After the European Union's new General Data Protection Regulation (GDPR) became applicable in May 2018, concerns about the legal compliance of public blockchain systems with rights guaranteed by GDPR have emerged, e.g., on the "right to be forgotten". In order to better understand how the blockchain sector sees the challenges raised by GDPR and how such their communications could influence their users, this paper reports our data-driven analysis of GDPR-related public online communications of blockchain developers and service providers. Our analysis covers 314 public blockchain systems, and two different online communication channels: legal documents in-cluding privacy policies, T&C (Terms and Conditions) documents and other similar legal documents published on systems' official websites and public tweets of their official Twitter accounts. Our analysis revealed that only a minority (86/314 ≈ 27.5%) of the investigated blockchain systems had covered GDPR at least once using one or both communication channels. Among the 86 systems, only 27 systems (8.6%) had at least one legal document that actually talks about GDPR for the corresponding blockchain system. We noticed a systematic lack of detail about why and how the GDPR compliance issue was addressed, and most systems made questionable statements about GDPR compliance. The results are surprising considering that the GDPR was enacted in 2016 and has been in effect since May 2018.
In recent years, cryptocurrencies have increasingly gained interest. The underlying technology, Blockchain, shifts the responsibility for securing assets to the end-user and requires them to manage their (private) keys. Little attention has been given to how cryptocurrency users handle the challenges of key management in practice and how they select the tools to do so. To close this gap, we conducted semi-structured interviews (N=10). Our thematic analysis revealed prominent themes surrounding motivation, risk assessment, and coin management tool usage in practice. We found that the choice of tools is driven by how users assess and balance the key risks that can lead to loss: the risk of (1) human error, (2) betrayal, and (3) malicious attacks. We derive a model, explaining how risk assessment and intended usage drive the decision which tools to use. Our work is complemented by discussing design implications for building systems for the crypto economy.
Activity-tracking applications and location-based services using short-range communication (SRC) techniques have been abruptly demanded in the COVID-19 pandemic, especially for automated contact tracing. The attention from both public and policy keeps raising on related practical problems, including \textit{1) how to protect data security and location privacy? 2) how to efficiently and dynamically deploy SRC Internet of Thing (IoT) witnesses to monitor large areas?} To answer these questions, in this paper, we propose a decentralized and permissionless blockchain protocol, named \textit{Bychain}. Specifically, 1) a privacy-preserving SRC protocol for activity-tracking and corresponding generalized block structure is developed, by connecting an interactive zero-knowledge proof protocol and the key escrow mechanism. As a result, connections between personal identity and the ownership of on-chain location information are decoupled. Meanwhile, the owner of the on-chain location data can still claim its ownership without revealing the private key to anyone else. 2) An artificial potential field-based incentive allocation mechanism is proposed to incentivize IoT witnesses to pursue the maximum monitoring coverage deployment. We implemented and evaluated the proposed blockchain protocol in the real-world using the Bluetooth 5.0. The storage, CPU utilization, power consumption, time delay, and security of each procedure and performance of activities are analyzed. The experiment and security analysis is shown to provide a real-world performance evaluation.
The unprecedented growth of the smart home industry brings increasing amount of IoT devices into people's home. The transmission of data and execution of commands across connected network were meant to bring security, comfort and accessibility. However, the inter-connectivity and complexity of smart home systems leads to higher vulnerability to cyberattacks, network congestion and information leaks. In this paper, we first analyze the limitations of existing centralized approaches. Then we propose a blockchain-enabled solution to help build a secure smart home system. We demonstrate the design architecture and implementation methods as a proof of concept. We believe that the proposed blockchain-enabled solution can improve security while offering intelligent control of smart home systems.
In today's digital world, information is exchanged between systems and it is expected that each interaction / transaction between the systems is secure and reliable. Block chain technology can be applied to protect the security of healthcare data. It is important to have access control mechanism that allows only authorized persons to share the medical data. In this work, we introduce a blockchain based system for securely sharing health records. The system includes a smart contract based data protection and accessibility mechanism.
Blockchain secures a variety of IoT circumstance, when information or system validation information is placed on a blockchain, personal data might be spilled through the affirmation of working system. This paper observes a Zero-Knowledge proof for an awesome meter framework to illustrate the effectiveness of uncovered information as an instance. This research work has pondered a way to enhance the obscurity of blockchain for safety insurance. [2] In addition to that, device Near-field communication (NFC) generation is used as a mobile platform application. The fundamental idea of this research is to provide a secure service to a consumer through mobile application using the near field communication card and Zero knowledge authentication system.
