assword has been the major vulnerability and challenge in cloud computing environment due to adversarial threat sources. Zero-Knowledge Proof (ZKP) becomes the excellent optional strategy and current anticipation for Cloud Data security and assurance as it gives the server zero knowledge of passwords. However, the VERIFIER, despite having no knowledge of the password must verify that the password entered by the PROVER is correct. A major challenge that occurs is when the user disremembers the password, the cloud environment becomes inaccessible and the cloud service provider has no any replica of the password as a backup. Eavesdropping/snooping is a major threat which provides full access to the cloud environment. Adding Time-based One-time Password (TOTP) will be an elucidation to password delinquency as it expires after a certain splits of seconds or minutes which would render the password unserviceable to the snooped. This research examined cloud services in relation to the security challenges faced by organizations and proposed the hybridization of the Zero-Knowledge Proof and Time- Based One-Time Password algorithms for a better security of the cloud environment.
Data in healthcare domain is highly sensitive in nature. Besides, there is need for maintaining integrity of such data. Blockchain technology has emerged to solve the problem of data integrity and non-repudiation with immutable storage in distributed repository. Thus secure data storage and retrieval in cloud environments is made possible using blockchain implementation. There are many existing healthcare systems with blockchain integration found in the literature. However, there is need for a system that supports complete set of operations that are governed by smart contracts. Another important consideration is that end users should be able to operate healthcare system without the need for knowledge of blockchain technology. Towards this end, in this paper, we proposed a Blockchain based secure healthcare data storage and retrieval system known as HealthBlock for cloud computing environments. We defined smart contract with underlying structures and functions using Solidity language for Ethereum blockchain platform. We also proposed and implemented an algorithm known as Healthcare Transactions over Blockchain (HToB). This algorithm supports secure blockchain based data storage and retrieval governed by smart contracts. Our system is evaluated using user-friendly web based client application. The experimental results showed that our system is able to ensure data integrity and non-repudiation besides reaping all benefits of blockchain technology.
In recent years, blockchain technology has been widely applied in the Internet of Things (IoT) field, where devices located in different blockchains need to interact with each other cross-chain. Existing cross-chain models have high-implementation complexity, long response times, and are difficult to apply in IoT scenarios. In this article, we propose keyword-based embedded smart contract cross-chain interoperability and collaboration model. This model identifies the status of smart contracts through the keywords of smart contracts, completes cross-chain operations, and achieves smart contract collaboration and asset exchange among devices in different blockchains. To find matching collaborative contracts, contract-specific keywords will be set, including asset amounts and types. In the cross-chain asset exchange scenario of the model, the assets sent by the sender are frozen in the contract. When the contract is successfully executed, the assets will be sent to the receiver, otherwise returned to the sender. In the cross-chain contract collaboration scenario, we identify the number of contract interactions, and when the contract collaboration is completed, the data will be retained, otherwise it will be invalidated. We also use an embedded smart contract method to further optimize IoT application scenarios. This method embeds the steps of deploying smart contracts into the invoked transaction, enabling the deployment and invocation of smart contracts through a single transaction. The experiments show that the keyword-based embedded contract method is 47% faster and 49% less costly compared to notary schemes solutions in cross-chain scenarios.
Sogolsadat Mansouri, Vodelina Samatova, Nodirbek Korchiev, Kemafor Anyanwu
Blockchains are distributed ledger platforms that were originally envisioned for implementing digital assets and cryptocurrencies such as BITCOIN. Mainstream blockchain platforms such as Ethereumand Hyperledgersupport both "native" transactional behavior i.e., transferring cryptocurrency assets, as well as, other types of transactional behavior relevant to an emerging class of applications called decentralized applications or DApps. However, "non-native" transactional behavior is achieved in terms of user-defined programs, commonly referred to as smart contracts. Unfortunately, smart contracts have several known limitations, including the burden on both implementor and contract consumers, being prone to financially-costly errors, higher cost of execution, and overall difficulty with concurrency optimization. Further, there is a lack of standardization with respect to implementation. Consequently, this contributes to the difficulty of enabling interoperability across blockchains. In this paper, we propose an ontology DeMaTO for modeling transactional behavior on blockchains as a foundation for extending blockchain transaction primitives. As an application context, we focus on marketplace transactions because marketplaces are one of the most popular categories of DApps, i.e., decentralized marketplaces. This modeling of transactional behavior complements the modeling supported by existing ontologies that focus on the infrastructure layer. We illustrate how DeMaTO can be used in blockchain transaction modeling and its value with respect to blockchain queryability and transaction validation.
