Yang Xiao, Ning Zhang, Jin Li, Wenjing Lou · 5 authors
The abundance and rich varieties of data are enabling many transformative applications of big data analytics that have profound societal impacts. However, there are also increasing concerns regarding the improper use of individual data owner's private data. In this paper, we propose PrivacyGuard, a system that leverages blockchain smart contract and trusted execution environment (TEE) to enable individual's control over the access and usage of their private data. Smart contracts are used to specify data usage policy, i.e., who can use what data under which conditions and what analytics to perform, while the distributed blockchain ledger is used to keep an irreversible and non-repudiable data usage record. To address the efficiency problem of on-chain contract execution and to prevent exposing private data on the publicly viewable blockchain, PrivacyGuard incorporates a novel TEE-based off-chain contract execution engine along with a protocol to securely commit the execution result onto blockchain. We have built and deployed a prototype of PrivacyGuard with Ethereum and Intel SGX. Our experiment result demonstrates that PrivacyGuard fulfills the promised privacy goal and supports analytics on data from a considerable number of data owners.
Dijiang Huang, Chun-Jen Chung, Qiuxiang Dong, Jim Luo · 5 authors
Blockchain technology is increasingly being adopted as a trusted platform to support business functions including trusted and verifiable transactions, tracking, and validation. However, most business use-cases require privacy and confidentiality for data and transactions. As a result, businesses are forced to choose private blockchain solutions and unable to take full advantage of the capabilities, benefits and infrastructure of public blockchain systems. To address this issue, we present an Attribute-Based Encryption (ABE) security solution built on a private-over-public (PoP) blockchain approach. The policy based distributed operation of ABE conforms well to the blockchain concept. The cross-chain PoP approach provides the benefits from both public blockchains and private blockchains. Businesses will be able to restrict access, maintain privacy, and improve performance while still being able to leverage the distributed trust of public blockchains. This paper present the ABE-based security framework and protocol for securing data, transactions as well as smart contracts. Security analysis and performance evaluation show the proposed solution to be effective, efficient and practical. It can greatly reduce the cost and complexity for businesses compared to running isolated private blockchain solutions.
Smart contracts are applications that are deployed and executed on a blockchain's decentralised infrastructure. Many smart contract applications rely on data that resides outside the blockchain. However, while traditional web applications can communicate with trustworthy data sources directly through the Internet, this is not possible for smart contracts because their execution must be deterministic. Bringing external data into the blockchain has been a topic of research since the first introduction of Ethereum. A system that can provide this data to smart contracts is called an oracle. The primary requirement in designing oracles is that the authenticity of the data must be publicly verifiable, which can be achieved through signatures. However, transmitting data to the blockchain and performing the verification is costly, especially if applications require data from multiple sources. In that case, current approaches would need to retrieve the data from each source separately. In this paper, we present the concept of MUlti-Source oraCLE (MUSCLE) for retrieving data from multiple sources, which we believe to be the first to focus on the multi-source scenario. We implement five variants of MUSCLE, each using a different signature or aggregate signature scheme and compare their performance with two oracles that are based on TLS-N, which represents the current state of the art. Our results show that the ECDSA-based MUSCLE features the lowest total gas expenditure, while the BGLS-based oracle provides lower transaction and storage costs.
Vincent Reniers, Dimitri Van Landuyt, Paolo Viviani, Bert Lagaisse · 6 authors
Many applications by design depend on costly trusted third-party auditors. One such example is the industrial application case of federated multi-disciplinary optimization (MDO), in which different organizations contribute to a complex engineering design effort. Although blockchain and distributed ledger technology (DLT) has strong potential in reducing the dependence on such intermediaries, the architectural complexity involved in designing a solution is daunting.
In economic activities, there are massive contracts, transactions, and payments. The consistency, integrity, and security of these important transaction data are crucial. The application of blockchain technology in document certification, asset trading and payment reconciliation, solves the security vulnerabilities existing in traditional technical solutions, optimizes business models, improves efficiency, ensures security, and enhances core competitiveness.
Nowadays, achieving strong accountability for two or more parties that interact each other within heterogeneous and distributed business processes using a trustable and decentralised approach has become a very important issue. In this paper a solution is proposed that consists of an IT infrastructure which uses blockchain and digital identity technologies as the building blocks. In particular, the notion of accountability node, a special case of blockchain 3.0 masternode, is identified as the key element of the devised infrastructure which acts as the main interface to cooperating services and relieves the users from the burden of having to directly interact with the blockchain.
