Interoperation for data sharing between permissioned blockchain networks relies on networks' abilities to independently authenticate requests and validate proofs accompanying the data; these typically contain digital signatures. This requires counterparty networks to know the identities and certification chains of each other's members, establishing a common trust basis rooted in identity. But permissioned networks are ad hoc consortia of existing organizations, whose network affiliations may not be well-known or well-established even though their individual identities are. In this paper, we describe an architecture and set of protocols for distributed identity management across permissioned blockchain networks to establish a trust basis for data sharing. Networks wishing to interoperate can associate with one or more distributed identity registries that maintain credentials on shared ledgers managed by groups of reputed identity providers. A network's participants possess self-sovereign decentralized identities (DIDs) on these registries and can obtain privacy-preserving verifiable membership credentials. During interoperation, networks can securely and dynamically discover each others' latest membership lists and members' credentials. We implement a solution based on Hyperledger Indy and Aries, and demonstrate its viability and usefulness by linking a trade finance network with a trade logistics network, both built on Hyperledger Fabric. We also analyze the extensibility, security, and trustworthiness of our system.
Muneeb Ejaz, Tanesh Kumar, Ivana Kovacevic, Mika Ylianttila · 5 authors
The rapid evolution of technology allows the healthcare sector to adopt intelligent, context-aware, secure, and ubiquitous healthcare services. Together with the global trend of an aging population, it has become highly important to propose value-creating, yet cost-efficient digital solutions for healthcare systems. These solutions should provide effective means of healthcare services in both the hospital and home care scenarios. In this paper, we focused on the latter case, where the goal was to provide easy-to-use, reliable, and secure remote monitoring and aid for elderly persons at their home. We proposed a framework to integrate the capabilities of edge computing and blockchain technology to address some of the key requirements of smart remote healthcare systems, such as long operating times, low cost, resilience to network problems, security, and trust in highly dynamic network conditions. In order to assess the feasibility of our approach, we evaluated the performance of our framework in terms of latency, power consumption, network utilization, and computational load, compared to a scenario where no blockchain was used.
Identity management is the set of policies, processes, and technologies used for managing access to information systems, safeguarding digital data, and tracking system activities. The existing Identity management system is not that secure, reliable, distributed and trustworthy. All these systems containing digital information are vulnerable to getting hacked or sometimes act as a malicious entity if the data is altered on central servers. Data breaches, including confidential data, are happening regularly. Blockchain on the other hand is one of the most emerging technologies that has gained a lot of attention in the past 5-6 years. Blockchain can address most of the issues with the existing identity management system. Over few years, various dApps have been created using Blockchain Framework (leveraging PKI system) to solve the problem of Digital Identity Management, but at the same time, most of the work done is compromising the feature of decentralization (systems based on Centralization as Verifiable Credentials / Public-Private Keys are stored in the central server for verification). In this system, the authors have proposed an interoperable blockchain solution for Identity Management. The purpose of this research work is to study the feasibility of whether or not we can use interoperable blockchain solutions for Identity and Access Management. The authors were able to create a PoC for illustrating the same. This system was able to complete the authentication and verification process within 1 second, and all the necessary functions created to test the feasibility was able to execute within 1 second. Also in this system authors have achieved full decentralization.
