Francesco Buccafurri, Vincenzo De Angelis, Roberto Nardone
The Internet of Things is constantly capturing interest from modern applications, changing our everyday life and empowering industrial applications. Interaction and the collaboration among smart devices offer new challenges to security since they conflict with economic and energy consumption requirement constraints. On the other hand, the lack of security measures could negatively impact the concrete adoption of this paradigm. This paper focuses on the Message Queuing Telemetry Transport (MQTT) protocol, widely adopted in the Internet of Things. This protocol does not implement natively secure authentication mechanisms, which are demanded to developers. Hence, this paper proposes a novel OTP (one-time password)-authentication schema for MQTT, which uses the Ethereum blockchain to implement a second-factor out-of-band channel. The proposal enables the authentication of both local and remote devices preserving user privacy and guaranteeing trust and accountability via Ethereum smart contracts.
In the modern financial sector, interest in providing financial services that employ blockchain technology has increased. Blockchain technology is efficient and can operate without a trusted party to store all transaction information; additionally, it provides transparency and prevents the tampering of transaction information. However, new security threats can occur because blockchain technology shares all the transaction information. Furthermore, studies have reported that the private keys of users who use the same signature value two or more times can be recovered. Because private keys of blockchain identify users, private key leaks can result in attackers stealing the ownership rights to users' property. Therefore, as more financial services use blockchain technology, actions to counteract the threat of private key recovery must be continually investigated. Private key recovery studies are presented here. Based on these studies, duplicated signatures generated by blockchain users are defined. Additionally, scenarios that generate and use duplicated signatures are applied in an actual bitcoin environment to demonstrate that actual bitcoin users' private keys can be recovered.
Hanumantharaju R, K. N. Shreenath, K. G. Srinivasa, Swetha Namburu
Mobile edge computing is a recent trend to complement the Internet of Things (IoT) ecosystem in the computing sector. IoT is the internet connected communications related to physical devices and everyday objects. The emergence of intelligent living spaces has been due to the rapid development of IoT technologies. Blockchain is one such technology that expands the list of information also referred to like records that are saved as blocks in the Blockchain which are connected using cryptographic algorithms. Within a Blockchain IoT environment, when data or device authentication information is stored in a Blockchain, authentication information can be displayed when verifying Block chain’s transactions, which are also referred to as proof of work. A principle of Zero-knowledge proof (ZKF) is implemented in this paper which is a way of proving that knowledge is known without exposing any data to the user. The proposed model uses a Mobile application where users can prove without revealing users' passwords. Blockchain stores client information that can prevent data from being manipulated. The results of applying the ZKF theory for data security are shown through a web application and NFC.
Oscar Delgado-Mohatar, Julián Fiérrez, Rubén Tolosana, Rubén Vera-Rodríguez
Blockchain technologies provide excellent architectures and practical tools for securing and managing the sensitive and private data stored in biometric templates, but at a cost. We discuss opportunities and challenges in the integration of blockchain and biometrics, with emphasis in biometric template storage and protection, a key problem in biometrics still largely unsolved. Key tradeoffs involved in that integration, namely, latency, processing time, economic cost, and biometric performance are experimentally studied through the implementation of a smart contract on the Ethereum blockchain platform, which is publicly available in github for research purposes.
Industrial Internet of Things (IIoT) is considered as one of the most promising revolutionary technologies to prompt smart manufacturing and increase productivity. With manufacturing being more complicated and sophisticated, an entire manufacturing process usually involves several different administrative IoT domains (e.g., factories). Devices from different domains collaborate on the same task, which raises great security and privacy concerns about device-to-device communications. Existing authentication approaches may result in heavy key management overhead or rely on a trusted third party. Thus, security and privacy issues during communication remain unsolved but imperative. In this paper, we present an efficient block-chain-assisted secure device authentication mechanism BASA for cross-domain IIoT. Specifically, consortium blockchain is introduced to construct trust among different domains. Identity-based signature (IBS) is exploited during the authentication process. To preserve the privacy of devices, we design an identity management mechanism, which can realize that devices being authenticated remain anonymous. Besides, session keys between two parties are negotiated, which can secure the subsequent communications. Extensive experiments have been conducted to show the effectiveness and efficiency of the proposed mechanism.
