Fady Nissan, Jacob Hamade, Jimmy Xiao, Jonah Ragle · 7 authors
Over the past several years, Bitcoin (the pioneer of Blockchain) has harnessed the cutting edge Blockchain software technology to securely decentralize financial transactions so control can be passed democratically to anyone who wishes to participate in the peer-to-peer network. It does this entire task with a mere shared chain of transaction history utilizing blocks of 5-tuples (transaction ID, transaction fee, transaction size, sender(s) private key(s) and amount(s), recipient(s) public key(s) and amount(s)) that get added to the distributed ledger across all nodes in the peer-to-peer network around once every ten minutes. With Bitcoin’s market capitalization at nearly a billion dollars, and many rising competitors taking advantage of Blockchain for financial transactions, it is not hard to see that this new way to transcribe digital information is sweeping the financial world at a blistering rate. For reasons explained further in this paper, we will explore why Blockchain financial ledgers tremendously increase security, transparency and privacy in comparison to traditional database financial ledgers.
Blockchain as a potentially disruptive technology can advance many different fields, e.g., cryptocurrencies, supply chains, and the industrial Internet of Things. The next-generation blockchain ecosystem is expected to consist of various homogeneous and heterogeneous distributed ledgers. These ledger systems will inevitably require a certain level of proper cooperation of multiple blockchains to enrich advanced functionalities and enhance interoperable capabilities for future applications. The interoperability among blockchains will revolutionize current blockchain design principles, like the emergence of the Internet. However, the development of cross-blockchain applications involves much complexity regarding the variety of underlying cross-blockchain communication. With that regard, we propose an efficient, interoperable blockchain architecture, InterTrust, to support interoperability and trustworthiness among arbitrary blockchain systems (including homogeneous and heterogeneous blockchains). It consists of an atomic cross-chain communication protocol, which can be considered an agnostic protocol to integrate existing blockchain systems smoothly. InterTrust is powered by two innovative techniques: threshold signature scheme and trusted hardware. The threshold signature scheme guarantees consistency and verifiability in the target blockchain systems, and the trusted hardware guarantees trusted services among distinct blockchain systems. Combining these two techniques provides an efficient cross-chain communication protocol to facilitate atomic swaps and interoperable operations between different blockchain systems. Our interoperable architecture is robust to support arbitrary blockchain systems. We also present the security analysis on the scenarios of integrating our protocol into Byzantine fault tolerance based blockchain systems.
Eranga Bandara, Deepak K. Tosh, Sachin Shetty, Bheshaj Krishnappa
For operational efficiency, enterprise-level Energy Delivery Systems (EDS) rely on a number of software or hardware providers. Overseas suppliers generally manufacture and integrate critical EDS components, increasing the attack surface for adversaries looking to enter EDS (e.g., the recent SolarWinds supply chain attack). The EDS supply chain requires cyber risk management that can track cyber vulnerabilities, establish quantifiable mechanisms to understand the severity and exploitability of EDS applications while providing a remediation plan to effectively mitigate such risks. In this work, we propose a Cyber Supply Chain Provenance platform for EDS by leveraging distributed ledger technology for enabling cyber risk management capability to defend and respond to cyber supply-chain attacks (e.g., SolarWinds) and establish data provenance in a cyber supply chain ecosystem.
Ali Shahaab, Imtiaz Khan, Ross Maude, Chaminda Hewage
Public service organisations (PSOs) have a need to collaborate with each other in order to provide a seamless user experience, mitigate fraud and increase operational efficiency at a reduced tax payer's cost. However, legacy systems built over decades using different technology stacks, make collaboration challenging and hinder efficiency. Distributed ledger technologies (DLTs) have been proposed as a trust and efficiency mechanism for several inter organisation collaborative tasks. They can reduce friction in operations and help achieve a more streamlined and unified public service infrastructure. However, most of the work are either based on theory or purely conceptual and lack implementation. In this paper, we elaborate on the design and implementation of a proof of concept (POC) of a blockchain based interoperability and data sharing system that allows PSOs to seamlessly collaborate and share information in real time. The POC is based on the Registration of Overseas Entities and Beneficial Owners (ROEBO) legislation in the UK and demonstrates interactions between Companies House UK and other PSOs in a hybrid blockchain setting.