Abdel Ali Harchaoui, Ali Younes, Abdelaaziz El Hibaoui, Ahmed Bendahmane
Proof of Retrievability (PoR) is a technique used to ensure the authenticity of data on outsourced storage services. It improves the soundness and the robustness of the data integrity scheme and allows clients to recover the remote data. Under the circumstance of considering untrusted parties including the Cloud Storage Provider (CSP) and Third Party Authenticator (TPA), incorporating PoR and zero-knowledge Proofs, which is another technique used to allow a prover to convince a verifier that a secret exists without revealing the secret itself, will ensure client integrity verification, strengthen privacy, and improve fairness to both sides. In this paper, we present, on one hand, the state-of-the-art of PoR under zero-knowledge constructs following an existing data integrity scheme taxonomy of cloud storage. We analyze the PoR scheme formalism and its similarities with zero-knowledge concepts, in addition to the techniques used to settle robustness and zero-knowledge proofs methods. On the other hand, we propose our improved taxonomy of proofs of retrievability enriched by the zero-knowledge, the cryptography model, and the cryptographic setup. The proposed taxonomy equips researchers with a tool to think about the PoR scheme from those perspectives. In the end, we state some fruitful lines of works that PoR can take advantage of; i.e Bulletproofs, Interactive Oracle Proofs, and Interactive Oracle Proofs of Proximity For Reed-Solomon.
Academic degrees are subject to corruptions, system flaws, forgeries, and imitations. In this paper we propose to develop a blockchain smart contract-based application using Ethereum Platform, to store, distribute and verify academic certificates. It constitutes a trusted, decentralized certificate’s management system that can offer a unified viewpoint for students, academic institutions, as well as for other potential stakeholders such as employers. The article describes the implementation of three main parts of our proposed solution that includes: verification application, university interface and accreditor interface. This application avoids administrative barriers, makes the process of deployment, verification, and validation of certificates faster, efficient, and more secure. Additionally, it offers confidentiality of the data by using AES encryption algorithm before creating transactions and allows bulk submission of multiple academic certificates.
Blockchain has emerged as a promising solution for secure data storage and retrieval for decentralized applications. To scale blockchain systems, a prevailing approach is to employ a hybrid storage model, where only small meta-data are stored on-chain while the raw data are outsourced to an off-chain storage service provider. The key issue for query processing in such a system is the design of gas-efficient authenticated data structure (ADS) to authenticate the query results. In this paper, we study novel ADS schemes for authenticated keyword search in hybrid-storage blockchains. We first propose the Suppressed Merkle inverted (Merkleinv) index, which maintains only a partial ADS structure on-chain that can be securely updated with a logarithm-sized cryptographic proof. Moreover, we propose a Chameleon inverted (Chameleoninv) index that leverages the chameleon vector commitment to achieve a constant maintenance cost. It is further optimized with Bloom filters to enhance the query and verification performance. We prove the security of the proposed ADS schemes and evaluate their performance using real datasets on the Ethereum platform. Experimental results show that, compared to a baseline solution, the proposed Merkleinvand Chameleoninvindexes reduce the average on-chain maintenance cost from US$10.39 down to US$2.50 and US$0.24, respectively, without sacrificing much the query performance.
Cho Nwe Zin Latt, Sandi Rahmadika, Kyung-Hyune Rhee
The Myanmar rice cycle’s existing system is still relying on a third party to manage every rice data information from several organizations. It is inconvenient to supervise simultaneously due to the unreliability of information provided by organizations. Thus, the rice cycle’s original data is challenging to be utterly trusted since irresponsible parties can manipulate the current state of information. Moreover, the applied system does not preserve a proper incentive for the involved parties. In this paper, we leverage the Ethereum blockchain to be adopted to tackle the aforementioned issues. The main objective is to build trust between parties in the Myanmar rice cycle system. Our proposed scheme allows customers to check and trace information about the rice cycle information without worrying about the integrity of the data. Furthermore, the authorized parties are also rewarded by the government through Ethereum smart contract features. Eventually, our scheme achieves traceability in the rice chain system and leads to the complete digitization and automation of the rice cycle information.
