During the normal operation of a Cloud solution, no one usually pays attention to the logs except technical department, which may periodically check them to ensure that the performance of the platform conforms to the Service Level Agreements. However, the moment the status of a component changes from acceptable to unacceptable, or a customer complains about accessibility or performance of a platform, the importance of logs increases significantly. Depending on the scope of the issue, all departments, including management, customer support, and even the actual customer, may turn to logs to find out what has happened, how it has happened, and who is responsible for the issue. The party at fault may be motivated to tamper the logs to hide their fault. Given the number of logs that are generated by the Cloud solutions, there are many tampering possibilities. While tamper detection solution can be used to detect any changes in the logs, we argue that critical nature of logs calls for immutability. In this work, we propose a blockchain-based log system, called Logchain, that collects the logs from different providers and avoids log tampering by sealing the logs cryptographically and adding them to a hierarchical ledger, hence, providing an immutable platform for log storage.
Fergus Dall, Gabrielle De Micheli, Thomas Eisenbarth, Daniel Genkin · 7 authors
Intel Software Guard Extensions (SGX) allows users to perform secure computation on platforms that run untrusted software. To validate that the computation is correctly initialized and that it executes on trusted hardware, SGX supports attestation providers that can vouch for the user’s computation. Communication with these attestation providers is based on the Extended Privacy ID (EPID) protocol, which not only validates the computation but is also designed to maintain the user’s privacy. In particular, EPID is designed to ensure that the attestation provider is unable to identify the host on which the computation executes. In this work we investigate the security of the Intel implementation of the EPID protocol. We identify an implementation weakness that leaks information via a cache side channel. We show that a malicious attestation provider can use the leaked information to break the unlinkability guarantees of EPID. We analyze the leaked information using a lattice-based approach for solving the hidden number problem, which we adapt to the zero-knowledge proof in the EPID scheme, extending prior attacks on signature schemes.
Thanks to the growth of cloud computing and network technology, different organizations might want to share data and resources between each other. However, cross-organizational authentication systems usually need a central control system, which must be fully trusted. Thus, we use blockchain technology to store the access control list of users due to its tamper-proof and decentralized feature. Our system also provides authentication/authorization/accounting functions by using a virtual coin exe_coin to achieve accounting function. The method of one-way hash chain is used to securely adapt to the transparency feature of blockchain. In authentication system, the transparency may lead to the linkability problem. In our scheme, attackers cannot get the linkability between the transactions and the particular user. To the best of our knowledge, our scheme is the first blockchain-based authentication system with the merits of unlinkability and accounting.
Sushmita Ruj, Mohammad Shahriar Rahman, Anirban Basu, Shinsaku Kiyomoto
In order to ensure faster audits, higher transparency and security, many applications are being designed using blockchains. We propose BlockStore, a secure decentralized storage framework using blockchain technology. The primary motivation is efficient utilization of storage resources of users. Users often have un-utilized or underutilized storage in their devices. They can choose to host their storage resources when they are not in use. Users rent storage from the host for a fee for a fixed period of time and release back after the time expires. BlockStore keeps track of un-utilized storage of hosts in Space Wallet, a structure that helps in assigning storage to renters on request. The ownership of storage can be proved by logging all storage transactions in a public ledger (the blockchain), which can be verified by any user. A host cannot host the same storage to two users at the same time, nor can it tamper with the data of the renter. Renters cannot frame a host of cheating. BlockStore uses proofs of storage and data possession to verify that the hosts do not tamper with data and penalizes parties for misbehavior. Users can encrypt data for privacy. Payment and penalty are handled using smart contracts. BlockStore differs from existing solutions, by providing stronger audit that detects and penalizes misbehaving parties earlier than existing schemes.
Nguyen B. Truong, Tai‐Won Um, Bo Zhou, Gyu Myoung Lee
In recent years, Blockchain has been expected to create a secure mechanism for exchanging not only for cryptocurrency but also for other types of assets without the need for a powerful and trusted third-party. This could enable a new era of the Internet usage called the Internet of Value (IoV) in which any types of assets such as intellectual and digital properties, equity and wealth can be digitized and transferred in an automated, secure, and convenient manner. In the IoV, Blockchain is used to guarantee security of transactions that the transactions are nearly impossible to be altered; thus it is impractical to retract once a transaction is confirmed. Therefore, to strengthen the IoV, before making any transactions it is crucial to evaluate trust between participants for reducing the risk of dealing with malicious peers. In this article, we clarify the concept of IoV and propose a trust-based IoV model including a system architecture, components and features. Then, we present a trust platform in the IoV considering two concepts, Experience and Reputation, originated from Social Networks for evaluating trust between two any peers in the IoV. The Experience and Reputation are characterized and calculated using mathematical models with analysis and simulation in the IoV environment. We believe this paper consolidates the understandings about IoV technologies and demonstrates how trust is evaluated and used to strengthen the IoV. It also opens important research directions on both IoV and trust in the future.
