The relationship between doctors and patients is reinforced through the expanded communication channels provided by remote healthcare services, resulting in heightened patient satisfaction and loyalty. Nonetheless, the growth of these services is hampered by security and privacy challenges they confront. Additionally, patient electronic health records (EHR) information is dispersed across multiple hospitals in different formats, undermining data sovereignty. It allows any service to assert authority over their EHR, effectively controlling its usage. This paper proposes a blockchain enforced attribute-based access control in healthcare service. To enhance the privacy and data-sovereignty, the proposed system employs attribute-based access control, zero-knowledge proof (ZKP) and blockchain. The role of data within our system is pivotal in defining attributes. These attributes, in turn, form the fundamental basis for access control criteria. Blockchain is used to keep hospital information in public chain but EHR related data in private chain. Furthermore, EHR provides access control by using the attributed based cryptosystem before they are stored in the blockchain. Analysis shows that the proposed system provides data sovereignty with privacy provision based on the attributed based access control.
Avni Rustemi, Fisnik Dalipi, Vladimir Atanasovski, Aleksandar Risteski
Abstract Nowadays, the centralized systems used in higher education institutions are sophisticated and have high security mechanisms, offering secure data transfer and real-time encryption. Despite the prevalent usage of centralized systems in many institutions, particularly those within the realm of higher education, some unresolved concerns persist pertaining to privacy, potential abuse, transparency, and the limited capacity to digitize numerous services. Blockchain systems are considered as a potential solution for addressing these constraints. This study begins by highlighting the significance of implementing blockchain systems in higher education institutions, while also outlining the obstacles encountered by researchers in this domain. Centralized systems and blockchain systems are distinguished, with a description of the challenges related to data transfer and adaptation to different platforms. A thorough explanation of the proposed blockchain system begins with a presentation of the conceptual model, followed by a detailed architecture of the processes that would be executed by the system, with particular emphasis on the generation and authentication of academic credentials. Additionally, an analysis is provided on the significance of smart contracts in the programming of blockchain systems. This includes a detailed explanation of the main smart contract architecture used in the proposed blockchain system. This article aims to explore the development of a proposed blockchain system and its practical implementation for testing purposes using specific scenarios and data in the foreseeable future.
Seyed Amid Moeinzadeh Mirhosseini, Stefan Craß, Bernhard Uhl, Leander B. Hörmann · 5 authors
With the advent of the Internet of Things (IoT), device-generated data has surged significantly. These ever increasing volumes of data need to be trusted and relied on for various purposes. Data consumers heavily depend on the correctness and integrity of the generated data sets, whereas inadequate IoT security measures increase the risk of data contamination. While data quality problems due to technical issues like sensor faults, unstable communication links, and storage failures can be mitigated with simple measures like redundant nodes and checksums, protection against arbitrary attacks by hackers or insiders requires more sophisticated mechanisms. Blockchain technology enables such an integrity protection mechanism as data is stored in a distributed ledger that cannot be controlled by a single entity. However, the main challenge of this approach in the context of resource-constrained IoT devices lies in the potentially high computational overhead of the underlying cryptographic operations as well as additional storage and bandwidth requirements. Therefore, this paper proposes an energy-efficient data anchoring method tailored for IoT sensors that provides end-to-end security guarantees using a combination of advanced hash trees and digital signatures. By checking the corresponding ledger transaction, any interested party can verify the authenticity of arbitrary sensor data items that were shared by the responsible data provider. Our experiments show a negligible energy overhead for sensor nodes compared to the unprotected protocol, thus indicating the practical feasibility of the approach.
In recent years, multiple solutions have been proposed for blockchain interoperability. However, designing these solutions is complex, and design failures have caused great economic damage to their owners. Safety and liveness are essential properties for these solutions, and formalisation eases their verification. However, only a few efforts were performed to formalise interoperability solutions with known formal methods. TLA+ and PAT were previously used; however, the Event-B method has not been explored, although it might be a suitable approach. The purpose of this paper was to explore the formalisation of a gateway-based interoperability solution with Event-B. The results showed that the method was suitable and that a straightforward specification could be developed considering Ethereum and Hyperledger Fabric as the involved blockchains. The specification was assessed with three strategies that enabled its verification and validation. In particular, formal verification (e.g. safety properties), functional validation, and functional utility. These promising results constitute a step forward in the development of formal specifications for blockchain interoperability solutions.