The Bisq DAO is a core component of Bisq, a decentralized cryptocurrency exchange. The purpose of the Bisq DAO is to decentralize the governance and finance functions of the exchange. However, by interacting with the Bisq DAO, participants necessarily publish data to the Bitcoin blockchain and broadcast additional data to the Bisq peer-to-peer network. We examine the privacy cost to participants in sharing this data. Specifically, we use a novel address clustering heuristic to construct the one-to-many mappings from participants to addresses on the Bitcoin blockchain and augment the address clusters with data stored within the Bisq peer-to-peer network. We show that this technique aggregates activity performed by each participant: trading, voting, transfers, etc. We identify instances where participants are operating under multiple aliases, some of which are real-world names. We identify the dominant transactors and their role in a two-sided market. We conclude with suggestions to better protect the privacy of participants in the future.
Nowadays, data is an extremely important asset. Governments around the world encourage big data sharing and trading to flourish the big data economics. However, existing data trading platforms are not fully trusted. Data providers lack control over data trading rights. Meanwhile, the data price model needs further justification. These issues hinder the development of big data trading. In this paper, we propose a blockchain-based decentralized data trading platform, on which data providers can better control data trading. Accordingly, we design smart contracts for distributed data trading and set rules to assign data rewards in trading. The contract guarantees the efficiency of data matching and fair reward distribution. We also adopt proxy re-encryption to ensure the security of data transmission. We verify the security, availability, and efficiency of the proposed big data trading platform.
Blockchain is a revolutionary technology that enables the secure recording and storage of transactions without the need for a trusted third-party intermediary. This distributed ledger technology has the potential to mainstream entirely new, decentralized business models where determining the operation of a blockchain-based product or service is decided democratically among the systems users. Because of the way that it works, blockchain presents a significant challenge for the European Union’s General Data Protection Regulation (GDPR). The GDPR is the leading privacy law in the world, serving as a template for privacy laws in many countries and affecting a vast number of multinational organizations. Blockchain, unfortunately, fits rather poorly in the GDPR’s regulatory framework. This is primarily because the legislation makes the assumption that the entities that define the means and purpose of processing users’ personal data, that is, the Data Controllers, are readily identifiable and remain constant. In blockchains with decentralized data governance, where a user’s role can vary over time, this assumption is often false. Several commissions in the European Union have tried to tackle the conundrum of how to fit blockchain into the GDPR’s framework, but the analysis and recommendations of these bodies has failed to adequately resolve the conflicts. This Article is the first to provide an overview of blockchain technology that distinguishes between the variety of centralized and decentralized data governance models. To bring about the truly revolutionary applications of blockchain while ensuring adequate individual personal data protections, this Article proposes that the European Union eliminate untenable GDPR data controller obligations for blockchains with decentralized data governance models.
Location-based services (LBS) bring convenience to people's lives but are also accompanied with privacy leakages. To protect the privacy of LBS users, many location privacy protection algorithms were proposed. However, these algorithms often have difficulty to maintain a balance between service quality and user privacy. In this paper, we first overview the shortcomings of the existing two privacy protection architectures and privacy protection technologies, then we propose a location privacy protection method based on blockchain. Our method satisfies the principle of k-anonymity privacy protection and does not need the help of trusted third-party anonymizing servers. The combination of multiple private blockchains can disperse the user's transaction records, which can provide users with stronger location privacy protection and will not reduce the quality of service. We also propose a reward mechanism to encourage user participation. Finally, we implement our approach in the Remix blockchain to show the efficiency, which further indicates the potential application prospect for the distributed network environment.
Due to the increase of cybercrime and security risks in computer networks as well as violations of user privacy, it is essential to upgrade the existing protection models and provide practical solutions to meet these challenges. An example of these risks is the presence of a third party between users and various services, which leads to the collection and control of large amounts of users' personal information and the possibility of their databases being misused or hacked. Blockchain technology and encrypted currencies have so far shown that a decentralized network of peer-to-peer users, along with a general ledger, can do reliable computing. So, in this article, we are going to introduce a protocol that converts the blockchain network to an automated access control manager without the presence of a third party. To this end, we designed a mutual authentication protocol to create a secure channel between the user and the service and then demonstrate its accuracy and completeness using the Gong-Nidham-Yahalom belief logic The results of our evaluations show that our proposed protocol is secure enough to be used on the blockchain network and attackers are unable to penetrate, track, impersonate, inject, misrepresent or distort information using the common attacks.