Caciano dos Santos Machado, Antônio Augusto Fröhlich
Blockchain technologies can enable decentralized and trustful features for the Internet of Things (IoT). Although, existing blockchain based solutions to provide data integrity verification for semi-trusted data storages (e.g. cloud providers) cannot respect the time determinism required by Cyber-Physical Systems (CPS). Additionally, they cannot be applied to resource-constrained IoT devices. We propose an architecture that can take advantage of blockchain features to allow further integrity verification of data produced by IoT devices even in the realm of CPS. Our architecture is divided into three levels, each of them responsible for tasks compatible with their resources capabilities. The first level, composed of sensors, actuators, and gateways, introduces the concept of Proof-of-Trust (PoT), an energy-efficient, time-deterministic and secure communication based on the Trustful Space-Time Protocol (TSTP). Upper levels are responsible for data persistence and integrity verification in the Cloud. The work also comprises a performance evaluation of the critical path of data to demonstrate that the architecture respect time-bounded operations demanded by the sense-decide-actuate cycle of CPSs. The additional delay of 5.894us added by our architecture is negligible for a typical TSTP with IEEE 802.15.4 radios which has communication latencies in the order of hundreds of milisseconds in each hop.
Abstract The goal of the paper is to provide a vague summary of currently existing blockchain use cases in the information technology industry. Respective use cases have been examined in already existing scientific papers, Master Theses, industry white papers and blogs of industry experts. The paper also contains a description of blockchain main technological aspects and working principles, which allows making the assessment of the presented use cases. For each use case respective companies or organisations are added that are applying or testing the given solution. Due to research limitations the paper should not be considered an exhaustive blockchain use case description. The paper also provides short introduction into a feasibility analysis of specific blockchain use case. The authors describe the basic steps of potential idea evaluation with regards to blockchain main aspects. It helps understand the necessity for development of a detailed blockchain feasibility model.
Distributed Ledger technology and its most notable implementation, the Blockchain, is disrupting today's industry in extremely fast pace with a potential to change the world. The security posture of Blockchain remains one of a key topics in today's industry and distributed services. On and on, we can embrace the attempts to implement the Blockchain technology in sensitive areas of our daily life like finance [1], insurance services [2], health care [3] etc. It is therefore crucial raise awareness of its limitations, possible improvements, as well as embedded compensations. In this paper, we provide a holistic view on the security aspects of the Blockchain technology. We identify the most notable security threats applicable in the above context and reveal technology-specific challenges, that need to be taken into account. Our analysis lists the security features already embedded in the Blockchain and sample uses in nowadays industry. Our results lead to several observations, recommendations, and open points that could be considered in ongoing development of the technology.
Fog computing has emerged due to the problem that it becomes difficult to store every data to the cloud system as the number of Internet of Things increases. In this fog computing, a vast amount of data generated from the Internet of Things is transmitted to the cloud system located at a remote place, and is processed by a fog computer such as a sensor or a router located nearby, so that only the necessary data is transmitted to the cloud system. However, the above-mentioned fog computer has some drawbacks like being shut down due to an attack by a malicious user in advance, and a method of processing when a fog computer is down or restored. In this paper we describe a fog computing with blockchain that enables fog computers to share transaction generated by processing transaction information of a device controlled by a blockchain method to a security and device control method of a fog computer utilizing the technology. Furthemore by using security properties of blockchain such as authentication, non-repudiation and data integrity, fog computing using blockchain has advantage of security comparing to previous Cloud and fog computing system using centralized database or P2P networks.
Subasri Mathiyalahan, Shobana Manivannan, Mahalakshmi Nagasundaram, R. Ezhilarasie
Data integrity of outsourced data is main problem in CSP (cloud service provider). Space overhead and computation complexity are very high issue in recent PDP(Provable Data Possession) verification schemes. To overcome such issues MPDP (Mobile Provable Data Possession) schemes using hash tree data structure and Boneh-Lynn-Snacham short signature scheme have been used over decade. Data dynamics is well supported in MPDP scheme via block less verification, dynamic data operations, stateless verification, and verification out sourcing. But still there are some operations which can be performed much more efficiently in some other way than that of the two methods prescribed above. Operations in particular, data modification operations like insertion and deletion operations is somewhat difficult or in other words time consuming in hash tree data structure. In this paper, we have deployed an improved hash tree structure called MPT (Merkle Patricia Tree) for integrity checking.MPT is combination of MHT (Merkle Hash Tree) and patricia tree where each node consists of key-value pairs. As of now, MPT has been used only in block chain technology for providing authentication of transactions through Ethereum.
