Chao Lin, Debiao He, Xinyi Huang, Kim‐Kwang Raymond Choo
Outsourcing computations have been widely used to meet the growing computing demands, although achieving trust in an untrusted (or a zero-trust) environment can be challenging in practice. Fair payment, a candidate solution, can potentially facilitate fair trading among outsourcing computation participants such as users and workers. However, most existing solutions including traditional e-cash-based or blockchain-based, may potentially compromise the worker’s fairness (i.e., does not achieve robust fairness, since trusted third parties are required during the trading process), or involve heavy zero-knowledge proofs (ZKPs, with significant computation costs). To mitigate these limitations, we propose a system model of an optimized blockchain-based fair payment (OBFP) for outsourcing computations. Then, we construct a ZKP-free solution based on blockchain by combining any secure commitment, accumulator, and symmetric encryption schemes, as well as a hash function. To demonstrate the utility of our proposed OBFP system, we provide security analysis, performance evaluation and a comparison with existing popular solutions. Specifically, the cryptographic tools are instantiated as commitment (Perdesen commitment), accumulator (RSA-based accumulator), and symmetric encryption (a concrete scheme with the indistinguishability under chosen-plaintext attack (IND-CPA) security), and a hash function (Keccak-256). The prototype is implemented in COSBench and Remix to analyze cloud scalability and concurrency, as well as gas cost.
operates on a blockchain full node maintained directly by the DApp owner (i.e., an in-house RPC node) or a set of nodes hosted by a third party (i.e., a third-party RPC service) intended to ease DApp deployment. Given the ever-growing blockchain states (e.g., 130 GB and 1.8 TB for a fully synced and an archived Ethereum node, respectively, as of 2018), the RPC service plays an increasingly important role in the DApp ecosystem, scaling DApp clients to low-end mobile devices and web browsers. Major blockchains today flock to roll out RPC supports, which spawn a good number of services in practice, including nine service providers (as is evaluated in this work) supporting the Ethereum's JSON-RPC interface [16], blockchain.info [5] with Bitcoin's JSON-RPC [2], dfuse.io [13] and greymass.com [39] with EOSIO's Chain API [6], stellar.org [46] with Stellar Horizon [23], etc. These services host the majority of DApps; for instance, at least 63% of Ethereum based DApps use one RPC service [10]. DApp clients RPC service JSON-RPC Block/tx synchronization Blockchain peers
Ruba Awadallah, Azman Samsudin, Je Sen Teh, Mishal Almazrooie
Due to its wide accessibility, cloud services are susceptible to attacks. Data manipulation is a serious threat to data integrity which can occur in cloud computing - a relatively new offering under the umbrella of cloud services. Data can be tampered with, and malicious actors could use this to their advantage. Cloud computing clients in various application domains want to be assured that their data is accurate and trustworthy. On another spectrum, blockchain is a tamper-proof digital ledger that can be used alongside cloud technology to provide a tamper-proof cloud computing environment. This paper proposes a scheme that combines cloud computing with blockchain that assures data integrity for all homomorphic encryption schemes. To overcome the cloud service provider's (CSP) ultimate authority over the data, the proposed scheme relies on the Byzantine Fault Tolerance consensus to build a distributed network of processing CSPs based on the client requirements. After certain computations performed by all CSPs, they produce a master hash value for their database. To ensure immutable data is produced, master hash values are preserved in Bitcoin or Ethereum blockchain networks. The master hash values can be obtained by tracking the block header address for verification purposes. A theoretical analysis of the overhead costs associated with creating master hash values for each of the cryptocurrencies is presented. We found that Ethereum leads to lower client financial costs and better online performance than Bitcoin. We also specify the data security requirements the proposed scheme provides, the ground-level implementation, and future work. The proposed verification scheme is based on public cryptocurrency as a back-end service and does not require additional setup actions by the client other than a wallet for the chosen cryptocurrency.
As cloud computing becomes more popular, research has focused on usable solutions to the problem of verifiable computation (VC), where a computationally weak device (Verifier) outsources a program execution to a powerful server (Prover) and receives guarantees that the execution was performed faithfully. A Prover can further demonstrate knowledge of a secret input that causes the Verifier’s program to satisfy certain assertions, without ever revealing which input was used. State-of-the-artZero-KnowledgeProofs of Knowledge (ZKPK) methods encode a computation using arithmetic circuits and preserve the privacy of Prover’s inputs while attesting the integrity of program execution. Nevertheless, developing, debugging, and optimizing programs as circuits remains a daunting task, as most users are unfamiliar with this programming paradigm. In this work, we present Zilch, a framework that accelerates and simplifies the deployment of VC and ZKPK for any applicationtransparently, i.e., without the need of trusted setup. Zilch uses traditional instruction sequences rather than static arithmetic circuits that would need to be regenerated for each different computation. Towards that end, we have implemented Z MIPS: a MIPS-like processor model that allows verifying each instruction independently and compose a proof for the execution of the target application. To foster usability, Zilch incorporates a novel cross-compiler from an object-oriented Java-like language tailored to ZKPK and optimized our Z MIPS model, as well as a powerful API that enables integration of ZKPK within existing C/C++ programs. In our experiments, we demonstrate the flexibility of Zilch using two real-life applications, and evaluate Prover and Verifier performance on a variety of benchmarks.
