The deployment of cloud storage services has significant benefits in managing data for users. However, it also causes many security concerns, and one of them is data integrity. Public verification techniques can enable a user to employ a third-party auditor to verify the data integrity on behalf of her/him, whereas existing public verification schemes are vulnerable toprocrastinating auditorswho may not perform verifications on time. Furthermore, most of public verification schemes are constructed on the public key infrastructure (PKI), and thereby suffer from certificate management problem. In this paper, we propose acertificatelesspublicverification scheme againstprocrastinatingauditors (CPVPA) by usingblockchain technology. The key idea is to require auditors to record each verification result into a transaction on a blockchain. Because transactions on the blockchain are time-sensitive, the verification can be time-stamped after the transaction is recorded into the blockchain, which enables users to check whether auditors perform the verifications at the prescribed time. Moreover, CPVPA is built on certificateless cryptography, and is free from the certificate management problem. We present rigorous security proofs to demonstrate the security of CPVPA, and conduct a comprehensive performance evaluation to show that CPVPA is efficient.
One decade ago, Bitcoin was introduced, becoming the first cryptocurrency and establishing the concept of "blockchain" as a distributed ledger. As of today, there are many different implementations of cryptocurrencies working over a blockchain, with different approaches and philosophies. However, many of them share one common feature: they require proof-of-work to support the generation of blocks (mining) and, eventually, the generation of money. This proof-of-work scheme often consists in the resolution of a cryptography problem, most commonly breaking a hash value, which can only be achieved through brute-force. The main drawback of proof-of-work is that it requires ridiculously large amounts of energy which do not have any useful outcome beyond supporting the currency. In this paper, we present a theoretical proposal that introduces a proof-of-useful-work scheme to support a cryptocurrency running over a blockchain, which we named Coin.AI. In this system, the mining scheme requires training deep learning models, and a block is only mined when the performance of such model exceeds a threshold. The distributed system allows for nodes to verify the models delivered by miners in an easy way (certainly much more efficiently than the mining process itself), determining when a block is to be generated. Additionally, this paper presents a proof-of-storage scheme for rewarding users that provide storage for the deep learning models, as well as a theoretical dissertation on how the mechanics of the system could be articulated with the ultimate goal of democratizing access to artificial intelligence.
This paper evaluates the current cybersecurity vulnerability of the prolific use of Elliptical Curve Digital Signature Algorithm (**ECDSA**) cryptography in use by the Bitcoin Core, Ethereum, Bitcoin Cash, and enterprise blockchains such as Multi-Chain and Hyperledger projects Fabric, and Sawtooth Lake. These blockchains are being used in media, health, finance, transportation and government with little understanding, acknowledgment of the risk and no known plans for mitigation and migration to safer public-key cryptography. The second aim is to evaluate ECDSA against the threat of **Quantum Computing** and propose the most practical National Institute of Standards and Technology (NIST) Post-Quantum Cryptography candidate algorithm lattice-based cryptography countermeasure that can be implemented near-term and provide a basis for a coordinated industry-wide lattice-based public-key implementation. Commercial quantum computing research and development is rapid and unpredictable, and it is difficult to predict the arrival of fault-tolerant quantum computing. The current state of covert and classified quantum computing research and advancement is unknown and therefore, it would be a significant risk to blockchain and Internet technologies to delay or wait for the publication of draft standards. Since there are many hurdles Post-Quantum Cryptography (PQC) must overcome for standardisation, coordinated large-scale testing and evaluation should commence promptly.
Summary We present an overview of hybrid Casper the Friendly Finality Gadget (FFG), a proofâofâstake checkpointing protocol overlaid onto Ethereum's proofâofâwork blockchain. We describe its core functionalities and reward scheme and explore its properties. Our findings indicate that Casper's implemented incentives mechanism ensures liveness, while providing safety guarantees that improve over standard proofâofâwork protocols. On the basis of a minimal impact implementation of the protocol as a smart contract on the blockchain, we discuss additional issues related to parametrization, funding, throughput, and network overhead and detect potential limitations.