Abstract The recent advances in information technology for mobile devices have increased the work efficiency of users, the mobility of compact mobile devices, and the convenience of location independence. However, mobile devices have limited computing power and storage capacity, so mobile cloud computing is being researched to overcome these limitations in mobile devices. Mobile cloud computing is divided into two methods: the use of external cloud services and the use of mobile resource management without a cloud server (MRM), which integrates the computing and storage resources of nearby mobile devices. Because mobile devices can freely participate in MRM, it is critical to have authentication technology to determine the correctness of information regarding resources. Conventional technologies require strong authentication techniques because they have vulnerabilities that can easily be tampered with via man-in-the-middle (MITM) attacks. This paper proposes the Secure Authentication Management human-centric Scheme (SAMS) to authenticate mobile devices using blockchain for trusting resource information in the mobile devices that are participating in the MRM resource pool. The SAMS forms a blockchain based on the resource information of the subordinate client nodes around the master node in the MRM. Devices in the MRM that have not been authorized through the SAMS cannot access or falsify data. To verify the SAMS for application with MRM, it was tested for data falsification by a malicious user accessing the SAMS, and the results show that data falsification is impossible.
John Collomosse, Tu Bui, Alan Brown, John Sheridan · 9 authors
We present ARCHANGEL; a de-centralised platform for ensuring the long-term integrity of digital documents stored within public archives. Document integrity is fundamental to public trust in archives. Yet currently that trust is built upon institutional reputation --- trust at face value in a centralised authority, like a national government archive or University. ARCHANGEL proposes a shift to a technological underscoring of that trust, using distributed ledger technology (DLT) to cryptographically guarantee the provenance, immutability and so the integrity of archived documents. We describe the ARCHANGEL architecture, and report on a prototype of that architecture build over the Ethereum infrastructure. We report early evaluation and feedback of ARCHANGEL from stakeholders in the research data archives space.
While the cyber insurance market has been growing significantly in recent years, its insurance providers face several challenges: first, there is a lack of standardized frameworks to rate ""cyber""; second, there's a shortage of relevant data to calculate premiums; and third, security postures of insured organizations constantly change. Unlike other types of insurance, cyber insurance requires creating a continuous feedback loop between customers and insurers. In this article, we introduce BlockCIS, a blockchain-based continuous monitoring and processing system for cyber insurance. BlockCIS aims to realize an automated, real-time, and immutable feedback loop between the insurer, its customer, third parties and potential auditors. As an example instantiation, we prototype BlockCIS using the open source Hyperledger Composer blockchain framework.
Distributed ledger technologies (DLTs) are receiving much attention. As discussion focuses on the potential applications of DLTs, Blockchain-as-a-Service (BaaS) offerings are emerging to provide the underlying supporting infrastructure. BaaS entails a service provider supplying and managing aspects of a DLT infrastructure to facilitate and bring efficiencies regarding the development, experimentation, deployment, and the ongoing management of DLT applications. However, much of the interest in DLTs stems from their potential to decentralise, disintermediate, and enable `trustless' interactions. At first sight, BaaS - being offered by a provider - appears to run counter to this. In practice, whether BaaS raises substantive trust concerns depends on the nature of the offering, the application's specifics, and the participants' goals and risk appetite. This paper elaborates the nature of BaaS and explores the trust considerations it raises, particularly regarding the role of providers as part of a wider infrastructure.
Trust in the cloud is still a problem. Most are in agreement that 'transparency' is key to cloud trust, but transparency applies to a variety of cloud operations, which is why cloud trust research is diverse. Widely publicized breaches recently had to do with third parties. Untrusted third parties and data movement are closely related. There are valid use cases to duplicate data for redundancy, but this typically happens behind closed doors. We see that as a problem; there are no mechanisms that we know of to police or track data as it gets copied or moves between clouds. We are proposing an approach to cloud trust that leverages the innovative blockchain technology to help increase transparency and also reduce the problem of depending on TTPs. By using a consumer belief model tailored to the cloud we also show the relevance of consumer policies in trust with regards to their data. We propose to use smart contracts as the vehicle for the policies and a belief/recommendation model to help guide us to a successful outcome.
