This paper explores the synergetic potential of blockchain technology and attribute-based encryption to enhance security and privacy in decentralized data sharing systems, particularly within healthcare. We introduce PAVA, a novel privacy-preserving attribute-based scheme, which leverages smart contracts for verifiable authentication and ensures secure data interactions in healthcare applications. The scheme incorporates dual access policies: a data provider policy and a data user policy, which respectively authorize data providers to write (encrypt) and data users to read (decrypt) health data records. Encrypted health data records are stored on a blockchain within a healthcare smart contract, which enforces these access policies while keeping them confidential from unauthorized users and the smart contract itself. This arrangement allows for verifiable authentication checks on both the data providers (user authentication) and the integrity of the data they submit (data authentication) without revealing specific policy attributes. PAVA employs ciphertext-policy attribute-based encryption with partially hidden access policies based on linear secret sharing schemes (LSSS) and integrates blind access policies to facilitate verifiable authentication. Furthermore, the security of PAVA can be proved using the dual system encryption technique under static assumptions in the standard model, demonstrating its robustness and applicability in real-world healthcare data sharing scenarios.
Fausto Neri da Silva Vanin, Yalew Tolcha, Rodrigo da Rosa Righi, Cristiano André da Costa · 5 authors
After the release of version 2.0 of the Electronic Product Code Information Services (EPCIS), the standard consolidated as one of the most prominent standards for supply chain traceability in many industries. In this work, we introduce an innovative framework that integrates the EPCIS 2.0 standards with Hyperledger Fabric Decentralized Ledger Technology (DLT) to significantly improve product security and traceability within supply chains. By designating each product as a Non-Fungible Token (NFT), we establish a direct link between EPCIS events and NFT operations, enabling precise traceability and enhanced security. Our method maps standard events to token operations and the implementation of a traceability module employing hash mapping to manage product lifecycle information efficiently. In addition, we present algorithms designed to prevent counterfeiting by verifying product originality through EPCIS event data analysis. We evaluate the model considering relevant criteria, like performance on capturing and querying traceability information using Hyperledger Caliper, and show that our traceability query improves query time significantly without much overhead in capturing.
Cloud Data Security Solutions
Green IT and Sustainability
Additive Manufacturing and 3D Printing Technologies
The zero knowledge succinct non-interactive argu-ment of knowledge (zkSNARK) systems necessitate the generation of a common reference string (CRS) via a trusted setup that traditionally involves a trusted third party (TTP). An alternative method, employing multiparty computation (MPC), facilitates the creation of an updatable structured reference string (SRS) without the need for a TTP, ensuring security provided at least one participant remains honest. We introduce a secure way to generate CRS without any trust assumption for participants. We introduce a novel platform designed to enable participants to autonomously update the CRS at their discretion. This platform transforms the CRS into a non-fungible token (NFT), enhancing the transparency and traceability of the CRS's revision history. Our platform incorporates a protocol for the generation and utilization of the proving and verification keys, integral to the zkSNARK scheme, based on the updated CRS. Implementation of this platform on the Ethereum blockchain has demonstrated secure CRS update mechanisms and the low overhead of CRS transformation.
Elmira Ebrahimi, Michael Sober, Anh-Tu Hoang, Can Umut Ileri · 6 authors
Federated learning is a distributed learning technique that enables parties to train a model collaboratively without disclosing their local data. To this end, a centralized aggregator collects local models from participating parties and aggregates them to form a global model. However, if parties are malicious, this approach is susceptible to security threats such as model poisoning and global aggregation attacks. Blockchain-based federated learning has been introduced as an alternative to the centralized aggregator to aggregate local models directly on the blockchain. However, employing blockchain-based solutions introduces challenges, including high computational costs and privacy concerns. To mitigate such challenges, this paper leverages zero-knowledge proofs (i.e., zk-SNARKs) to guarantee the privacy and verifiability of local model training and global model aggregation. The proposed framework verifies the local and global models' computational correctness without storing and revealing them on the blockchain. We evaluate our framework by utilizing a real-life dataset, with experimental results demonstrating its viability regarding both computational costs and learning model performance.