With the development of the Internet of Vehicles, more and more applications require collaboration between vehicles. Vehicles from different car manufacturers have their own private clouds, and the collaboration between them is poor, resulting in inefficient collaboration between heterogeneous vehicles. A single cloud lacks collaboration between vehicles and it's an inevitable trend for developing collaboration between clouds. JointCloud is a new computing model in which collaboration services provided between clouds are used to server users in a software-defined manner based on blockchain. This paper proposes the collaboration framework of multiple vehicle clouds, introduces the blockchain to establish the coordination mechanism, and describes standardization method and service combination method of the vehicular cloud service in detail. At the end of this paper, we designed a distributed cloud service evaluation method based on blockchain to provide users with an effective cloud service evaluation solution.
Blockchains offer an interesting solution to some of the security challenges encountered in military applications. They are particularly attractive in the scenarios, where it is difficult or even impossible to establish a common root of trust, e.g., in the context of civil-military collaboration, where military organizations need to build trusted information exchange infrastructure with various types of civilian governmental and non-governmental organizations, local communities, commercial companies and private persons. In our work, we discuss how blockchain can be used to store metadata describing information collected from the IoT devices owned by the federation members as well as crowdsourced from sensors belonging to private users. We present a high level architecture for a metadata binding solution using blockchains compliant with STANAG 4774 and 4778. We also describe a concrete technical solution based on Hyperledger Fabric and some of the open issues.
Paul Merrill, Thomas H. Austin, Jenil Thakker, Younghee Park · 5 authors
Bitcoin introduced the world to blockchain-based cryptocurrencies, and Ethereum highlighted their value in building distributed applications (dApps). However, the development of blockchain-based applications has been held back by high transaction fees. In this paper, we introduce a model for free transactions on the blockchain. Rather than spending tokens for transaction fees, a token owner (known as a client) locks tokens to generate new tokens as a reward for the miner who includes the transaction in a block. This token-locking reward model eases congestion on the blockchain in the same manner as fees do in protocols like Bitcoin, but without forcing clients to sacrifice their tokens. This same design can be used to incentivize service providers. We show how a client can lock their tokens to generate new tokens for storage providers, and how this reward mechanism can help to facilitate an audit of the storage provider.
Blockchain, as the underlying technique of cryptocurrency, has triggered a wave of innovation in decentralized computing. Despite some research on blockchain data query, a primary concern for blockchain to be fully practical is to combat the data query inefficiency and query result authenticity. To provide both efficient and verifiable data query services for blockchain-based systems, we propose a Verifiable Query Layer (VQL). The middleware layer extracts transactions stored in the underlying blockchain system and efficiently reorganizes them in databases to provide various query services for public users. To prevent falsified data being stored in the middleware, a cryptographic hash value is calculated for each constructed database. The database fingerprint including the hash value and some database properties will be first verified by miners and then stored in the blockchain. We implement VQL and conduct extensive experiments based on a practical blockchain system Ethereum. The evaluation results demonstrate that VQL can effectively support various data query services and guarantee the authenticity of query results for the blockchain system.
Traditional cloud Service Level Agreement (SLA) suffers from lacking a trustworthy platform for automatic enforcement. The emerging blockchain technique brings in an immutable solution for tracking transactions among business partners. However, it is still very challenging to prove the credibility of possible violations in the SLA before recording them onto the blockchain. To tackle this challenge, we propose a witness model using game theory and the smart contract techniques. The proposed model extends the existing service model with a new role called “witness” for detecting and reporting service violations. Witnesses gain revenue as an incentive for performing these duties, and the payoff function is carefully designed in a way that trustworthiness is guaranteed: in order to get the maximum profit, the witness has to always tell the truth. This is analyzed and proved through game theory using the Nash equilibrium principle. In addition, an unbiased sortition algorithm is proposed to ensure the randomness of the independent witnesses selection from the decentralized witness pool, to avoid possible unfairness or collusion. An auditing mechanism is also introduced in the paper to detect potential irrational or malicious witnesses. We have prototyped the system leveraging the smart contracts of Ethereum blockchain. Experimental results demonstrate the feasibility of the proposed model and indicate good performance in accordance with the design expectations.
