While Internet of Things (IoT) technology has been widely recognized as an essential part of Smart Cities, it also brings new challenges in terms of privacy and security. Access control (AC) is among the top security concerns, which is critical in resource and information protection over IoT devices. Traditional access control approaches, like Access Control Lists (ACL), Role-based Access Control (RBAC) and Attribute-based Access Control (ABAC), are not able to provide a scalable, manageable and efficient mechanism to meet the requirements of IoT systems. Another weakness in today’s AC is the centralized authorization server, which can cause a performance bottleneck or be the single point of failure. Inspired by the smart contract on top of a blockchain protocol, this paper proposes BlendCAC, which is a decentralized, federated capability-based AC mechanism to enable effective protection for devices, services and information in large-scale IoT systems. A federated capability-based delegation model (FCDM) is introduced to support hierarchical and multi-hop delegation. The mechanism for delegate authorization and revocation is explored. A robust identity-based capability token management strategy is proposed, which takes advantage of the smart contract for registration, propagation, and revocation of the access authorization. A proof-of-concept prototype has been implemented on both resources-constrained devices (i.e., Raspberry PI nodes) and more powerful computing devices (i.e., laptops) and tested on a local private blockchain network. The experimental results demonstrate the feasibility of the BlendCAC to offer a decentralized, scalable, lightweight and fine-grained AC solution for IoT systems.
Paolo Missier, Shaimaa Bajoudah, Angelo Capossele, Andrea Gaglione · 5 authors
Internet of Things (IoT) data are increasingly viewed as a new form of massively distributed and large scale digital assets, which are continuously generated by millions of connected devices. The real value of such assets can only be realized by allowing IoT data trading to occur on a marketplace that rewards every single producer and consumer, at a very granular level. Crucially, we believe that such a marketplace should not be owned by anybody, and should instead fairly and transparently self-enforce a well defined set of governance rules. In this paper we address some of the technical challenges involved in realizing such a marketplace. We leverage emerging blockchain technologies to build a decentralized, trusted, transparent and open architecture for IoT traffic metering and contract compliance, on top of the largely adopted IoT brokered data infrastructure. We discuss an Ethereum-based prototype implementation and experimentally evaluate the overhead cost associated with Smart Contract transactions, concluding that a viable business model can indeed be associated with our technical approach.
This paper presents LinBFT, a novel Byzantine fault tolerance (BFT) protocol for blockchain systems that achieves amortized O(n) communication volume per block under reasonable conditions (where n is the number of participants), while satisfying determinist guarantees on safety and liveness. This significantly improves previous results, which either incurs quadratic communication complexity, or only satisfies safety in a probabilistic sense. LinBFT is based on the popular PBFT protocol, and cuts down its $O(n^4)$ complexity with three tricks, each by $O(n)$: linear view change, threshold signatures, and verifiable random functions. All three are known, i.e., the solutions are right in front of our eyes, and yet LinBFT is the first $O(n)$ solution with deterministic security guarantees. Further, LinBFT also addresses issues that are specific to permission-less, public blockchain systems, such as anonymous participants without a public-key infrastructure, proof-of-stake with slashing, rotating leader, and a dynamic participant set. In addition, LinBFT contains no proof-of-work module, reaches consensus for every block, and tolerates changing honesty of the participants for different blocks.
Ruinian Li, Tianyi Song, Bo Mei, Hong Li · 6 authors
With the dramatically increasing deployment of IoT devices, storing and protecting the large volume of IoT data has become a significant issue. Traditional cloud-based IoT structures impose extremely high computation and storage demands on the cloud servers. Meanwhile, the strong dependencies on the centralized servers bring significant trust issues. To mitigate these problems, we propose a distributed data storage scheme employing blockchain and cetrificateless cryptography. Our scheme eliminates the traditional centralized servers by leveraging the blockchain miners who perform “transaction” verifications and records audit with the help of certificateless cryptography. We present a clear definition of the transactions in a non-cryptocurrency system and illustrate how the transactions are processed. To the best of our knowledge, this is the first work designing a secure and accountable IoT storage system using blockchain. Additionally, we extend our scheme to enable data trading and elaborate how data trading can be efficiently and effectively achieved.