Blockchain technology is considered the most relevant technology after the internet that revolutionizes many application domains. The first generation of BC technology, BC 1.0, is used for cryptocurrency purposes; the second generation, BC 2.0, as represented by Ethereum, is an open and decentralized platform empowering the running of decentralized applications (DApps) on top of BC as a new computing paradigm. Ethereum as a BC 2.0 leader has a large development community. Its open-source feature leads to the development of several emulation tools, simulators, TestNets, and security verification tools dedicated to Ethereum-based system performance analysis. Making an adequate decision regarding the choice of the most appropriate Ethereum tool responding to the requirement of a specific system or application still requires more investigation from researchers. In this regard, this chapter presents the characteristics of the most-used Ethereum simulators, emulators, and TestNets and provides comparative studies between Ethereum simulators, TestNets, and security verification tools.
The first step to realise the true potential of blockchain systems is to explain the associated security risks and vulnerabilities. These risks and vulnerabilities, exploited by the threat agent to affect the valuable assets and services. In this work, we use a security risk management (SRM) domain model and develop a framework to explore two security risks - Sybil and Double-spending - that are observed and considered most concerning security risks within blockchain systems. The framework illustrates the protected assets or assets to secure, the classification of threats that the attacker can trigger using Sybil attack, the identification of threats that cause Double-spending, the vulnerabilities of identified threats, and their countermeasures. We evaluated a newly built framework by exploring Sybil and Double-spending risks in Ethereum-based healthcare applications. We also recognise the various other security and implementation challenges of blockchain that hinder the acceptance of blockchain-enabled solutions. Furthermore, we discuss the permissioned blockchain systems making an appearance in industry-level enterprises and how permissioned blockchain systems control these challenges. We conclude the paper and outline the future work that aims to build an ontology-based blockchain security reference model. The results of this work could help blockchain developers, practitioners, and other associated stakeholders to communicate about Sybil and Double-spending risks, what security countermeasures should be introduced, and what security and implementation challenges are emerging in blockchain systems.
Manpreet Kaur, Mohammad Zubair Khan, Shikha Gupta, Abdulfattah Noorwali · 6 authors
As Blockchain innovation picks up popularity in many areas, it is frequently hailed as a sound innovation. Because of the decentralization and encryption, many imagine that data put away in a Blockchain is and will consistently be protected. Among various abstraction layers of Blockchain architecture, the consensus layer is the core component behind the performance and security measures of the Blockchain network. Consensus mechanisms are a critical component of a Blockchain system's long-term stability. Consensus forms the core of blockchain technology. Therefore, a range of consensus protocols has been introduced to maximize Blockchain systems' efficiency and meet application domains' individual needs. This research paper describes the layered architecture of Blockchain. A comprehensive review of mainstream consensus protocols mainly Proof of Work (PoW), Proof of Stake (PoS), Delegated Proof of Stake (DPoS), Proof of Activity (PoA) is presented in the paper. These mainstream consensus protocols have been explained and detailed performance analysis of these consensus protocols has been done. We have proposed a performance matrix of these consensus protocols based on different parameters like Degree of decentralization, Latency, Fault Tolerance Rate, Scalability, etc. Consensus protocols being the core of a strong fault-tolerant secured blockchain system, the proposed work intends to help inappropriate protocol selection and further research on strengthening trust and ownership in the technology. Depending upon different parameters like decentralization which is low in POA compared to other protocols, whereas POW is non-scalable, so depending on the priority of a particular performance parameter, the paper will help in the selection of a specific protocol.
There has been a great deal of discussion of the challenges on privacy, data interoperability and quality of Educational Professional Personal Record (EPPR). Therefore, there is a need to reassess the current models, in which various parties generate, exchange and observe a huge amount of personal data with regard to EPPR. Ethereum blockchain has shown that trusted, auditable transactions is detectible using a decentralized network of nodes accompanied by a general ledger. Thus, due to the fast-moving development of educational and professional data generators such as online universities and distance learning, requires learners to engage in detail into their EPPR as well as the educational and professional data generators. In this paper, we propose a novel decentralized framework to manage EPPR using Ethereum blockchain technology. The framework provides the owner of the EPPR a comprehensive immutable log and ease of access to their educational records across the educational record editors and consumers. Furthermore, it provides a recommender engine to endorse skills and competencies to the education record owners and similar candidates for educational records editors and consumers. Ethereum blockchain can provide solutions in terms of exchanging of data among parties by ensuring privacy, accountability and data interoperability. The aim of the proposed framework is to enable educational stakeholders (universities and employing agencies) to participate in the network as blockchain miners rewarded by pseudonymized data in compliance with General Data Protection Rules in United Arab Emirates.