Blockchain’s versatility is primarily due to its immutable and almost indestructible nature. These attributes have caught the attention of researchers and developers interested in applications and environments where the need for the integrity of identity and content are as paramount as the safe delivery and record of transactions. Self-sovereign digital identity in particular is often cited as a human right that nation states need to embrace with as much conviction as education and lifelong learning are considered to be a public good. Although the blockchain has long been identified as an opportunity for driving much-needed change in the core processes of the education sector, use cases to date have been limited in scope and execution, with blockchain advocates and education policy makers seemingly disconnected on fundamental issues such as governance, self-sovereignty, interoperability, choice of blockchain platforms and overall trust in standards and the integrity of the infrastructure. This article is primarily interested in the affordances of the technology as a public good for the education sector. It levers on the lead author’s perspective as a mediator between the blockchain and education sectors in Europe on high-profile blockchain in education projects to provide a snapshot of the challenges and workable solutions in the blockchain-enabled, European digital credentials sector.
Robert Karaszewski, Paweł Modrzyński, Joanna Modrzyńska
Blockchain technology is currently one of the trends considered to have a tremendous future ahead. It ensures data security, data sharing protection and automation development—elements that are of colossal importance in the era of cloud solutions, big data and Internet of Things (IoT) reality. Additionally, blockchain technology allows one to create new programmable ecosystems on an unprecedented scale. The implementation of blockchain technology leads not only to improving the flow of documents and data storage, as is the case with the creation of shared service centers (SSCs), but—as this paper shows—allows one to reduce the carbon footprint when servicing SSCs at a considerably higher organizational level at the same time. The example of an SSC in Elbląg, Poland, proves that cloud solutions enabling electronic documents flow and data storage combined with blockchain technology are tools essential for further SSCs development. Furthermore, such tools allow us not only to obtain economic effects (i.e., cost reduction), but also to achieve positive ecological effects (i.e., carbon footprint reduction).
Nowadays, existing public key infrastructures (PKIs) certificate authentication suffers from many security failures. Trusted certificate authorities (CAs) can issue a valid certificate for any domain name. Although CA is supposed to be trusted by a client if the certificate issued to the client links to the chain of trust (e.g., root CA or subordinate CA). By compromising any of the latter (e.g., root CAs or subordinate CAs) an attacker can jeopardize the security of the entire system. Moreover, third-party CAs have to be trusted by domain owners. Currently, the trust is not balanced among the entities involved in the certificate authentication and issuance process (i.e., CAs and domain owners). To counter this problem approaches such as Domain authentication name entity (DANE) and Certificate Authority Authorization (CAA) offer additional securities for domain authentication. However, these approaches depend upon DNS/DNSSEC infrastructure which requires complex requirements for deployment as well as the adoption rate has been low. In this paper, we design, implement a robust and scalable domain authentication scheme based on blockchain technology with privacy-preserving features for low-constrained devices (e.g., mobile, browser, and IoT devices). The proposed system records a set of trusted CAs each associated with a specific domain in the blockchain. That is, each CA has to first verify if it is trusted to perform the actual issuance process. We compare our scheme with existing authentication methods and show that it requires less storage capacity and low bandwidth to authenticate certificates than other methods.
Blockchain mining is increasingly dominated by a few centralized mining pools [1]. Large pools can censor transactions on the blockchain and can coordinate their efforts to potentially carry out a 51% attack [2]. There have been 2 previous decentralized mining pools P2Pool and SmartPool, but both had unique limitations and are no longer actively mining. PoolParty is a novel decentralized blockchain-agnostic mining pool. By using smart-contracts to validate shares and punish miner misbehavior, as well as employing fines to disincentivize cheating, PoolParty is both secure and has low overhead operating costs. PoolParty can provide 0.05% overhead costs on Ethereum, and 0.003% overhead costs on Ethereum Classic for users with 20% pool hash-power. Finally, PoolParty can be implemented on less expensive smart contract hostable blockchains to improve scalability and overhead.
