Ji-Sun Park, Taek-Young Youn, Hye-Bin Kim, Kyung-Hyune Rhee · 5 authors
Internet of Things (IoT)-based devices, especially those used for home automation, consist of their own sensors and generate many logs during a process. Enterprises producing IoT devices convert these log data into more useful data through secondary processing; thus, they require data from the device users. Recently, a platform for data sharing has been developed because the demand for IoT data increases. Several IoT data marketplaces are based on peer-to-peer (P2P) networks, and in this type of marketplace, it is difficult for an enterprise to trust a data owner or the data they want to trade. Therefore, in this study, we propose a review system that can confirm the reputation of a data owner or the data traded in the P2P data marketplace. The traditional server-client review systems have many drawbacks, such as security vulnerability or server administrator's malicious behavior. However, the review system developed in this study is based on Ethereum smart contracts; thus, this system is running on the P2P network and is more flexible for the network problem. Moreover, the integrity and immutability of the registered reviews are assured because of the blockchain public ledger. In addition, a certain amount of gas is essential for all functions to be processed by Ethereum transactions. Accordingly, we tested and analyzed the performance of our proposed model in terms of gas required.
Tomás Robles, Borja Bordel, Ramón Alcarria, Diego Sánchez-de-Rivera
Blockchain enables the creation of distributed ledgers as a type of database that is shared, replicated, and synchronized among the members of a network. In this paper we analyze how distributed ledgers can be used for empowering end-users to self-manage their own data, enabling third parties to access those data under a cryptographic management model. We propose a use case where both blockchain and smart contracts are employed by using cryptographic technology to enable user empowerment of data management in AmI. Finally, we analyze strengths and weaknesses of the proposed scenario.
Karan Ganju, Qi Wang, Wei Yang, Carl A. Gunter · 5 authors
With the growing adoption of machine learning, sharing of learned models is becoming popular. However, in addition to the prediction properties the model producer aims to share, there is also a risk that the model consumer can infer other properties of the training data the model producer did not intend to share. In this paper, we focus on the inference of global properties of the training data, such as the environment in which the data was produced, or the fraction of the data that comes from a certain class, as applied to white-box Fully Connected Neural Networks (FCNNs). Because of their complexity and inscrutability, FCNNs have a particularly high risk of leaking unexpected information about their training sets; at the same time, this complexity makes extracting this information challenging. We develop techniques that reduce this complexity by noting that FCNNs are invariant under permutation of nodes in each layer. We develop our techniques using representations that capture this invariance and simplify the information extraction task. We evaluate our techniques on several synthetic and standard benchmark datasets and show that they are very effective at inferring various data properties. We also perform two case studies to demonstrate the impact of our attack. In the first case study we show that a classifier that recognizes smiling faces also leaks information about the relative attractiveness of the individuals in its training set. In the second case study we show that a classifier that recognizes Bitcoin mining from performance counters also leaks information about whether the classifier was trained on logs from machines that were patched for the Meltdown and Spectre attacks.
Christian Badertscher, Peter Gaži, Aggelos Kiayias, Alexander Russell · 5 authors
We present a novel Proof-of-Stake (PoS) protocol, Ouroboros Genesis, that enables parties to safely join (or rejoin) the protocol execution using only the genesis block information. Prior to our work, PoS protocols either required parties to obtain a trusted "checkpoint" block upon joining and, furthermore, to be frequently online or required an accurate estimate of the number of online parties to be hardcoded into the protocol logic. This ability of new parties to "bootstrap from genesis" was a hallmark property of the Bitcoin blockchain and was considered an important advantage of PoW-based blockchains over PoS-based blockchains since it facilitates robust operation in a setting with dynamic availability, i.e., the natural setting---without external trusted objects such as checkpoint blocks---where parties come and go arbitrarily, may join at any moment, or remain offline for prolonged periods of time. We prove the security of Ouroboros Genesis against a fully adaptive adversary controlling less than half of the total stake in a partially synchronous network with unknown message delay and unknown, varying levels of party availability. Our security proof is in the Universally Composable setting assuming the most natural abstraction of a hash function, known as the strict Global Random Oracle (ACM-CCS 2014); this highlights an important advantage of PoS blockchains over their PoW counterparts in terms of composability with respect to the hash function formalisation: rather than a strict GRO, PoW-based protocol security requires a "local" random oracle. Finally, proving the security of our construction against an adaptive adversary requires a novel martingale technique that may be of independent interest in the analysis of blockchain protocols.
