Secure management of Critical National Infrastructures (CNI) is a burning challenge to any state. As a CNI, Electronic Healthcare System (EHS) infrastructure records citizens’ medical records, raising security and privacy concerns. Traditional EHS functions independently where patients’ records are recorded and maintained in centralized systems that produce massive redundant data. Due to the non-coherence of these systems, data atomicity is not maintained; hence research results based on these data create questioning. Moreover, medical records are valuable for research but cannot be public due to security and privacy. Blockchain (BC) is currently considered a potential solution for the challenges. Blockchain can integrate every independent EHS as a bridging platform. The solution can ensure data uniqueness and overcome security issues. The prime difficulties for the integration are data synchronization of the traditional EHS and BC-based EHS. Furthermore, the autonomous interoperability betweenSQLandNoSQLdatabase used in typical EHS and BC-based EHS, respectively, is a prime challenge. Therefore, this research proposes a Blockchain-based framework that bridges Traditional E-Health Systems(TEHS) and allows uninterruptible data exchanges between two systems, even for archive medical records. Beyond that, the framework shows an elevated way to overcome a single point of failure, data security, access control, etc., issues in a centralized system. Finally, the testbed implementation justifies the proposed architecture.
Open banking allows banks and financial sectors to easily access the customersâ financial data which is revolutionizing. It also provides the customers with excellent cloud access to various providersâ wide range of financial services. The storage of such sensitive services and data on cloud servers is a doubleâedged sword. It can ease and support fineâgrained access to such services/data anywhere and anytime, supporting the open banking system. But, on the other hand, data privacy and secrecy are a challenge. Thus, efficient access control should exist for open bankingâs services and data to protect cloudâhosted financial sensitive data from unauthorized customers. This paper proposes a new access control scheme that employs blockchain for the keyârevocation process. We implement the smart contractâs functions on the Ethereum platform and test the contractâs code on the Kovan Testnet before deploying it to the Mainnet. Although the customer is authenticated to open banking, his key/s can be revoked according to the status response of the bank branch. Thus, his access to financial services and data is denied. We did comprehensive experiments for the revocation status response time, data exchanged until receiving the revocation status, and the time spent updating the policy. Also, we compared the results of our proposed scheme with two wellâknown methodsâCertificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP). The experimental results show that our proposed scheme (BKRâAC) has a faster response time than Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP) in case of nonrevoked keys/certificates and a slower response time in case of revoked keys to avoid nonrevoking a revoked key. But the data exchanged is an average for BKRâAC between CRL and OCSP, which is still a tiny amount and accepted. The security analysis proved that our scheme is secure against some wellâknown attacks on open banking systems. In addition, it is also secured against the chosenâtext attack by employing the challengeâresponse authentication mechanism.
The Know Your Client (KYC) process is an essential part of the financial ecosystem. The KYC process requires banks to validate and verify primary documents. The market these days, though, is flooded with KYC utilities that facilitate this process and share these documents with multiple entities, however they provide very little value addition. Blockchain technology, with its concept of immutable timestamped ledgers and distributed systems, can effectively facilitate banks to improve their KYC methods by allowing near real-time data exchange among various entities for quicker and effective validation ensuring data integrity alongside bringing down the time and costs significantly.
Cloud storage service provides a convenient way for users to store massive data. To guarantee the integrity of the outsourced data, provable data possession (PDP) schemes for multi-copy data and multi-cloud have been proposed respectively. To avoid a single point of failure and to increase the security of the outsourced data, many users store multiple copies on multiple cloud servers. However, few protocols support multi-copy data and multi-cloud at the same time. Considering that three entities (third-party auditor, cloud organizer and cloud storage servers) participate in the auditing process, it is difficult for users to locate the position of the faults, including entity position, file position and data block corruption position, when the auditor reports data corruption. In this paper we propose a certificateless multi-copy public auditing protocol in multi-cloud storage, which supports to locate the faults entities and corrupted data blocks. Specifically, instead of relying on a trusted centralized judgement entity to deal with the faults detection, smart contracts combined with the binary search technique are utilized to help achieve the reliability of faults localization result and the accuracy of the judgement. Additionally, the proposed protocol supports data dynamics update, including data modification, insertion and deletion. Theoretical analysis and experiment results show that our protocol is efficient and practical.