Tzung‐Her Chen, Ting-Le Zhu, Fuh-Gwo Jeng, Chien-Lung Wang
Although encryption and signatures have been two fundamental technologies for cryptosystems, they still receive considerable attention in academia due to the focus on reducing computational costs and communication overhead. In the past decade, applying certificateless signcryption schemes to solve the higher cost of maintaining the certificate chain issued by a certificate authority (CA) has been studied. With the recent increase in the interest in blockchains, signcryption is being revisited as a new possibility. The concepts of a blockchain as a CA and a transaction as a certificate proposed in this paper aim to use a blockchain without CAs or a trusted third party (TTP). The proposed provably secure signcryption scheme implements a designated recipient beforehand such that a sender can cryptographically facilitate the interoperation on the blockchain information with the designated recipient. Thus, the proposed scheme benefits from the following advantages: (1) it removes the high maintenance cost from involving CAs or a TTP, (2) it seamlessly integrates with blockchains, and (3) it provides confidential transactions. This paper also presents the theoretical security analysis and assesses the performance via the simulation results. Upon evaluating the operational cost in real currency based on Ethereum, the experimental results demonstrate that the proposed scheme only requires a small cost as a fee.
With the rapid development of blockchain technology, different types of blockchains are adopted and interoperability across blockchains has received widespread attention. There have been many cross-chain solutions proposed in recent years, including notary scheme, sidechain, and relay chain. However, most of the existing platforms do not take confidentiality into account, although privacy has become an important concern for blockchain. In this paper, we present TrustCross, a privacy- preserving cross-chain platform to enable confidential interoperability across blockchains. The key insight behind TrustCross is to encrypt cross-chain communication data on the relay chain with the assistance of trusted execution environment and employ fine-grained access control to protect user privacy. Our experimental results show that TrustCross achieves reasonable latency and high scalability on the contract calls across heterogeneous blockchains.
With the rising popularity of the Internet and the development of big data technology, an increasing number of organizations are opting to cooperate across domains to maximize their benefits. Most organizations use public key infrastructure to ensure security in accessing their data and applications. However, with the continuous development of identity-based encryption (IBE) technology, small- and medium-sized enterprises are increasingly using IBE to deploy internal authentication systems. To solve the problems that arise when crossing heterogeneous authentication domains and to guarantee the security of the certification process, we propose using blockchain technology to establish a reliable cross-domain authentication scheme. Using the distributed and tamper-resistant characteristics of the blockchain, we design a cross-domain authentication model based on blockchain to guarantee the security of the heterogeneous authentication process and present a cross-domain authentication protocol based on blockchain. This model does not change the internal trust structure of each authentication domain and is highly scalable. Furthermore, on the premise of ensuring security, the process of verifying the signature of the root certificate in the traditional cross-domain authentication protocol is improved to verify the hash value of the root certificate, thereby improving the authentication efficiency. The developed prototype exhibits generality and simplicity compared to previous methods.
Jongbeen Han, Mansub Song, Hyeonsang Eom, Yongseok Son
A blockchain wallet is a financial application which provides an interface for managing a digital asset. In the blockchain wallet, a digital signature (single or multiple signatures) is used to sign a transaction. However, the wallet is often vulnerable to security attacks when a single-signature scheme is used, and there are performance issues when a multi-signature scheme is employed. To address these issues, we propose a new efficient multi-signature wallet that improves performance, storage efficiency, and privacy without modifying the blockchain protocol. The steps in the development of the wallet are as follows, we first design a blockchain wallet that supports multi-signature as a single-signature by using a threshold elliptic curve digital signature algorithm (T-ECDSA) for high validation performance. Second, for achieving high storage efficiency and privacy, we use a bloom-filter for transactions for ensuring a small transaction size and identifying the participant of a transactions without exposing participant information. Experimental results indicate that the proposed multi-signature wallet shows higher verification performance in a blockchain, with a small transaction size compared with existing wallets.