Nowadays, academic certificates are still widely issued in paper format. Traditional certificate verification is a lengthy, manually intensive, and sometimes expensive process. In this paper, we propose a novel NFT-based certificate framework called NFTCert, which enables the establishment of links between a legitimate certificate and its owner through a Blockchain. In this paper, we describe the implementation of the NFTCert framework, including schema definition, minting, verification, and revocation of NFT-based certificates. We also introduce a payment gateway into the minting process, which enables NFTCert to be used by a wider audience. Therefore, participants of NFTCerts do not need to rely on cryptocurrency for transactions. All in all, the proposed framework is designed to achieve usability, authenticity, confidentiality, transparency, and availability properties when it is compared to existing Blockchain-based systems.
Smart contracts running on blockchains have emerged as an indispensable mechanism to enhance trust, security, transparency and traceability of data shared among critical distributed applications. Unfortunately, a smart contract deployed on a blockchain by itself is usually inadequate in maintaining data security and privacy because the data are replicated to all the nodes on the network. There has been some recent work that tries to tackle this privacy leakage issue in smart contract execution by integrating blockchains with hardware supported trusted execution environments(TEEs). Although TEEs ensure privacy to some extent, the smart contract execution can still be compromised if the developed code does not use the TEEs' capabilities correctly. One important security issue for leveraging TEEs in practice is the memory access pattern disclosure. Even though the TEEs encrypt all the memory content during the program execution, the memory access sequence can be observed by the malicious operating system, and can be used to infer sensitive information such as “who submitted the second highest bid to the auction?”. Hence, for enhanced security for TEE based applications, the memory access pattern leakage need to be addressed. Given these observations, an apparent question that comes to light is, how can we use TEEs correctly to enable efficient, privacy enhancing and secure applications? In this work, we address this challenge in the context of digital auctions. We develop a novel generic and secure framework that allow an auction smart contract to run inside secure enclaves over Intel SGX based TEEs on a blockchain. To our knowledge, this is the first work that provides access pattern leakage free TEE based secure auction smart contract deployment. We achieve this by implementing oblivious execution (i.e., no memory access pattern leakage) of both first price and second price sealed bid auctions as templates. Furthermore, we implement an end-to-end encryption service to keep the bids secure. Our empirical results and privacy analysis show that this architecture does not cause a significant impact to efficiency given the level of security achieved.
In real-world scenarios, in order to encourage one to report others crimes, judicial department usually rents independent cloud storage spaces to receive the precious evidences from whistleblowers. Since the uploaded data are not controlled by cloud users, remote data integrity is very important. Public cloud auditing enables an auditor to periodically check the integrity of outsourcing data on behalf of users, without retrieving the entire data file. However, most existing data auditing schemes have potential security vulnerabilities, and thus cannot defense many security attacks (e.g., the man-in-the-middle attack). Meanwhile, it is significant to protect whistleblower’s identity privacy, reward the real data uploader, and further trace the responsibility of slanders accurately. From the aforementioned requirements, we present an efficient blockchain-assisted conditional anonymity privacy-preserving public auditing (BA-CAPPPA) scheme with reward mechanism. The Ethereum blockchain is integrated into BA-CAPPPA to enhance the security level of the whole public auditing mechanism. Theoretical analysis results show that the BA-CAPPPA achieves man-in-the-middle attack resistance, storage correctness guarantee, data privacy-preservation, conditional identity anonymity, and reward mechanism. Performance evaluations and comparisons demonstrate that BA-CAPPPA could outperform some state-of-the-art data auditing schemes.
Cloud Infrastructure as a Service (IaaS) Service Level Agreements (SLAs) assessment constitutes the de facto area of interest and applications in the public cloud infrastructure. However, the domination of colossal corporations tends to monopolize the way metrics and Key Performance Indicators (KPIs) are measured and determined, leading to governed environments where the clientele is unable to obtain accurate and unbiased assessment of SLAs. Leaning toward SLA self-assessment, this paper provides a fair SLA consensus approach with innate transparency and privacy by leveraging permissioned blockchains that are equipped with Trusted Execution Environments (TEEs). The SLA assessment intelligence is performed inside enclaved smart contracts isolated from the on-chain entities views. The result constitutes a permissioned blockchain ecosystem where the IaaS and their clientele commonly agree on all the respective SLA monitoring and computation rules beforehand, as defined in any SLA assessment process, while the SLA consensus scheme constantly audits the SLA metrics based on these pre-approved regulations.