The drastically increasing volume and the growing trend on the types of data have brought in the possibility of realizing advanced applications such as enhanced driving safety, and have enriched existing vehicular services through data sharing among vehicles and data analysis. Due to limited resources with vehicles, vehicular edge computing and networks (VECONs) i.e., the integration of mobile edge computing and vehicular networks, can provide powerful computing and massive storage resources. However, road side units that primarily presume the role of vehicular edge computing servers cannot be fully trusted, which may lead to serious security and privacy challenges for such integrated platforms despite their promising potential and benefits. We exploit consortium blockchain and smart contract technologies to achieve secure data storage and sharing in vehicular edge networks. These technologies efficiently prevent data sharing without authorization. In addition, we propose a reputation-based data sharing scheme to ensure high-quality data sharing among vehicles. A three-weight subjective logic model is utilized for precisely managing reputation of the vehicles. Numerical results based on a real dataset show that our schemes achieve reasonable efficiency and high-level of security for data sharing in VECONs.
As cloud services greatly facilitate file sharing online, there's been a growing awareness of the security challenges brought by outsourcing data to a third party. Traditionally, the centralized management of cloud service provider brings about safety issues because the third party is only semi-trusted by clients. Besides, it causes trouble for sharing online data conveniently. In this paper, the blockchain technology is utilized for decentralized safety administration and provide more user-friendly service. Apart from that, Ciphertext-Policy Attribute Based Encryption is introduced as an effective tool to realize fine-grained data access control of the stored files. Meanwhile, the security analysis proves the confidentiality and integrity of the data stored in the cloud server. Finally, we evaluate the performance of computation overhead of our system.
This study proposes a privacy preserving Blockchain-Based Ticketing Service (BB Tickets), which stores information about events and related tickets in the blockchain network. As the blockchain technologies can ensure information integrity, ticket buyers can use the data stored in the blockchain network to ensure the authenticity of the purchased tickets and to resolve related disputes. Furthermore, the Non-Interactive Zero-Knowledge (NIZK) scheme is utilized in the proposed system to protect user privacy. Therefore, this study contributes to providing a privacy-preserving means for users to enjoy the reliable ticketing service provided by the blockchain technologies.
Open banking brings both the opportunities and challenges to banks all over the world. Due to the different economic development levels of each country and the gaps among financial environment maturity, all countries have different strategies and regulations towards the privacy protection of data in financial scenes, such as the General Data Protection Regulation (GDPR) by European Union (EU). A blockchain as a continuously growing list of records managed by a peer-to-peer network is widely used in various application scenarios, and can protect the privacy of financial data. However, financial blockchain still poses some problems that cannot fully meet the data protection needs. In order to address the existing problems, this paper proposes a new blockchain-based data privacy management framework. The framework consists of three components: a data privacy classification method according to the characteristics of financial data and a new collaborative-filtering-based model and a confirmation data disclosure scheme for customer strategies based on the Nudge Theory. We implement a prototype and propose a set of algorithms for this management framework.
In recent years, Bitcoin, Ethereum and other cryptocurrencies have attracted a great deal of attention from the whole industry including the financial as a new settlement system. Transaction information of these cryptocurrencies is stored in a distribution ledger called Blockchain on the P2P network through processing such as PoW. Meanwhile, since PoW requires a large amount of computer resources, researches on private / consortium type blockchain that do not need PoW. In this paper, we propose a decentralized netting protocol using a consortium type block chain that has the channel function. On a system that implements the proposed protocol, netting settlement can be performed on P2P hiding information of the sender and receiver name of transaction, amount of money, calculation butt of netting, and without setting up a specific central organization such as a central server.
Blockchain technology, on which digital currencies are based, is poised to be the most important disruption business innovation since the Internet. Today researchers and renowned companies have proposed the use of this technology in other areas such as voting, identity management, smart city, and others. Regarding smart city, car navigation systems is one of the main research directions that aims to streamline traffic and calculate travel routes. Existing applications such as Google Traffic or Waze are often used, but for users worried about their personal data, these systems are something of a black box. Using blockchain technology, in this paper we describe the architecture of a car navigation system in which personal data protection is a major concern.
