In the Internet of Things (IoT) ecosystem, the volume of data generated by devices in the user’s environment is continually increasing and becoming of particular value. In such an environment the average user is bound to face considerable difficulties in understanding the size and scope of his/her collected data. However, the provisions of the European General Data Protection Regulation (GDPR) require data subjects to be able to control their personal data, be informed, and consent to its processing in an intelligible manner. This paper proposes ADVOCATE platform, a user-centric solution that allows data subjects to easily manage consents regarding access to their personal data in the IoT ecosystem. The proposed platform also assists data controllers to meet GDPR requirements, such as informing data subjects in a transparent and unambiguous manner about the data they will manage, the processing purposes, and periods. The integrity of personal data processing consents and the immutable versioning control of them are protected by a blockchain infrastructure. Finally, the paper provides a prototype implementation of the proposed platform that supports the main consents management functionality.
Rima Rana, Razieh Nokhbeh Zaeem, K. Suzanne Barber
Personally Identifiable Information (PII) is often used to perform authentication and acts as a gateway to personal and organizational information. One weak link in the architecture of identity management services is sufficient to cause exposure and risk identity. Recently, we have witnessed a shift in identity management solutions with the growth of blockchain. Blockchain—the decentralized ledger system—provides a unique answer addressing security and privacy with its embedded immutability. In a blockchain-based identity solution, the user is given the control of his/her identity by storing personal information on his/her device and having the choice of identity verification document used later to create blockchain attestations. Yet, the blockchain technology alone is not enough to produce a better identity solution. The user cannot make informed decisions as to which identity verification document to choose if he/she is not presented with tangible guidelines. In the absence of scientifically created practical guidelines, these solutions and the choices they offer may become overwhelming and even defeat the purpose of providing a more secure identity solution.
Sofia Terzi, Konstantinos Votis, Dimitrios Tzovaras, Ioannis Stamelos · 5 authors
The adoption of Information Communication Technologies (ICT) and Web 3.0 contributes to the e-government sector by transforming how public administrations provide advanced and innovative services to interact with citizens. Blockchain (BC) and Artificial Intelligence (AI) disruptive technologies will reshape how we live, work, and interact with government sectors and industries. This paper presents how Blockchain 3.0 and Artificial Intelligence enhance robust, secure, scalable, and authenticity provenance solutions. Two validation scenarios are analyzed to present how blockchain smart contracts and AI agents support energy and health-oriented e-government services.
Transparency in climate finance mechanisms, such as Reducing Emissions from Deforestation and Forest Degradation (REDD+), relies on the transfer of information within a complex global web of state and nonstate actors. Such information is required under internationally agreed REDD+ safeguards, including measurement, reporting and verification (MRV) processes and free, prior, and informed consent (FPIC), and works to establish substantive and normative transparency. However, the sources of, access to, and outcomes from these information flows are still contentious. To address these problems, REDD+ project proponents are increasingly looking to information and communication technologies, such as mobile devices, to improve information gathering, processing, and access. In this article we develop a model and provide tentative examples of how normative and substantive transparency are connected through input and output legitimacy within broader governance contexts. We highlight that even though mobile devices are being used to bring forest communities into the REDD+ process, substantive transparency for emissions reductions through MRV tends to be prioritized over normative dimensions associated with FPIC. We conclude by highlighting the need to further understand the role of decentralized information flows in multilevel carbon governance and opportunities for how mobile technologies may be used to address transparency challenges in the governance of REDD+.
Privacy, Security, and Data Protection
Conservation, Biodiversity, and Resource Management
Erasmus Mundus Joint International Doctoral Fellow in Law, Science and Technology, European Union, O.I. Konashevych
The use of blockchain technology, in particular, data insertion (anchoring, hashing) in the blockchain as a way of signing documents or imparting legal properties to facts is researched. A comparative analysis of the known methods of using electronic digital signature with the method of inserting data into the blockchain is carried out. The following issues were addressed. What is the data insertion in the blockchain and what properties do the data acquire? What is the difference between insertion, anchoring, and hashing on the blockchain? What is the difference between blockchain hashing and a digital signature on a document? Will the document be legally binding if it is anchored in the blockchain? What conditions must be met to give legal force for the document? How can anchoring be used to sign contracts, certify evidence that has legal value, denote time stamps, confirm authorship and copyrights, as well as transfer them, issue, and transfer power of attorney and delegate other rights, issue and transfer bearer instruments?