Non-Fungible Tokens (NFTs), recognized for their uniqueness and irreplaceability, serve as an effective mechanism for copyright protection of digital works. Utilizing NFTs to build trading platforms facilitates copyright authentication, monitoring, and circulation of artworks. To alleviate the immense storage pressure on blockchain networks, NFT artworks are often stored in the InterPlanetary File System (IPFS). However, as IPFS is a decentralized file system lacking encryption mechanisms for data, the absence of privacy protection could render copyright protection measures ineffective if malicious users access and utilize the data outside the trading platform. This paper proposes a tri-layered protection mechanism for NFT artwork data, encompassing access control, image watermarking, and data encryption. The proposed scheme ensures artwork protection against theft without compromising the circulation and transaction of works. Experimental results demonstrate that the scheme meets the privacy and security needs of the artworks efficiently and at a low cost.
Mary Jane C. Samonte, Raphael M. Abaleta, Maverick D. Cayabyab, L.G. Guerrero
Domain Name Systems (DNS) are crucial components of any modern network, as they allow users to type in a domain name as opposed to complete IP addresses to visit web pages on the internet. The DNS resolution process typically involves a recursive server that fetches addresses from the root, top-level domain, and authoritative nameservers and sends the address to the client. Since this process can be slow, a caching system is implemented to save and access previous queries. However, this approach can result in security and privacy vulnerabilities. Blockchain is an emerging distributed ledger technology whose decentralized nature and data validation mechanisms help ensure data integrity, reliability, and authenticity. This study investigates the feasibility of integrating blockchain into DNS. It examines and reviews how DNS security is typically implemented, how blockchain can be implemented in other systems, like Internet of Things (IoT) systems, as a security measure, and how other technologies, like honeypots and artificial intelligence (AI), can be implemented to enhance system security in different systems, and potentially in DNS. The discussion results highlight blockchain's effectiveness in securing and improving the privacy of DNSs and their users. The study recommends that more studies be conducted on integrating blockchain in existing system architectures, like DNS, and on using other technologies, such as honeypots and AI, in conjunction with blockchain to improve security in computer networks and systems further.
A health record is a crucial component of patient follow-up, encompassing healthcare professionals' observations, prescriptions, diagnoses, and all relevant data about the patient. Multiple stakeholders—including the patient, doctor, and pharmacist—are involved in the management and sharing of this record. Electronic Medical Records (EMRs) can be accessed by authorized individuals from anywhere, facilitating the sharing of information among various healthcare providers. However, this sharing process requires strict security and confidentiality measures. Current medical systems face challenges such as potential system failures and malicious attacks, which can undermine service reliability. Additionally, managing centralized access control can be difficult. This paper introduces SEMRAchain, a system integrating role-based access control (RBAC), attribute-based access control (ABAC), and smart contracts. This combination enables decentralized, fine-grained, and dynamic access management for EMR systems. By leveraging blockchain technology as a secure distributed ledger, SEMRAchain offers stakeholders not only visibility but also trustworthiness, credibility, and immutability.
A cryptocurrency is a digital currency that enables online transactions for various products and services. Cryptocurrencies are deployed over public blockchains which have the transactions duplicated and dispersed across multiple nodes within a computer network. This decentralized mechanism is devised in order to achieve reliability in a network consisting of unreliable nodes. Privacy, anonymity and security have become crucial in this context. For that reason, formal and mathematical approaches are gaining popularity in order to guarantee the correctness of the cryptocurrency implementations. Mimblewimble is a privacy-oriented cryptocurrency technology which provides security and scalability properties that distinguish it from other protocols of its kind. Mimblewimble combines confidential transactions, CoinJoin and cut-through to achieve a higher level of privacy and security, as well as, scalability. In this work, we present and discuss these security properties and outline the basis of a model-driven verification approach to address the certification of the correctness of the protocol implementations. In particular, we propose an idealized model that is key in the described verification process. Then, we identify and precisely state the conditions for our model to ensure the verification of relevant security properties of Mimblewimble. In addition, we analyze the Grin and Beam implementations of Mimblewimble in their current state of development. We present detailed connections between our model and their implementations regarding the Mimblewimble structure and its security properties. Finally, we analyze the Litecoin soft-fork that enhances privacy over the blockchain based on Mimblewimble features.