In this paper, we propose a new framework based on two main concepts: Software-Defined Vehicular Networks (SDVN) and Blockchain to efficiently manage and secure Vehicular Social Network (VSN). Using SDVN makes the network programmable, virtualized, and partitionable, but also it creates a well-known vulnerability named single-point of failure. Hence we propose to introduce a Blockchain paradigm that enables to certify the transactions and provide anonymity of data in distributed way using miners nodes. To this end, we introduce three levels of controllers: Principal controller (PC), Road Side Units (RSU) and miners. The PC has a global overview of the network like network topology. The RSU is an intermediate between the PC and the miners. We select local controllers acting as miners due to safety and performance. In order to select miners, we propose a Distributed Miners Connected Dominating Set algorithm (DM-CDS). The DM-CDS is a distributed algorithm with a single phase that supports dynamic topology. The selection of miners is based on a function called miner-score which depends on trust parameter particularly trust metric and network parameters such as: the connectivity degree, the average link quality indicator and the rank. The performance of the proposed DM-CDS is evaluated using many scenarios with different parameters like trust metric, node density, node mobility and radio range. The obtained results show the importance of the proposed architecture in terms of number of miners (CDS size) and robustness with different scenarios.
Traditionally, a Certification Authority (CA) is required to sign, manage, verify and revoke public key certificates. Multiple CAs together form the CA-based Public Key Infrastructure (PKI). The use of a PKI forces one to place trust in the CAs, which have proven to be a single point-of-failure on multiple occasions. Blockchain has emerged as a transformational technology that replaces centralized trusted third parties with a decentralized, publicly verifiable, peer-to-peer data store which maintains data integrity among nodes through various consensus protocols. In this paper, we deploy three blockchain-based alternatives to the CA-based PKI for supporting IoT devices, based on Emercoin Name Value Service (NVS), smart contracts by Ethereum blockchain, and Ethereum Light Sync client. We compare these approaches with CA-based PKI and show that they are much more efficient in terms of computational and storage requirements in addition to providing a more robust and scalable PKI.
In the age of Big Data, releasing protected sensitive data at a future point in time is critical for various applications. Such self-emerging data release requires the data to be protected until a prescribed data release time and be automatically released to the recipient at the release time, even if the data sender goes offline. While straight-forward centralized approaches provide a basic solution to the problem, unfortunately they are limited to a single point of trust and involve a single point of control. This paper presents decentralized techniques for supporting self-emerging data using smart contracts in Ethereum blockchain networks. We design a credible and enforceable smart contract for supporting self-emerging data release. The smart contract employs a set of Ethereum peers to jointly follow the proposed timed-release service protocol allowing the participating peers to earn the remuneration paid by the service users. We model the problem as an extensive-form game with imperfect information to protect against possible adversarial attacks including some peers destroying the private data (drop attack) or secretly releasing the private data before the release time (release-ahead attack). We demonstrate the efficacy and attack-resilience of the proposed techniques through rigorous analysis and experimental evaluation. Our implementation and experimental evaluation on the Ethereum official test network demonstrate the low monetary cost and the low time overhead associated with the proposed approach and validate its guaranteed security properties.
Shu Yun Lim, Pascal Tankam Fotsing, Abdullah Almasri, Omar Musa · 7 authors
The Internet today lacks an identity protocol for identifying people and organizations. As a result, service providers needed to build and maintain their own databases of user information. This solution is costly to the service providers, inefficient as much of the information is duplicated across different providers, difficult to secure as evidenced by recent large-scale personal data breaches around the world, and cumbersome to the users who need to remember different sets of credentials for different services. Furthermore, personal information could be collected for data mining, profiling and exploitation without users' knowledge or consent. The ideal solution would be self-sovereign identity, a new form of identity management that is owned and controlled entirely by each individual user. This solution would include the individual's consolidated digital identity as well as their set of verified attributes that have been cryptographically signed by various trusted issuers. The individual provides proof of identity and membership by sharing relevant parts of their identity with the service providers. Consent for access may also be revoked hence giving the individual full control over its own data. This survey critically investigates different blockchain based identity management and authentication frameworks. A summary of the state-of-the-art blockchain based identity management and authentication solutions from year 2014 to 2018 is presented. The paper concludes with the open issues, main challenges and directions highlighted for future work in this area. In a nutshell, the discovery of this new mechanism disrupted the existing identity management and authentication solutions and by providing a more promising secure platform.
