing in recent years, which brings critical challenges in data privacy protection. Federated learning (FL) and blockchain technology are two popular techniques used in IoT data aggregation, where FL enables data training with privacy protection, and blockchain provides a decentralized architecture for data storage and mining. However, very few the state-of-the-art works consider the applicability of the combination of FL and blockchain. In this paper, we adopt the federated averaging algorithm to reduce the communication overhead between the blockchain and end users to achieve higher performance. We also apply the double-mask-then-encrypt approach for end users to submit their local updates in order to protect data privacy. Finally, we propose and implement a non-interactive Public Verifiable Secret Sharing (PVSS) algorithm with Distributed Hash Table (DHT) that solves the user-drop-out problem and improves the communication efficiency between blockchain and end-users. At last, we theoretically analyze the security strengths of the proposed solution and conduct experiments to measure the execution time of PVSS on both the server and clients sides.

Samiksha Kodgire Samiksha, Padma Adane, Ajay Jadhav, Aman R. Agrawal · 5 authors

Transactions over the internet have increased rapidly and so is the need to prove one’s identity and have a secured system to keep records. To overcome identity theft and fraud cases, Self-Sovereign Identity (SSI) was introduced which gives the user complete control over their identity on the internet. Self-Sovereign Identity eliminates the centralized authority and brings Zero-knowledge proof concepts into account to help in easy transactions over the internet. It avoids revealing unnecessary information and correlation attacks. Self-Sovereign Identity, on top of blockchain public ledger features, provides an extra security layer to the system that can be used to monitor the entries in confidential places. This research paper describes a software module, that we have developed, to grant verifiable credentials to users. These credentials, on verification, can grant entry into any security system with which the module is integrated. The module utilizes the facilities provided by Hyperledger Indy and Hyperledger Aries for the creation of verifiable credentials and subsequent verification in a secure manner.

Mohammad Reza Nosouhi, Shui Yu, Keshav Sood, Marthie Grobler · 7 authors

In cryptocurrencies, privacy of users is preserved using pseudonymity . However, it has been shown that pseudonymity does not result in anonymity if a user's transactions are linkable. This makes cryptocurrencies vulnerable to deanonymization attacks. The current solutions proposed in the literature suffer from at least one of the following issues: (1) requiring a trusted third–party entity, (2) poor performance, and (3) incompatible with the standard structure of cryptocurrencies. In this article, we propose Unlinkable Coin (UCoin), a secure mix–based approach to address these issues. In UCoin, the link between the input (payer) and output (payee) addresses in a transaction is broken. This is done by mixing the transactions of multiple users into a single aggregated transaction in which the output addresses have been secretly shuffled. In our protocol design, we first develop HDC–net, a secure shuffling protocol that enables a group of users to anonymously publish their data. Then, we deploy the proposed HDC–net protocol in the UCoin architecture (as a mixing unit) to generate the aggregate transactions. We show that UCoin (1) does not rely on a trusted third–party, (2) can mix 50 transactions in 6.3 seconds that is 18% faster than the current solutions, and (3) is fully compatible with the architecture of cryptocurrencies.

Seyed Amid Moeinzadeh Mirhosseini, Ali Fanian, T. Aaron Gulliver

The advent of Bitcoin, and consequently Blockchain, has ushered in a new era\nof decentralization. Blockchain enables mutually distrusting entities to work\ncollaboratively to attain a common objective. However, current Blockchain\ntechnologies lack scalability, which limits their use in Internet of Things\n(IoT) applications. Many devices on the Internet have the computational and\ncommunication capabilities to facilitate decision-making. These devices will\nsoon be a 50 billion node network. Furthermore, new IoT business models such as\nSensor-as-a-Service (SaaS) require a robust Trust and Reputation System (TRS).\nIn this paper, we introduce an innovative distributed ledger combining Tangle\nand Blockchain as a TRS framework for IoT. The combination of Tangle and\nBlockchain provides maintainability of the former and scalability of the\nlatter. The proposed ledger can handle large numbers of IoT device transactions\nand facilitates low power nodes joining and contributing. Employing a\ndistributed ledger mitigates many threats, such as whitewashing attacks. Along\nwith combining payments and rating protocols, the proposed approach provides\ncleaner data to the upper layer reputation algorithm.\n

Meng Li, Yifei Chen, Chhagan Lal, Mauro Conti · 6 authors

Vehicular Digital Forensics (VDF) is essential to enable liability cognizance of accidents and fight against crimes. Ensuring the authority to timely gather, analyze, and trace data promotes vehicular investigations. However, adversaries crave the identity of the data provider/user, damage the evidence, violate evidence jurisdiction, and leak evidence. Therefore, protecting privacy and evidence accountability while guaranteeing access control and traceability in VDF is no easy task. To address the above-mentioned issues, we propose Eunomia: an anonymous and secure VDF scheme based on blockchain. It preserves privacy with decentralized anonymous credentials without trusted third parties. Vehicular data and evidence are uploaded by data providers to the blockchain and stored in distributed data storage. Each investigation is modeled as a finite state machine with state transitions being executed by smart contracts. Eunomia achieves fine-grained evidence access control via ciphertext-policy attribute-based encryption and Bulletproofs. A user must hold specific attributes and a temporary-and-unexpired token/warrant to retrieve data from the blockchain. Finally, a secret key is embedded into data to trace the traitor if any evidence breach happens. We use a formal analysis to demonstrate the strong privacy and security properties of Eunomia. Moreover, we build a prototype in a WiFi-based Ethereum test network to evaluate its performance.