Access and utilization of data are central to the cloud computing paradigm. With the advent of the Internet of Things (IoT), the tendency of data sharing on the cloud has seen enormous growth. With data sharing comes numerous security and privacy issues. In the process of ensuring data confidentiality and fine-grained access control to data in the cloud, several studies have proposed Attribute-Based Encryption (ABE) schemes, with Key Policy-ABE (KP-ABE) being the prominent one. Recent works have however suggested that the confidentiality of data is violated through collusion attacks between a revoked user and the cloud server. We present a secured and efficient Proxy Re-Encryption (PRE) scheme that incorporates an Inner-Product Encryption (IPE) scheme in which decryption of data is possible if the inner product of the private key, associated with a set of attributes specified by the data owner, and the associated ciphertext is equal to zero 0 . We utilize a blockchain network whose processing node acts as the proxy server and performs re-encryption on the data. In ensuring data confidentiality and preventing collusion attacks, the data are divided into two, with one part stored on the blockchain network and the other part stored on the cloud. Our approach also achieves fine-grained access control.
Data has become an invaluable asset in recent times. Although, so many technologies for storing and processing these data, are in existence, cloud computing is known as the best in most of the parameters. Cloud computing allows its users to store and process a huge amount of data that are in the remote servers, thus reducing the burden on user side. Since, the users have to hand over the control over their data to an unknown authority, this method gives birth to a new challenge of data protection in terms of confidentiality, integrity and availability. There have been numerous researches on data integrity protection, so far, using cryptographic tools and data replication strategies. Yet, there is always a need to trust on a third party auditor for performing data integrity verifications. This has led to the threat of being cheated on, if the cloud authority colludes with the third party verifier. Also, the verification strategies that are already proposed and executed failed to identify the data corruption at the time of occurrence itself. To overcome this problem, we propose a data integrity verification scheme that uses blockchain technology for storing the data in the cloud. The blockchain properties like immutability and decentralization are integrated to identify the tampering of data immediately. Hence, the third party auditor is removed by enabling the minors to take control over the blocks in the blockchain. This paper shows the design and working model of the integration of blockchain in cloud storage.
Mar 1, 2019·2019 1st International Conference on Advanced Technologies in Intelligent Control, Environment, Computing & Communication Engineering (ICATIECE)
Students and other individuals who want to create, share and send certificates that contain private or sensitive information, like academic transcripts or digital badges, can do so with an added layer of security. In this paper, we have proposed a system which is focused on verification of personal portfolio using the trending blockchain technology. This is a decentralized system which can be expanded to any professional domain where your personal identity attributes and certificates are mandatory. We aim to create a nation-wide coherent, simple, and universal atmosphere to provide a standardized platform for identity management in a permanent, transparent and secure way.
Pervasive systems over the years continuous to grow exponentially. Engagement of IoT in fields such as Agriculture, Home automation, industrial applications etc is on the rise. Self organizing networks within the IoT field give rise to engagement of various nodes for data communication. The rise in Cyber-attacks within IoT pose a lot of threat to these connected nodes and hence there is a need for data passing through nodes to be verified during communication. In this paper we proposed a nodal authentication approach in IoT using blockchain in securing the integrity of data passing through the nodes in IoT. In our work, we engaged the GOST algorithm in our approach. At the end, we achieved a nodal authentication and verification of the transmitted data. This makes it very difficult for an attacker to fake a node in the communication chain of the connected nodes. Data integrity was achieved in the nodes during the communication.
Richard Nuetey Nortey, Li Yue, Promise Ricardo Agdedanu, Michael Adjeisah
Currently, storing patient's sensitive data by medical healthcare into Electronic Healthcare Records (EHR) has evolved immensely. Specifically, distributed healthcare records have brought ease to how hospitals and other different third parties access the sensitive medical health information of patients for various uses leading to generation of big data. Big data in healthcare is important as it can be used in the prediction of outcome of diseases, prevention of co-morbidities fatality and saving the cost of medical treatment. However, this has also made it easy for security breaches and privacy violations during the data collection process. In this paper, we propose a platform which uses the blockchain technology for privacy preservation during collection, management and distribution of EHR data. The aim of this paper is to ensure the total privacy, integrity and access control of distributed electronic health records to the data owners during its distribution on the blockchain. Simulated results demonstrate our proposed system establishes total transparency and ensures perfect privacy within the distributed network of sharing EHRs in the medical setting using the blockchain.