E-voting reduced the cost of election and provided convenience to some extent as compared to the traditional approach of pen and paper but it was considered to be unreliable as anyone having access to the machine physically can obstruct the machine and alter the votes. Also in order to control the e
Open access
Internet Traffic Analysis and Secure E-voting
Privacy, Security, and Data Protection
Advanced Steganography and Watermarking Techniques
The European General Data Protection Regulation (GDPR) has had a far-reaching impact on data privacy and compliance for cloud providers. GDPR influences access to, storage, processing and transmission of personal data, requiring these operations to be verified by a cloud user through explicit consent prior to execution. GDPR rules implemented for such operations can be ambiguous and often open to interpretation, making manual verification a time consuming and error prone process for cloud providers. An encoding of GDPR rules is described, with each operation carried out using these rules recorded into a Blockchain for auditing purposes. Specifically, this work shows how some GDPR rules can appear asopcodesin smart contracts to verify the operations of providers on user data in a transparent and automatic way. An abstract model is designed to demonstrate how cloud providers can access and deploy such smart contracts through a Blockchain-based virtual machine. A case study is used to demonstrate how this approach can be used in practice. The case study uses a collection of design patterns and smart contracts to verify provider operations, includingread,write,executionandtransferon user data. Validation is undertaken by deploying the smart contracts in a Blockchain test network to investigate the execution costs of GDPR compliance checking.
Mobile crowdsensing (MCS) is an emerging data acquisition technique that combines crowdsourcing with mobile devices to collect massive data in a cost-satisfactory manner. Two notable challenges of MCS are leakage of privacy and the challenge of malicious users, privacy-preserving reputation management scheme is an efficient method to tackle these challenges. However, most existing schemes rely on a semi-honest server and process data in plaintext domain without considering single point of failure and privacy of participants. In this paper we propose a reputation management scheme with blockchain to identify malicious users and protect users’ privacy simultaneously in MCS scenario. The secure and open nature of blockchain are exploited to build a dependable and efficient reputation management platform. Moreover, we adopt a distributed computing algorithm, Eigentrust, to construct a distributed reputation management framework, nevertheless, it neglects to preserve users’ privacy. So we leverage a verifiable secret sharing scheme into Eigentrust algorithm, which can prevent users’ personal information from being disclosed. The extensive analysis and experiments performed on EOS blockchain demonstrate that our system can effectively identify malicious users while preserving privacy.
Dynamic Access Control in IoT (Internet of Things) through monitoring user behavior is a procedure that defines access control theory. Usually, an institution provides services to a user who owns a specific role that was issued by another institution. Such access control methods are possible in man-to-man communications only, but not in computer networks, because it is hard to establish security and limit spiteful actions through the users with high-risk values. High-risk values are caused by the users who do the tasks which they are not intended to do. In this paper, we bring forward a technique to limit malicious activities by monitoring user behavior using smart contracts. This proposed technique uses blockchain based technology and smart contracts for trust and the confirmation of user's possession. We described the substructure, containing two main parts: smart contract and an authentication arrangement protocol.
Ethereum is the largest public blockchain by usage. It applies an account-based model, which is inferior to Bitcoin's unspent transaction output model from a privacy perspective. Due to its privacy shortcomings, recently several privacy-enhancing overlays have been deployed on Ethereum, such as non-custodial, trustless coin mixers and confidential transactions. In our privacy analysis of Ethereum's account-based model, we describe several patterns that characterize only a limited set of users and successfully apply these quasi-identifiers in address deanonymization tasks. Using Ethereum Name Service identifiers as ground truth information, we quantitatively compare algorithms in recent branch of machine learning, the so-called graph representation learning, as well as time-of-day activity and transaction fee based user profiling techniques. As an application, we rigorously assess the privacy guarantees of the Tornado Cash coin mixer by discovering strong heuristics to link the mixing parties. To the best of our knowledge, we are the first to propose and implement Ethereum user profiling techniques based on quasi-identifiers. Finally, we describe a malicious value-fingerprinting attack, a variant of the Danaan-gift attack, applicable for the confidential transaction overlays on Ethereum. By incorporating user activity statistics from our data set, we estimate the success probability of such an attack.
Paulo Sergio Rangel Garcia, João Henrique Kleinschmidt
Increased longevity and people's concern about aging with quality has led to increased health and wellness data. Much of the data is not interoperable because of its divergent structures and semantics, being little used and little protected. Existing standards are complex and lack the adherence of the agents involved to ensure their application. Blockchain technology offers alternatives to unify the standards and their application by consensus algorithm, which considers the validation and secrecy in the insertion of the blocks of transactions in the chain. However, smart contracts can ensure secrecy and the rules of data sharing in blocks in the chain. In this paper, we propose a blockchain architecture with a consensus algorithm that considers data collected in the health and wellness ecosystem, including those obtained by IoT devices and persisted in middleware platforms. It is intended that this architecture be able to answer the questions and establish the concepts for the full and secure sharing of health and wellness data.
