Wensheng Tian, Lianfu Zhang, Shuangxi Chen, Wang Hu · 5 authors
The two main types of blockchains that are currently widely deployed are public blockchains and permissioned blockchains. The research that has been conducted for blockchain vulnerability detection is mainly oriented to public blockchains. Less consideration is given to the unique requirements of the permissioned blockchains, which cannot be directly migrated to the application scenarios of the permissioned blockchains. The permissioned blockchain is deployed between verified organizations, and its smart contracts may contain sensitive information such as the transaction flow of the contracts, transaction algorithms, etc. The sensitive information can be considered as the private information of the smart contracts themselves, which should be kept confidential to users outside the blockchain. In this paper, a privacy-preserving smart contract vulnerability detection framework is proposed. The framework leverages blockchain and confidential computing technologies to enable vulnerability detection in permissioned blockchain smart contracts while protecting the privacy of smart contracts. The framework is also able to protect the interests of vulnerability detection model owners. We experimentally validate the detection performance of our framework in a confidential computing environment.
How can a model owner prove they trained their model according to the correct specification? More importantly, how can they do so while preserving the privacy of the underlying dataset and the final model? We study this problem and formulate the notion of zero-knowledge proof of training (zkPoT), which formalizes rigorous security guarantees that should be achieved by a privacy-preserving proof of training. While it is theoretically possible to design zkPoT for any model using generic zero-knowledge proof systems, this approach results in extremely unpractical proof generation times. Towards designing a practical solution, we propose the idea of combining techniques from MPC-in-the-head and zkSNARKs literature to strike an appropriate trade-off between proof size and proof computation time. We instantiate this idea and propose a concretely efficient, novel zkPoT protocol for logistic regression.
Rofaida Khemaissia, Makhlouf Derdour, Mohamed Amine Ferrag, Mohammed Mounir Bouhamed
The main goal of a Data Service Composition is combining multiple data services to provide for a user’s query a new service which uses data from multiple service providers that are incorporated in the composition. In this situation, the data privacy and especially of the service providers can be breached when their critical data can be seen by another party. Therefore, keeping the data privacy during the composition process is crucial by every work in the context of the service composition. Recent approaches rely on a central mediator that can be trusted or not to ensuring the privacy of the service providers during the query execution. The most recent approaches found problems in case of untrusted mediator where they enforce restrictions like k-protection that can affect the efficiency of their works. Therefore, we propose PrSChain which preserves the privacy of all service providers during service composition and execution using BlockChain technology. We used a permissioned BlockChain that acts as trusted mediator where it enables users to access to the BC if a valid certificate is given. We use Hyperledger Fabric to implement our solution where it stores sensitive data about the composition plan. In addition, the intermediate query results are saved in IPFS that acts as offchain storage. As a proof of concept, we have tested PrSChain on a real-world medical dataset to show its feasibility and efficiency for maintaining privacy in a secure and trusted manner.
Privacy is one of the essential pillars for the widespread adoption of blockchains, but public blockchains are transparent by nature. Modern analytics techniques can easily subdue the pseudonymity feature of a blockchain user. Some applications have been able to provide practical privacy protections using privacy-preserving cryptography techniques. However, malicious actors have abused them illicitly, discouraging honest actors from using privacy-preserving applications as "mixing" user interactions and funds with anonymous bad actors, causing compliance and regulatory concerns. In this paper, we propose a framework that balances privacy-preserving features by establishing a regulatory and compliant framework called Selective De-Anonymization (SeDe). The adoption of this framework allows privacy-preserving applications on blockchains to de-anonymize illicit transactions by recursive traversal of subgraphs of linked transactions. Our technique achieves this without leaving de-anonymization decisions or control in the hands of a single entity but distributing it among multiple entities while holding them accountable for their respective actions. To instantiate, our framework uses threshold encryption schemes and Zero-Knowledge Proofs (ZKPs).