Audit logs are a critical component in today’s enterprise business systems as they provide several benefits such as records transparency and integrity and security of sensitive information by creating a layer of evidential support. However, current implementations are vulnerable to attacks on data integrity or availability. This paper presents a Blockchain-based audit trail mechanism that leverages the security features of Blockchain to enable secure and reliable audit trails and to address the aforementioned vulnerabilities. The architecture design and specific implementation are described in detail, resulting in a real prototype of a reliable, secure, and user-friendly audit trail mechanism.
Group signature can provide the privacy-preserving authentication mechanism for the blockchain. In the traditional blockchain privacy-preserving scheme based on the group signature, there is only one group manager to revoke the anonymity. Thus, the traditional scheme will have single point of failure and key escrow problems. To solve these problems, we propose a privacy-preserving scheme in the blockchain based on the group signature with multiple managers. Our scheme is constructed based on bilinear pairing and the technique of distributed key generation. Finally, we analyze the application of the proposed scheme in the field of blockchain-based provable data possession (PDP), as well as the correctness and security of the scheme.
Imen Riabi, Hella Kaffel Ben Ayed, Bilel Zaghdoudi, Laurent George
We propose the integration of blockchain with the OAuth standard. Two blockchains are considered for the implementation: Ethereum where ACL and token processing is performed on-chain and MultiChain where the processing is performed off-chain. The experiments show that the on-chain token generation provides an additional overhead compared to the off-chain one. However, it provides a secure token management and access traceability. The main advantage of our contribution is to propose a decentralized authorization system while relying on a standard specification.
Yage Cheng, Bei Gong, Zhijuan Jia, Yanyan Yang · 6 authors
In this article, we analysed the problems of electronic medical records (EMRs) and found that the EMRs generated by different hospitals for the same patient are mutually independent and duplication and data sharing are difficult among hospitals. In order to solve this problem, this paper proposes an efficient and secure cross-domain sharing scheme of EMRs based on edge computing. The program allows the doctor to access the personal history EMRs through the patient’s authorization so that the doctor can understand the patient’s history of illness and, on this basis, generate a new medical record for the patient. Then, the doctor sends the EMRs to the edge server, and the server calculates the ciphertext and adds it to the patient’s personal medical record to complete the case update. Analysis shows that this solution can effectively prevent data tampering and forgery through blockchain and avoid privacy leakage problems in plaintext sharing by using searchable encryption and by relying on edge servers to solve nearby computing tasks and divert the computing capacity of cloud servers to improve efficiency. The security proof shows that the scheme satisfies the complex problem of the BDH assumption. Performance analysis shows that the scheme is feasible and efficient.
Abdullah Ayub Khan, Asif Ali Laghari, Aftab Ahmed Shaikh, Sami Bourouis · 6 authors
Degree attestation verification and traceability are complex one-to-one processes between the Higher Education Commission (HEC) and universities. The procedure shifted to the digitalized manner, but still, on a certain note, manual authentication is required. In the initial process, the university verified the degree and stamp seal first. Then, a physical channel of degree submission to the receiving ends is activated. After that, the degree is attested while properly examining and analyzing the tamper records related to degree credentials through e-communication with the university for verification and validation. This issue poses a serious challenge to educational information integrity and privacy. Potentially, blockchain technology could become a standardized platform to perform tasks including issuing, verifying, auditing, and tracing immutable records, which would enable the HEC, universities, and Federal Education Ministry (FEM) to quickly and easily get attested and investigate the forge proof versions of certificates. Besides, decentralized distributed data blocks in chronological order provide high security between distributed ledgers, consensus engine, digital signature, smart contracts, permissioned application, and private network node transactions that guarantee degree record validation and traceability. This paper presents an architecture (HEDU-Ledger) and detail design of blockchain-enabled hyperledger fabric applications implementation for degree attestation verification and traceable direct channel design between HEC and universities. The hyperledger fabric endorses attestation records first, and then validates (committer) the degree and maintains the secure chain of tracing between stakeholder peer nodes. Furthermore, this HEDU-Ledger architecture avoids language and administrative barriers. It also provides robustness in terms of security and privacy of records and maintains integrity with secure preservation as compared to that of the other state-of-the-art methods.