Security presents a significant challenge for the implementation and the realization of IoT scenarios. Its requirements include data confidentiality, authentication, access control as well as privacy and trust among things and services. To evaluate entities trustworthiness, exchanging trust information is crucial to reach an accurate assessment. Secure sharing and storage of trust information is essential for its confidentiality, integrity and privacy. In this context, our objective is to propose a secure trust management system based on the blockchain technology so that we can take advantages of security features it provides regarding reliability, traceability and information integrity. Blockchain based trust management can provide tamper proof data, enable a more reliable trust information integrity verification, and help to enhance its privacy and availability during sharing and storage. For this purpose, we design and implement a blockchain based trust architecture to collect trust evidences, to define a trust score for each device and to securely store and share them with other devices within the network by embedding them into blockchain transactions. Results from performance evaluation demonstrate that our proposal provides security features including tamper-proof and attacks resiliency, reliability in addition to a low complexity for IoT scenarios and applications.
We present models that utilize smart contracts and interledger mechanisms to provide decentralized authorization for constrained IoT devices. The models involve different tradeoffs in terms of cost, delay, complexity, and privacy, while exploiting key advantages of smart contracts and multiple blockchains that communicate with interledger mechanisms. These include immutably recording hashes of authorization information and policies in smart contracts, resilience through the execution of smart contract code on all blockchain nodes, and cryptographically linking transactions and IoT events recorded on different blockchains using hash and time-lock mechanisms. The proposed models are evaluated on the public Ethereum testnets Rinkeby and Ropsten, in terms of execution cost (gas), delay, and reduction of data that needs to be sent to the constrained IoT devices.
We present models for utilizing blockchain and smart contract technology with the widely used OAuth 2.0 open authorization framework to provide delegated authorization for constrained IoT devices. The models involve different trade-offs in terms of privacy, delay, and cost, while exploiting key advantages of blockchains and smart contracts. These include linking payments to authorization grants, immutably recording authorization information and policies in smart contracts, and offering resilience through the execution of smart contract code on all blockchain nodes.
The electronic authentication system authenticates the documents electronically using the blockchain technology, which enables us to implement an integrated system of official documents of all kinds for Al-Zaytoonah University of Jordan. This technology allows us to build a robust database system that cannot be tampered with, modified, destroyed or altered. It further ensures the safety of documents issued within the University departments and those exported or deported outside the University system; such as, financial documents, official documents and academic certificates. Moreover, this system guarantees us a very high level of data and information security and confidentiality. Our system will be built using a database that provides 100% true information about the exports of that system. This technology will help users prevent the forgery of the data and official documents issued by the University of Al-Zaytoonah, both internally and externally, and also enables the departments within the University to issue documents to third parties while ensuring confirmed, undeniable delivery and sound content.
Blockchain technology has attracted much attention due to the great success of the cryptocurrencies. Owing to its immutability property and consensus protocol, blockchain offers a new solution for trusted storage and computation services. To scale up the services, prior research has suggested a hybrid storage architecture, where only small meta-data are stored onchain and the raw data are outsourced to off-chain storage. To protect data integrity, a cryptographic proof can be constructed online for queries over the data stored in the system. However, the previous schemes only support simple key-value queries. In this paper, we take the first step toward studying authenticated range queries in the hybrid-storage blockchain. The key challenge lies in how to design an authenticated data structure (ADS) that can be efficiently maintained by the blockchain, in which a unique gas cost model is employed. By analyzing the performance of the existing techniques, we propose a novel ADS, called GEM2-tree, which is not only gas-efficient but also effective in supporting authenticated queries. To further reduce the ADS maintenance cost without sacrificing much the query performance, we also propose an optimized structure, GEM2*-tree, by designing a two-level index structure. Theoretical analysis and empirical evaluation validate the performance of the proposed ADSs.