The rapid increase in vehicle traffic volume in modern societies has raised the need to develop innovative solutions to reduce traffic congestion and enhance traffic management efficiency. Revolutionary advanced technology, such as Intelligent Transportation Systems (ITS), enables improved traffic management, helps eliminate congestion, and supports a safer environment. ITS provides real-time information on vehicle traffic and transportation systems that can improve decision-making for road users. However, ITS suffers from routing issues at the network layer when utilising Vehicular Ad Hoc Networks (VANETs). This is because each vehicle plays the role of a router in this network, which leads to a complex vehicle communication network, causing issues such as repeated link breakages between vehicles resulting from the mobility of the network and rapid topological variation. This may lead to loss or delay in packet transmissions; this weakness can be exploited in routing attacks, such as black-hole and gray-hole attacks, that threaten the availability of ITS services. In this paper, a Blockchain-based smart contracts model is proposed to offer convenient and comprehensive security mechanisms, enhancing the trustworthiness between vehicles. Self-Classification Blockchain-Based Contracts (SCBC) and Voting-Classification Blockchain-Based Contracts (VCBC) are utilised in the proposed protocol. The results show that VCBC succeeds in attaining better results in PDR and TP performance even in the presence of Blackhole and Grayhole attacks.
Blockchain based federated learning is a distributed learning scheme that allows model training without participants sharing their local data sets, where the blockchain components eliminate the need for a trusted central server compared to traditional Federated Learning algorithms. In this paper we propose a softmax aggregation blockchain based federated learning framework. First, we propose a new blockchain based federated learning architecture that utilizes the well-tested proof-of-stake consensus mechanism on an existing blockchain network to select validators and miners to aggregate the participants' updates and compute the blocks. Second, to ensure the robustness of the aggregation process, we design a novel softmax aggregation method based on approximated population loss values that relies on our specific blockchain architecture. Additionally, we show our softmax aggregation technique converges to the global minimum in the convex setting with non-restricting assumptions. Our comprehensive experiments show that our framework outperforms existing robust aggregation algorithms in various settings by large margins.
Kulaea Taueveeve Pauu, Jun Wu, Yixin Fan, Qianqian Pan · 5 authors
Natural disasters such as earthquakes can cause damage to critical infrastructures and limit access to vital information, making it difficult for disaster response teams to respond effectively. Unmanned aerial vehicles (UAVs) have the potential to aid and provide real-time information for disaster response teams, however, the need to process distributed learning for huge amounts of interconnected nodes in a graph network poses several challenges. First, distributed learning in graph networks for UAVs is still an open issue, making it difficult to train and share models on such networks. Second, such a network can leak privacy-sensitive information, making it harder to ensure data security. To address these challenges, we propose, in this paper, a novel privacy and blockchain-empowered UAVs-enabled decentralized graph federated learning (DPBE-DGFL) framework for disaster response. The framework includes three phases: (i) local model training utilizing stochastic gradient descent with differential privacy, (ii) model weights integrity authentication using blockchain to ensure secure and efficient sharing of model weights, and (iii) final validator selection and model weights aggregation using a dedicated proof-of-stake, (DPoS), consensus mechanism to ensure efficient and decentralized consensus while maintaining security and integrity. Our DPBE-DGFL framework was evaluated using extensive simulations on EMNIST and real-world disaster datasets from Tonga. The results show that it offers a promising solution for privacy-preserving federated learning in graph networks, balancing privacy protection and model accuracy while maintaining latency, communication, and computational efficiency.
Nidhi Desai, Damiano Di Francesco Maesa, Nishanth Sastry, Steve Schneider · 5 authors
This paper is concerned with helping people who are vulnerable during important transitions in life, such as 'coming out' as LGBTQIA+, experiencing serious illness, undergoing relationship breakdown etc. Rich sensor streams derived from so-called 'smart' Internet of Things (IoT) devices can be highly beneficial, for example in ensuring the safety of such individuals during their sensitive life transitions, or in providing functionality that can mitigate some of the difficulties faced by them. However, the data that needs to be extracted to provide these benefits can itself be highly sensitive and needs to be processed with safeguards to protect privacy. We develop scenarios that highlight issues arising from having to merge data streams from multiple devices, including data governance issues that are relevant when the sensors are owned by multiple individuals. We propose a "Transition Guardian" architecture that leverages "Smart Experts" written as smart contracts operating on homomorphically encrypted sensor data streams to provide real-time protection without disclosing their sensitive information. We have also implemented a proof-of-concept on the Ethereum protocol to validate our proposed solution.
