Consortium blockchain has been widely used in different scenarios, where blockchain members demand that their uploaded data could be audited under their identities without exposing the data themselves. However, so far, no solution of privacy-preserving data auditing has been proposed. To address the problem, we propose zkrpChain, which focuses on protection of the integrity and privacy of the data uploaded by blockchain members while leaving their identities public. In zkrpChain, which is based on Hyperledger Fabric and Bulletproofs, both standard-range and arbitrary-range zero-knowledge range proofs generation and verification are supported. To improve the efficiency, the aggregation of multiple proofs and batch verification are also developed. For further development, we provide the client codes, chaincodes and related APIs. Finally, we conduct experiments to evaluate the performance of zkrpChaln, and the results show that the consumed time (in an 8-thread scheme) of chaincodes and needed on-chain space of zkrpChain are very close to Bulletproofs, which is evaluated in a single-machine environment.
Proof-of-work (PoW) based blockchain protocols, are protocols that organize data into blocks, connected through the use of a hash function to form chains, and which make use of PoW to reach agreement, i.e., proofs that require spending some amount of computational power to be generated. This type of protocols rose into prominence with the advent of Bitcoin, the first protocol that provably implements a distributed transaction ledger against an adversary that controls less than half of the total computational power in the network, in a setting where protocol participants join and leave dynamically without the need for a registration service. Protocols in this class were also the first to be shown sufficient to solve consensus under similar conditions, a problem of fundamental importance in distributed computing. In this thesis, we explore foundational issues of PoW-based blockchain protocols that mainly have to do with the assumptions required to ensure their safe operation. We start by examining whether a common random string that is shared at the start of the protocol execution among the protocol participants is required to efficiently run such protocols. Bitcoin's security is based on the existence of such a string, called the genesis block. On the other hand, protocols found in previous works that do not assume such a setup are inefficient, in the sense that their round complexity strongly depends on the number of protocol participants. Our first contribution is the construction of efficient PoW-based blockchain protocols that provably implement a distributed ledger and consensus without such setup. Next, we turn our attention to the PoW primitive. All previous analyses model PoW using a random oracle. While satisfactory as a sanity check, the random oracle methodology has received significant criticism and shown not to be sound. We make progress by introducing a non-idealized security model and appropriate computational assumptions that are sufficient to implement a distributed ledger or consensus when combined with the right PoW-based protocol. Finally, we analyze GHOST, a recently proposed blockchain protocol, and prove its security against a byzantine adversary under similar assumptions as Bitcoin. Previous works only considered specific attacks.
Mbarek Marwan, Abdelkarim Ait Temghart, Fatima Sifou, Feda AlShahwan
The integration of cloud computing and Internet of Things (IoT) offers a promising, rich platform for data collection and analysis in smart healthcare. In such a model, IoT devices collect data about patient health status through multiple intelligent sensors, whereas cloud offers scalable resources to quickly meet workload demands. Despite these remarkable improvements, the current architectures do not sufficiently address the security needs for patient medical records. In this perspective, and bearing in mind the specific characteristics of each technology, we propose a distributed security mechanism in a way that fits with IoT and cloud constraints. Our contribution to secure cloud-enabled IoT is twofold. First, we rely on OM-AM (Objective, Model, Architecture and Mechanism) for modeling and analysing the security and privacy requirements of smart healthcare. Second, we use blockchain architecture along with Attribute-Based Access Control (ABAC) model as a decentralized flexible system to support access control decisions. In particular, we rely on XACML (eXtensible Access Control Markup Language) to easily build and implement robust policies required for maintaining a secure IoT-based environment. The novelty of the proposed framework lies at smartly leveraging the recent technologies to keep health information confidential. In fact, putting blockchain and IoT together would undoubtedly create a totally new solution for remote patient monitoring. The simulation results show that the proposal is an efficient way of implementing ubiquitous and cognitive tools for smart healthcare systems.
In the cryptocurrency era, Blockchain is one of the expeditiously growing information technologies that help in providing security to the data. Data tampering and authentication problems generally occur in centralized servers while sharing and storing the data. Blockchain provides the platform for big data and cloud storage in enhancing the security by evading from pernicious users. In this paper, we have discussed the exhaustive description of blockchain and its need, features and applications. Analysis of blockchain is done for different domains such as big data, cloud, internet of things and mobile cloud where the differences V’s are compared with big data and blockchain. SWOT (Strength Weakness Opportunities Threats) analysis is performed to address the merits and limitations in blockchain technology. The survey in aspects of data security, data storage, data sharing and data authentication through blockchain technology is done and the challenges are discussed to overcome the problem that leads in big data and cloud storage. The detailed comparative analysis proves that the blockchain technology overcomes the problems in big data storage and data security in cloud.