ABSTRACT This case promotes discussions about blockchain technology. It shows a transaction execution scenario and its tax implications. The case provides (1) an overview of the steps required to install a Digital Wallet; (2) an explanation of the need to add cryptocurrencies to the wallet in order to transact on the blockchain; (3) an overview of executing a transaction, in which an accounting consulting service is provided in the exchange of a cryptocurrency; (4) methods to review the existing transaction, from the service provider side, the service receiver side, and from the blockchain side, with a highlight of the role of both internal and external auditors; (5) clarifies the importance of dealing with cryptocurrencies, given that the IRS identifies cryptocurrencies as properties; and (6) a reflection on the link between a company ERP system and the transaction information on the blockchain.
In recent existences, the cryptocurrency has provided great opportunities and challenges for the modern financial industry. Nowadays people to pay the college fees in different ways, such as credit card, cheque, demand draft, and, direct cash. These types of transactions need an intermediate to transfer amount from the merchant to the beneficiary and the intermediate charge a transaction fee to transfer the money. In this hypothesis, we propose a decentration college fee transaction methods using blockchain technology. A blockchain is fundamentally a distributed ledger of the transcript of all transactions that has been accomplished and shared among contributing parties and it does not require any intermediate to transfer the money. Each transaction in the public ledger is confirmable by the participator in the system. Essentially, itâs a disseminated database which manages an endlessly mounting proof of blocks it grips lots of transactions. Thus the concluded blocks are added into the networks in chronological order and each block contains an index, timestamp, data, and previous hash which indicate the previous block.
Token represents the right to do some operations in software. In blockchain, there are two types of tokens: utility token and security token. They endow the items of token more value in blockchain world. In order to achieve asset tokenization, we propose a new kind of token in this paper, the asset-backed token, which is used for the proposed blockchain based Open Asset Protocol (OAP). Using OAP, we show to how to convert both of the real and virtual objects to asset-backed tokens on blockchain. Then we discussed a new method for data utilization and privacy-preserving based on OAP and compare with our previous scheme, the Secure Multi-Party Computation (SMPC). Additionally, we introduce the Policy-Backed Token(PBT), which is an instance implementing OAP in insurance industry. We have applied PBT in the airline travel insurance product E-life of an insurance company.
Performing a fair exchange without a Trusted Third Party (TTP) was considered to be impossible. With multi party computation and practices like Proof-of-Work (PoW), blockchain accomplishes a fair exchange in a trustless network. Data confidentiality is a key challenge that has to be resolved before adopting blockchain for enterprise applications where tokenized assets will be transferred. Protocols like Zcash are already providing the same for financial transactions but lacks flexibility required to apply in most of the potential use cases of blockchain. Most of the real world application work in a way where a transaction is carried out when a particular action is performed. Also, the zero knowledge proof method used in Zcash, ZKSNARK has certain weaknesses restricting its adoption. One of the major drawbacks of ZKSNARK is that it requires an initial trust setup phase which is difficult to achieve in blockchain ecosystem. ZKSTARK, an interactive zero knowledge proof does not require this phase and also provides security against post quantum attacks. We propose a system that uses two indistinguishable hash functions along with ZKSTARK to improve the flexibility of blockchain platforms. The two indistinguishable hash functions are chosen from SHA3-finalists based on their security, performance and inner designs.
Blockchain is challenging the status quo of the central trust infrastructure currently prevalent in the Internet towards a design principle that is underscored by decentralization, transparency, and trusted auditability. In ideal terms, blockchain advocates a decentralized, transparent, and more democratic version of the Internet. Essentially being a trusted and decentralized database, blockchain finds its applications in fields as varied as the energy sector, forestry, fisheries, mining, material recycling, air pollution monitoring, supply chain management, and their associated operations. In this paper, we present a survey of blockchain-based network applications. Our goal is to cover the evolution of blockchain-based systems that are trying to bring in a renaissance in the existing, mostly centralized, space of network applications. While re-imagining the space with blockchain, we highlight various common challenges, pitfalls, and shortcomings that can occur. Our aim is to make this work as a guiding reference manual for someone interested in shifting towards a blockchain-based solution for one's existing use case or automating one from the ground up.