Zengpeng Li, Mei Wang, Teik Guan Tan, Jianying Zhou
A trustworthy source of randomness is a crucial component of many decentralized and crypto-based application systems, especially blockchain consensus. A decentralized random beacon (DRB) periodically outputs a new source of randomness generated using a distributed technique, such as publicly verifiable secret sharing (PVSS) or distributed verifiable random functions (VRFs). These protocols offer a variety of efficiency versus randomness quality tradeoffs, but guarantee security under a variety of configurations, assumptions, and adversarial models. This article aims to provide a future-proof unbiased decentralized randomness (abbreviated as Funder) via a post-quantum threshold VRF for sustainable proof-of-stake blockchain. We also provide a generic compiler for achieving post-quantum VRF from a classical VRF solution, but our approach makes use of symmetric-key primitives Our novel compiler is validated and evaluated using the ZKBoo and ZKB++ quantum-secure zero-knowledge systems, respectively. The implementation of the proof-of-concept demonstrates that the overheads introduced by our solution are acceptable for real-world deployments even in the present day. In addition, we demonstrate the protocol’s possible application in lottery-based proof-of-stake consensus protocols.
The confidentiality, integrity, and availability triad is a fundamental principle for information security. The objective of this chapter is to examine this triad where blockchain technology can be applied to enhance security in cloud computing. The current pasture of cloud security is explored to identify the gaps and approaches for using blockchain technology to reduce those gaps are discussed in this chapter. Blockchain technology is well-recognized for its ability to ensure data integrity. The largest gap that can be reduced is in this area. With the decentralized and distributed architecture of blockchain, there are ways to leverage it to improve the availability of cloud security. Confidentiality, where encryption plays a significant role, has the least gap in cloud computing; however, since the responsibility for assuring confidentiality is on the user, blockchain offers alternative and additional strengths. This chapter also covers a detailed discussion of avoiding prevalent security threats by implementing blockchain technology in cloud computing for making it more secure.
Verifiable Credential (VC) is a new standard proposed by the W3C association to facilitate the expression and verification of third-party-verified credentials on the Internet, such as passports or diplomas. However, the current VC data model lacks an explicit revocation design that guarantees the secure operations of the system, which limits its application. In this paper, we specify the requirements for a tamper-evident and privacy-preserving revocation mechanism, based on which we compare existing solutions and propose our revocation mechanism that satisfies all the requirements. Our design combines a cryptographic accumulator and a role-based blockchain. With zero-knowledge proof, the verifier can operate off-chain computation of the revocation status while ensuring the correctness of revocation information published on the blockchain. Our analysis shows that the proposed revocation mechanism can prevent fraud using forged and revoked credentials and relieve privacy concerns caused by the correlation of digital data. Our proof-of-concept implementation demonstrates that our revocation mechanism adds only 42.86 ms overhead in the presentation and 31.36 ms overhead in the verification of verifiable credentials. We also provide scalability analysis, which illustrates that the throughput of our blockchain can meet real-world needs.
Blockchain has emerged as a prevailing paradigm for decentralized applications due to its reliability and transparency. To scale up retrieval services, a common strategy is to use a hybrid storage model, where on-chain storage is responsible for small metadata and off-chain storage is for outsourced raw data. However, data security and result authenticity are ongoing challenges in this scenario, and little work has been done due to the difficulty of combining result verification and privacy preservation, especially for dynamic updates while supporting forward privacy. In this paper, we formally define the problem of efficient, verifiable, and secure conjunctive keyword search in hybrid-storage blockchains (vsChain) and propose a novel hybrid index that achieves efficient query and verification while supporting dynamic updates with forward privacy guarantee. We also design two optimized schemes to improve query and verification performance by using a partition-based method and an obfuscated counting Bloom filter mechanism. Finally, we provide a theoretical security analysis and empirical evaluations using real and synthetic datasets to demonstrate the feasibility of our proposed schemes.
