David Froelicher, Patricia Egger, João Sá Sousa, Jean Louis Raisaro · 8 authors
Abstract Current solutions for privacy-preserving data sharing among multiple parties either depend on a centralized authority that must be trusted and provides only weakest-link security (e.g., the entity that manages private/secret cryptographic keys), or leverage on decentralized but impractical approaches (e.g., secure multi-party computation). When the data to be shared are of a sensitive nature and the number of data providers is high, these solutions are not appropriate. Therefore, we present U n L ynx , a new decentralized system for efficient privacy-preserving data sharing. We consider m servers that constitute a collective authority whose goal is to verifiably compute on data sent from n data providers. U n L ynx guarantees the confidentiality, unlinkability between data providers and their data, privacy of the end result and the correctness of computations by the servers. Furthermore, to support differentially private queries, U n L ynx can collectively add noise under encryption. All of this is achieved through a combination of a set of new distributed and secure protocols that are based on homomorphic cryptography, verifiable shuffling and zero-knowledge proofs. U n L ynx is highly parallelizable and modular by design as it enables multiple security/privacy vs. runtime tradeoffs. Our evaluation shows that U n L ynx can execute a secure survey on 400,000 personal data records containing 5 encrypted attributes, distributed over 20 independent databases, for a total of 2,000,000 ciphertexts, in 24 minutes.
Bitcoin is a decentralized currency system that does not need any central authorities. All transactions issued by users have been recorded in the common ledger, called blockchain, which is shared by all users. In Bitcoin, an SPV (Simplified Payment Verification) client, which is a lightweight client that does not possess the entire blockchain, are developed for storage constrained devices such as a mobile phone. For an SPV client to check if there are transactions related to it, a Bloom filter where their Bitcoin addresses are involved is sent to a full client that possesses the entire blockchain. The full client only transfers transactions of which Bitcoin addresses are positive on the received Bloom filter. However, it is necessary to preserve the privacy of SPV clients when designing a Bloom filter because SPV clients' Bitcoin addresses will be identified by a full client with high probability. In this paper, we propose a privacy-preserving Bloom filter design for SPV clients based on γ-Deniability. γ-Deniability is a privacy metric that shows how much true positive Bitcoin addresses are hidden by the false positives in a Bloom filter. Furthermore, in order to design a Bloom Filter that satisfies a certain γ-Deniability, it is necessary to know the number of unique Bitcoin addresses that appear for the first time since the queried time. Based on our manual inspection, we propose to estimate it based on the linear regression. We show that our scheme achieves good estimation accuracy and γ through the simulation with a real Bitcoin blockchain.
Yukun Niu, Lingbo Wei, Chi Zhang, Jianqing Liu · 5 authors
Anonymous authentication can protect users' privacy and security when they access public Wi-Fi hotspots. However, most of the existing privacy-enhanced authentication schemes either do not consider users' accountability or they are inherently dependent on trusted third parties, and therefore are undeployable in practical settings. In this paper, we design and implement an access authentication scheme to simultaneously and efficiently provide anonymity and accountability without relying on any trusted third party. Our scheme is inspired by the recent progress of Bitcoin techniques such as Colored Coins and CoinShuffle protocol. We utilize the unmodified Bitcoin blockchain as the powerful platform to manage and determine ownership of access credentials in a peer-to-peer fashion and introduce a completely decentralized Bitcoin mixing protocol that allows users to anonymously exchange their access credentials offline. The verification path of access credentials is designed to support blacklisting and punishing misbehaving anonymous users. Our proposed scheme is compatible with the current Bitcoin system, and its effectiveness and feasibility in Wi-Fi hotspot access scenario are also demonstrated by security analysis and performance evaluation.