We as a whole realize that blockchain is a procedure of bitcoin which is one of the most well-known technique for digital money that permit circulated add just open record all exchanges to be recorded. Appropriated agreement convention which depends on motivating force good evidence of work gives abnormal state of security this all framework and is controlled by a system hub called miners. Miners sincerely keep up the blockchain so as to get motivators. Bitcoin dispatch in 2009, its economy has developed at a tremendous rate, and it is presently worth about170 billions of dollars. This widespread rise in the market estimation of bitcoin incite enemies to achieve bad marks for benefit, and specialists to find new presentation in the framework, propose cure, and anticipate up and coming procedure. In this chapter, we present a dealt with examination that covers the security and assurance parts of bitcoin. Our strategy initially started from chart of Bitcoin Protocol, second critical portions of bitcoin, third parts convenience and last sections interchanges inside the system. The present chapter in bitcoin and its fundamental noteworthy progressions, for instance, blockchain-based agreement tradition lead to the execution of various security perils to the normal handiness of bitcoin. We discuss about the handiness and soundness of the front-line security courses of action. Moreover, we present current assurance and absence of definition examinations in bitcoin and analyze the security-related threats to bitcoin customers close by the examination of the 224 present security shielding courses of action. Finally, we format the essential open troubles and propose rules for future research toward furnishing firm security and assurance frameworks for bitcoin.
Blockchain, an emerging paradigm of secure and shareable computing, is a systematic integration of 1) chain structure for data verification and storage, 2) distributed consensus algorithms for generating and updating data, 3) cryptographic techniques for guaranteeing data transmission and access security, and 4) automated smart contracts for data programming and operations. However, the progress and promotion of Blockchain have been seriously impeded by various security issues in blockchain-based applications. Furthermore, previous research on blockchain security has been mostly technical, overlooking considerable business, organizational, and operational issues. To address this research gap from the perspective of information systems, we review blockchain security research in three levels, namely, the process level, the data level, and the infrastructure level, which we refer to as the PDI model of blockchain security. In this survey, we examine the state of blockchain security in the literature. Based on the insights obtained from this initial analysis, we then suggest future directions of research in blockchain security, shedding light on urgent business and industrial concerns in related computing disciplines.
The General Purpose Atomic Crosschain Transaction protocol allows composable programming across multiple Ethereum blockchains. It allows for inter-contract and inter-blockchain function calls that are both synchronous and atomic: if one part fails, the whole call execution tree of function calls is rolled back. The protocol operates on existing Ethereum blockchains without modification. It works for both public permissioned and consortium blockchains. Additionally, the protocol is expected to work across heterogeneous blockchains other than Ethereum. This paper describes the protocol, analyses it in terms of Gas usage and Finalised Block Periods for three scenarios: reading a value from one blockchain to another, writing a value from one blockchain to another, and a trade finance system involving five contracts on five blockchains with a complex call execution tree, and provides an initial security analysis that shows that the protocol has Safety and Liveness properties.
Blockchain technology has a wide scope of applicability for accounting and auditing purposes, separate from Bitcoin or other cryptocurrencies. However, although blockchain technology is identified as a popular topic within the field, there currently exists a lack of consensus on how it will be realistically applied. This paper aims to map the presently existing international auditing literature and offer clarity to an otherwise heterogeneous field. The mapping analysis will aid in examining the underlying theme employed within studies. Through the use of the Bibliometrix R-Package "Biblioshiny", a sample of 112 studies were downloaded from the Web of Science Core Collection and analyzed. This study's results show that the topic has gained increased international popularity and separated into distinct research streams; Encrypted Private and Secure Information Sharing, Distributed Ledger, Smart Contracts, Continuous Audit, Audit Trail and Tokenization. However, there still exists a research gap that must be addressed to hasten the adoption of blockchain technology in auditing.
Nov 23, 2020·The international archives of the photogrammetry, remote sensing and spatial information sciences/International archives of the photogrammetry, remote sensing and spatial information sciences
Kazım Onur TOKA, Yılmaz Dikilitaş, Talha Oktay, Ahmet Sayar
Abstract. IoT is becoming ubiquitous in industry, homes, cities, literally in every aspect of our daily lives. Securing IoT-based systems is difficult because of deficiencies in the very nature of IoT devices such as limited battery power, processing, and storage, etc. Blockchain is a new approach used to securely record transactions and offers potential solutions to computer and internet security issues such as confidentiality, integrity, availability, authentication, authorization, and accountability. Blockchain, as a decentralized ledger consisting of interconnected blocks, can remedy most of the security deficiencies of heavily IoT based systems. The Hyperledger Fabric blockchain network used in this study provides confidentiality, data integrity, authentication, and data security for data obtained from IoT devices. Widely used IoT data transfer MQTT protocol is included in the proposed approach. The approach is demonstrated in a simple demo Hyperledger network with simulated IoT devices. The proposed approach is discussed in terms of network security dimensions. Based on the features of the Hyperledger Blockchain network, it is displayed that the IoT security deficiencies can largely be remedied with the proposed approach.