The use of IoT technology in collecting personal health records (PHR) within the eHealth environment is a growing trend. However, data integrity is a concern as cloud service providers (CSPs) often cannot guarantee it. Blockchain technology offers a solution to guarantee data integrity and traceability. However, the immutability of traditional blockchain conflicts with GDPR's requirements. To address scalability and privacy concerns, we have designed a comprehensive scheme that integrates the redactable blockchain with the existing revocable IPFS mechanism. Our scheme overcomes the disadvantage of residual downloading information in the traditional blockchain. Additionally, we have developed an enhanced proxy re-encryption scheme that simplifies access control for physicians without the need for complex group key management. Unlike traditional blockchains and P2P file sharing systems, our PHR platform allows for selective removal of records and files while maintaining auditable logs. Evaluation results demonstrate that our proposed scheme effectively enhances the exclusive revocation feature with acceptable overheads. To the best of our knowledge, this is the first work to provide the merit of fully complete record and file revocation on a blockchain-based system.
Rafiqullah, Amjad Mehmood, Muhammad Altaf Khan, Carsten Maple · 5 authors
The growing deployment of Industrial Internet of Things (IIoTs) raises significant authentication concerns, especially in scenarios where resource-constrained devices need to delegate tasks with more powerful entities. This critical factor affects the information exchange during the delegation process between the Original User (OU) and the Proxy Signer (PS). The process of delegation communication entails the transfer of signing authority from a delegator to a PS. It enables the proxy signer to sign messages on behalf of delegator. As a result, complexity is increased significantly to enhance both the security and efficiency of communication overhead. To address these challenges in a transparent way, this article proposed and explores the utilization of Zero-Knowledge Proofs (ZKPs) as an additional authentication step in certificateless proxy signature mechanism. Whereas, for security hardness, Hyperelliptic Curve (HEC) is being amalgamated using ‘Schnorr signature’. Performance analysis depicts that the proposed approach exhibits not only minimized communication overhead but also provides optimal security as compared to existing approaches.
With the ongoing advancement and widespread adoption of blockchain technology, Ethereum has established itself as the foremost platform for executing smart contracts.As a focal point of the industry, the security and stability of the Ethereum ecosystem have become crucial. Ethereum Improvement Proposals (EIPs) play a vital role in promoting the technological progress of Ethereum and providing direction for innovation in the blockchain field. ERCs, as a type of EIP, define application-level standards and conventions that are crucial for promoting innovation and ensuring the scalability and maintainability of the system. In particular, some ERCs, such as the ERC-20 token standard, have become the foundation of the Ethereum ecosystem. However, if EIPs have security issues, any security vulnerabilities or design flaws can have severe consequences, including financial losses, data leaks, and damage to the reputation of the entire Ethereum network. This paper primarily focuses on the security analysis of application standard proposals (ERC). We conducted research on the current state of EIP security, performed case studies, and provided security recommendations. The goal is to gain a comprehensive understanding of the security features and potential risks of these proposals, and to propose practical solutions to enhance the security of EIPs.
Blockchain technology realizes information traceability by constructing chain network structure; Through distributed storage and consensus mechanism, each transaction can be verified and shared. Hyperledger Fabric has the characteristics of deep encryption, convenient expansion, flexible deployment and pluggability, and provides a modular distributed ledger platform for the needs of different applications. Combining the blockchain technology with the storage and sharing requirements of railway engineering data and drawing information, this paper first introduces the related concepts of blockchain technology, Hyperledger Fabric and critical algorithms and puts forward a Coverage Tag Validation (CTV) for the storage of railway engineering data and drawing information, which can improve the query efficiency and optimize the results, and provide some reference for future research.