The International Journal of Computer Science Engineering and Its Research Trends (IJCERT) is a peer-reviewed, open access journal that publishes high-quality research papers, reviews, short communications, and notes in the field of computer science engineering and its research trends. The journal covers a wide range of topics in computer science and engineering, including: Welcome to the International Journal of Computer Science Engineering in Research Trends (IJCERT), is a peer-reviewed, open access journal dedicated to publishing innovative research papers, reviews, short communications, and notes in the field of computer science engineering and related disciplines. IJCERT encourages conceptual, state-of-the-art, research, standard, implementation, experimental, application, and industrial case study discussions in various areas, including: computer architecture, computer networks, software engineering, information security, artificial intelligence, machine learning, data science, robotics, cyber-physical systems, the internet of things, and other areas of computer science engineering and Its Applications.
We provide a novel smart contract-based Verifiable Random Function (VRF) scheme that addresses the challenges associated with existing frameworks. Our suggested distributed VRF instantiation employs multi-party computation (MPC) within a blockchain network, ensuring collective randomness and security by preventing any singular participant from predicting the VRF’s output. We endeavor to augment the stochastic nature of our VRF system by incorporating a cryptographically secure ChaCha20 sequence for the generation of pseudo-random sequences. We consider the forward security by adapting Identity-based Encryption (IBE) and show a cryptographic VRF construction, based on Elgamal Encryption and Discrete Logarithm Problem (DLP)-based cryptographic primitives with Decentralized Identifier (DID) for the MPC operations. The construction presents how to prove the correctness of the VRF’s outputs with proofs, rendering it applicable for use cases necessitating random yet verifiable values. Moreover, we show the security analysis with formal proofs and entropy approximation for the randomness of the VRF output. Furthermore, employing the NIST SP800-22 randomness test suite for statistical randomness evaluation, our result shows an overall pass rate of 96.59% across a total of 176 tests encompassing 11 standard test cases. The average p -value is observed as 0.5728, indicative of relevant statistical randomness within the generated sequences. We also provide specific details on the implementation of our VRF scheme within a Solidity smart contract.
Over the past few years, personalized recommendations have emerged as a fundamental component of the consumer electronics sector. The rise of decentralized federated learning has expanded the horizons of personalized recommendations, offering significant potential. Nonetheless, the utilization of confidential data from diverse clients raises legitimate concerns regarding privacy and security. In response to these challenges, we present an innovative framework for secure and privacy-preserving decentralized federated learning, tailored to personalized recommendations within the consumer electronics sector. Our approach strives to facilitate the collective contribution of data from multiple clients to the learning process while safeguarding their privacy. To accomplish this, we harness the power of homomorphic encryption, ensuring that clients’ data remains encrypted and impervious to prying eyes. Additionally, we leverage blockchain technology to establish a secure, decentralized foundation for data exchange and management. Through the utilization of blockchain, we empower clients to validate the integrity of the learning process, guarantee system transparency, and thwart any malicious attempts at result manipulation. Our framework is rigorously assessed using real-world consumer electronics data, highlighting its capacity to provide a secure, decentralized, and privacy-centric solution for personalized recommendations. This approach not only enriches the user experience but also offers robust safeguards for sensitive data.
Abstract Privacy concerns the majority of individuals, governments, and organizations that share data over dissimilar networks of nodes. Every kind of participant requires awareness of the data journey that unfolds inside a blockchain network with its own trustworthy rules of data management and accessibility. This paper provides a methodological approach on privacy for data sharing within blockchain environments. Specific technological aspects of blockchains that relate to on‐chain privacy such as network nature, party join, smart contracts, blockchain states, transactions, and ledger flows, are analysed with respect to the involvement and impact of privacy in distributed ledgers. A high‐level architectural approach is suggested that is intended to address significant privacy concerns on data sharing among different kinds of users in the context of blockchain networks deployment and the broader Web 3.0 ecosystem building. Simultaneously, many pertinent challenges are discussed regarding network nature, configurable privacy, ownership, confidentiality, secured computation, and data monetization that appear in the field and ought to be carefully tackled for the future mass adoption of privacy‐matured distributed ledgers that interconnect delivering the future Internet.