Chinnapong Angsuchotmetee, Pisal Setthawong, Sapjarern Udomviriyalanon
Voting is an essential activity in the modern democracy. To facilitate the voting process, there are several attempts on proposing an electronic voting system such that, the voting and tallying processes can be done efficiently and the results would be accountable to the public. To date, however, an online electronic voting system has been rarely adopted in practice due to the possibility of having the voting result tampered through vote-rigging or cyber-attacking. In 2009, the blockchain algorithm was proposed by Satoshi Nakamoto. Blockchain is a technique for recording transactions between self-auditing ledgers in an open, distributed, permanent, and verifiable manner. Even though blockchain was originally designed for a financial applications, it is possible to apply blockchain to other domains, including in the implementation of an online decentralized-based electronic voting system. In this study, the architecture of a blockchain-based electronic voting system, named \textit{BlockVOTE}, is proposed. The architecture design and all related formal definitions are given. To validate the proposal, two BlockVOTE prototypes were implemented using two different blockchain application frameworks. The performance analysis of both versions of the prototypes are given. The analysis of both technical and management aspects on the possibility of adopting the proposed decentralized voting system in an actual voting scenario is also given at the end of this study.
Zhengwei Ren, Xianye Zha, Kai Zhang, Jing Liu · 5 authors
A number of solutions have been proposed to tackle the user privacy-preserving issue. Most of existing schemes, however, focus on methodology and techniques from the perspective of data processing. In this paper, we propose a lightweight privacy-preserving scheme for user identity from the perspective of data user and applied cryptography. The basic idea is to break the association relationships between User identity and his behaviors and ensure that User can access data or services as usual while the real identity will not be revealed. To this end, an interactive zero-knowledge proof protocol of identity is executed between CSP and User. Besides, a trusted third-party is introduced to manage user information, help CSP to validate User identity and establish secure channel between CSP and User via random shared key. After passing identity validation, User can log into cloud platform as usual without changing existing business process using random temporary account and password generated by CSP and sent to User by the secure channel which can further obscure the association relationships between identity and behaviors. Formal security analysis and theoretic and experimental evaluations are conducted, showing that the proposal is efficient and practical.
Healthcare networking and computing infrastructure is rapidly changing from closed environments to open environments that incorporate ubiquitous medical devices and novel application scenarios. For example, home-based healthcare involves the collection and analysis of data from pervasive sensors (often in real time) to guide therapy or to perform medical interventions. In this article, we address the challenges of data interoperability and regulatory compliance when designing and deploying healthcare applications in a heterogeneous home-edge-cloud environment. We propose the ChainSDI framework that leverages the blockchain technique along with abundant edge computing resources to manage secure data sharing and computing on sensitive patient data. We implement programmable ChainSDI application programming interfaces to facilitate the specification of home-based healthcare services running on a software-defined infrastructure (SDI). This article is a collaboration between computer scientists, medical researchers, healthcare IT professionals as well as healthcare providers with the goal of increasing the availability of SDI infrastructures while meeting the performance and regulatory requirements of healthcare applications. Our prototype demonstrates the feasibility of the framework and serves as a testbed for novel experimental studies in the context of emerging healthcare applications.
Ajay Kumar Shrestha, Ralph Deters, Julita Vassileva
The tremendous technological advancement in the last few decades has brought many enterprises to collaborate in a better way while making intelligent decisions. The use of Information Technology tools in obtaining data of people's everyday life from various autonomous data sources allowing unrestricted access to user data has emerged as an important practical issue and has given rise to legal implications. Various innovative models for data sharing and management have privacy and centrality issues. To alleviate these limitations, we have incorporated blockchain in user modeling. In this paper, we constructed a decentralized data sharing architecture with MultiChain blockchain in the travel domain, which is also applicable to other similar domains including education, health, and sports. Businesses that operate in the tourism industries including travel and tour agencies, hotels and resorts, shopping malls are connected to the MultiChain and they share their user profile data via stream in the MultiChain. The paper presents the hotel booking service for an imaginary hotel as one of the enterprise nodes, which collects user profile data with proper validation and will allow users to decide which of their data to be shared thus ensuring user control over their data and the preservation of privacy. The data from the repository is converted into an open data format while sharing via stream in the blockchain so that other enterprise nodes, after receiving the data, can easily convert them and store into their own repositories. The paper presents an evaluation of the performance of the model by measuring the latency and memory consumption with three test scenarios that mostly affect the user experience. The node responded quickly in all of these cases.