Blockchain, as an emerging technology, is constantly evolving due to its remarkable advantages but is also subject to its unalterability, which leads to the misuse of blockchain storage and causes adverse effects. Hence, the redactable blockchain was proposed, which can alleviate the above issues in a controlled manner. However, a situation exists in which the modifiers specified by customized identities or attributes in the existing schemes may be malicious, which can easily lead to malicious modification events. Evaluating, filtering, and limiting malicious modifiers in advance may be a feasible solution to the situation. Hence, we propose an efficient dynamic trust-based redactable blockchain supporting update and traceability, which offers full-process security with pre-modification pre-evaluation, modification privilege restrictions, and post-modification traceability. Firstly, we consider the user’s various behaviors and multiple factors and customize a dynamic trust evaluation model for redactable blockchain to comprehensively evaluate the reliability of the user. Then, we combine the user’s trust worthiness, dynamic proactive secret sharing($\mathcal {DPSS}$), chameleon hash($\mathcal {CH}$), and digital signature ($\mathcal {DS}$) to design a dynamic trust-based chameleon hash supporting update and traceability, called$\mathcal {DTCH}$, to realize full-process security, and prove its security. Thirdly, we construct the$\mathcal {DTCH}$-based redactable blockchain supporting update and traceability, demonstrate its security and further apply it to consortium blockchain. Finally, we evaluate the performance of the constructed model and scheme, and the evaluation results illuminate that they are not only effective but also possess better performance.
Blockchain is a decentralized and tamper-proof distributed ledger technology. The consensus algorithm is one of the key technologies underlying blockchain. The Proof of Stake (PoS) consensus mechanism determines the next block producer on the blockchain based on the user's staked equity. Compared to Proof of Work (PoW), the Proof of Stake consensus mechanism solves the problem of wasted resources. However, the PoS consensus mechanism faces serious issues such as the coin age accumulation attack and the zero-cost benefit problem. Therefore, this paper proposes a Trust-Based Proof of Stake (TPoS) mechanism based on dynamic trustworthiness. TPoS divides nodes in the network into miner nodes and basic equity representative (shareholder) nodes, and assigns corresponding trustworthiness to nodes based on their participation in creating blocks. Shareholder nodes sign blocks and assign them trustworthiness, and finally compete for the weight of trustworthiness obtained by blocks to go on the chain. In addition, this paper analyzes the attack cost and system response to bribery attacks and common equity accumulation attacks. The results of simulation experiments show that the TPoS mechanism has significant advantages over traditional Proof of Stake mechanisms in dealing with bribery attacks and equity accumulation attacks.
The integration of directed acyclic graph (DAG) blockchain and mobile edge computing (MEC) has emerged as a promising means to enable computation-intensive, delay-sensitive, and secure task execution in Internet of Things (IoT) applications. However, off-chain task execution results are not credible even if the results have been recorded on the chain, since blockchain cannot extend the trust of on-chain data to off-chain. To make the off-chain and on-chain trust consistent, we first develop a trusted MEC (T-MEC) framework by employing a DAG blockchain-aided decentralized trust management (DAG-DTM) mechanism. Specifically, DAG-DTM evaluates the off-chain trust of edge nodes according to the quality of task execution results, and the trust can be further verified off the chain by any edge node under the same trust management rule. Moreover, the approval time for recording the execution result of the edge node on the chain is positively correlated with the verified off-chain trust, which can further promote on-chain transaction security of trusted edge node. Second, we jointly optimize the bandwidth and computation resource allocation to minimize the system latency that consists of off-chain task execution delay and on-chain transaction confirmation delay. Numerical results compare system latency and security performance between the optimized T-MEC and the benchmark schemes. In particular, the optimized T-MEC can achieve a 33.12% gain of computation delay and a 10.19% gain of system latency at an affordable cost of transaction confirmation delay (i.e., 3.21%) over T-MEC, while meeting the requirements of off-chain task execution latency and on-chain transaction security simultaneously.
Blockchain technology has gained significant popularity in recent years, with its ability to create secure, transparent and decentralized systems. React.js is a popular frontend development library, known for its performance and reusability. There are several common ways to create front-end dApps on blockchain networks, including using libraries such as Web3.js, web3-react, and ThirdWeb framework (later ThirdWeb). There are also several ways to create a complex dApp like NFT Marketplace, and the methods of architecture creating and implementing further projects have their own nuances and limitations that have to be discussed in this article.
Many institutions and organizations require nostrification and verification of qualification as a prerequisite for hiring. The idea is to recognize the authenticity of a copy or digital document issued by an institution in a foreign country and detect forgeries. Certificates, financial records, health records, official papers and others are often required to be attested from multiple entities in distinct locations. However, in this digital era where most applications happen online, and document copies are uploaded, the traditional signature and seal methods are obsolete. In a matter of minutes and with a simple photo editor, a certificate or document copy may be plagiarized or forged. Blockchain technology offers a decentralized approach to record and verify transactions without the need for huge infrastructure investment. In this paper, we propose a blockchain based nostrification system, where awarding institutions generate a digital certificate, store in a public but permissioned blockchain, where students and other stakeholders may verify. We present a thorough discussion and formal evaluation of the proposed system.