Data sharing serves to maximize the efficiency of data resources by facilitating their full utilization and reducing associated costs. However, existing data-sharing schemes are confronted with issues such as data loss, data tampering, difficulties in privacy protection, and high sharing costs. To address these issues, this paper proposes a blockchain-based security-oriented data-sharing scheme. Firstly, an architecture that separates data from data ownership is employed to enhance the security of the scheme and reduce storage overhead. Secondly, a lightweight on-chain and off-chain collaborative data security algorithm based on ECC and ECDHE is designed to ensure confidentiality during data sharing. Finally, a mechanism for tracking the circulation of shared data is proposed, which records the data flow in non-fungible tokens (NFTs), thereby improving the traceability of the proposed scheme. We designed relevant experiments to evaluate the proposed solution, and the results demonstrate that the data-sharing scheme devised in this paper performs well in terms of both security and usability, effectively achieving secure data sharing.
This paper present a novel blockchain CP-ABE (Ciphertext-Policy Attribute-Based Encryption) data ciphertext sharing scheme, leveraging decentralized proxy re-encryption. It utilizes Ethereum blockchain and zero-knowledge proof technologies to develop a blockchain key management system for multiparty secure computation. This system aims to mitigate heavy computation and key leakage risks associated with traditional centralized CP-ABE systems. The approach begins with the design of a distributed master key generation and distribution protocol within the data ciphertext access control, deploying the UMBRAL-based proxy re-encryption technology on blockchain for key management system. Moreover, the paper uses ERC1155 to mint transferable NFTs for blockchain transactions in data sharing and access control. Through simulation experiments, our scheme demonstrates improved scalability in blockchain ciphertext data transactions and storage, alongside a significant decrease in the Gas costs of on-chain data asset transactions. Furthermore, our methodology not only augments the safety of distributed key management but also realizes high computational efficiency and swift query response, particularly in scenarios of high concurrency.
Mischelle A. Esguerra, Keno Piad, Isagani M. Tano, Jayson M. Victoriano · 6 authors
The Technical Education and Skills Development Authority (TESDA) in the Philippines issues National Certificates (NCs) which is an important credential for graduates and skilled workers, affirming their capabilities in line with defined competency standards. However, with the advancement in information technology and the availability of affordable editing tools in the market raised concerns about the creation of counterfeit documents including NCs. The study focused on creating a smart credentialing and verification system for issuing National Certificates using blockchain technology. Researchers used Polygon blockchain that implements Proof-of-Stake consensus algorithm for system's efficiency and security. Certificates generated by the system are stored on the blockchain, with each certificate assigned a unique address for verification purposes. The system was assessed using ISO/IEC 25010 standards, and respondents provided good feedback on a variety of parameters. Future development recommendations include integrating a mobile application for easier certificate access and verification, providing real-time updates, establishing a feedback mechanism, and implementing analytics to gain insights into certificate issuance and user engagement.
José Manuel Bernabé Murcia, Eduardo Cánovas, Jesús García-Rodríguez, Alejandro Molina Zarca · 5 authors
The adoption of the Computing Continuum is characterised by the seamless integration of diverse computing environments and devices. In this dynamic landscape, sharing resources across the continuum is becoming a reality and security must move an step forward, specially in terms of authentication and authorisation for such a distributed and heterogeneous environments. The need for robust identity management is paramount and, in this regard, Decentralised Identity Management (DIM) emerges as a promising solution. It leverages decentralised technologies to secure and facilitate identity interactions across the Computing Continuum. Particularly, to enhance security and privacy, it would be desirable to apply the principles of Self-Sovereign Identity (SSI). In this paradigm, users have full ownership and control of their digital identities that empowers individuals to manage and share their identity data on a need-to-know basis. These mechanisms could contribute to improve security properties during continuum resource management operations. In this context, this paper presents the design, workflows and implementation of a solution that provides authentication/authorisation features to distributed zero-trust based infrastructures across the continuum, enhancing security in resource sharing and resource acquisition stages. To this aim, the solution relies on key aspects like decentralisation, interoperability, trust management and privacy-enhancing capabilities. The decentralisation leverages distributed ledger technologies, such as blockchain, to establish a decentralised identity ecosystem. The solution prioritises interoperability, enabling nodes to seamlessly access and share their identities across different domains and environments. Trustworthiness is at the core of DIM, and privacy is also considered, incorporating privacy-preserving techniques that individuals to selectively disclose identity attributes while safeguarding sensitive information. The implementation includes different operations for allowing continuum frameworks to be enhanced with decentralised authentication and authorisation features. The performance has been evaluated measuring the impact for the adoption of the solution. The most expensive task, the self-identity generation, takes only a few seconds (in our deployment) and it is only executed once. Authorisation tasks operate in the millisecond range, which is a totally invaluable time if incorporated into resource acquisition processes in frameworks such as Liqo, used in the scope of FLUIDOS project.