Christoph Stach, Clémentine Gritti, Dennis Przytarski, Bernhard Mitschang
A large number of food scandals (e. g., falsely declared meat or non-compliance with hygiene regulations) are causing considerable concern to consumers. Although Internet of Things (IoT) technologies are used in the food industry to monitor production (e. g., for tracing the origin of meat or monitoring cold chains), the gathered data are not used to provide full transparency to the consumer. To achieve this, however, three aspects must be considered: a) The origin of the data must be verifiable, i. e., it must be ensured that the data originate from calibrated sensors. b) The data must be stored tamper-resistant, immutable, and open to all consumers. c) Despite this openness, the privacy of affected data subjects (e. g., the carriers) must still be protected. To this end, we introduce the SHEEPDOG architecture that “shepherds” products from production to purchase to enable a trustworthy, secure, and privacy-aware food monitoring. In SHEEPDOG, attribute-based credentials ensure trustworthy data acquisition, blockchain technologies provide secure data storage, and fine-grained access control enables privacy-aware data provision.
Battery-powered mobile devices are convenient to use anywhere and anytime. Nowadays maximum people using the mobile device, such as Smartphone, Tablet computers to use mobile services anytime and anywhere. Moreover, most of the Smartphone having wireless communication like Wi-Fi and 4G. For some applications, the requirement of computing power may be very high, but the actual configuration of mobile devices are very limited, such as CPU, memory, storage, and battery. Among these computational resources, bandwidth and battery are the most significant problems for Smartphone. Efficient Computational Offloading is the best solution for extending the usage of Smartphone by executing the resource-intensive task to offload from mobile to the remote cloud servers can extend processing capability and support for multiple categories of application. However, this technique is having difficulty in offloading the process to a remote cloud server without the proven security of entity verification. To deal with these challenges, here we are proposing new security protocol to authenticate mobile and cloud server with zero knowledge proof of authentication to verify the communication entities and recommends to offload the service. The proposed protocol will get verify by the University of Oxford developed verification tool Scyther.
Smart contracts are the triggered self executing contracts which are termed and conditioned among the trusted parties. Being independent of trusted third party, smart contract rely on blockchain and the underlying consensus submitted by participants for the security. Hyper ledger fabric provides peer-to-peer-network based distributed operating environment. This scenario highlights the need of identification of peer, more precisely on the `who the user is' rather than `what does the user possess'. This paper proposes an architecture of the integration of multimodal biometric authentication system incorporation with the permissioned blockchain based smart contract. Every peer has to be authenticated before getting involved in smart contract. Paper also informs about the surveyed ways of multimodal recognition which ensures the major concern of various applications like insurance settlement, market predictions and internet on things, etc. i.e. liveliness detection.
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Md. Abdur Rahman, Khalid Abualsaud, Stuart J. Barnes, Mamunur Rashid · 5 authors
In this paper, we propose a gesture-based secure interaction system with smart home IoT health devices to support elderly people or people with special needs. The framework uses a decentralized blockchain consensus for storing the smart home IoT health data and user identities. The framework leverages off-chain solution for storing raw multimedia IoT sensory payload and gesture data. Using our proposed health monitoring framework, a smart homeowner or service provider can create a cyber-physical space with a secure digital wallet for each human resident and authorized IoT health devices. Multiple authorized home residents can interact with the IoT-based smart home monitoring sensors, carry out user and IoT health sensory media registration, and transfer transactional values via secure tokens, as well as raw IoT health data payload through gesture. In this paper, we will present the design and implementation details of the smart home health monitoring framework in terms of gesture-based interaction with smart home IoT health devices, such as smart locks and light bulbs, which uses decentralized blockchain for security, trust, digital identity and privacy preservation.
Jehangir Arshad, Muhammad Abu Bakar Siddique, Zainab Zulfiqar, Amna Khokhar · 8 authors
Pakistan is an agricultural country and its economy is mainly dependent on agriculture. Agriculture provides large economic opportunities along with the yield of food and other raw materials in our life. To increase the yield of products there is a need for the deployment of modern technology. To tackle this problem, a private blockchain-based secure access control for agriculture can be employed to monitor the different climatic parameters such as (light, humidity, temperature, and, soil moisture, etc) in the fields. The environmental and climatic parameters are very important for the quantity, quality, efficient growth of the crops. Also, any kind of unwanted modification, interception, and expunction on these parameters can leave a bad impact on fields and crops. Therefore, privacy and security are key challenges while deploying the monitoring systems in the fields. In this regard, we have designed a novel remote user authentication scheme by using private blockchain-based secure access control for agriculture monitoring. The proposed scheme is authorized through private blockchain access control (PBAC) algorithms and is applied using hyper ledger cello tools. We customarily analyze the privacy and security of the scheme by using a random oracle model. Furthermore, the proposed protocol is secure and resist different sorts of malicious attacks. The proposed scheme is also suitable in a real-life application to avoid all kinds of security attacks.