Currently, blockchain technology, which is decentralized and may provide tamper-resistance to recorded data, is experiencing exponential growth in industry and research. In this paper, we propose the MIStore, a blockchain-based medical insurance storage system. Due to blockchain's the property of tamper-resistance, MIStore may provide a high-credibility to users. In a basic instance of the system, there are a hospital, patient, insurance company and n servers. Specifically, the hospital performs a (t, n)-threshold MIStore protocol among the n servers. For the protocol, any node of the blockchain may join the protocol to be a server if the node and the hospital wish. Patient's spending data is stored by the hospital in the blockchain and is protected by the n servers. Any t servers may help the insurance company to obtain a sum of a part of the patient's spending data, which servers can perform homomorphic computations on. However, the n servers cannot learn anything from the patient's spending data, which recorded in the blockchain, forever as long as more than n - t servers are honest. Besides, because most of verifications are performed by record-nodes and all related data is stored at the blockchain, thus the insurance company, servers and the hospital only need small memory and CPU. Finally, we deploy the MIStore on the Ethererum blockchain and give the corresponding performance evaluation.
Personal data are often collected and processed in a decentralized fashion, within different contexts. For instance, with the emergence of distributed applications, several providers are used to correlate their records, to provide personalized services to their clients. As such, to protect users' privacy, different pseudonyms are generally used for different contexts. These pseudonyms have to be unlinkable to prevent identifying records to be associated to the same user. Although unlinkable, these pseudonyms have to be processed and exchanged according to their owners' consent and in a privacy-preserving fashion. In this paper, we propose BDUA, a new Blockchain-based Data Usage Auditing system, that ensures a controlled yet privacy preserving exchange of distributed data, such that a set of authorized auditing entities are able to conduct an accurate auditing relying on registered blockchains' transactions.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
With the development of information and communication technology, the amount of data in the world is increasing dramatically every day. Now data has been recognized as a valuable asset, and monetization from valuable data becomes an urgent need. In light of this, many data trading platforms have emerged in recent years. Existing data trading schemes, however, generally rely on a third party to trade data. These schemes suffer from complex transaction process, high transaction cost, and possibly unfair exchange. In this paper, we propose two secure, fair and efficient data trading schemes that do not rely on any third party using blockchain. The first scheme achieves direct raw data exchange for large amount of data, while the second scheme achieves data statistics trading. We implement both our schemes with smart contracts, and conduct comprehensive experiments to evaluate their performance. The experiment results show that they are highly efficient in trading data: the first scheme can trade 100,000 data records within 1.51s, while the second scheme can process a statistic over a data set of 1,024 records within 1.99s.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
The rapid development of Internet of Things technology has led to the sharp increase of the number of interconnected devices. A large amount of data is generated by large-scale loT devices. In this paper, we propose PDash with parallel distributed architecture, a scalable blockchain-based platform for loT data storage and sharing. PDash aims to solve the bottleneck problem of blockchain system: scalability, and makes it possible for users to keep ownership of their own data as well as share data securely with economic feedback. PDash integrates decentralized blockchain network and distributed storage network to achieve secure data storage, validation and sharing, and utilizes multiple encryption technologies to enable efficient interaction between two parallel distributed networks.