In the realm of modern healthcare, Electronic Health Records EHR serve as invaluable assets, yet they also pose significant security challenges. The absence of EHR access auditing mechanisms, which includes the EHR audit trails, results in accountability gaps and magnifies security vulnerabilities. This situation effectively paves the way for unauthorized data alterations to occur without detection or consequences. Inadequate EHR compliance auditing procedures, particularly in verifying and validating access control policies, expose healthcare organizations to risks such as data breaches, and unauthorized data usage. These vulnerabilities result from unchecked unauthorized access activities. Additionally, the absence of EHR audit logs complicates investigations, weakens proactive security measures, and raises concerns to put healthcare institutions at risk. This study addresses the pressing need for robust EHR auditing systems designed to scrutinize access to EHR data, encompassing who accesses it, when, and for what purpose. Our research delves into the complex field of EHR auditing, which includes establishing an immutable audit trail to enhance data security through blockchain technology. We also integrate Purpose-Based Access Control (PBAC) alongside smart contracts to strengthen compliance auditing by validating access legitimacy and reducing unauthorized entries. Our contributions encompass the creation of audit trail of EHR access, compliance auditing via PBAC policy verification, the generation of audit logs, and the derivation of data-driven insights, fortifying EHR access security.
Cloud-assisted intelligent transportation systems depend on cloud computing to provide powerful computing capabilities and big data storage services. As precise intelligent traffic control and dispatch policies are heavily based on real-time traffic information (e.g., unmanned driving test information), any altered data may cause severe consequences. The integrity of outsourced critical traffic control data has been the most concerning security issue. To this end, a lightweight proxy-oriented data integrity checking mechanism has been devised, without incurring substantial certificates management. The mechanism enables a data manager in traffic information control center to delegate the proxy to produce the signatures of encrypted data and outsource them to the cloud server, dramatically alleviating the work intensity of the data manager. By integrating blockchain into the mechanism, it gives assistance to the data manager for validating malicious integrity checking behaviors. The comprehensive security analysis and performance evaluation demonstrate the feasibility of the mechanism in the deployment of cloud-assisted intelligent transportation systems.
In the era of cloud computing, guaranteeing the safety and effectiveness of data management is of utmost importance. This investigation presents a novel approach that amalgamates the sharding concept, encryption, zero-knowledge proofs (zkp), and blockchain technology for secure data retrieval and data access control to improve data security, efficiency in cloud storage and migration. Further, we utilize user-specific digital wallets for secure encryption keys in order to encrypt the file before storing into the cloud. As Large files (greater than 50 MB) or Big data files (greater than 1 TB) require greater computational complexity, we leverage the sharding concept to enhance both space and time complexity in cloud storage. Hence, the large files are divided into shards and stored in different database servers. We also employ a blockchain smart contract to enhance secure retrieval of the file and also a secure access method, which ensures the privacy of the user. The zk-snark protocol is utilized to ensure the safe transfer of data between different cloud services. By utilizing this approach, data privacy is preserved, as only the proof of the data’s authenticity is shared with the verifier at the destination cloud, rather than the actual data themselves. The suggested method tackles important concerns related to data protection, privacy, and efficient resource utilization in cloud computing settings by ensuring it meets all the cloud policies required to store data. Since the environment maintains the privacy of the user data and the raw data of the user is not stored anywhere, the entire environment is set up as a Zero trust model.