An electronic medical record (EMR) is the digital medical data of a patient, and they are healthcare system's most valuable asset. In this paper, we introduce a decentralized network using blockchain technology and smart contracts as a solution to manage and secure medical records storing, and transactions between medical healthcare providers. Ethereum blockchain is employed to build the blockchain. Solidity object-oriented language was utilized to implement smart contracts to digitally facilitate and verify transactions across the network (creating records, access requests, permitting access, revoking access, rejecting access). This will mitigate prevailing issues of current systems and enhance their performance, since current EMRs are stored on a centralized database, which cannot guarantee data integrity and security, consequently making them susceptible to malicious attacks. Our proposed system approach is of vital importance considering that healthcare providers depend on various tests in making a decision about a patient's diagnosis, and the respective plan of treatment they will go through. These tests are not shared with other providers, while data is scattered on various systems, as a consequence of these ensuing scenarios, patients suffer of the resulting care provided. Moreover, blockchain can meliorate the motley serious challenges caused by future use of IoT devices that provide real-time data from patients. Therefore, integrating the two technologies will produce decentralized IoT based healthcare systems.
This paper examines the features of blockchain technology from the viewpoint of those responsible for external financial reporting and their auditors. Financial professionals worry about the potential disconnect between digital and real-world transactions that can create potentially misleading illusions-of-truth. The largest objection from financial professionals surrounds the widespread assertion that the consensus verification may replace the financial statements or their required audit. The discussion explains why verified “on chain” data falls considerably short of audited financial statements. In a structured literature review, this work contrasts the treatment of blockchain’s consensus verification feature in IT and accounting literature over a four-year period, showing a dramatic increase in this topic but little convergence between IT and financial communities on the problems with blockchain verification in auditing contexts. Knowing the auditing community’s concerns, as explored in this work, can help direct future developments in blockchain technology and target implementation suited to user needs.
Sergey Bezzateev, Aleksandra Afanasyeva, Konstantin Zhidanov, Aleksandr Ometov
The development generally drives the evolution of modern systems towards distributed ones, generally, in blockchain and Distributed Ledger Technology domains. Ensuring the reliable digital signature of messages and the data security of messages signed with a digital signature from unauthorized interference is an essential part of enabling the operation of the paradigms as mentioned earlier. This work proposes a method for signing messages in the distributed system by introducing a two level nodes’ hierarchy, distribution of the Public Key Generator (PKG) master key the nodes of the second level so that a distributed PKG threshold scheme is formed from those. Further, one or more second-layer leaders are selected by the nodes of the first message level in such a way that the aggregate content of the messages determines the value of the current identifier and, thus, the public key are formed by the nodes of the second level forming a distributed threshold PKG, shares of the session secret key corresponding to the identifier and the public key. The session secret key is recovered by one or more second level nodes selected as the leader, and the current message is signed using the corresponding session secret key.
Leo Eichhorn, Tanya Shreedhar, Aleksandr Zavodovski, Nitinder Mohan
Edge computing has received significant attention from both academic and industrial research circles. The paradigm aims to decentralize the existing cloud infrastructure by incorporating resources co-located alongside its client. Researchers have also proposed solutions for a fully decentralized crowdsourced compute paradigm enabled by Distributed Ledger Technologies (DLTs). This paper investigates the rationale behind DLTs over crowdsourced resource marketplaces to support the requirements of latency-critical applications targeted by edge computing. We develop a fully configurable NEtworked Blockchain emULAtor, or NEBULA, to scrutinize the internal performance bottlenecks of DLTs. We evaluate two blockchain categories - proof-based (popularly used in Bitcoin, Ethereum) and hybrid consensus and find that the enabling factor of DLTs -scale - is also its primary latency contributor. We show that, in reality, the latency overheads due to DLT operation far exceed the operational requirements of edge applications.