The distribution of information through web protocols is today based on the client-server model. Recently, decentralized protocols with greater availability appear as well as blockchain-based attestation methods, allowing for proving the existence of information. In combination, these methods promise a secure, decentralized and long-term storage. However, there exist two major problems: (1) the scalability of blockchains limits their storage capacity and (2) various (de)centralized web protocols are in use and could alleviate this problem, but they do not support blockchain-based attestations. In this paper, we extend an approach for blockchain-based attestation with compatibility for multi-protocol storage. Instead of specific protocols or blockchains, the extended approach aims to contribute novel concepts to the discussion on blockchain scalability. It augments the capabilities of existing protocols for applications such as certification or timestamping of digital artifacts. With the use of decentralized protocols such as IPFS, further availability and inherent resilience properties are gained, allowing for applications such as open research repositories and digital registries. We discuss the architecture of the extended approach, a possible implementation in a smart contract on the Ethereum blockchain with IPFS and Git, and evaluate the time and cost of attestations.
Cloud outsourcing provides flexible storage and computation services for data users in a low cost, but it brings many security threats as the cloud server may not be fully trusted. Previous secure outsourcing solutions mostly assume that the server is honest-but-curious while the adversary model of a malicious server that may return incorrect results is rarely explored. Moreover, with the increasing popularity of verifiable computations, existing verification schemes are yet not efficient and cannot cater to different scenarios in practice. In this paper, we propose a blockchain-based verifiable search framework in the adversarial cloud outsourcing context. When outsourcing the encrypted data to the cloud or Interplanetary File System (IPFS), we also store the encrypted data index in a decentralized blockchain (i.e., Ethereum in this paper) which is public and cannot be modified. Once a user is authorized, he/she can flexibly obtain the query results and efficiently check the query integrity via the pre-deployed smart contract, without the need of the data owner being online. Moreover, for user's privacy protection, we construct a stealth authorization scheme to deliver the access authorization without any identity disclosure. Finally, theoretical analysis and performance evaluation validate the security and efficiency of our proposed framework.
Increasing numbers of users are outsourcing data to the cloud, but data integrity is an important issue. Due to the decentralization and immutability of blockchain, more and more researchers tend to use blockchain to replace third-party auditors. This paper proposes a data integrity system based on blockchain expansion technology that aims to solve the problem of high cost for blockchain network maintenance and for user creation of new blocks caused by the rapid growth of blocks in the data integrity audit scheme of existing blockchain technology. Users and cloud service providers (CSP) deploy smart contracts on the main chain and sub-chains. Intensive and frequent computing work is transferred to the sub-chain for completion, and the computation results of the sub-chain are submitted to the main chain periodically or when needed to ensure its finality. The concept of non-interactive audit is introduced to avoid affecting user experience due to the communication with the CSP during the audit process. In order to ensure data security, a reward pool mechanism is introduced. Comprehensive analysis from aspects such as storage, batch auditing and data consistency proves the correctness of the scheme. Experiments on the Ethereum blockchain platform demonstrate that this scheme can effectively reduce storage and computational overhead.
As the size of data is increasing exponentially, its security is a major concern, emerging technology like blockchain is used to provide security. Since the inception of blockchain, it has been adopted by researchers and industry, however, it gained enormous attention after cryptocurrency. It can be defined as a means of storing information in such a way that modification and hacking the system is difficult or impossible. A blockchain is a decentralized ledger that is digital and public, consisting of records of transactions called blocks. A consensus technology assures that all nodes agree on a unique sequence for appending blocks. A comprehensive examination of these algorithms will aid in understanding how and why each blockchain operates in the manner that it does. In this study, we addressed extensively used consensus techniques in the blockchain and the importance of consensus protocol in blockchain technology. The underlying consensus algorithm is a critical component of every blockchain system which determine the performance and security of the system. Ensuring the correctness of consensus protocols is uttermost important to create trust in the blockchain-based systems and formal methods are the way to create that trust and develop correct and verified systems. Formal modeling is a method of writing a system mathematically and examining the correctness and verifying the developed system. This study analyzed the importance of consensus mechanisms and how formal methods are helping to develop a correct blockchain-based system. This paper is a rigorous study on the current scenario of the application of formal methods in the consensus mechanism of blockchain for their verification.