Purpose This study takes an affordance approach to explain how users perceive the affordance of user action within blockchain and examines how it influences the subsequent user experience. Focusing on the effect of trust on cognitive processes, the authors analyze how affordances in blockchains affect the user experience. Design/methodology/approach The blockchain affordances are examined through a two-stage process. The authors employ a qualitative analysis based on insights gained from the current literature and interviews. The authors then apply a quantitative survey to examine the role of trust in interactions with blockchain services. A structural user model was tested in which their appreciation of affordances of blockchain predicted the trust and satisfaction. Findings Users' appreciation for transparency and reliability explained to what extent they trust and are satisfied, thereby suggesting the heuristic roles of trust in blockchains. The study findings indicate a heuristic role for trust regarding underlying links to technological and affective affordances. A user's cognitive heuristics affect their attitudes toward blockchain, in which technological features are processed through users' perceptions and experience. Research limitations/implications The model contributes to the conceptualization of security, privacy and traceability along with trust, which is then linked to transparency and reliability. The findings show how the frame of affordances gains explanatory power by being linked to the concepts of affect and emotion. The heuristics of direct perception of security–traceability–privacy (STP) can be used to understand the trajectory of heuristics and ongoing choices of blockchain. Practical implications The study results offer a lens through which to address the technology's most common problems by pairing user experience principles and heuristics to blockchain technologies. This study offers insights into the understanding of user actions related to blockchains and into practical implications for developing trust-based services. The results guide the application and tailoring of motivational affordances in blockchain. Originality/value While blockchain technology has gained popularity and momentum, there has been little research on how specific features of blockchain technology create value. This study contributes to the research gap by highlighting the role and dimension of trust in relation to STP in blockchains and provides meaningful implications for theory and practice.
E-voting is one of the valid use cases of blockchain technology with many blockchain e-voting systems already proposed. But efforts that focus on critical analysis of blockchain e-voting architectures for national elections from stakeholders’ perspectives are mostly lacking in the literature. Therefore, government decision-makers and election stakeholders do not yet have a sufficient basis to understand the potential risks, challenges, and prospects that are associated with blockchain e-voting. This paper demonstrates how the use of the Architecture Trade-off Analysis Method (ATAM) can enable stakeholders in national elections to understand the risks, prospects, and challenges that could be associated with a blockchain e-voting system for national elections. By using a study context of South Africa, a proposed blockchain e-voting architecture was used as a basis to aid election stakeholders to reason on the concept of blockchain e-voting to get them to understand the potential risks, security threats, critical requirements attributes, and weaknesses that could be associated with using blockchain e-voting for national elections. The study found that blockchain e-voting can prevent many security attacks, internal vote manipulation, and promote transparency. However, voter validation and the security of the blockchain architecture are potential weaknesses that will need significant attention.
In order to contain the COVID-19 pandemic, several countries enforced extended social distancing measures for several weeks, effectively pausing the majority of economic activities. In an effort to resume economic activity safely, several Digital Contact Tracing applications and protocols have been introduced with success. However, DCT is a reactive method, as it aims to break existing chains of disease transmission in a population. Therefore DCT is not suitable for proactively preventing the spread of a disease; an approach that relevant to certain use cases, such as international tourism, where individuals travel across borders. In this work, we first identify the limitations characterising DCT related to privacy issues, unwillingness of the public to use DCT mobile apps due to privacy concerns, lack of interoperability among different DCT applications and protocols, and the assumption that there is limited, local mobility in the population. We then discuss the concept of a Health Passport as a means of verifying that individuals are disease risk-free and how it could be used to resume the international tourism sector. Following, we present the DHP Framework that uses a private blockchain and Proof of Authority for issuing Digital Health Passports. The framework provides a distributed infrastructure supporting the issuance of DHPs by foreign health systems and their verification by relevant stakeholders, such as airline companies and border control authorities. We discuss the attributes of the system in terms of its usability and performance, security and privacy. Finally, we conclude by identifying future extensions of our work on formal security and privacy properties that need to be rigorously guaranteed via appropriate security protocols.
Yi Liu, Jialiang Peng, Jiawen Kang, Abdullah M. Iliyasu · 6 authors
Federated learning (FL) has recently been proposed as an emerging paradigm to build machine learning models using distributed training datasets that are locally stored and maintained on different devices in 5G networks while providing privacy preservation for participants. In FL, the central aggregator accumulates local updates uploaded by participants to update a global model. However, there are two critical security threats: poisoning and membership inference attacks. These attacks may be carried out by malicious or unreliable participants, resulting in the construction failure of global models or privacy leakage of FL models. Therefore, it is crucial for FL to develop security means of defense. In this article, we propose a blockchain-based secure FL framework to create smart contracts and prevent malicious or unreliable participants from being involved in FL. In doing so, the central aggregator recognizes malicious and unreliable participants by automatically executing smart contracts to defend against poisoning attacks. Further, we use local differential privacy techniques to prevent membership inference attacks. Numerical results suggest that the proposed framework can effectively deter poisoning and membership inference attacks, thereby improving the security of FL in 5G networks.