Although employing blockchain in supply chain management (SCM) can provide benefits in numerous aspects such as traceability, transparency, and more, using public blockchain for SCM may compromise the privacy of the supply chain participants and their business secrets. In this paper, we review recent papers that integrate blockchain with SCM and the papers that propose privacy-preserving approaches for public blockchain. Then, we identify the problem in the existing solutions. Additionally, we present an outline of a framework that enables entities in a supply chain to upload their data records anonymously. This framework preserves unlinkability when transferring product ownership. The proposed scheme allows data auditors, who can be the end customers of a supply chain, to access a product's history and verify the authenticity of the data while preserving the privacy of the data uploader. We demonstrate that supply chain data records follow a directed acyclic graph (DAG), similar to the data structure that maintains data records in version control systems (VCS). Hence, this insight could make the framework applicable for anonymous version control systems based on blockchain.
Dae-Geun Yoon, SungJin Mun, Kisung Park, Sungkee Noh
With the onset of the AI era, the demand for personal data is on the rise. Numerous companies are gathering user data to enhance their services. As the utilization of this personal data surges, its intrinsic value also escalates. Despite individuals being the source of this valuable personal data, it's the centralized service providers that reap the profits. This research introduces a blockchain-based trading framework for personal data utilizing Decentralized Identifiers (DID) Non-Fungible Token (NFT). The proposed system empowers users to amass personal data within their designated storage space provided by the system. DID and NFT serve the roles of verifying user identity and establishing data ownership, respectively, all without relying on centralized systems. To guarantee data integrity and transaction history, Ethereum is employed, which constitutes a decentralized blockchain nodes. The operational demonstration of our system is showcased through a monitoring setup that offers real-time insights into user data and trading activities. The research validates that our proposed system enables seamless personal data transactions between two parties - a seller and a buyer - eliminating the need for centralized service providers.
While blockchain is a secure and tamper-proof registry, it is not well-suited for storing large amounts of data due to its limited storage capacity and high cost. Additionally, storing data on a blockchain can lead to scalability issues and slow down the network. Therefore, it is generally not recommended to store large amounts of data on a blockchain. This paper proposes a solution to transmit data to smart contracts without compromising security with a single point of failure, using a bounty hunting mechanism to ensure fair concurrency between oracles retrieving data on an IPFS database. The proposed solution has been implemented as a prototype and its feasibility has been demonstrated through experiments.
In the healthcare system, electronic medical records are very critical, and they must be authenticated and verified. During the medical check-up, a large amount of patient medical data is generated which includes reports related to blood, life-threatening diseases, and personal information such as credit card numbers and addresses. Any privacy breach in patient medical records will bring various risks. A simple blockchain (Ethereum) can be effective to validate and authenticate stored data by deploying an immutable ledger. However, the main challenge in the simple blockchain is that its data can be easily accessible. In this paper, the authors create a business network for healthcare using Hyperledger fabric, which ensures that data is only available to the concerned person and its access rights are granted and revoked by the concerned participant. Additionally, the authors tested different scenarios to access blockchain security and its benefits.
Qingyang Zhang, Zhiming Zhang, Jie Cui, Hong Zhong · 7 authors
As the disruptor of cloud storage, decentralized storage could lead to a major shift in how organizations store data in the future. To ensure data availability, users generally encrypt the data and distribute it to multiple storage service providers. It is necessary to study data integrity verification in decentralized storage. Although some recent studies have proposed the using blockchain technology to assist auditing work in decentralized storage networks, the on-chain overhead still increases linearly with an increase in audit requests. Blockchain networks will inevitably be overloaded. In this study, we propose an efficient data integrity auditing scheme for multiple copies in decentralized storage. Particularly, using different polynomial commitment schemes, we first propose a basic scheme for verifying multiple copies of a single file, and then we propose an efficient batch auditing scheme for multiple copies of multiple files. Our scheme can significantly reduce the computation overhead of storage service providers while keeping the on-chain storage overhead constant. Security analysis and performance analysis show that our scheme is efficient and practical.