Yongli Tang, Yuanhong Li, Qing Ye, Ying Li ¡ 5 authors
Although the existing group signature schemes from lattice have been optimized for efficiency, the signing abilities of each member in the group are relatively single. It may not be suitable for complex applications. Inspired by the pioneering work of Bellare and Fuchsbauer, we present a primitive called policy-based group signature. In policy-based group signatures, group members can on behalf of the group to sign documents that meet their own policies, and the generated signatures will not leak the identity and policies of the signer. Moreover, the group administrator is allowed to reveal the identity of signer when a controversy occurs. Through the analysis of application scenarios, we concluded that the policy-based group signature needs to meet two essential security properties: simulatability and traceability. And we construct a scheme of policy-based group signature from lattice through techniques such as commitment, zero-knowledge proof, rejection sampling. The security of our scheme is proved to be reduced to the module short integer solution (MSIS) and module learning with errors (MLWE) hard assumptions. Furthermore, we make a performance comparison between our scheme and three lattice-based group signature schemes. The result shows that our scheme has more advantages in storage overhead and the sizes of key and signature are decreased roughly by 83.13%, 46.01%, respectively, compared with other schemes.
Wattana Viriyasitavat, Li Da Xu, Dusit Niyato, Zhuming Bi ¡ 5 authors
Blockchain (BC), as an emerging technology, is revolutionizingBusiness Process Management(BPM) in multiple ways. The main adoption is to serve as a trusted infrastructure to guarantee the trust of collaborations among multiple partners in trustless environments. Especially, BC enables trust of information by usingDistributed Ledger Technology(DLT). With the power ofsmart contracts, BC enforces the obligations of counterparties that transact in abusiness process(BP) by programming the contracts as transactions. This paper aims to study the state-of-the-art of BC technologies by (1) exploring its applications in BPM with the focus on how BC provides the trust of BPs in their lifecycles; (2) identifying the relations of BPM as the need and BC as the solution with the assessment towards BPM characteristics; (3) discussing the up-to-date progresses of critical BC in BPM; (4) identifying the challenges and research directions for future advancement in the domain. The main conclusions of our comprehensive review are (1) the study of adopting BC in BPM has attracted a great deal of attention that has been evidenced by a rapidly growing number of relevant articles. (2) The paradigms of BPM overInternet of Things(IoT) have been shifted frompersistenttotransient, fromstatic to dynamic, and fromcentralized to decentralized, and new enabling technologies are highly demanded to fulfill some emergingfunctional requirements(FRs) at the stages ofdesign, configuration, diagnosis, andevaluationof BPs in their lifecycles. (3) BC has been intensively studied and proven as a promising solution to assure the trustiness for both of business processes and their executions in decentralized BPM. (4) Most of the reported BC applications are at their primary stages, future research efforts are needed to meet the technical challenges involved ininteroperation, determination of trusted entities, confirmation of time-sensitive execution, andsupport of irreversibility.
This paper proposes a novel lattice-based aggregate signature (LAS) scheme that bring post-quantum security to the Bitcoin system without sacrificing its transaction efficiency. Bitcoin currently employs Elliptic Curve Digital Signature Algorithm (ECDSA), which is insecure against the emerging quantum technology, so post-quantum signature schemes like the proposed LAS will become necessary in the near future. However, most of the post-quantum signatures schemes have large signature sizes which decrease Bitcoinâs efficiency while our proposed scheme does not have this negative side effect. Our LAS scheme is based on CRYSTALS-Dilithium and a zero-knowledge Scalable Transparent Arguments of Knowledge (STARK) protocol. CRYSTALS-Dilithium is the most prominent algorithm chosen by the National Institute of Standards and Technology (NIST), yet it still has an adverse limitation: it would cause Bitcoinâs transaction efficiency to fall by 17 times due to its relatively large signature size. On the other hand, the proposed LAS scheme takes full advantage of signature aggregation using the STARK protocol and Dilithiumâs easy and fast implementation, thus generating signatures with post-quantum security and small signature sizes which are critical to transaction efficiency. Our proofs convey the correctness, compactness, and post-quantum security of our construction in the quantum random oracle model, and our implementation conveyed that the proposed scheme would only decrease Bitcoinâs transaction efficiency by 3 times, a significant improvement from using Dilithium and other lattice-based aggregate signature schemes. Our proposed scheme has many advantages over the existing schemes and may become very valuable to Bitcoin.