The security of vehicular networks has been paid increasing attention to with the rapid development of automobile industry and Internet of Things (IoT). However, existing approaches mainly focus on ensuring data authentication and integrity, which are not sufficient to assess the credibility of received messages. Recently, reputation systems are proved to be effective approaches to solve the above problem. This paper proposes a new reputation system for data credibility assessment based on the blockchain techniques. In this system, vehicles rate the received messages based on observations of traffic environments and pack these ratings into a “block”. Each block is “chained” to the previous one by storing the hash value of the previous block. Then, a temporary center node is elected from vehicles and it is responsible for broadcasting its rating block to others. Based on ratings stored in the blockchain, vehicles are able to calculate the reputation value of the message sender and then evaluate the credibility of the message. Simulation results reveal that the proposed system is reliable in collecting, validating, and storing reputation information in vehicular networks.
Secret sharing is an important component of cryptography protocols and has a wide range of practical applications. However, the existing secret sharing schemes cannot apply to computationally weak devices and cannot efficiently guarantee fairness. In this study, a novel outsourcing secret sharing scheme is proposed. In the setting of outsourcing secret sharing, clients only need a small amount of decryption and verification operations, while the expensive reconstruction computation and verifiable computation can be outsourced to cloud service providers (CSP). The scheme does not require complex interactive argument or zero‐knowledge proof. The malicious behaviour of clients and CSP can be detected in time. Moreover, the CSP cannot get any useful information about the secret, and it is fair for every client to obtain the secret. At the end of this study, the authors prove the security of the proposed scheme and compare it with other secret sharing schemes.
Sep 8, 2017·Proceedings of the 2017 ACM International Joint Conference on Pervasive and Ubiquitous Computing and Proceedings of the 2017 ACM International Symposium on Wearable Computers
Mathieu Chanson, Andreas Bogner, Felix Wortmann, Elgar Fleisch
Giving people ownership of the data they produce becomes more and more important in times of ever-growing capabilities to collect and analyze data of individuals. In light of this challenge, we show how blockchain technology can enable privacy by presenting an odometer fraud prevention system. It records mileage and GPS data of cars and secures that on the blockchain, which strongly hinders odometer fraud. Our users own and control their data while at the same time data integrity is ensured. This facilitates the certification of that data. We discuss the advantages of this approach compared to current systems and also highlight limitations of our architecture and the use of blockchain technology.
Ziye Geng, Yunhua He, Tong Niu, Hong Li · 7 authors
In Location Based Services (LBSs), service providers can obtain mobile users' locations or traces while receiving their service requests. K-anonymity, which is the most commonly used location privacy protection method, needs the cooperation among mobile users to form a k-anonymous group. Though several incentive mechanisms have been proposed to motivate mobile users to participate in the k-anonymous group, most of them rely on a `trustful' center. In this paper, we propose a distributed secure incentive mechanism that applies blockchain smart contracts to motivate users for k-anonymity cooperation. To protect the reward transaction information, group encryption and blind collective signature are adopted. The simulations demonstrate the effectiveness of our proposed incentive mechanism.
The rise of big data age in the Internet has led to the explosive growth of data size. However, trust issue has become the biggest problem of big data, leading to the difficulty in data safe circulation and industry development. The blockchain technology provides a new solution to this problem by combining non-tampering, traceable features with smart contracts that automatically execute default instructions. In this paper, we present a credible big data sharing model based on blockchain technology and smart contract to ensure the safe circulation of data resources.
Abstract The I owe you (IOU) credit network Ripple is one of the most prominent alternatives in the burgeoning field of decentralized payment systems. Ripple’s path-based transactions set it apart from cryptocurrencies such as Bitcoin. Its pseudonymous nature, while still maintaining some regulatory capabilities, has motivated several financial institutions across the world to use Ripple for processing their daily transactions. Nevertheless, with its public ledger, a credit network such as Ripple is no different from a cryptocurrency in terms of weak privacy; recent demonstrative deanonymization attacks raise important concerns regarding the privacy of the Ripple users and their transactions. However, unlike for cryptocurrencies, there is no known privacy solution compatible with the existing credit networks such as Ripple. In this paper, we present PathShuffle, the first path mixing protocol for credit networks. PathShuffle is fully compatible with the current credit networks. As its essential building block, we propose PathJoin, a novel protocol to perform atomic transactions in credit networks. Using PathJoin and the P2P mixing protocol DiceMix, PathShuffle is a decentralized solution for anonymizing path-based transactions. We demonstrate the practicality of PathShuffle by performing path mixing in Ripple.