In the pharmaceutical industry, process validation tasks are based on the raw data and its derived analytical results generated from the process. Process validation failure affects both patient safety and the economic success of the manufacturing company. Hence, data integrity is highly critical in this area. Regulatory agencies, such as the Food and Drug Administration (FDA), reacted to past data integrity breaches by publishing new guidelines on data integrity for the correct handling of data in the pharmaceutical context. In this contribution, we want to show how data integrity can be improved on a technological level, removing the need for trusted third parties and centralized systems for this task. Therefore, we implemented an approach that uses existing tools, currently mostly used by software developers, and combined them with a new smart contract built on top of the Ethereum blockchain. In a case study, we test how data manipulation or backdating of results can be easily detected and how regulatory agencies can audit the complete data flow from the regulatory report back to the original raw data. The results of this contribution outline a possible road map for the development of production-ready tools, such as versioned database systems that natively interoperate with distributed ledgers. This will improve the trustworthiness of pharmaceutical manufacturing data by both protecting the intellectual property of the industrial company and improving the safety of the patients. <i>LAY ABSTRACT:</i> In the pharmaceutical industry, economically driven manufacturing companies are regulated and controlled by regulatory agencies. The pharmaceutical manufacturing companies need to produce large amounts of process and analytical data to show that their products are safe for patients. As the decisions of the regulatory agencies rely on this data, manufacturing companies need to prove how their generated data can be protected from technical breaches or data manipulation. As of today, the available technical solutions to provide data integrity are not working well enough. Regulatory agencies have published multiple documents highlighting the current data integrity issues. In this contribution, we show how blockchain, a technology that multiple cryptocurrencies like Bitcoin rely on, can help to improve the integrity of manufacturing data and data science analysis procedures. Therefore, we combined a smart contract on the Ethereum blockchain with tools currently mostly used by software developers. The presented workflow shows how data integrity can be guaranteed on a technological level without the need for trusted third parties.
With the advent of blockchain technologies, the idea of decentralized applications has gained traction. Smart contracts permit the implementation of application logic to foster distributed systems that are capable of removing intermediaries. Hereby, lock in effects originating from isolated data storage and central authorities are mitigated. Yet, smart contracts deployed to a ledger generate dependencies on the underlying blockchain. Over time, requirements regarding contract execution may detach from the utilized blockchain due to contradicting incentives and security or performance issues. To avoid a novel form of lock in effect towards a host blockchain, we introduce a concept for smart contract portability that permits any user to migrate contract logic and state between blockchains in a flexible and verifiable manner. As the Ethereum Virtual Machine (EVM) is supported by a multitude of blockchain implementations, it poses a common execution environment for smart contracts. We provide a toolbox that facilitates smart contract portability between EVM-compatible blockchains without trust requirements in the entity executing the migration process. To prove the concept's soundness, we transfer token contracts based on the ERC20 standard as well as applications containing dependencies to other smart contracts. Our evaluation shows the validity of ported applications including their current states.