Hongjian Yin, Yan Zhu, Guanglai Guo, William Cheng‐Chung Chu
Blockchain-based smart legal contract, as a legally binding executable contract, has attracted extensive attentions in trade finance. However, since the contract is deployed on open and transparent blockchain network, all transaction data are publicly visible, which brings to privacy disclosure problem. Aiming at this problem, we introduce an improved architecture of smart legal contract with privacy protection, involving contract development, deployment, and execution. In this architecture, the sensitive data of transaction are declared and protected in the form of contract terms. These terms allow the compiler to link predefined cryptographic algorithms into smart contract programs, and then to generate executable contract code. Furthermore, as predefined cryptographic algorithms, we construct a new dual-mode identity-based broadcast encryption (DM-IBBE) scheme to meet specific-purpose or generic-purpose privacy by using selective encryption mode or exclusive encryption mode, respectively. We proved that our DM-IBBE scheme is semantically secure under the decisional Diffie–Hellman assumption. In addition, our experimental results show that the proposed scheme can satisfy the privacy requirements of transaction, and it is practicable and easy-to-develop for introducing privacy preserving mechanisms into smart legal contract languages.
This study paper explores the critical topic of formal verification of smart contracts in distributed ledger technology (DLT) systems. Smart contracts, self-executing code running on blockchain platforms, have gained widespread adoption in various industries due to their automation and transparency benefits. However, the decentralized and immutable nature of DLT raises concerns regarding smart contract security, leading to vulnerabilities and potential exploits. Formal verification methods offer a systematic approach to analyze smart contracts for correctness and safety. This paper provides an overview of smart contracts, DLT, and the importance of formal verification. It reviews various formal verification techniques and presents state-of-the-art tools and frameworks. The paper concludes with discussions on challenges, future research opportunities, and the role of formal verification in enhancing DLT-based applications' security and usability.
A redactable blockchain allows authorized individuals to remove or replace undesirable content, offering the ability to remove illegal or unwanted information. Access control is a mechanism that limits data visibility and ensures that only authorized users can decrypt and access encrypted information, playing a crucial role in addressing privacy concerns and securing the data stored on a blockchain. Redactability and access control are both essential components when implementing a regulated consortium blockchain in real-world situations to ensure the secure sharing of data while removing undesirable content. We propose a decentralized consortium blockchain system prototype that supports redactability and access control. Through the development of a prototype blockchain system, we investigate the feasibility of combining these approaches and demonstrate that it is possible to implement a redactable blockchain with access control in a consortium blockchain setting.
Abstract Providing trust in machine learning (ML) systems and their fairness is a socio-technical challenge, and while the use of ML continues to rise, there is lack of adequate processes and governance practices to assure their fairness. In this paper, we propose FaaS, a novel privacy-preserving, end-to-end verifiable solution, that audits the algorithmic fairness of ML systems. FaaS offers several features, which are absent from previous designs. The FAAS protocol is model-agnostic and independent of specific fairness metrics and can be utilised as a service by multiple stakeholders. FAAS uses zero knowledge proofs to assure the well-formedness of the cryptograms and provenance in the steps of the protocol. We implement a proof of concept of the FaaS architecture and protocol using off-the-shelf hardware, software, and datasets and run experiments to demonstrate its practical feasibility and to analyse its performance and scalability. Our experiments confirm that our proposed protocol is scalable to large-scale auditing scenarios (e.g. over 1000 participants) and secure against various attack vectors.
The rapid development of Industrial IoT (IIoT) opens up promising possibilities for data analysis and machine learning in IIoT networks. As a distributed paradigm, federated learning (FL) allows numerous IIoT devices to collaboratively train a global model without collecting their local data together in central servers. Unfortunately, a centralized server used to aggregate local gradients can be compromised and forge the result, which incurs the need for aggregation verification. Several approaches focusing on verifying the correctness of aggregation have been proposed. However, it is still an open problem since devices have to devote more computation resources for verification, which are especially not friendly to resource-constrained IIoT devices. Furthermore, verifying weighted aggregation has not been supported in existing approaches. In this paper, we propose an efficient verifiable federated learning approach for IIoT networks, which verifies the aggregation of gradients and requires lowest burden on IIoT devices by introducing zero-knowledge proof techniques. Moreover, our design supports weighted aggregation verification to validate the aggregation of weighted gradients in the cloud server. By comparing the proposed approach with the state-of-the-art schemes including VerifyNet and VeriFL, we demonstrate the superior performance of our approach for resource-constrained devices, which minimizes the computational overheads of the IIoT devices.