The IoT is innovative and important phenomenon prone to several services and applications, but it should consider the legal issues related to the data protection law. However, should be taken into account the legal issues related to the data protection and privacy law. Technological solutions are welcome, but it is necessary, before developing applications, to consider the risks which we cannot dismiss. Personal data is a value. In this context it is fundamental to evaluate the legal issues and prevent them, adopting in each project the privacy by design approach. Regarding the privacy and security risks, there are some issues with potential consequences for data and liability. The IoT system allows us to transfer data on the Internet, including personal data. In this context, it is important to consider the new European General Data Protection Regulation (GDPR) that will be in force on 25 May 2018. The GDPR introduces Data Protection Impact Assessment (DPIA), data breach notification and very hard administrative fines in respect of infringements of the Regulation. A correct law analysis allows evaluating risks preventing the wrong use of personal data. The contribution describes the main legal issues related to privacy and data protection focusing on the Privacy by Design approach, according to the GDPR. Furthermore, I resolutely believe that is possible to develop a global privacy standard framework that organisations can use for their data protection activities.
Rawia Bdiwi, Cyril de Runz, Sami Faïz, Arab Ali Chérif
Ubiquitous learning environments have an increasing trend considering the huge number of connected smart devices dedicated to educational services. Ubiquitous learning (U-learning) provides to students the possibility to learn at anyplace and anytime within the collaborative environment using interactive multimedia system that enables effective communication among teacher and learners. The architecture of ubiquitous learning environment (ULE) still suffers from the problems of vulnerability. Blockchain (BC) technology recently explored to provide much more privacy and security using essentially peer-to-peer (P2P) networks has a significant role in the development of decentralized topologies. This paper expounds a novel BC-based architecture for ULE that preserves the benefits of security and privacy. The architecture offers new opportunities to design secured collaborative learning system. It provides data exchange with BC using trust methods within the decentralized topology. The evaluation of this implemented system demonstrates its efficiency while it delivers security and privacy for ULE.
The recent approval of the General Data Protection Regulation (GDPR) imposes new data protection requirements on data controllers and processors with respect to the processing of European Union (EU) residents' data. These requirements consist of a single set of rules that have binding legal status and should be enforced in all EU member states. In light of these requirements, we propose in this paper the use of a blockchain-based approach to support data accountability and provenance tracking. Our approach relies on the use of publicly auditable contracts deployed in a blockchain that increase the transparency with respect to the access and usage of data. We identify and discuss three different models for our approach with different granularity and scalability requirements where contracts can be used to encode data usage policies and provenance tracking information in a privacy-friendly way. From these three models we designed, implemented, and evaluated a model where contracts are deployed by data subjects for each data controller, and a model where subjects join contracts deployed by data controllers in case they accept the data handling conditions. Our implementations show in practice the feasibility and limitations of contracts for the purposes identified in this paper.
Sensor networks and Wireless Sensor Networks (WSN) are key components for the development of the Internet of Things. These networks are subject of two kinds of constraints. Adaptability by the mean of mutability and evolutivity, and constrained node resources such as energy consumption, computational complexity or memory usage. In this context, none of the existing protocols and models allows reliable peer authentication and trust level management. In the field of virtual economic transactions, Bitcoin has proposed a new decentralized and evolutive way to model and acknowledge trust and data validity in a peer network by the mean of the blockchain. We propose a new security model and its protocol based on the blockchain technology to ensure validity and integrity of cryptographic authentication data and associate peer trust level, from the beginning to the end of the sensor network lifetime.