Zaffar Ahmed Shaikh, Abdullah Ayub Khan, Lin Teng, Asif Ali Wagan ¡ 5 authors
This paper presents a layered hierarchy that depicts the progressive relationship between data, information, knowledge, and wisdom. To begin with, data is gathered and organized into information. Information is gathered, filtered, refined, and put through an investigation process to create knowledge. Wisdom is attained after knowledge discovery through the process of filtration and aggregation through experience. The layered hierarchy in the domain of eâhealthcare necessitates higher scheduling costs for data collection, processing wisdom, and management, which is also an insecure and untrustworthy process for progressive medical service. The medical industry faces a difficult problem in providing collected data integrity, information reliability, and knowledge trustworthiness for the service of progressive medical relationships in the face of an increasing number of dayâtoâday records. The blockchain consortium hyperledger (fabric) has been used in this paper to act as a bridge that bridges the gap between electronic data, information, knowledge, and wisdom (DIKW) movement and processes by enabling the process of the layered hierarchy of schedule information and management and providing security and transparency. For eâhealthcare information management and privacy, the DIKWâledger, such as patientsâ consultancy information, availing medical services, personal records, appointments, treatment details, and other healthârelated transactions, a consortium hyperledger fabricâenabled efficient architecture is proposed. This proposed architecture creates two networks: a public network for medical stakeholders to exchange and agree on specific medical activities before being preserved on distributed storage (readâonly after record registration) and a private network for complete DIKW process scheduling and management. We designed and created smart contracts for this purpose, as well as useâcase diagrams to describe the overall execution process. The proposed architectural solution provides more efficient information integrity, provenance, and storage procedures to immutably preserve the medical ledger in a permissioned hashâencrypted structure.
With the popularity of cloud computing services, an increasing number of users begin to use subscription-based services. Due to the semi-trusted cloud servers that may access the outsourced data, and malicious senders who may publish unauthorized data or junk data, access control encryption (ACE) schemes have been studied recently to enforce secure data write control as well as read control. However, their access control policies are specified by the authority or publishers, which do not apply to the subscriptions. In this paper, we propose DSFlow, a secure and fine-grained flow control system for subscription-based data services. DSFlow is designed in the cloud-edge computing architecture, which employs edge nodes to control the communications between publishers and cloud servers by sanitizing the original ciphertexts to resist malicious publishers, and allows any valid subscriber to decrypt the sanitized ciphertexts in cloud. We introduce a receiver-policy attribute-based ACE (RA-ACE) scheme for DSFlow, which embeds the fine-grained access control policy within the receiver's decryption key. We give a concrete construction of RA-ACE from key-policy attribute-based encryption, structure-preserving signature and non-interactive zero-knowledge proof, and formally prove the no-read rule and no-write rule of RA-ACE. The experiments demonstrate the efficiency of DSFlow compared with existing schemes.
Secure cloud search service allows resource-constrained clients to effectively search over encrypted cloud storage. Towards enabling owner-enforced search authorization, the notion of attribute-based keyword search (ABKS) has been introduced and widely deployed in practice. To enhance traditional security of ABKS, two state-of-the-art solutions are presented to address keyword guessing attacks or setup inconsistency for secret key. Nevertheless, they have not simultaneously considered the following threats to a data user: (i) inconsistent secret key/cipher-index caused by outside dishonest authority and/or data owner; (ii) algorithm substitution attacks (ASA) launched by inside adversarial eavesdropping. These attacks may unfortunately lead to cloud data breach and user information exposure. To tackle such outside and inside threats, we introduce subversion-resistance and consistency for secure and fine-grained cloud document search services. In particular, we propose a consistent ABKS system with cryptographic reverse firewalls (CRF). Technically, we refer to verifiable functional encryption and employ non-interactive zero-knowledge proofs of discrete logarithm equality to ensure strong input consistency for ABKS. In addition, we build a trusted CRF zone for sanitizing algorithm outputs against ASA attacks. Moreover, we formalize the security model and formally prove security of our system. To clarify practical performance, we implement state-of-the-art solutions and our system in real cloud environment based on Enron dataset. The results show that our system achieves more enhanced security properties without obviously sacrificing performance. In particular, our system achieves comparable time and storage cost for document-index encryption and document search, as compared to state-of-the-art solutions.