Yue Zhang, Jian Weng, Jiasi Weng, Ming Li · 5 authors
With the popularity of Blockchain comes grave security-related concerns. Achieving privacy and traceability simultaneously remains an open question. Efforts have been made to address the issues, while they may subject to specific scenarios. This paper studies how to provide a more general solution for this open question. Concretely, we propose Onionchain, featuring a suite of protocols, offering both traceability and privacy. As the term implies, our Onionchain is inspired by Onion routing. We investigate the principles of Onion routing carefully and integrate its mechanism together with Blockchain technology. We advocate the Blockchain community to adopt Onionchain with the regards of privacy and traceability. To this end, a case-study of Onionchain, which runs in the context of Vehicular Ad Hoc Networks (VANETs), is proposed, providing the community a guideline to follow. Systematic security analysis and extensive experiments are also conducted to validate our secure and cost-effective Onionchain.
Robert Muth, Kerstin Eisenhut, Jochen Rabe, Florian Tschorsch
Urban development processes often suffer from mistrust amongst different stakeholder groups. The lack of transparency within complex and long-term planning processes and the limited scope for co-creation and joint decision-making constitute a persistent problem for successful participation in urban planning. Civic technology has the potential to improve this predicament. With BBBlockchain, we propose a blockchain-based participation platform, which is able to address all layers of participation. In the development of the platform, we focus on two key aspects: How to increase transparency and how to introduce enhanced co-decision-making. To this end, we exploit the immutable nature of blockchains and effectively offer a platform that excludes monopolistic control over information. The decision-making process is governed by smart contracts implementing, for example, timestamping of planning documents, opinion polls, and the management of a participatory budget. Our architecture and prototypes show the operational capabilities of this approach in a series of use cases for urban development.
Recently, due to the popularity of Bitcoin, interest in the blockchain which is the core technology of Bitcoin, has also increased. Blockchain is a distributed ledger technology that stores transaction information that occurs in P2P(Peer-to-Peer) networks on the ledger of all nodes in a different way than centralized method and verifies whether they are stored correctly. As a result of blockchain technology, not only Bitcoin but also various cryptocurrencies such as Ethereum, Litecoin, Ripple and Bitcoin Cash are being developed. Blockchain is used in various fields because of its features such as integrity and anonymity, but it is also used for illegal transactions and drug transactions. To solve these problems, monitoring system is needed to collect data from blockchain networks and detect abuse and illegal transactions. In this paper, we propose monitoring system for detecting and tracking illegal transactions by collecting and analyzing information in a blockchain network. In addition, we introduce an efficient storage system implemented by Apache Kafka and Apache Storm among the Blockchain monitoring systems.
Social network advertising is currently one of the most effective advertising types available to promote a product or a brand. The problem discussed in this paper concerns the possibility to ensure that advertising reaches really interested users, and also to prove this. At this aim, we propose the use of Blockchain to store users' interest and to obtain an assertion that a user is interested in a product before the advertising is shown. The proposal has been implemented by a Solidity smart contract in Ethereum and has been shown to be effective and cheap.
New currencies designed for user anonymity and privacy – widely referred to as “privacy coins” – have forced governments to listen and legislate, but the political motivations of these currencies are not well understood. Following the growing interest of political brands in different contexts, we provide the first systematic review of political motivations expressed in cryptocurrency whitepapers whose explicit goal is “privacy.” Many privacy coins deliberately position themselves as alternative political brands. Although cryptocurrencies are often closely associated with political philosophies that aim to diminish or subvert the power of governments and banks, advocates of privacy occupy much broader ideological ground. We present thematic trends within the privacy coin literature and identify epistemic and ethical tensions present within the communities of people calling for the adoption of entirely private currencies.
Domenico Rotondi, Marco Saltarella, Gaetano Giordano, Francesco Pellecchia
Abstract Compliance of distributed ledger technology (DLT) based solutions with the European Union General Data Protection Regulation (EU GDPR) is currently a hot topic both from a technical point of view, as well as from a legal and normative one. Flexible working is a new working model where employees can perform their work activity without specific time and space constraints. In this context privacy and information trustworthiness are relevant and, therefore, on the one hand it can gain benefit from using DLT based solutions, on the other hand it must comply with the GDPR. This paper describes a solution that combines DLTs and the new Ciphertext‐Policy Attribute Based Encryption cryptographic techniques to support compliance with the EU GDPR in the context of flexible working. The devised solution is being concretely experimented, in the context of the EU H2020 CITADEL project, by the Municipality of Bari (Italy).