Gang Xu, Yibo Cao, Shiyuan Xu, Ke Xiao · 7 authors
In recent decades, log system management has been widely studied for data security management. System abnormalities or illegal operations can be found in time by analyzing the log and provide evidence for intrusions. In order to ensure the integrity of the log in the current system, many researchers have designed it based on blockchain. However, the emerging blockchain is facing significant security challenges with the increment of quantum computers. An attacker equipped with a quantum computer can extract the user's private key from the public key to generate a forged signature, destroy the structure of the blockchain, and threaten the security of the log system. Thus, blind signature on the lattice in post-quantum blockchain brings new security features for log systems. In our paper, to address these, firstly, we propose a novel log system based on post-quantum blockchain that can resist quantum computing attacks. Secondly, we utilize a post-quantum blind signature on the lattice to ensure both security and blindness of log system, which makes the privacy of log information to a large extent. Lastly, we enhance the security level of lattice-based blind signature under the random oracle model, and the signature size grows slowly compared with others. We also implement our protocol and conduct an extensive analysis to prove the ideas. The results show that our scheme signature size edges up subtly compared with others with the improvement of security level.
Andrea Lisi, Prateeti Mukherjee, Laura De Santis, Lei Wu · 6 authors
The disclosure of security vulnerabilities plays an important role in notifying vendors and the public about flaws in digital systems. Among the proposed disclosure approaches, the most utilized is Responsible Disclosure, which unfortunately suffers from several disadvantages such as fostering a false sense of security among the end-users, allowing arbitrary delays in the disclosure process, and forcing the party reporting a vulnerability to identify themselves, which has been exploited by vendors in the past through intimidation and malpractice. To address these issues, this paper presents an improved version of the Responsible Disclosure approach called Automated Responsible Disclosure (ARD) - a solution that leverages distributed ledgers and interledger technologies to automate the disclosure process while offering increased security, privacy, and transparency. A prototype implementation has been released as open-source software, and the evaluation of the solution shows that ARD is capable of addressing the key shortcomings in existing solutions and fostering more transparent vulnerability disclosure practices.
Blockchain technologies have been boosting the development of data-driven decentralized services in a wide range of fields. However, with the spirit of full transparency, many public blockchains expose all types of data to the public such as Ethereum. Besides, the on-chain persistence of large data is significantly expensive technically and economically. These issues lead to the difficulty of sharing fairly large private data while preserving attractive properties of public blockchains. Although direct encryption for on-chain data persistence can introduce confidentiality, new challenges such as key sharing, access control, and legal rights proving are still open. Meanwhile, cross-chain collaboration still requires secure and effective protocols, though decentralized storage systems such as IPFS bring the possibility for fairly large data persistence. In this paper, we propose Sunspot, a decentralized framework for privacy-preserving data sharing with access control on transparent public blockchains, to solve these issues. We also show the practicality and applicability of Sunspot by MyPub, a decentralized privacy-preserving publishing platform based on Sunspot. Furthermore, we evaluate the security, privacy, and performance of Sunspot through theoretical analysis and experiments.
This paper investigates the problem of distributed storage of electronic documents (both metadata and files) in decentralized blockchain-based b2b systems (DApps). The need to reduce the cost of implementing such systems and the insufficient elaboration of the issue of storing big data in DLT are considered. An approach for building such systems is proposed, which allows optimizing the size of the required storage (by using Erasure coding) and simultaneously providing secure data storage in geographically distributed systems of a company, or within a consortium of companies. The novelty of this solution is that we are the first who combine enterprise DLT with distributed file storage, in which the availability of files is controlled. The results of our experiment demonstrate that the speed of the described DApp is comparable to known b2c torrent projects, and subsequently justify the choice of Hyperledger Fabric and Ethereum Enterprise for its use. Obtained test results show that public blockchain networks are not suitable for creating such a b2b system. The proposed system solves the main challenges of distributed data storage by grouping data into clusters and managing them with a load balancer, while preventing data tempering using a blockchain network. The considered DApps storage methodology easily scales horizontally in terms of distributed file storage and can be deployed on cloud computing technologies, while minimizing the required storage space. We compare this approach with known methods of file storage in distributed systems, including central storage, torrents, IPFS, and Storj. The reliability of this approach is calculated and the result is compared to traditional solutions based on full backup.