Privacy of blockchains has been a matter of discussion since the inception of Bitcoin. Various techniques with a varying degree of privacy protection and complexity have been proposed over the past decade. In this survey, we present a systematic analysis of these proposals in four categories: (i) identity, (ii) transaction, (iii) consensus, and (iv) smart contract privacy. Each of these categories have privacy requirements of its own, and various solutions have been proposed to meet these requirements. Almost every technique in the literature of privacy enhancing technologies have been applied to blockchains: mix networks, zero-knowledge proofs, blind signatures, ring signatures, secure MPC, homomorphic encryption, to name just a few. We analyze each category separately in the paper. We first define the related privacy issues, and then review the proposed solutions. The limitations of each solution and the attacks discovered are also discussed along with the proposals. For each category, we first define the relevant privacy issues, and then review the proposed solutions along with their features and limitations
In Internet of Vehicles (IoV), data sharing among vehicles is essential to improve driving safety and enhance vehicular services. To ensure data sharing security and traceability, highefficiency Delegated Proof-of-Stake consensus scheme as a hard security solution is utilized to establish blockchain-enabled IoV (BIoV). However, as miners are selected from miner candidates by stake-based voting, it is difficult to defend against voting collusion between the candidates and compromised high-stake vehicles, which introduces serious security challenges to the BIoV. To address such challenges, we propose a soft security enhancement solution including two stages: (i) miner selection and (ii) block verification. In the first stage, a reputation-based voting scheme for the blockchain is proposed to ensure secure miner selection. This scheme evaluates candidates' reputation by using both historical interactions and recommended opinions from other vehicles. The candidates with high reputation are selected to be active miners and standby miners. In the second stage, to prevent internal collusion among the active miners, a newly generated block is further verified and audited by the standby miners. To incentivize the standby miners to participate in block verification, we formulate interactions between the active miners and the standby miners by using contract theory, which takes block verification security and delay into consideration. Numerical results based on a real-world dataset indicate that our schemes are secure and efficient for data sharing in BIoV.
We consider the problem of single-round private information retrieval (PIR) from N replicated databases. We consider the case when B databases are outdated (unsynchronized), or even worse, adversarial (Byzantine), and therefore, can return incorrect answers. In the PIR problem with Byzantine databases (BPIR), a user wishes to retrieve a specific message from a set of M messages with zero-error, irrespective of the actions performed by the Byzantine databases. We consider the T-privacy constraint in this paper, where any T databases can collude, and exchange the queries submitted by the user. We derive the information-theoretic capacity of this problem, which is the maximum number of correct symbols that can be retrieved privately (under the T-privacy constraint) for every symbol of the downloaded data. We determine the exact BPIR capacity to be C = (N -2B)/N·(1-T/(N-2B))/(1-(T/(N - 2B))M), if 2B + T <; N. This capacity expression shows that the effect of Byzantine databases on the retrieval rate is equivalent to removing 2B databases from the system, with a penalty factor of (N - 2B)/N, which signifies that even though the number of databases needed for PIR is effectively N - 2B, the user still needs to access the entire N databases. The result shows that for the unsynchronized PIR problem, if the user does not have any knowledge about the fraction of the messages that are missynchronized, the single-round capacity is the same as the BPIR capacity. Our achievable scheme extends the optimal achievable scheme for the robust PIR (RPIR) problem to correct the errors introduced by the Byzantine databases as opposed to erasures in the RPIR problem. Our converse proof uses the idea of the cut-set bound in the network coding problem against adversarial nodes.
Chenhan Xu, Kun Wang, Peng Li, Song Guo · 7 authors
The emergence of edge computing has witnessed a fast-growing volume of data on edge devices belonging to different stakeholders which, however, cannot be shared among them due to the lack of the trust. By exploiting blockchain's non-repudiation and non-tampering properties that enable trust, we develop a blockchain-based big data sharing framework to support various applications across resource-limited edges. In particular, we devise a number of novel resource-efficient techniques for the framework: (1) the PoC (Proof-of-Collaboration) based consensus mechanism with low computation complexity which is especially beneficial to the edge devices with low computation capacity, (2) the blockchain transaction filtering and offloading scheme that can significantly reduce the storage overhead, and (3) new types of blockchain transaction (i.e., Express Transaction) and block (i.e., Hollow Block) to enhance the communication efficiency. Extensive experiments are conducted and the results demonstrate the superior performance of our proposal.
