New digital technologies generate large amounts of information. This data is processed by Service Providers in order to improve and develop new services or products, but also to fund themselves. However, processing these personal data can result in the extraction of sensitive information. In consequence, it can lead to users' privacy risk. To mitigate this risk, the EU elaborated the GDPR. It forces Service Providers to have Data Subjects' explicit consent for collecting and processing their personal data. The problem is that legislative text does not define how to transparently demonstrate that they already have this consent. Also, most users do not know the rights they have over their personal data, neither this regulation provides techniques for them to be aware about what happens with it. In this paper, we propose a lightweight blockchain-based GDPR-compliant personal data management platform. It provides public access to immutable evidences that show the agreements between the Data Subjects and Service Providers. The Service Providers can demonstrate that they are fulfilling the regulation, and Data Subjects are aware about what happens with their personal data and can manage it according to their rights.
Sheikh Mohammad Idrees, Mariusz Nowostawski, Roshan Jameel
The COVID-19 pandemic has caused substantial global disturbance by affecting more than 42 million people (as of the end of October 2020). Since there is no medication or vaccine available, the only way to combat it is to minimize transmission. Digital contact tracing is an effective technique that can be utilized for this purpose, as it eliminates the manual contact tracing process and could help in identifying and isolating affected people. However, users are reluctant to share their location and contact details due to concerns related to the privacy and security of their personal information, which affects its implementation and extensive adoption. Blockchain technology has been applied in various domains and has been proven to be an effective approach for handling data transactions securely, which makes it an ideal choice for digital contact tracing apps. The properties of blockchain such as time stamping and immutability of data may facilitate the retrieval of accurate information on the trail of the virus in a transparent manner, while data encryption assures the integrity of the information being provided. Furthermore, the anonymity of the user's identity alleviates some of the risks related to privacy and confidentiality concerns. In this paper, we provide readers with a detailed discussion on the digital contact tracing mechanism and outline the apps developed so far to combat the COVID-19 pandemic. Moreover, we present the possible risks, issues, and challenges associated with the available contact tracing apps and analyze how the adoption of a blockchain-based decentralized network for handling the app could provide users with privacy-preserving contact tracing without compromising performance and efficiency.
The Internet of Things (IoT) is expected to improve the individuals’ quality of life. However, ensuring security and privacy in the IoT context is a non-trivial task due to the low capability of these connected devices. Generally, the IoT device management is based on a centralized entity that validates communication and connection rights. Therefore, this centralized entity can be considered as a single point of failure. Yet, in the case of distributed approaches, it is difficult to delegate the right validation to IoT devices themselves in untrustworthy IoT environments. Fortunately, the blockchain may provide decentralization of overcoming the trust problem while designing a privacy-preserving system. To this end, we propose a novel privacy-preserving IoT device management framework based on the blockchain technology. In the proposed system, the IoT devices are controlled by several smart contracts that validate the connection rights according to the privacy permission settings predefined by the data owners and the stored record array of detected misbehavior of each IoT device. In fact, smart contracts can immediately detect the devices that have vulnerabilities and have been hacked or pose a threat to the IoT network. Therefore, the data owner’s privacy is preserved by enforcing the control over the own devices. For validation purposes, we deploy the proposed solution on a private Ethereum blockchain and give the performance evaluation.
With the development of ICT technology, users are actively participated in content creation and sharing. Service providers have provided more diverse and extensive information services. With the recent evolution to a customized service, the demand for the use of personal information is increasing. However, it affects the efficiency and convenience of service provision, as social problems and security threats such as personal information leakage, human trafficking, and misuse increase. In this article, we proposed an intelligent mediator-based enhanced smart contract for privacy protection. The proposed approach performs the tasks, which are mediation transactions, authorization, and transaction record management, with blockchain-based personal information management. Then it is possible to prevent misuse of personal information and to support rational decision-making on the transparency of information and the use of personal information by autonomously performing personal information management.
Today, developing technology is one of the most effective tools to make our lives easier. One of these developing technologies is blockchain that enables securely transferring digital assets between peers without requiring a trusted third party. In particular, blockchain poses new opportunities to effectively satisfy transparency, verifiability and anonymity for e-voting schemes. Based on recent proposals, it can be easily seen that applicability of blockchain technology for e-voting systems is actively researched. In this paper, we first summarized the set of e-voting requirements based on studies by Popoveniuc et al., Fujioka et al., Cranor et al., Benaloh et al., Juels et al. and etinkaya et al. In the light of these studies and requirement set, we analyzed recently proposed blockchain-based e-voting systems. As a result of these analyzes, one can determine that a mature blockchain based e-voting system that can meet all criteria has not been proposed yet. Particularly, we show that either the proposed schemes misses the basic requirements or does not fulfill these while claiming otherwise. Additionally, by simulating a large-scale election, we show that time complexity of e-voting schemes utilizing cryptocurrency blockchain such Bitcoin or Ethereum is impractical. Besides, we also emphasize new risks of utilizing public cryptocurrency blockchains for e-voting schemes. Accordingly, the readiness of blockchain-based e-voting has been discussed, from which it can be deduced that it would be more advantageous to research for e-voting specific blockchain technologies instead of utilizing existing cryptocurrency blockchains.
The principle of data protection by design, as it is enshrined in article 25 of the GDPR, is difficult to apply in blockchains. This article will assess how the reliance on asymmetric encryption and other privacy enhancing technological architectures -necessary in a blockchainbased system-approach both user control and data protection by design compliance from the single scope of anonymization and unlinkability. Data subjects' rights, accountability, and the potential shortcomings of applied technological constraints are thus sidelined. Ultimately, this limited understanding of technological privacy, acts as a misguiding set of principles for technological co-regulation through standardisation in blockchains. The standardization of these choices without a holistic analysis of data protection by design imperatives could ultimately weaken the position of data subjects, whose trust in the technological protections of personal data might prove to be relatively misplaced.