Bitcoin and other cryptocurrencies have surged in popularity over the last decade. Although Bitcoin does not claim to provide anonymity for its users, it enjoys a public perception of being a privacy preserving financial system. In reality, cryptocurrencies publish users' entire transaction histories in plaintext, albeit under a pseudonym; this is required for transaction validation. Therefore, if a user's pseudonym can be linked to their human identity, the privacy fallout can be significant. Recently, researchers have demonstrated deanonymization attacks that exploit weaknesses in the Bitcoin network's peer-to-peer (P2P) networking protocols. In particular, the P2P network currently forwards content in a structured way that allows observers to deanonymize users. In this work, we redesign the P2P network from first principles with the goal of providing strong, provable anonymity guarantees. We propose a simple networking policy called Dandelion which provides quasi-optimal, network-wide anonymity, with minimal cost to the network's utility. We also discuss practical implementation challenges and propose heuristic solutions.
Blockchain is a technology that is based on Bitcoin cryptocurrency. It is a technology for decentralizing transaction and managing data. Immense research and deep thinking has gone into conceptualizing blockchain since the time it was first showcased by Satoshi Nakamoto in 2008. The growing interest among researchers and technologists is the central attribute of blockchain that provides a high level of security, anonymity and data integrity without any intervention from third party who is in control of the transactions. Here in this study we have carried out through a well-defined study with the sole aim of collecting all relevant research areas and technologies on Blockchain Technology. With Blockchain becoming future in transactions in financial sector, it also comes with its own burden of risks. But since it has the potential to revolutionize the existing technology, it feels right to take the plunge[1].
Jun 1, 2017·2017 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
The IoT is innovative and important phenomenon prone to several services ad applications, but it should consider the legal issues related to the data protection law. However, should be taken into account the legal issues related to the data protection and privacy law. Technological solutions are welcome, but it is necessary, before developing applications, to consider the risks which we cannot dismiss. Personal data is a value. In this context is fundamental to evaluate the legal issues and prevent them, adopting in each project the privacy by design approach. Regarding the privacy and security risks, there are some issues with potential consequences for data security and liability. The IoT system allows us to transfer data on the Internet, including personal data. In this context, it is important to consider the new European General Data Protection Regulation (GDPR) - already in force from 24 May 2016 - that will be applicable on 25 May 2018. The GDPR introduces Data Protection Impact Assessment (DPIA), data breach notification and very hard administrative fines in respect of infringements of the Regulation. A correct law analysis allows evaluating risks preventing the wrong use of personal data. The IoT ecosystem is evolving quickly, developing several applications in different sectors. The main topics for the last time are Big Data and the blockchain. People are paying attention to the latest one because of its potential concrete use for services and applications, increasing the security measures to guarantee a secure system. However, it is equally important to analyse the legal issues related to them. Everyone has the right to the protection of personal data concerning him or her. In this context, we cannot dismiss to guarantee an adequate protection of personal data designing any application. The contribution describes the main legal issues related to privacy and data protection especially regarding the blockchain, focusing on the Privacy by Design approach, according to the GDPR. Furthermore, I resolutely believe that is possible to develop a worldwide privacy standard framework that organisations can use for their data protection activities.
5G mobile communication is being designed as heterogeneous network where different platforms, several technologies, and various cell sizes are deployed to fit specific requirements in terms of data rates and latency. The heterogeneity nature of this network will lead to new security issues and threats, especially when the number of deployed mobile devices become very important. In this paper, we propose a simple PKI certificate based access control scheme that is implemented on a multi-layer communication architecture designed for 5G networks. In addition, we establish a scalable authentication and handover schemes that can ensure security within the network. To this purpose, we define various types of certificates with different features and utilization. The authentication scheme is based on zero knowledge proof (ZKP) and is used to achieve secure device registration procedure before generating authorization certificates that will be used to enable secure device-to-device communication. We use simulation work to assess the efficiency of our scheme in terms of total overhead and average latency. Performance evaluation results show that our scheme is more scalable than existing authentication and handover schemes.