Blockchain Technology Applications and Security
User Authentication and Security Systems
Advanced Steganography and Watermarking Techniques
IoT Devices have revolutionized how people interact with each other and their surroundings, with Gartner predicting 50 billion devices by 2020. IoT devices emerging from WSN to RFIDs are capable of sensing, actuating and sharing data but are resource-constrained devices meaning these devices have limited memory, storage, and computation power. Thus, IoT devices are incapable of securing themselves from various security and privacy threats. Moreover, current Cloud-IoT architectures are centralized; managed and controlled by Trusted Third parties also individuals have no control over their data. Fog-IoT integration has better latency, response time and is much secure compared to Cloud-IoT integration. Recently, Blockchain emerged as a decentralized, highly trusted and tamper-proof technology. In this paper, we proposed a blockchain-based scheme for secure User authentication access to Fog enabled IoT devices. The proposed scheme utilizes the Ethereum Smart Contract. We developed our smart contract using Solidity language with Remix-IDE and tested its functionalities on two test networks Test RPC (Ganache) and Rinkeby Test Network. We also analyzed security vulnerabilities of our smart contract on the ChainSecurity analyzing tool.
Abbas Yazdinejad, Gautam Srivastava, Reza M. Parizi, Ali Dehghantanha · 6 authors
In any interconnected healthcare system (e.g., those that are part of a smart city), interactions between patients, medical doctors, nurses and other healthcare practitioners need to be secure and efficient. For example, all members must be authenticated and securely interconnected to minimize security and privacy breaches from within a given network. However, introducing security and privacy-preserving solutions can also incur delays in processing and other related services, potentially threatening patients lives in critical situations. A considerable number of authentication and security systems presented in the literature are centralized, and frequently need to rely on some secure and trusted third-party entity to facilitate secure communications. This, in turn, increases the time required for authentication and decreases throughput due to known overhead, for patients and inter-hospital communications. In this paper, we propose a novel decentralized authentication of patients in a distributed hospital network, by leveraging blockchain. Our notion of a healthcare setting includes patients and allied health professionals (medical doctors, nurses, technicians, etc), and the health information of patients. Findings from our in-depth simulations demonstrate the potential utility of the proposed architecture. For example, it is shown that the proposed architecture's decentralized authentication among a distributed affiliated hospital network does not require re-authentication. This improvement will have a considerable impact on increasing throughput, reducing overhead, improving response time, and decreasing energy consumption in the network. We also provide a comparative analysis of our model in relation to a base model of the network without blockchain to show the overall effectiveness of our proposed solution.
Rafael Páez, Manuel Pérez, Gustavo Ramirez Espinosa, Juan Montes · 5 authors
This paper proposes an architecture for biometric electronic identification document (e-ID) system based on Blockchain for citizens identity verification in transactions corresponding to the notary, registration, tax declaration and payment, basic health services and registration of economic activities, among others. To validate the user authentication, a biometric e-ID system is used to avoid spoofing and related attacks. Also, to validate the document a digital certificate is used with the corresponding public and private key for each citizen by using a user’s PIN. The proposed transaction validation process was implemented on a Blockchain system in order to record and verify the transactions made by all citizens registered in the electoral census, which guarantees security, integrity, scalability, traceability, and no-ambiguity. Additionally, a Blockchain network architecture is presented in a distributed and decentralized way including all the nodes of the network, database and government entities such as national register and notary offices. The results of the application of a new consensus algorithm to our Blockchain network are also presented showing mining time, memory and CPU usage when the number of transactions scales up.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Existing implanted medical devices often do not use any form of authentication due to resource constraints, resulting in unauthorized access or programming of devices. In this paper, we introduce Medical Implant Consent (MedIC), a non-embedded, blockchain-based solution that provides authentication and authorization according to patient consent. We design protocols for doctors to obtain digital medical licenses and for patients to obtain and verify digital patient consent. We evaluate the performance and cost of our solution, using time measurements and memory footprint of relevant operations. We also enumerate our cryptographic operations and compute the energy with benchmarked measurements. Our results demonstrate a memory footprint of 4436 MB and timing delay of 200 ms to authenticate according to our patient’s consent.
In today’s fourth industrial revolution, various blockchain technologies are being actively researched. A blockchain is a peer-to-peer data-sharing structure lacking central control. If a user wishes to access stored data, she/he must employ a private key to prove ownership of the data and create a transaction. If the private key is lost, blockchain data cannot be accessed. To solve such a problem, public blockchain users can recover the key using a wallet program. However, key recovery in a permissioned blockchain (PBC) has been but little studied. The PBC server is Honest-but-Curious (HBC), and should not be able to learn anything of the user; the server should simply recover and store the key. The server must also be resistant to malicious attacks. Therefore, key recovery in a PBC must satisfy various security requirements. Here, we present a password-protected secret sharing (PPSS) key recovery system, protected by a secure password from a malicious key storage server of a PBC. We describe existing key recovery schemes and our PPSS scheme.