Proof of Stake (PoS) blockchain protocols emerged as a promising alternative to the largely energy-wasteful proof of work mechanisms currently in place. In contrast to computing power, however, “stake” is a virtual resource that can be replicated or reused, opening the door to attack vectors that have no counterpart in a PoW setting, and are much harder to defeat. We present PoTS (Proof of TEE-Stake), a novel PoS protocol that leverages properties of trusted execution environments (TEEs) to limit the attack surface of malicious validators, and employs techniques such as forward security to guarantee protection against posterior-corruption attacks. We show that PoTS is secure against nothing at stake, grinding, and long range attacks down to realistic hardware assumptions on TEE and well-established cryptographic assumptions, and retains reasonable security even in face of compromised TEEs. We evaluate the performance of our proposal by means of implementation. Our evaluation results demonstrate that PoTS offers an excellent trade-off between security and performance.
Sujit Biswas, Kashif Sharif, Fan Li, Iqbal Alam · 5 authors
The use of the Internet of Things and modern technologies has boosted the expansion of e-health solutions significantly and allowed access to better health services and remote monitoring of patients. Every service provider usually implements its information system to manage and access patient data for its unique purpose. Hence, the interoperability among independent e-health service providers is still a major challenge. From the structure of stored data to its large volume, the design of each such big data system varies, hence the cooperation among different e-health systems is almost impossible. In addition to this, the security and privacy of patient information is a challenging task. Building a unified solution for all creates significant business and economic issues. In this article, we present a solution to migrate existing e-health systems to a unified Blockchain-based model, where access to large scale medical data of patients can be achieved seamlessly by any service provider. A core blockchain network connects individual & independent e-health systems without requiring them to modify their internal processes. Access to patient data in the form of digital assets stored in off-chain storage is controlled through patient-centric channels and policy transactions. Through emulation, we show that the proposed solution can interconnect different e-health systems efficiently.
With the proliferation of information and communication technology in every walks of the society, including healthcare services, digitization, and increased sophistication have been gaining pace, digital healthcare alternatives such as electronic healthcare record (EHR) have gained prominence with increased patients' data volume. However, traditional EHR-based systems are plagued by data loss risks, security and immutability consensus over health records, gapped communication among constituted hospitals, and inefficient clinical data retrieval systems, among others. Blockchain has been developed as a decentralized technology that holds the promise to address the aforesaid facilities in EHR-based systems. This article presents a patient-centric design of a decentralized healthcare management system with blockchain-based EHR using javascript-based smart contracts. A working prototype based on hyperledger fabric and composer technology has also been implemented which guarantees the security of the proposed model. Experiments with the hyperledger caliper benchmarking tool provide performance such as latency, throughput, resource utilization, and so on under varied scenarios and control parameters. The results affirm the efficacy of the proposed approach.
ML-as-a-service (MLaaS) becomes increasingly popular and revolutionizes the lives of people. A natural requirement for MLaaS is, however, to provide highly accurate prediction services. To achieve this, current MLaaS systems integrate and combine multiple well-trained models in their services. Yet, in reality, there is no easy way for MLaaS providers, especially for startups, to collect sufficiently well-trained models from individual developers, due to the lack of incentives. In this article, we aim to fill this gap by building up a model marketplace, called as Golden Grain, to facilitate model sharing, which enforces the fair model-money swapping process between individual developers and MLaaS providers. Specifically, we deploy the swapping process on the blockchain, and further introduce a blockchain-empowered model benchmarking process for transparently determining the model prices according to their authentic performances, so as to motivate the faithful contributions of well-trained models. Especially, to ease the blockchain overhead for model benchmarking, our marketplace carefully offloads the heavy computation and designs a secure off-chain on-chain interaction protocol based on a trusted execution environment (TEE), for ensuring both the integrity and authenticity of benchmarking. We implement a prototype of our Golden Grain on the Ethereum blockchain, and conduct extensive experiments using standard benchmark datasets to demonstrate the practically affordable performance of our design.