In this study, a new data-sharing method is proposed that uses a private InterPlanetary File System—a decentralized storage system operated within a closed network—to distribute data to external entities while making its authenticity verifiable. Among the two operational modes of IPFS, public and private, this study focuses on the method for using private IPFS. Private IPFS is not open to the general public; although it poses a risk of data tampering when distributing data to external parties, the proposed method ensures the authenticity of the received data. In particular, this method applies a type of zero-knowledge proof, namely, the Groth16 protocol of zk-SNARKs, to ensure that the data corresponds to the content identifier in a private IPFS. Moreover, the recipient’s name is embedded into the distributed data to prevent unauthorized secondary distribution. Experiments confirmed the effectiveness of the proposed method for an image data size of up to 120 × 120 pixels. In future studies, the proposed method will be applied to larger and more diverse data types.
With the development of smart grid, the introduction of blockchain technology provides a novel idea for secure power data sharing. The existing blockchain-based data aggregation schemes generally rely on a unique leader node to perform verification algorithms, but there may be a lazy leader node not performing aggregation data verification to save computation costs. In addition, in the existing verification mechanism, light nodes need to perform the same verification operations as the leader node, which results in resource-constrained light nodes being unable to bear. In this paper, we propose an efficient blockchain-based data aggregation scheme with privacy-preserving on the smart grid, called EC-ASPG, which implements a supervised mechanism for the lazy leader node, enhancing the security of the system. Furthermore, we propose a separable consensus verification mechanism, which can prevent other light nodes from performing duplicate verification operations like the leader node, effectively improving the efficiency of consensus verification. Finally, we present a formal security proof and comprehensive performance evaluations. The results show that our scheme is secure and outperforms the compared schemes in terms of performance analysis.
Caleb Geren, Amanda Board, Gaby G. Dagher, Tim Andersen · 5 authors
With the growing development and deployment of large language models (LLMs) in both industrial and academic fields, their security and safety concerns have become increasingly critical. However, recent studies indicate that LLMs face numerous vulnerabilities, including data poisoning, prompt injections, and unauthorized data exposure, which conventional methods have struggled to address fully. In parallel, blockchain technology, known for its data immutability and decentralized structure, offers a promising foundation for safeguarding LLMs. In this survey, we aim to comprehensively assess how to leverage blockchain technology to enhance LLMs' security and safety. Besides, we propose a new taxonomy of blockchain for large language models (BC4LLMs) to systematically categorize related works in this emerging field. Our analysis includes novel frameworks and definitions to delineate security and safety in the context of BC4LLMs, highlighting potential research directions and challenges at this intersection. Through this study, we aim to stimulate targeted advancements in blockchain-integrated LLM security.
Domenico Tortola, Andrea Lisi, Paolo Mori, Laura Ricci
A blockchain is a data structure consisting of a list of blocks containing transactions and maintained by a network of nodes in a decentralized manner. In permissionless blockchains, anyone can contribute to the decentralization and security of the transactions. With the advent of smart contracts, programs whose execution is replicated by all the nodes of the network, the blockchain can be deemed not only a reliable and auditable data repository, but also a secure and verifiable computational infrastructure. However, due to the aforementioned features, the throughput of most permissionless blockchains is low, and executing a smart contract can be expensive, depending on its computational complexity. To mitigate these issues, a popular research line studies the implementation of Layer 2 solutions, which consists of nodes that operate off-chain yet remaining tethered to the blockchain. Our literature analysis revealed that a majority of the research articles surveying Layer 2 technologies and solutions typically classify them on the basis of the Layer 2 operations they perform, as well as their ability to improve the processing capacity of the blockchain. In this paper, instead, we survey the methodologies that provide a secure binding between Layer 2 and the blockchain. We refer to these binding techniques as “proving schemes” which we classify as: data integrity proofs, validity proofs, and fraud proofs. For each proving scheme, we describe its intended purpose, the advantages it offers, the methodologies commonly used to connect the operations performed at Layer 2 with the blockchain, and the applications that benefit from such scheme. Finally, we discuss and compare them to give a general comprehension about how schemes can satisfy general requirements common to most Decentralized Applications.