Blockchain and federated learning, as two key technologies for trusted and privacy-preserving collaboration in distributed environments, have been intensively studied in recent years. Federated learning aims to train a centralized global model from decentralized datasets without leaking user privacy, while blockchain helps establish mutual trusts among multiple clients with technical features such as tamper-proof, anonymity, security and traceability, among others. Specially, blockchain-based smart contracts can perform complex logics and behaviors in an efficient and accurate fashion to schedule collaborations. Therefore, leveraging these advantages, this paper proposed a novel framework for enabling distributed and collaborative federated learning based on blockchain and smart contracts, and discussed its major components, i.e., the blockchain-based distributed architecture, the smart-contract-based scheduling, as well as the incentive mechanism design for federated learning. We also discussed the potential application scenarios of our framework, which can be expected to help establish safer, fairer, smarter, and more efficient collaborations for distributed federated learning.
High-performance sensors play a crucial role in IoV (Internet of Vehicles) to achieve advanced autonomous driving. Typically, IoV involves extensive data sharing and centralizes data storage, posing significant security challenges for sensors. Although blockchain offers a decentralized platform for data exchange, it can’t guarantee the reliability and trustworthiness of each sensor in IoV. Besides, blockchain primarily focuses on technical aspects and falls short of establishing a comprehensive organizational and operational framework for sensors. To address these challenges, we introduce the concept of DAO (Decentralized Autonomous Organization and Operation) into sensors and propose a new framework for reliable sensor operations in IoV, namely SensorDAO. It utilizes the collaboration of on-chain and off-chain layers to support various scenarios at the application layer. We also provide key technical elements to construct SensorDAO, including distributed storage, intelligent algorithms, governance, and incentive mechanisms.
The current Internet of Vehicles (IoV) data are facing challenges such as data silos, security and privacy concerns, data quality issues, and collaboration barriers. This paper proposes an IoV Information Management System (IIMS) based on parallel intelligence and blockchain to address these challenges. By leveraging the decentralized, immutable, and traceable nature of blockchain, combined with the incentive mechanisms and collaborative models of decentralized autonomous organizations (DAOs), a secure and trustworthy data sharing platform is established for collaborative analysis, business cooperation, and innovative applications of IoV data. The proposed approach utilizes the decentralized nature and data backup capabilities of blockchain to mitigate the single point of failure issues associated with centralized servers. Additionally, the anonymity, immutability, and traceability features of blockchain ensure the privacy, security, and integrity of data sharing. Moreover, the incentive mechanisms and DAO solutions within the blockchain promote data sharing among vehicles while ensuring data quality.
Consumer IoT (CIoT) manufacturers seek customer feedback to enhance their products and services, creating a smart ecosystem like a smart home. Due to security and privacy concerns, Blockchain-based federated learning (BCFL) ecosystems can let CIoT manufacturers update their Machine Learning (ML) model using end-user data. FL uses privacy-preserving ML techniques to forecast customers' needs and consumption habits, and blockchain replaces the centralised aggregator to safeguard the ecosystem. However, Blockchain technology (BCT) struggles with scalability and quick ledger expansion. In BCFL, local model generation and secure aggregation are other issues. This research contributes a novel architecture emphasising Gateway Peer (GWP) in blockchain network to resolve scalability, ledger optimisation and secure model transmission issues. In the architecture we replace the centralised aggregator by the blockchain network, while GWP restricts the number of local transactions to execute in BCN. Considering the security and privacy of FL processes, we have added differential privacy and advanced normalisation techniques to ML processes. The approaches strengthen end-users' cyber security and encourage the adoption of technological innovation standards by service providers. The proposed approach has been tested extensively using a well-respected Stanford Cars dataset. We experimentally demonstrate that the proposed architecture makes the network scalable and optimises the ledger significantly. In addition, the normalisation technique outperforms batch normalisation when features are under DP protection.