Verifying the integrity of IoT data in cloud-based IoT architectures is crucial for building reliable IoT applications. Traditional data integrity verification methods rely on a Trusted Third Party (TTP) that has issues of risk and operational cost by centralization. Distributed Ledger Technology (DLT) has a high potential to verify IoT data integrity and overcome the problems with TTPs. However, the existing DLTs have low transaction throughput, high computational and storage overhead, and are unsuitable for IoT environments, where a massive scale of data is generated. Recently, Directed Acyclic Graph (DAG) based DLTs have been proposed to address the low transaction throughput of linear DLTs. However, the integration of IoT Gateways (GWs) into the peer to peer (P2P) DLT network is challenging because of their low storage and computational capacity. This paper proposes Lightweight and Scalable DAG based distributed ledger for IoT (LSDI) that can work with resource-constrained IoT GWs to provide fast and scalable IoT data integrity verification. LSDI uses two key techniques: Pruning and Clustering, to reduce 1) storage overhead in IoT GWs by removing sufficiently old transactions, and 2) computational overhead of IoT GWs by partitioning a large P2P network into smaller P2P networks. The evaluation results of the proof of concept implementation showed that the proposed LSDI system achieves high transaction throughput and scalability while efficiently managing storage and computation overhead of the IoT GWs.
With the advancement of Building Information Modeling (BIM) technology, BIM gains more importance and becomes a prerequisite in building projects. BIM is useful throughout a building lifecycle; from building bid, design, construction, completion, operation, and maintenance to building demolition. However, current information exchange surrounding BIM is still limited and bound to a single participant or organization and is also limited to a particular phase in the building lifecycle. This paper aims to explore BIM information exchange among many parties involved in a secure manner using a blockchain platform throughout the whole building lifecycle. In this research, many parties involved in the building project will be able to recognize one another through deployment of a permissioned blockchain. This information exchange uses Hyperledger Composer, a permissioned blockchain running on a blockchain platform called Hyperledger Fabric. Our experiment shows that BIM information exchange could be further improved. In this study, BIM information exchange can be implemented not only in one building phase but throughout the whole building lifecycle. It also facilitates BIM information exchange among multiple participants in a secure manner via a permissioned blockchain.
Junhoo Park, Hyekjin Kim, Geunyoung Kim, Jae‐Cheol Ryou
As blockchain-based applications and research such as cryptocurrency increase, an oracle problem to bring external data in the blockchain is emerging. Among the methods to solve the oracle problem, a method of configuring oracle based on TLS, an existing internet infrastructure, has been proposed. However, these methods currently have the disadvantage of not supporting privacy protection for external data, and there are limitations in configuring the process of a smart contract based on external data verification for automation. To solve this problem, we propose a framework consisting of middleware of external source server, data prover, and verification contract. The framework converts the data signed in the web server into a proof that the owner can prove with zk-SNARKs and provides a smart contract that can verify this. Through these procedures, data owners not only protect their privacy by proving themselves, but they can also automate on-chain processing through smart contract verification. For the proposed framework, we create a proof using libsnark for server data and show the performance and cost to verify with Solidity the smart contract language of the Ethereum platform.
Imagechain is a cryptographic structure that chain digital images with hash links. The most important feature, which differentiates it from blockchain, is that the pictures are not stored inside the blocks. Instead, the block and the image are combined together in the embedding process. Therefore, the imagechain is built from standard graphic files that may be used in the same way as any other image, but additionally, each of them contains a data block that links it to a previous element of the chain. The presented solution does not require any additional files except the images themselves. It supports multiple file formats and embedding methods, which makes it portable and user-friendly. At the same time, the scheme provides a high level of security and resistance to forgery. This is achieved by hashing the whole file with embedded data, so the image cannot be altered or removed from the chain without losing integrity. This article describes the basic concept of an imagechain together with building blocks and applications. The two most important issues are embedding methods and block structure.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Ammar Ibrahim El Sayed, Mahmoud Abdel Aziz, Mohamed Hassan Abdel Azeem
IoT adds more flexibility in many areas of applications to makes it easy to monitor and manage data instantaneously. However, IoT has many challenges regarding its security and storage issues. Moreover, the third-party trusting agents of IoT devices do not support sufficient security level between the network peers. This paper proposes improving the trust, processing power, and storage capability of IoT in distributed system topology by adopting the blockchain approach. An application, IoT Trust Management (ITM), is proposed to manage the trust of the shared content through the blockchain network, e.g., supply chain. The essential key in ITM is the trust management of IoT devices data are done using peer to peer (P2P), i.e., no third-party. ITM is running on individual python nodes and interact with frontend applications creating decentralized applications (DApps). The IoT data shared and stored in a ledger, which has the IoT device published details and data. ITM provides a higher security level to the IoT data shared on the network, such as unparalleled security, speed, transparency, cost reduction, check data, and Adaptability.