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Secure naming systems, or more narrowly public key infrastructures (PKIs), form the basis of secure communications over insecure networks. All security guarantees against active attackers come from a trustworthy binding between user-facing names, such as domain names, to cryptographic identities, such as public keys. By offering a secure, distributed ledger with highly decentralized trust, blockchains such as Bitcoin show promise as the root of trust for naming systems with no central trusted parties. PKIs based upon blockchains, such as Namecoin and Blockstack, have greatly improved security and resilience compared to traditional centralized PKIs. Yet blockchain PKIs tend to significantly sacrifice scalability and flexibility in pursuit of decentralization, hindering large-scale deployability on the Internet. We propose Conifer, a novel PKI with an architecture based upon CONIKS, a centralized transparency-based PKI, and Catena, a blockchain-agnostic way of embedding a permissioned log, but with a different lookup strategy. In doing so, Conifer achieves decentralized trust with security at least as strong as existing blockchain-based naming systems, yet without sacrificing the flexibility and performance typically found in centralized PKIs. We also present our reference implementation of Conifer, demonstrating how it can easily be integrated into applications. Finally, we use experiments to evaluate the performance of Conifer compared with other naming systems, both centralized and blockchain-based, demonstrating that it incurs only a modest overhead compared to traditional centralized-trust systems while being far more scalable and performant than purely blockchain-based solutions.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Harsha S. Gardiyawasam Pussewalage, Vladimir Oleshchuk
Modern electronic healthcare (e-health) settings constitute collaborative environments requiring sophisticated fine-grained access control mechanisms to cater their access demands. Access delegatability is quite crucial to realize fine-grained, flexible access control schemes compatible with such environments. In this paper, we addressed this issue through proposing an attribute based access control scheme integrated with controlled access delegation capabilities suitable for a multi-domain e-health environment. We have utilized the blockchain technology to manage attribute assignments, delegations as well as revocations. The scheme enables delegations in a controlled manner without jeopardizing the security of the system. The control is achieved via granting each delegating user the capability of controlling the subsequent delegations made by the delegatee as well as limiting the length of a chain of delegations. Furthermore, it is equipped with a superior attribute revocation mechanism and induces substantially lower key management overhead to the end-users in comparison to the existing access control schemes with delegatability.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Kei Leo Brousmiche, Antoine Durand, Thomas Heno, Christian Poulain · 6 authors
The blockchain technology has recently attracted increasing interests in a wide range of use-cases. Among those, the management of vehicles' data and life cycle over a blockchain has sparked various research initiatives on a global scale, with the promise to prevent automobile frauds and to enable more collaborations between the involved stakeholders. In this paper, we investigate the problem of securing and sharing vehicles' data over a consortium blockchain, and we describe the architecture of the implemented proof-of-concept. Then, we introduce a novel hybrid cryptographic protocol to secure the access to vehicles' data between the involved stakeholders. Finally, we discuss the lessons learned acquired from the preliminary trials and we highlight the future research challenges and opportunities.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Aleksey Charapko, Ailidani Ailijiang, Murat Demirbaş
The distributed consensus problem has been extensively studied in the last four decades as an important problem in distributed systems. Recent advances in decentralized consensus and blockchain technology, however, arose from a disparate model and gave rise to disjoint knowledge-base and techniques than those in the classical consensus research. In this paper we make a case for bridging these two seemingly disparate approaches in order to help transfer the lessons learned from the classical distributed consensus world to the blockchain world and vice versa. To this end, we draw parallels between blockchain consensus and a classical consensus protocol, Paxos. We also survey prominent approaches to improving the throughput and providing instant irreversibility to blockchain consensus and show analogies to the techniques from classical consensus protocols. Finally, inspired by the central role formal methods played in the success of classical consensus research, we suggest more extensive use of formal methods in modeling the blockchains and smartcontracts.