This paper introduces ZK-Team, a solution addressing the challenges faced by organizations in enabling shared ownership of accounts among team members. The conventional method involves smart contracts, but usability issues and privacy concerns hinder practicality. ZK-Team leverages Ethereum’s Account ion (ERC-4337) and zero-knowledge proofs to allow shared accounts without dedicated EOAs (Externally Owned Accounts) for gas fees, ensuring privacy. Our solution includes an innovative mechanism for transparently managing zero-knowledge inputs, minimizing on-chain storage without relying on an off-chain storage. The paper discusses both the theoretical aspects of the solution and its implementation available as an open-source project.
A sharding framework has been proposed by Ethereum 2.0, and each shard can execute transactions requested by users, so the number of transactions dealt with by the shard-based blockchain grows as the number of shards increases. Dealing with cross-shard transactions, however, is a major hindrance to blockchain performance, because each such transaction requires cooperation among different shard validators in the network. Given this background, this paper proposes a novel cross-shard architecture in which smart contract functions in different shards are called in a hierarchical manner so as to dramatically reduce the interactions among different shard validators.
Damiano Di Francesco Maesa, Francesco Donini, Paolo Mori, Laura Ricci
Non-Fungible Tokens (NFTs) are currently used in a large number of scenarios, from digital art to the metaverse, to trace the ownership of assets exchanged between users. However, most NFT defining standards, such as the widely adopted ERC 721 for the Ethereum protocol, have been designed with immutable assets only in mind. As such, they are not suitable for representing assets with features that may need to be updated during their lifetime. To overcome this issue, in the literature have been proposed new models that properly represent and protect mutable assets through NFTs, such as Non Fungible Mutable Tokens, NMTs. In this paper, we expanded the NMT model with a security support meant to protect assets’ features updates through access control policies that are defined by the asset creator and the current asset owner and enforced during the assets’ lifetime. Policing updates is of paramount importance, because it protects the asset from unintended updates that could greatly alter the asset itself and its value. The main contributions of this paper are a detailed description of the NMT smart contracts architecture and internal dependencies, as well as an experimental validation of NMTs by providing the implementation of a NMT representing a wearable (a jacket) in Decentraland, a popular metaverse environment.
Blockchain Technology Applications and Security
Innovative Microfluidic and Catalytic Techniques Innovation
Blockchain is a distributed ledger technology that can provide trustworthy data services and robust support for secure data sharing. However, it faces the challenge of data privacy leakage during application, greatly limiting its scope and application areas. With the increasing volume of on-chain data, ensuring privacy protection during the blockchain data query process has become one of the key concerns for researchers. To address this issue, this paper proposes a framework called Trusted Execution Environment-based Blockchain Query Framework (TEEBQF). This framework loads blockchain query transactions based on smart contracts into a trusted execution environment, authenticates the trusted execution environment with relevant cryptographic techniques, and protects the confidentiality of query content, thereby achieving privacy protection during the data query process. Finally, the effectiveness of this framework is analyzed through performance evaluation, confirming its ability to provide robust support for privacy protection during blockchain data queries while achieving efficient and available queries, thus contributing to secure data sharing in blockchain environments.
With the rapid development of modern medical technology and the dramatic increase in the amount of medical data, traditional centralized medical information management is facing many challenges. In recent years blockchain, which is a peer-to-peer distributed database, has been increasingly accepted and adopted by different industries and use cases. Key areas of healthcare blockchain applications include electronic medical record (EMR) management, medical device supply chain management, remote condition monitoring, insurance claims and personal health data (PHD) management, among others. Even so, there are a number of challenges in applying blockchain concepts to healthcare and its data, including interoperability, data security privacy, scalability, TPS and so on. While these challenges may hinder the development of blockchain in healthcare scenarios, they can be improved with existing technologies In this paper, we propose a blockchain-based healthcare operations management framework that is combined with the Interplanetary File System (IPFS) for managing EMRs, protects data privacy through a distributed approach while ensuring that this medical ledger is tamper-proof. Doctors act as full nodes, patients can participate in network maintenance either as light nodes or as full nodes, and the hospital acts as the endpoint database of data, i.e., the IPFS node, which saves the arithmetic power of nodes and allows the data stored in the hospitals and departments to be shared with the other organizations that have uploaded the data. Therefore, the integration of blockchain and zero-knowledge proof proposed in this paper helps to protect data privacy and is efficient, better scalable, and more throughput.