David Hawig, C. Zhou, Sebastian Fuhrhop, Andre S Fialho · 5 authors
BACKGROUND Distributed ledger technology (DLT) holds great potential to improve health information exchange. However, the immutable and transparent character of this technology may conflict with data privacy regulations and data processing best practices. OBJECTIVE The aim of this paper is to develop a proof-of-concept system for immutable, interoperable, and General Data Protection Regulation (GDPR)âcompliant exchange of blood glucose data. METHODS Given that there is no ideal design for a DLT-based patient-provider data exchange solution, we proposed two different variations for our proof-of-concept system. One design was based purely on the public IOTA distributed ledger (a directed acyclic graph-based DLT) and the second used the same public IOTA ledger in combination with a private InterPlanetary File System (IPFS) cluster. Both designs were assessed according to (1) data reversal risk, (2) data linkability risks, (3) processing time, (4) file size compatibility, and (5) overall system complexity. RESULTS The public IOTA design slightly increased the risk of personal data linkability, had an overall low processing time (requiring mean 6.1, SD 1.9 seconds to upload one blood glucose data sample into the DLT), and was relatively simple to implement. The combination of the public IOTA with a private IPFS cluster minimized both reversal and linkability risks, allowed for the exchange of large files (3 months of blood glucose data were uploaded into the DLT in mean 38.1, SD 13.4 seconds), but involved a relatively higher setup complexity. CONCLUSIONS For the specific use case of blood glucose explored in this study, both designs presented a suitable performance in enabling the interoperable exchange of data between patients and providers. Additionally, both systems were designed considering the latest guidelines on personal data processing, thereby maximizing the alignment with recent GDPR requirements. For future works, these results suggest that the conflict between DLT and data privacy regulations can be addressed if careful considerations are made regarding the use case and the design of the data exchange system.
Distributed ledger and blockchain systems are expected to make financial systems easier to audit, reduce counter-party risk and transfer assets seamlessly. The key concept is a token controlled by a cryptographic private key for spending, and represented by a public key for receiving and audit purposes. Ownership transfers are authorized with digital signatures and recorded on a ledger visible to numerous participants. Several ways to enhance the privacy of such ledgers have been proposed. In this paper we study two major techniques to enhance privacy of token transfers with the help of improved cryptography: Möbius and CryptoNote. The comparison is illuminating: both techniques use "ring signatures" and some form of "stealth addressing" or key derivation techniques, yet each does it in a completely different way. Möbius is more recent and operates in a more co-operative way (with permission) and is not yet specified at a sufficiently detailed level. Our primary goal is to explore the suitability of these two techniques for improving the privacy of payments on cryptographic ledgers. We explain various conflicting requirements and strategic choices which arise when trying to conceal the identity of participants and the exact details of transactions in our context while simultaneously enabling fast final settlement of tokens with a reasonable level of liquidity. We show that in these systems, third-party observers see obfuscated settlement. We finish with a summary of explicit warnings and advice for implementors of such systems.
An essential requirement of any information management system is to protect data and resources against breach or improper modifications, while at the same time ensuring data access to legitimate users. Systems handling personal data are mandated to track its flow to comply with data protection regulations. We have built a novel framework that integrates semantically rich data privacy knowledge graph with Hyperledger Fabric blockchain technology, to develop an automated access-control and audit mechanism that enforces usersâ data privacy policies while sharing their data with third parties. Our blockchain based data-sharing solution addresses two of the most critical challenges: transaction verification and permissioned data obfuscation. Our solution ensures accountability for data sharing in the cloud by incorporating a secure and efficient system for End-to-End provenance. In this paper, we describe this framework along with the comprehensive semantically rich knowledge graph that we have developed to capture rules embedded in data privacy policy documents. Our framework can be used by organizations to automate compliance of their Cloud datasets.
Yang Xu, Ju Ren, Guojun Wang, Cheng Zhang · 6 authors
Emerging network computing technologies extend the functionalities of industrial IoT (IIoT) terminals. However, this promising service-provisioning scheme encounters problems in untrusted and distributed IIoT scenarios because malicious service providers or clients may deny service provisions or usage for their own interests. Traditional nonrepudiation solutions fade in IIoT environments due to requirements of trusted third parties or unacceptable overheads. Fortunately, the blockchain revolution facilitates innovative solutions. In this paper, we propose a blockchain-based fair nonrepudiation service provisioning scheme for IIoT scenarios in which the blockchain is used as a service publisher and an evidence recorder. Each service is separately delivered via on-chain and off-chain channels with mandatory evidence submissions for nonrepudiation purpose. Moreover, a homomorphic-hash-based service verification method is designed that can function with mere on-chain evidence. And an impartial smart contract is implemented to resolve disputes. The security analysis demonstrates the dependability, and the evaluations reveal the effectiveness and efficiency.