Jongbeen Han, Heemin Kim, Hyeonsang Eom, Yongseok Son
The use of digital documents is exploding around the world due to high productivity and convenience. However, the digital documents have some security issues. For example, when a user who has the permission behaves maliciously for his/her benefit, the digital document can be easily falsified. In this paper, we propose a decentralized document management system (DDMS) to improve security of a digital document. DDMS first distributes access permission to multiple users for higher security of the document. To do this, DDMS encrypts a document via a symmetric key and splits the key via a Shamir's secret sharing scheme. And, DDMS manages each split keys using blockchian and reconstructs the complete symmetric key when the document is retrieved via a devised smart contract. We implement DDMS based on Ethereum blockchain. The experimental results show that the proposed DDMS can provide higher security with a reasonable performance overhead compared with other three types of DMSs.
In the process of sharing data, the costless replication of electric energy data leads to the problem of uncontrolled data and the difficulty of third-party access verification. This paper proposes a controlled sharing mechanism of data based on the consortium blockchain. The data flow range is controlled by the data isolation mechanism between channels provided by the consortium blockchain by constructing a data storage consortium chain to achieve trusted data storage, combining attribute-based encryption to complete data access control and meet the demands for granular data accessibility control and secure sharing; the data flow transfer ledger is built to record the original data life cycle management and effectively record the data transfer process of each data controller. Taking the application scenario of electric energy data sharing as an example, the scheme is designed and simulated on the Linux system and Hyperledger Fabric. Experimental results have verified that the mechanism can effectively control the scope of access to electrical energy data and realize the control of the data by the data owner.
Jinnan Zhang, Changqi Lu, Gang Cheng, Teng Guo · 8 authors
Edge computing is a product of the evolution of IoT and the development of cloud computing technology, providing computing, storage, network, and other infrastructure close to users. Compared with the centralized deployment model of traditional cloud computing, edge computing solves the problems of extended communication time and high convergence traffic, providing better support for low latency and high bandwidth services. With the increasing amount of data generated by users and devices in IoT, security and privacy issues in the edge computing environment have become concerns. Blockchain, a security technology developed rapidly in recent years, has been adopted by many industries, such as finance and insurance. With the edge computing capability, deploying blockchain platforms/applications on edge computing platforms can provide security services for network edge environments. Although there are already solutions for integrating edge computing with blockchain in many IoT application scenarios, they slightly lack scalability, portability, and heterogeneous data processing. In this paper, we propose a trusted edge platform to integrate the edge computing framework and blockchain network for building an edge security environment. The proposed platform aims to preserve the data privacy of the edge computing client. The design based on the microservice architecture makes the platform lighter. To improve the portability of the platform, we introduce the Edgex Foundry framework and design an edge application module on the platform to improve the business capability of Edgex. Simultaneously, we designed a series of well-defined security authentication microservices. These microservices use the Hyperledger Fabric blockchain network to build a reliable security mechanism in the edge environment. Finally, we build an edge computing network using different hardware devices and deploy the trusted edge platform on multiple network nodes. The usability of the proposed platform is demonstrated by testing the round-trip time (RTT) of several important workflows. The experimental results demonstrate that the platform can meet the availability requirements in real-world usage scenarios.
Cloud storage technology enables users to outsource local data to cloud service provider (CSP). In spite of its copious advantages, how to ensure the integrity of data has always been a significant issue. A variety of provable data possession (PDP) scheme have been proposed for cloud storage scenarios. However, the participation of centralized trusted third-party auditor (TPA) in most of the previous work has brought new security risks, because the TPA is prone to the single point of failure. Furthermore, the existing schemes do not consider the fair arbitration and lack an effective method to punish the malicious behavior. To address the above challenges, we propose a novel blockchain-based decentralized data integrity auditing scheme without the need for a centralized TPA. By using smart contract technique, our scheme supports automatic compensation mechanism. DO and CSP must first pay a certain amount of ether for the smart contract as deposit. The CSP gets the corresponding storage fee if the integrity auditing is passed. Otherwise, the CSP not only gets no fee but has to compensate DO whose data integrity is destroyed. Security analysis shows that the proposed scheme can resist a variety of attacks. Also, we implement our scheme on the platform of Ethereum to demonstrate the efficiency and effectiveness of our scheme.