In multi-stakeholder systems, such as healthcare, the Internet of Things, and supply chain management, there is frequent data generation, exchange, and sharing. As a result, data owners often desire control over their data and maintain privacy, while data consumers require methods to ascertain the origins and creators of the data. These conflicts of interest require developing data governance systems that guarantee data provenance, privacy protection, consent management, and selective disclosure. This research proposed a decentralized data governance system utilizing blockchain technology, proxy re-encryption (PRE), and Boneh, Boyen, and Shacham (BBS) signatures to address these challenges. The proposed system enables data owners to control, selectively share, and track their data through privacy-enhancing, consent management, and selective disclosure mechanisms while also allowing data consumers to understand the lineage of the data through a blockchain-based provenance mechanism. As a case study, the research examined and evaluated electronic prescriptions involving sensitive data and multiple stakeholders, including patients as data owners and doctors and pharmacists as data consumers. The research was structured as a collection of published articles organized in the following sequence: problem formulation and developing smart contracts, implementing privacy and consent management through PRE, and applying BBS signatures for selective data sharing. The proof-of-concept implementation and evaluations, conducted using CosmWasm, Hyperledger Besu, Ethereum, pyUmbral PRE, and BBS signatures, demonstrate that the proposed decentralized system is platform-agnostic, scalable, and capable of providing a higher level of transparency, privacy, and trust with minimal overhead.
Joel Sousa, Emerson B. Tomaz, Allysson Allex Araújo
Authenticity represents an essential facet of information security explored across various Information Systems (IS), including Internet of Things (IoT) devices in Industry 4.0. However, deploying authentication mechanisms in specific IoT devices poses significant challenges, particularly for those with energy, memory, and computational power constraints. Given this context, this ongoing research project aims to compare conventional authentication mechanisms for low-resource IoT devices and identify the most efficient one among them. As an initial result, this paper aims to present our methodological scope and discuss preliminary empirical results derived from a computational experiment using the Non Interactive Zero Knowledge Proofs (NIZKP), algorithm in Arduino Nano. This research seeks to enhance the comprehension of authentication mechanisms in low-resource IoT devices, thus facilitating better decision-making processes in IS settings and contributing to academia and practice.
With the application of robotics in security monitoring, medical care, image analysis, and other high-privacy fields, vision sensor data in robotic operating systems (ROS) faces the challenge of enhancing secure storage and transmission. Recently, it has been proposed that the distributed advantages of blockchain be taken advantage of to improve the security of data in ROS. Still, it has limitations such as high latency and large resource consumption. To address these issues, this paper introduces PrivShieldROS, an extended robotic operating system developed by InterPlanetary File System (IPFS), blockchain, and HybridABEnc to enhance the confidentiality and security of vision sensor data in ROS. The system takes advantage of the decentralized nature of IPFS to enhance data availability and robustness while combining HybridABEnc for fine-grained access control. In addition, it ensures the security and confidentiality of the data distribution mechanism by using blockchain technology to store data content identifiers (CID) persistently. Finally, the effectiveness of this system is verified by three experiments. Compared with the state-of-the-art blockchain-extended ROS, PrivShieldROS shows improvements in key metrics. This paper has been partly submitted to IROS 2024.
Weihao Bai, Long Chen, Qianwen Gao, Zhenfeng Zhang
The MPC-in-the-Head framework has been proposed as a solution for Non-Interactive Zero-Knowledge Arguments of Knowledge (NIZKAoK) due to its efficient proof generation. However, most existing NIZKAoK constructions using this approach require multiple MPC evaluations to achieve negligible soundness error, resulting in proof size and time that are asymptotically at least λ times the size of the circuit of the NP relation. In this paper, we propose a novel method to eliminate the need for repeated MPC evaluations, resulting in a NIZKAoK protocol for any NP relation that we call Diet. The proof size and time of Diet are asymptotically only polylogarithmic with respect to the size of the circuit C of the NP relation, but are independent of the security parameter λ. Hence, both the proof size and time can be significantly reduced.Moreover, Diet offers promising concrete efficiency for proving Learning With Errors (LWE) problems and its variants. Our solution provides significant advantages over other schemes in terms of both proof size and proof time, when considering both factors together. Specifically, Diet is a promising method for proving knowledge of secret keys for lattice-based key encapsulation mechanisms (KEMs) such as Frodo and Kyber, offering a practical solution to future post-quantum certificate management. For Kyber 512, our implementation achieves an online proof size of 83.65 kilobytes (KB) with a preprocessing overhead of 152.02KB. The implementation is highly efficient, with an online proof time of only 0.68 seconds and a preprocessing time of 0.81 seconds. Notably, our approach provides the first reported implementation of proving knowledge of secret keys for Kyber 512 using post-quantum primitives-based zero-knowledge proofs.