Airdrops are a popular method of distributing cryptocurrencies and tokens. While often considered risk-free from the point of view of recipients, their impact on privacy is easily overlooked. We examine the Clam airdrop of 2014, a forerunner to many of today's airdrops, that distributed a new cryptocurrency to every address with a non-dust balance on the Bitcoin, Litecoin and Dogecoin blockchains. Specifically, we use address clustering to try to construct the one-to-many mappings from entities to addresses on the blockchains, individually and in combination. We show that the sharing of addresses between the blockchains is a privacy risk. We identify instances where an entity has disclosed information about their address ownership on the Bitcoin, Litecoin and Dogecoin blockchains, exclusively via their activity on the Clam blockchain.
The emergence of big data and Artificial Intelligence (AI) technology is reshaping the world. While the technological revolution improves the quality of our life, new concerns are triggered. The superhuman capability enables AI to outperform human workers in many data- and/or computing-intensive tasks. Also, digital superpowers are showing arrogance towards individuals, which erodes the trust foundation of the society. In this position paper, we suggest to construct trustworthy and safe communities based on a BLockchain-Enabled Social credits System (BLESS) that rewards the residents who commit in socially beneficial activities. Human being's true value lies in serving other people. The BLESS system is considered as an efficient approach to promote the value and dignity in efforts focused on enhancing our communities and regulating business and private behaviors. The BLESS system leverages the decentralized architecture of the blockchain network, which not only allows grassroots individuals to participate rating process of a social credit system (SCS), but also provides tamper proof of transaction data in the trustless network environment. The anonymity in blockchain records also protects individuals from being targeted in the fight against powerful enterprises. Smart contract enabled authentication and authorization strategy prevents any unauthorized entity from accessing the credit system. The BLESS scheme is promising to offer a secure, transparent and decentralized SCS.
In this paper, we explore the attack surfaces in open source permissioned blockchain project Hyperledger Fabric that can be exploited and compromised through cryptographic tactics. Attacks such as insider threats, DNS attacks, private key attacks, and certificate authority (CA) attacks are proposed and discussed. Points in transaction flow where the proposed attacks are threats to the permissioned blockchain are specified and analyzed. Key management systems are discussed, and a deep analysis of Hierarchical Deterministic wallets is conducted. The Membership Service Provider (MSP) proves to be a centralizing aspect of an otherwise decentralized system and proves to be a weakness of the permissioned blockchain network.
Olga B. Mora, Rogelio Rivera, Víctor M. Larios, J. Raul Beltran-Ramirez · 6 authors
In today Smart Cities, the automation strategy based on massive IoT devices deployment to gather Big Data to get insights into city behavior to improve its services. The Smart IoT devices interconnected to the Cyberinfrastructure in a Smart City can be exposed to security threats. To overcome failures and Cyberinfrastructure hacker's attacks, surveillance systems to monitor every citizen activity, compromise their privacy rights. We propose in this paper a use case where Blockchain is a promise to conciliate security versus privacy. Moreover, we discuss how we can start implementing a control access system integrating Blockchain, and we discuss benefits and challenges briefly.
Health information exchanges have been popular for some time with their advantages known and widely researched. In spite of their utility in increasing provider efficiency and decreasing administrative costs, one challenge that has persisted is the data owners inability to control data after transmission. The lack of technical mechanisms to effectively control patients' health data in the network significantly affects participation of health and medical institutions while perpetrating the silo-based data management that locks value and potential inherent in the data. This not only affects researchers due to the lack of data for research and analysis but the quality of life of patients.We present a blockchain-supported architectural framework for secure control of personal data in a health information exchange by pairing user-generated acceptable use policies with smart contracts. We highlight the merits of our system, its user-centric focus and also show experimental results along with directions for extending our work. The framework introduces minimal risk to data by architecting a mechanism for controlling data after sharing. In adopting our framework, health service providers can deliver a stronger assurance for data management than is possible with current systems.
The explosive development of mobile communications and networking has led to the creation of an extremely complex system, which is difficult to manage. Hence, we propose an AI-powered network framework that uses AI technologies to operate the network automatically. However, due to the separation between different mobile network operators, data barriers between diverse operators become bottlenecks to exploit the full power of AI. In this paper, we establish a mutual trust data sharing framework to break these data barriers. The framework is based on the distributed and temper-proof attributes of blockchain. We implement a prototype based on Hyperledger Fabric. The proposed system combines supervision and fine-grained data access control based on smart contracts, which provides a secure and trustless environment for data sharing. We further compare our system with existing data sharing schemes, and we find that our system provides a better functionality.