This paper presents a new trade-clearing framework with a Super-Large Ledger (SLL) that can be shared with exchanges, banks, and regulators. Furthermore, this SLL runs on top of a permissioned BC with significant redundancy, and can be efficiently processed at high speed with scalability. In other words, when the workload increases, the SLL will be split and allocated to different processors to speed up the operation. The framework has been implemented and evaluated at a clearinghouse and processed 3.3B historical and real-time transactions.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Enabling keyword search directly over the data stored on the blockchain is a desirable technique that can help in the effective utilization of the data while preserving the privacy. Searchable Encryption (SE) is a well-known technique that allows search queries over the encrypted Cloud data, however, existing solutions are based on the assumption of the Cloud Server being “trusted-but-curious” or “honest-but-curious”. This leads to a compelling case to use permissioned blockchain technology to ensure greater levels of security when the Cloud Server is malicious. The amalgamation of SE and permissioned blockchain empowers a client to place complete trust on the Cloud Server and the services it has to offer. This paper presents a novel privacy - preserving framework to facilitate keyword search over encrypted data stored on the blockchain network. The framework for the first time studies SE over a permissioned blockchain network i.e., Hyperledger-Fabric. The SE scheme is privacy-preserving as it is based on probabilistic trapdoors. As a result the framework guarantees prominent security and privacy gains.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Andreas Grüner, Alexander Mühle, Tatiana Gayvoronskaya, Christoph Meinel
Removing the need for a trusted third party, blockchain technology revolutionizes the field of identity management. Service providers rely on digital identities to securely identify, authenticate and authorize users to their services. Traditionally, these digital identities are offered by a central identity provider belonging to a specific organisation. Trust in the digital identity mainly originates from the identity provider's reputation, organizational functioning and contractual obligations. Blockchain technology enables the creation of decentralized identity management without a central identity provider as trusted third party. Therefore, the derivation of trust in digital identities within this paradigm requires a distinct approach. In this paper we propose a novel general quantifiable trust model and a specific implementation variant for blockchain-based identity management. Applying the model, trust is deduced in a decentralized manner from attestations of claims and applied to the associated digital identity. This concept replaces trust with a central identity provider by aggregated trust into attestation issuers. Thus, promoting self-sovereign identities to be fit for purpose. The calculated numerical trust metric serves as independent basis for the definition of assurance levels to simplify and automate reasoning about trust by service providers without requiring a dedicated evaluation of a trusted third party.
Barbara Carminati, Christian Rondanini, Elena Ferrari
One of the main issues in service collaborations among business partners is the possible lack of trust among them. A promising approach to cope with this issue is leveraging on blockchain technology by encoding with smart contracts the business process workflow. This brings the benefits of trust decentralization, transparency, and accountability of the service composition process. However, data in the blockchain are public, implying thus serious consequences on confidentiality and privacy. Moreover, smart contracts can access data outside the blockchain only through Oracles, which might pose new confidentiality risks if no assumptions are made on their trustworthiness. For these reasons, in this paper, we are interested in investigating how to ensure data confidentiality during business process execution on blockchain even in the presence of an untrusted Oracle.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Public key distribution and device authentication remain the main security challenges in many systems and applications. Existing solutions are based on Public Key Infrastructures (PKI) backed by Certificate Authorities (CA) to validate the authenticity of the devices. However, distributing and provisioning certificates for each client showed to be impractical especially for Internet of Things (IoT) devices. In this paper we propose a distributed PKI (Public Key Infrastructure) platform based on the Ethereum Blockchain. It contains a decentralized key-store that holds the public keys of all devices, and includes a generic protocol for PSK (Pre-Shared Keys) distribution. PSK keys can then be used by PSK-based security protocols (TLS-PSK, DTLS-PSK, SRTP...) for securing the communication channel between two devices. This platform includes a client-side module, a public key management module configured on the server, and a smart contract software deployed on the Ethereum Blockchain network. This generic platform can be used by many applications for client and server authentication, data integrity, and secure peer to peer communications. Moreover, this promising system may potentially eliminate the trust requirement imposed by the existing PKI/CAs infrastructure on clients.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
The Internet of Things aims at connecting everything ranging from individuals, organizations, companies to things in the physical and virtual world. The digital identity has always been considered as the keystone for all online services and the foundation for building security mechanisms such as authentication and authorization. However, current literature still lacks of a comprehensive research on the digital identity management for the Internet of Things (IoT). In this paper, we identify digital identity challenges and solutions for the Internet in general. We then focus on how existing solutions cope with IoT requirements such as scalability, interoperability, mobility, security and privacy. We also investigate recent surging blockchain sovereign identity solutions and enumerate some projects and startups which are focusing on IoT identity problems. Furthermore, we elaborate challenges of building identity management systems for the IoT, including access control, privacy preserving, trust and performance respectively. At last, we conclude with the promising future research trends in building IoT identity management systems.