Piyush Kumar Pareek, E. Naresh, A. Ashwitha, A.B. Shashikala · 6 authors
Information about healthcare is crucial for both individuals and service providers. It is essential to increase the safe sharing and upkeep of electronic healthcare records (EHR). To communicate health data across healthcare stakeholders, EHR systems have traditionally depended on a centralized system (such as the cloud), which may have exposed undisclosed and secret persistent intelligence. EHR has had trouble addressing the needs of many participants and approaches in relationships of separation, security, and supplementary legal requirements. Blockchain is a distributed, decentralized journal system that can offer capabilities for safe, verified, and unchangeable data transfer. Blockchain uses consistent cryptographic techniques (hashes) to construct a distributed ledger system that enables distributed activity without the need for a central authority. Due to the immutability of a blockchain network, data exploitation is challenging and obvious. We provide a a blockchain-based architecture that uses the Proof of Stake (POS) cryptographic consensus mechanism to authenticate user identification and secure EHR exchange amongst multiple electronic healthcare systems. In order to safeguard the data that was outsourced This study suggests the use of Secure Partially Homomorphic Encryption (SPHE), which allows users to multiply and divide the ciphertext. The cloud environment&s;s access control policy is more adaptable. The results demonstrate that, in terms of superpower use, authenticity, and medical data protection, the suggested technique outperforms the alternatives.
C. Li, Sidi Mohamed Beillahi, Guang Yang, Ming Wu · 6 authors
Authenticated storage access is the performance bottleneck of a blockchain, because each access can be amplified to potentially O (log n ) disk I/O operations in the standard Merkle Patricia Trie (MPT) storage structure. In this article, we propose a multi-Layer Versioned Multipoint Trie (LVMT), a novel high-performance blockchain storage with significantly reduced I/O amplifications. LVMT uses the authenticated multipoint evaluation tree vector commitment protocol to update commitment proofs in constant time. LVMT adopts a multi-layer design to support unlimited key–value pairs and stores version numbers instead of value hashes to avoid costly elliptic curve multiplication operations. In our experiment, LVMT outperforms the MPT in real Ethereum traces, delivering read and write operations 6× faster. It also boosts blockchain system execution throughput by up to 2.7×.
Among the most important documents for graduates are diplomas issued by schools or colleges or any educational institutions. Graduates' transcripts serve as proof of their qualifications and may be used for job applications or any other similar purposes. Important documents like passports, ID cards, and certificates can now be falsified because of the advancement of computer science and also the introduction of reasonably priced, office equipment which are of high quality into the marketplace. On the other hand, traditional certificate verification is costly and time-consuming. The goal of this research is to create a workable model that offers viable solutions for the blockchain-based issuance and verification of academic diplomas in light of this. Hashing, cryptography, public/private key encryption, digital signatures, proof of stake and proof-of-work are among the characteristics of blockchain technology.
The closed architecture of prevailing blockchain systems renders the usage of this technology mostly infeasible for a wide range of real-world problems. Most blockchains trap users and applications in their isolated space without the possibility of cooperating or switching to other blockchains. Therefore, blockchains need additional mechanisms for seamless communication and arbitrary data exchange between each other and external systems. Unfortunately, current approaches for cross-blockchain communication are resource-intensive or require additional blockchains or tailored solutions depending on the applied consensus mechanisms of the connected blockchains. Therefore, we propose an oracle with an off-chain aggregation mechanism based on Zero-Knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs) to facilitate cross-blockchain communication. The oracle queries data from another blockchain and applies a rollup-like mechanism to move state and computation off-chain. The zkOracle contract only expects the transferred data, an updated state root, and proof of the correct execution of the aggregation mechanism. The proposed solution only requires constant 378 kgas to submit data on the Ethereum blockchain and is primarily independent of the underlying technology of the queried blockchains.
The widespread availability of Internet access and online services has led to the generation of numerous large-scale graphs in various real-world applications, such as online social networks and knowledge graphs. Keyword search stands out as a crucial task in the analysis and mining of these graphs. However, graph data owners tend to outsource storage and computation tasks to the cloud due to limited computing and storage resources. In this case, it is critical to ensure the integrity of the query results, as the cloud may have an incentive to return tampered results to serve its own interests. Currently, blockchain systems can store data efficiently and securely, creating a decentralized, tamper-proof digital platform. This functionality positions blockchain as a crucial complement and enhancement to traditional cloud storage solutions. Mainstream blockchains use a hybrid storage system to improve scalability, storing small meta-data on-chain and outsourcing raw data off-chain. While cryptographic proofs protect data integrity for queries, current schemes only support key-value data. This paper pioneers the study of authenticated keyword searches on graphs in hybrid-storage blockchains. The key challenge is to design an authenticated data structure (ADS) based on the graph data that can efficiently deal with keyword search queries. We propose Merkle Path DAG (MP-DAG), a novel ADS that aggregates the unqualified paths that will not appear in the result trees to efficiently handle authenticated keyword search queries on graphs. Furthermore, to reduce the ADS storage cost, we design an optimization scheme MP-DAG* by combining the similar subgraphs of MP-DAG. Experimental results demonstrate the performance of the proposed ADS and optimization measure.