Matthew Johnson, Michael N. Jones, Mark Shervey, Joel T. Dudley · 5 authors
Decentralized apps (DApps) are computer programs that run on a distributed computing system, such as a blockchain network. Unlike the client-server architecture that powers most internet apps, DApps that are integrated with a blockchain network can execute app logic that is guaranteed to be transparent, verifiable, and immutable. This new paradigm has a number of unique properties that are attractive to the biomedical and health care communities. However, instructional resources are scarcely available for biomedical software developers to begin building DApps on a blockchain. Such apps require new ways of thinking about how to build, maintain, and deploy software. This tutorial serves as a complete working prototype of a DApp, motivated by a real use case in biomedical research requiring data privacy. We describe the architecture of a DApp, the implementation details of a smart contract, a sample iPhone operating system (iOS) DApp that interacts with the smart contract, and the development tools and libraries necessary to get started. The code necessary to recreate the app is publicly available.
Loïc Lesavre, Priam Varin, Peter Mell, Michael L. Davidson · 5 authors
Identity management systems (IDMSs) are widely used to provision user identities while managing authentication, authorization, and data sharing within organizations and on the web. Traditional identity systems typically suffer from single points of failure, lack of interoperability, and privacy issues, such as enabling mass data collection and user tracking. Blockchain technology has the potential to alleviate these concerns: it can support the ability for users to control the custody of their own identifiers and credentials, enabling novel data ownership and governance models with built-in control and consent mechanisms. Hence, blockchain-based IDMSs, which could benefit both users and businesses, are beginning to proliferate. This work categorizes these systems into a taxonomy based on differences in blockchain architectures, governance models, and other salient features. Context is provided for the taxonomy through the description of related terms, emerging standards, and use cases while highlighting relevant security and privacy considerations.
Blockchain and the European General Data Protection Regulation (GDPR) are two topics that are currently highly discussed in academia and amongst professionals. The Blockchain technology is claimed to revolutionize how business is being conducted by its way of storing data and sharing it with others. The recently introduced GDPR has a huge impact on processing personal data because it brought major changes to privacy regulation. This might also affect the processing of personal data in Blockchain-based application scenarios. Based on literature analysis, the paper at hand provides an overview of the Blockchain technology, presents a decision model, and introduces two possible Blockchain application scenarios. It analyses relevant requirements of the GDPR in view of processing personal data and compares these with the fundamental principles of the Blockchain technology. The paper concludes that processing personal data in the Blockchain is violating the GDPR because it conflicts with fundamental specification of this regulation. This finding reveals the need for further research to propose concepts and frameworks for a GDPR-compliant processing of personal data using Blockchain technology.
Identity management (IdM) is a method used to determine user identities. The centralized aspect of IdM introduces a serious concern with the growing value of personal information, as well as with the General Data Protection Regulation (GDPR). The problem with currently-deployed systems and their dominating approach, with identity providers (IdP) and single-point services, is that a third party is in charge of maintaining and controlling the personal data. The main challenge to manage data securely lies in trusting humans and institutes who are responsible for controlling the entire activity. Identities are not owned by the rightful owners or the user him/herself, but by the mentioned providers. With the rise of blockchain technology, self-sovereign identities are in place utilizing decentralization; unfortunately, the flaws still exist. In this research, we propose DNS-IdM, a smart contract-based identity management system that enables users to maintain their identities associated with certain attributes, accomplishing the self-sovereign concept. DNS-IdM has promising outcomes in terms of security and privacy. Due to the decentralized nature, DNS-IdM is able to avoid not only the conventional security threats, but also the limitations of the current decentralized identity management systems.
Data privacy has been an important issue, especially over the last few years. Ethereum and other blockchains have had an ongoing problem with the lack of privacy. The European Union (EU) approved a law in 2016, the General Data Protection Regulation (GDPR), that is currently enforceable. It is considered to be one massive step towards protecting and preserving user privacy. Not only does it affect companies with offices in the EU but also organizations throughout the world that have users from the EU. Further, it mandates key obligations for organizations handling user data, in addition to introducing new rights for individuals - for instance, the right to erasure represents a challenge to the immutable nature of a blockchain.