Blockchain has been adopted in many applications to construct trust among multiple participants, such as supply chain management, digital assets transfer, philanthropy, etc. Blockchain platforms are often used as decentralized databases. However, existing blockchain platforms are far less convenient to use than traditional databases. They are lack of the capability of modelling complex tasks conveniently and efficiently, especially when both on-chain and off-chain data are involved at the same time. In this paper, we propose and implement a novel blockchain database, called SEBDB, which leverages the existing databases' functionality which are optimized for decades. Comparing to existing works, SEBDB is the first platform which considers both useability and scalability. Specifically, first, weaddrelationaldata semantics into blockchain platform, where each transaction is a tuple with multiple attributes in a pre-defined table. Second, we use SQL-like language as the general interface, instead of code-level APIs, to support convenient application development, in which intrinsic operations are re-defined and re-implemented to suit for blockchain platform. Third, as RDBMS has achieved great success in the past decades, our system, though not relying on RDBMS, treats it as an important component. Finally, we define a mini-benchmark to evaluate the performance of the blockchain database. Extensive experiments demonstrate the effectiveness and efficiency of our proposed system.
The concerns held on the scalability of permissionless Blockchain platforms are a significant hindrance to their wider adoption. To address this issue rigorously, we consider it opportune to assess the current implementation and the associated improvement proposals, within a single coherent evaluation framework. This work addresses this specific question in the particular context of Ethereum, a prominent implementation of Blockchain, using a threefold approach. First, it maps the internal constituents of Ethereum onto a layered architecture inspired in the ISO/OSI model, so that its provisioning organization can be better understood. Second, it employs the AKF Scale Cube to analyze the pros and cons of the present specification of Ethereum, as well as of the current improvement proposals, so that the scalability challenges can be reasoned about in an orderly fashion. Finally, it uses an extensible test environment with synthetic benchmarks so that the transaction throughput of the current implementation of Ethereum can be evaluated in a private scenario, when no smart contract is to run. Our conclusions suggest that Ethereum respects the scalability trilemma being versed on security and decentralization renouncing scalability. These limits can be mitigated by adopting novel solutions such as Plasma and Sharding which enable a significant increment of performance by partitioning the data, and, ultimately, unlocking parallel execution of the transactions.
Reto E. Koenig, Lukas Laederach, Cédric von Allmen
This paper describes a new but state-of-the-art approach to provide authenticity in mqtt sessions using the means of zero-knowledge-proofs. This approach completely voids session hijacking for the mqtt protocol and provides authenticity without the need for any network-security nor channel-security nor broker-based predefined ACLs. The presented approach does not require the broker to keep any secrets for session handling, what so ever. Moreover, it allows the clientID, which represents the identification for a session, to be publicly known. The presented approach allows completely anonymous but authentic sessions, hence the broker does not need any a priori knowledge of the client-party. As it is especially targeted for applications within the world of IoT, the presented approach is tuned to require only the minimum in extra power in terms of energy and space. The approach does not introduce any new concept, but simply fusions a state-of-the-art cryptographic zero knowledge proof of identity with the existing MQTT-5 specification. Thus no protocol extension is required in order to provide the targeted security properties. The described approach is completely agnostic to the application layer at the client side and is only required during mqtt-session establishment.
Amir Teshome Wonjiga, Louis Rilling, Christine Morin
The cloud computing business model introduced a new paradigm in terms of ownership of a system. Before the cloud, a user acquires physical infrastructure and uses it by installing and configuring according to her/his needs. In that scenario, the full system is owned by a single entity. In the cloud, when the user outsources a service for a cloud provider the user owns some part of the system while the provider owns the remaining part. Thus, ownership in the cloud is divided between different entities. Clients hosting their information system need to trust and rely on what the providers claim. At the same time providers try to give assurance for some aspects of the provided service (e.g. availability) through service level agreements (SLAs). We aim at extending SLAs to include security monitoring terms. In a previous study [1] we proposed an SLA verification method for security monitoring SLAs describing the performance on an NIDS.In this paper we consider an SLA guaranteeing the integrity of tenants’ data stored in the cloud. The tenant outsources data storage service to a Storage as a Service cloud provider. In such a system the data is owned by the tenant while the provider owns the infrastructure. We consider an SLA offered by the provider to guarantee the integrity of tenants’ data. In this paper, we propose a verification method, i.e. an integrity checking method, which is based on a distributed ledger. Specifically, our proposed method allows both providers and tenants to perform integrity checking without one party relying on the other. The method uses a blockchain as a distributed ledger to store evidences of data integrity. Assuming the ledger as a secure, trusted source of information, the evidence can be used to resolve conflicts between providers and tenants. In addition, we present a prototype implementation and an experimental evaluation to show the feasibility of our verification method and to measure the time overhead introduced.