Shinsaku Kiyomoto, Mohammad Shahriar Rahman, Anirban Basu
In this paper, we design a distributed platform for anonymized dataset trading without any centralized trusted third party. The platform consists of peers and consensus-based blockchain mechanism, and each peer acts as a data broker, data receiver, or verifier for blockchain in a data transfer transaction. A data broker collects data from data owners under their consent for data trading. The Privacy Policy Manager (PPM) manages the consent information and confirms them on behalf of data owners, when data distribution is requested from data broker. We implement a prototype system of the platform using an open-source blockchain mechanism, Hyperledger Fabric, and provide evaluation results of the prototype system.
Hossein Shafagh, Lukas Burkhalter, Anwar Hithnawi, Simon Duquennoy
Today the cloud plays a central role in storing, processing, and distributing data. Despite contributing to the rapid development of IoT applications, the current IoT cloud-centric architecture has led into a myriad of isolated data silos that hinders the full potential of holistic data-driven analytics within the IoT. In this paper, we present a blockchain-based design for the IoT that brings a distributed access control and data management. We depart from the current trust model that delegates access control of our data to a centralized trusted authority and instead empower the users with data ownership. Our design is tailored for IoT data streams and enables secure data sharing. We enable a secure and resilient access control management, by utilizing the blockchain as an auditable and distributed access control layer to the storage layer. We facilitate the storage of time-series IoT data at the edge of the network via a locality-aware decentralized storage system that is managed with the blockchain technology. Our system is agnostic of the physical storage nodes and supports as well utilization of cloud storage resources as storage nodes.
I-Hsun Chuang, Bing-Jie Guo, Jen-Sheng Tsai, Yau-Hwang Kuo
Internet of Things (IoT) is an emerging network technology applied to provide various services in our daily life. Generally, IoT environments are composed of numerous heterogeneous devices with constrained resource. The limited capability of IoT devices makes it impractical to perform traditional security mechanisms, and thus IoT services are usually vulnerable to all kinds of security threats, such as impersonation and forgery attacks. Moreover, the inflexible protection provided by these security mechanisms leads to inefficiency because different services haves diverse requirements. To provide IoT services suitable security protection, Multi-graph Zero-knowledge-based Authentication System (M-ZAS), which is not only light-weight but also high-adaptive, is proposed. Compared to traditional authentication mechanisms as well as other Zero-knowledge-proof (ZKP) methods such as GMW-ZKP, M-ZAS provides higher performance and better security protection. In addition, M-ZAS has lower transmission overheads than GMW-ZKP does. Considering relevant contexts as parameters, M-ZAS provides adaptive protection to fulfill what users actually need. Experiment results show that M-ZAS is 3 times faster than GMW-ZKP and even 7 times than traditional authentication mechanisms in IoT devices. Also, M-ZAS reduces 3 times network traffic than GMW-ZKP. Thus, the proposed M-ZAS is the most practical authentication system in IoT environments.
Disseminating medical data beyond the protected cloud of institutions poses severe risks to patients’ privacy, as breaches push them to the point where they abstain from full disclosure of their condition. This situation negatively impacts the patient, scientific research, and all stakeholders. To address this challenge, we propose a blockchain-based data sharing framework that sufficiently addresses the access control challenges associated with sensitive data stored in the cloud using immutability and built-in autonomy properties of the blockchain. Our system is based on a permissioned blockchain which allows access to only invited, and hence verified users. As a result of this design, further accountability is guaranteed as all users are already known and a log of their actions is kept by the blockchain. The system permits users to request data from the shared pool after their identities and cryptographic keys are verified. The evidence from the system evaluation shows that our scheme is lightweight, scalable, and efficient.