This proposes a distributed solution based on blockchain technology for trusted Health Information Exchange (HIE). In addition to exchange of EHR between patient and doctor, the proposed system is also used in other aspects of healthcare such as improving the insurance claim and making data available for research organizations. Medical data is very sensitive, in both social as well as legal aspects, so permissioned block-chain such as Hyperledger Fabric is used to retain the necessary privacy required in the proposed system.
With the rapid growth of Internet of Things (IoT), it can be foreseen that IoT services will be influencing several use-cases. IoT brings along the security and privacy issues that may hinder its wide scale adoption. The scenarios in IoT applications are quite dynamic as compared to the traditional internet. It is vital that only authenticated and authorised users get access to the services provided. Hence, there is a need for a novel authentication and access control technique that is compatible and practically applicable in diverse IoT scenarios to provide adequate security to devices and data communicated. This article aims to highlight the potential of blockchain for enhanced and secured authentication and access control in IoT. The proposed method relies on blockchain technology, which tends to eliminate the limitations of intermediaries for authentication and access control. As compared to existing systems, it has advantages of decentralisation, secured authentication, authorisation, adaptability, and scalability.
Public blockchains have reached high popularity among technically inclined people, laypersons and researchers alike. Similarly, privacy has gained much attention in the same circles. This attention and high sensitivity of information transmitted in blockchains, lead more and more blockchain-based systems, especially cryptocurrencies, to provide privacy for their users. Popular approaches include ring signatures or zero-knowledge proofs to achieve unlinkable payments within the blockchain. However, these systems solely examine privacy by considering the blockchain and its embedded transactions. The underlying peer-to-peer network of a public blockchain is rarely considered. This leaves the dissemination of transactions open for privacy attacks, as the IP address of the originator of a transaction can be mapped to their real-world identity. In this thesis, we look into the important privacy aspects of broadcasting blockchain transactions. We collect and analyse data of a large blockchain network and construct a privacy-preserving latency estimator. Building on the insights gained from the analysis, we combine dining-cryptographers networks with a secret sharing technique and layer a flood-and-prune broadcast on top, to provide enforced k-anonymity to network participants. To increase the flexibility of this approach, we extend two established privacy protocols. First, we extend a dining-cryptographers based group messaging protocol to transmit arbitrary length messages. Further, we optimize the protocol for common cases, to improve its performance for various environments, especially blockchain transaction dissemination. As a performant intermediate privacy layer, we transform adaptive diffusion from a contact graph protocol to a computer network protocol. We achieve this by changing the underlying network assumptions and the attacker model. We derive optimal forwarding probabilities based on a statistical network model of unstructured peer-to-peer networks. These two sub-protocols are combined in an intertwined layering approach to create 3P3, a flexible privacy-preserving broadcast protocol. Lastly, to manage the groups required for 3P3 and other proposed and common protocols, we propose Pixy. Pixy is a privacy increasing group creation scheme, allowing for filtering and testing of group participants to establish trust. The system allows for smaller group sizes while maintaining privacy guarantees of previous systems, or better privacy for same-sized groups. The software, concepts, data and models in this thesis help researchers and developers of privacy preserving network protocols. Developers can use 3P3, tuning its parameters to the needs of their network. Researchers can build on the data, concepts and models to create novel schemes and generalizations of our insights. This improves privacy for all users of modern and future networks.
Mohammad Hossin shafiabadi, Mohammad Hossin shafiabadi
The purpose of the present research was to introduce a blockchain-based voting system so that any state, including totalitarian states, can show interest in using it. In this method, a hybrid voting system with two centralized and distributed systems was used. Its centralized system is one of the most common voter identification and polling models, and its distributed system, which is designed with Ethereum public blockchain, is voting for voters. Totalitarian states are not interested in announcing the results online. Also, the lack of trust in E-voting systems by both states and voters has led to E-voting in important political elections in most states as support for manual or paper voting. Based on the results of field research with this voting system, it was possible to create a 7 min break between the end of the voting process and the announcement of the results for political considerations. This break can be increased by agreement. The results of the votes cannot be manipulated in any way. Survey results should also be communicated to voters before the voting process. This voting system can improve the level of democracy and maximum participation. It is hoped that the spread of distributed technologies, especially the blockchain, will pave the way for the spread of justice and democracy around the world.
A blockchain is a class of technology that allows the creation and management of \ndifferent forms of decentralised and distributed digital ledgers where data are stored, \nchronologically recorded, transferred and finally shared between the ‘nodes’ participating in \na peer-to-peer network. These features prima facie clash with the GDPR that informs the EU \ndata protection legislation and is based on a centralised representation of the reality in which \ndata are processed, collected, and recorded in a database controlled by identified subjects. \nThe underpinning idea of this article is diametrically opposed to the one which considers the \ntechnology not GDPR-compliant by default. First, the author argues that the points of tension \ncan be mitigated by technical and/or governance methods, thus acting at both application and \ninfrastructure level. In essence, a case-by-case analysis is the only feasible option to assess the \ncompliance between the regulation and the technology. Second, a further and closer look at \nblockchain’s underlying concepts reveals how both the GDPR and the blockchain have the \nsame purposes but different approaches. More interestingly, the article suggests that the \nblockchain could be seen as a Privacy Enhancing Technology (PET), which might help data \nsubjects gain more control over their personal data and hence support one of the GDPR’s \npurposes (recital 7).