Shujie Cui, Muhammad Rizwan Asghar, Giovanni Russello
In blockchain-based systems, malicious behaviour can be detected using auditable information in transactions managed by distributed ledgers. Besides cryptocurrency, blockchain technology has recently been used for other applications, such as file storage. However, most of existing blockchain- based file storage systems can not revoke a user efficiently when multiple users have access to the same file that is encrypted. Actually, they need to update file encryption keys and distribute new keys to remaining users, which significantly increases computation and bandwidth overheads. In this work, we propose a blockchain and proxy re-encryption based design for encrypted file sharing that brings a distributed access control and data management. By combining blockchain with proxy re-encryption, our approach not only ensures confidentiality and integrity of files, but also provides a scalable key management mechanism for file sharing among multiple users. Moreover, by storing encrypted files and related keys in a distributed way, our method can resist collusion attacks between revoked users and distributed proxies.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Omnia Mahmoud, Henning Kopp, Amr T. Abdel-Hamid, Frank Kargl
Insurances are a way of financial risk mitigation that pay the user in case of damage. However, once the event happens, the user does not get paid immediately due to the large degree of human interaction required. In this paper, we automate insurance payment by using smart contracts. As additional contribution, our design supports integration of IoT devices to register events that trigger insurance contracts and offers additional privacy-protection even on public blockchains. In order to allow users to retrieve their payment from the insurance contract anonymously we remove the linkability and traceability between events that triggers the contract and the insurance holder by applying ring signatures. Using a prototypical implementation based on Ethereum, we study the additional overhead and cost that our design incurs and can show that exploiting latest features of Ethereum, gas cost can be driven down substantially compared to earlier approaches. In sum, we propose, implement, and evaluate a design for smart insurance contracts integrating IoT sensors and including additional privacy protection using ring signatures.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Scalability and privacy are two challenges for today's blockchain systems. Processing transactions at every node in the system limits the system's ability to scale. Furthermore, the requirement to publish all corporate or individual information for processing at every node, essentially making the data public, is - despite of all other advantages - often considered a major obstacle to blockchain adoption. In this paper, we make two main contributions to address these two problems: (i) To increase efficiency, we propose a processing model which employs non-interactive proofs to off-chain computations, thereby reducing on-chain computational efforts to the verification of correctness of execution rather than the execution itself. Due to the verifiable computation scheme's zero-knowledge property, private information used in the off-chain computation does not have to become public to verify correctness. (ii) We introduce ZoKrates, a toolbox to specify, integrate and deploy such off-chain computations. It consists of a domain-specific language, a compiler, and generators for proofs and verification Smart Contracts. ZoKrates hides significant complexity inherent to zero-knowledge proofs, provides a more familiar and higher level of programming abstractions to developers and enables circuit integration, hence fostering adoption.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Yan Zhu, Xiaoxu Song, Shuai Yang, Yao Qin · 5 authors
While smart contracts are praised widely, it should be noted that they have their disadvantages: lack of control over data protection and executive correctness or consistency. Aiming at this problem, we propose SMPC-based smart contract platform with three-layer structure: contract, computing, and group communication layer. In contract layer, we put forward SMPC-based smart contract framework, which gives the implementation process, language structure and grammar specification of smart contracts. In computing layer, fair SMPC algorithms based on general linear secret sharing scheme are designed to implement verifiable collaboration computing with input privacy and computation correctness. In group communication layer, the non-blocking broadcast is developed from non-blocking message passing interface (MPI)in order to ensure secure group communication in asynchronous networks with node and link failures. Finally, the results of simulation experiments with private currency transfers indicate that our platform is efficient and secure enough for common smart contracts.