The rise of decentralized finance (DeFi), Web 3.0, and other blockchain-based applications has led to an increased demand for on-chain data analysis across multiple blockchains. Conducting advanced queries, such as data aggregation and correlation analysis, is essential for gaining valuable insights in this context. However, multi-chain queries pose several challenges for the querying system, including compatibility with existing blockchains, supporting diverse query types, and ensuring the integrity of query results. To tackle these challenges, we propose a novel paradigm called verifiable virtual filesystem (V2FS). V2FS extends the POSIX I/O interface, shifting the focus from verifying computation to verifying data. This innovative approach empowers query clients to leverage an off-the-shelf database engine to evaluate queries using verifiable data retrieved from an indexing service provider (ISP). Our solution ensures strong integrity guarantees and can be smoothly integrated with existing database engines to support various query types. To achieve blockchain compatibility, we utilize the DCert framework to certify blocks from different blockchains, making our system applicable to various blockchain systems. Furthermore, we propose cache-based algorithms and a bloom filter-integrated algorithm to optimize query performance and minimize network communication costs. Security analysis and empirical study validate the effectiveness and efficiency of the proposed system.
The metaverse, which amalgamates physical and virtual realms for diverse social activities, has been the focus of extensive application development by organizations, research institutes, and companies. However, these applications are often isolated, employing distinct authentication methods across platforms. Achieving interoperable authentication is crucial for when avatars traverse different metaverses to mitigate security concerns like impersonation, mutual authentication, replay, and server spoofing. To address these issues, we propose a blockchain-enabled secure and interoperable authentication scheme. This mechanism uniquely identifies users in the physical world as well as avatars, facilitating seamless navigation across verses. Our proposal is substantiated through informal security analyses, employing automated verification of internet security protocols and applications (AVISPA), the real-or-random (ROR) model, and Burrows–Abadi–Needham (BAN) logic and showcasing effectiveness against a broad spectrum of security threats. Comparative assessments against similar schemes demonstrate our solution’s superiority in terms of communication costs, computation costs, and security features. Consequently, our blockchain-enabled, interoperable, and secure authentication scheme stands as a robust solution for ensuring security in metaverse environments.
Long Shi, Taotao Wang, Zehui Xiong, Zhe Wang · 6 authors
As a shared and distributed database, blockchain empowers distributed edge computing (EC) networks with decentralization, integrity, and auditability of trust management. However, a bottleneck issue of blockchain-enabled decentralized trust management (B-DTM) lies in off-chain trust verification, since blockchain is a guarantee of on-chain trustworthiness rather than the reliability of off-chain trust. To orchestrate the off-chain and on-chain trust, we develop a novel B-DTM framework for EC networks that features off-chain trust verification and on-chain trust based consensus mechanisms. In the off-chain environment of EC, each edge node gains its verifiable trust according to Quality of Task Execution (QoTE). Furthermore, we justify that verified off-chain trust can be used as stake for the on-chain consensus. In particular, we design a novel consensus mechanism called Proof-of-Trusted-Work (PoTW), wherein the difficulty adjustable mining work and chain structure of trust data are introduced to promote the on-chain trust security and the trust based mining difficulty adjustment is employed to improve the on-chain trust update efficiency. Simulation results demonstrate the efficiency and security performances of the proposed B-DTM against various on-chain and off-chain malicious attacks.
Users have become accustomed to storing data on the cloud using ciphertext policy attribute-based encryption (CP-ABE) for fine-grained access control. However, this encryption method does not consider the ability of malicious users to launch thousands of file download requests when launching an economic denial of sustainability attack (EDoS), which may be more expensive for data owners. Existing solutions typically use a cloud server to verify the download permissions of the data users. However, cloud servers are not completely trusted and cloud server providers and colluding data users can still launch an EDoS attack. With our scheme, using CP-ABE, a blockchain is introduced for verifying the download permission of data users. In addition, we propose a new mechanism to solve the problem of malicious user revocations under EDoS attacks by updating the ciphertext and symmetric encryption technology. A formal security proof has demonstrated that the proposed scheme is suitable for plaintext attack security. Theoretical and experimental analyses show that our scheme performs more efficiently than previous methods.