An outdated Service Level Agreement (SLA) model, untrusted third parties with access to our data, unknown data location, and unwanted data movement continue to negatively affect trust in the cloud. The majority of current research into cloud trust focuses on ensuring a trustworthy hardware platform using attestations verified by some trusted third party(TTP). We are proposing an approach to improve cloud trust that leverages blockchain technology to help reduce the problem of depending on TTPs for policy evaluation and storage and help track our data. It provides consumers more control and expression of how they want their data handled and by whom. We propose to use Ethereum blockchain for storage and smart contracts as the vehicle for the policies. The main contributions presented in this research are: 1) storing policies in an authoritative source outside the cloud, 2) improving cloud trust by using decentralization, 3) providing a data movement policy model.
Santiago Bragagnolo, Henrique Rocha, Marcus Denker, Sté́phane Ducasse
Solidity is a language used for smart contracts on the Ethereum blockchain. Smart contracts are embedded procedures stored with the data they act upon. Debugging smart contracts is a really difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded. In this paper, we address the lack of inspectability of a deployed contract by analyzing contract state using decompilation techniques driven by the contract structure definition. Our solution, SmartInspect, also uses a mirror-based architecture to represent locally object responsible for the interpretation of the contract state. SmartInspect allows contract developers to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code.
Blockchain is a one of emerging technology for decentralized and sharing of transactional data across a large peer to peer network, where non-trusting members can interact with each other without an intermediary, in a verifiable manner. In this paper, we review the basics of Blockchain, its applications, types, and working of Blockchain. Behind this innovative technique, the security, privacy issues and Con-sensus mechanisms of this technology are also important and are a matter of concern. The problems associated with Blockchain technol-ogy are also discussed in this paper.
Initial Coin Offerings (ICO) are public offers of new cryptocurrencies in exchange of existing ones, aimed to finance projects in the blockchain development arena. In the last 8 months of 2017, the total amount gathered by ICOs exceeded 4 billion US$, and overcame the venture capital funnelled toward high tech initiatives in the same period. A high percentage of ICOS is managed through Smart Contracts running on Ethereum blockchain, and in particular to ERC-20 Token Standard Contract. In this work we examine 1388 ICOs, published on December 31, 2017 on icobench.com Web site, gathering information relevant to the assessment of their quality and software development management, including data on their development teams. We also study, at the same date, the financial data of 450 ICO tokens available on coinmarketcap.com Web site, among which 355 tokens are managed on Ethereum blochain. We define success criteria for the ICOs, based on the funds actually gathered, and on the behavior of the price of the related tokens, finding the factors that most likely influence the ICO success likeliness.
Blockchains have recently generated explosive interest from both academia and industry, with many proposed applications. But descriptions of many these proposals are more visionary projections than realizable proposals, and even basic definitions are often missing. We define "blockchain" and "blockchain network", and then discuss two very different, well known classes of blockchain networks: cryptocurrencies and Git repositories. We identify common primitive elements of both and use them to construct a framework for explicitly articulating what characterizes blockchain networks. The framework consists of a set of questions that every blockchain initiative should address at the very outset. It is intended to help one decide whether or not blockchain is an appropriate approach to a particular application, and if it is, to assist in its initial design stage.
With the development of marine observation technology and network technology, the volume of marine data growing rapidly. This brings new challenges for data storage and transmission. How to protect data security of marine big data has become an urgent problem. The traditional information security methods' characteristic is centralization. These technologies cannot provide whole process protection, e.g., data storage, data management and application of data. The blockchain technology is a novel technology, which can keep the data security and reliability by using decentralized methodology. It has aroused wide interest in the financial field. In this paper, we describe the concept, characteristics and key technologies of blockchain technology and introduce it into the field of marine data security.
The network-centric world of the 21st century and explosive growth of the internet related technologies brought modern cybersecurity culture with complex threat landscape in the Higher Education environment. Cybersecurity landscape is always changing and education providers often do not have remit or in fact the means and capacity to cover the range of activities learners engage with, which attest their achievements, knowledge, and skills. Currently the awarding and validation of qualifications occurs exclusively under centralised management of an education institution or an employer take more ownership of the learning experience and its outcomes without compromising on safety, security, and accessibility. The centralised model of the present awarding and validation is no longer sustainable because learning happens increasingly on online platforms, and learning is far more international than it used to be. Key higher educational providers introduced degree apprenticeships which are new way to ‘do both’ higher level skills and provide progression routes to improve their employability prospects. \n \nThe ‘Blockchain’ (BC) facilitates digitized, decentralized, public ledger of all cryptocurrency transactions. It embraces a set of inter-related technologies. This paper expounds a novel BC-based architecture for transform centralised model of awarding and validation in to decentralized ledger of secured database. This database is shared, replicated, and synchronized for validation among the universities, partner institutions, professionals, statutory or regulatory bodies and industry bodies across the internet. The architecture offers secured collaborative validating system by qualification exchange with BC using trust methods within the decentralized topology.