Abhinaw Sai Erri Pradeep, Robert Amor, Tak Wing Yiu
Information exchange in a building information modelling (BIM) environment is critical yet complex due to the multi-party collaboration nature of a construction project. Uncoordinated workflows with a limited structure for approvals leave the exchange transactions prone to contractual, legal, and security challenges. In contrast to most studies that investigated paper-based solutions that are often insufficient, this study explores a blockchain technology (BCT) based solution to improve trust in data exchange in BIM following a case-study analysis of a commercial tool called BIMCHAIN. With the use of literature review and qualitative content analysis, the paper builds a list of essential functional requirements of an effective blockchain tool integrated into a BIM workflow. Subsequently, based on the technical documentation and the application’s beta version, the tool is analyzed to understand its value proposition and its functional appropriateness to address the mentioned challenges. The research has shown that there are eight key functional requirements from a blockchain tool that may address the above challenges. The analysis of BIMCHAIN concluded that it accomplishes most of its objectives, such as improving data reliability, limiting the scope of liability, and clarifying stakeholder responsibilities, among others. However, the legal validity of the tool’s proofs are still untested to establish its acceptance, and it does not completely justify its claims of ‘better quality of data’ as this is a function of many other factors. The tool includes four of the eight requirements from the list identified and satisfies two requirements partially. BIMCHAIN is only in its beta testing stage and has shown evidence of how BCT can be leveraged in a BIM environment. Further investigation can include evaluation of this tool in a real project and conduct a more detailed research on the functional requirements of blockchain in BIM.
As cloud storage services have become popular nowadays, the integrity of outsourced data stored at untrusted servers received increased attention. Provable data possession (PDP) provides an effective and efficient solution for cloud data integrity by asking the cloud server to prove that the stored data are not tampered with or maliciously discarded without returning the actual data to users. In this article, we propose an efficient identity-based privacy-preserving provable data possession scheme (ID-P$^3$DP) based on the RSA assumption for secure cloud storage. In ID-P$^3$DP, a cloud user takes the outsourcing file and a global parameter in a time period as inputs to generate identity-based homomorphic authenticators, and any third-party auditor (TPA) can check the integrity of the outsourced file by verifying the validity of homomorphic authenticators. The distinguished feature of ID-P$^3$DP is to support the aggregation of identity-based homomorphic authenticators generated by different users under the RSA assumption, which is an open problem in provable data possession. Specifically, we transfer the identity-based homomorphic authenticators generated in distinct time periods into those with the same period parameter, and the cloud can compress the homomorphic authenticators of different users to generate a data possession proof for integrity verification. Besides, by exploiting zero-knowledge proof, the leakage of outsourced data to TPA can be prevented. The soundness of ID-P$^3$DP is proved based on the RSA assumption, and the privacy against TPA is perfectly preserved. Finally, we demonstrate ID-P$^3$DP is more efficient on integrity verification than the existing BLS-based schemes, and cross-user aggregate verification can significantly reduce computational and communication overhead for TPA.
Social Internet of Things (SIoT) integrates the social concept into the Internet of Things (IoT) for enhancing the efficiency of services. Due to the increasing scale of the network and the intellectualization of IoT objects, the development of SIoT has also been accompanied by the issue of trust management which is crucial to the security and reliability of the system. The definition and evaluation of the trustworthiness of objects are vital to build cooperation among objects. In this paper, we employ the blockchain technology to address the trust management issue in SIoT. Blockchain will be adopted as an underlying support technology for trust-related data storage and retrieval. Moreover, we present a flexible and adaptive trust computation method to enhance the reliability of objects’ trustworthiness evaluation. The simulated experiment results demonstrate that the proposed blockchain-based method enhances the effectiveness and security of trust management in SIoT.
Smart contracts encode critical application logic for realizing digital agreements in a tamper-proof form. Blockchains guarantee that smart contracts cannot be altered after the first deployment and that the execution is strictly followed. Smart contracts can only operate on data available on-chain. Oracles are bridging the gap between on-chain and off-chain data. Oracles introduce a wide range of security risks, which were already exploited in publicly known hacks. In this paper OraclesLink is proposed, which is a secure and developer-friendly architecture for using oracles within smart contracts. The goal of the architecture is to eliminate single points of failure and single sources of truth through distribution. In order to demonstrate feasibility, a proof-of-concept implementation is provided.
The Electronic Medical Record (EMR) management system currently used by healthcare institutions has security concerns for data sharing and access control. To address these issues, we have proposed a security and privacy management scheme for blockchain-based EMR called GAC-PSPR (Granular Access Control supporting Privilege Separation and Property Revocation). The GAC-PSPR scheme uses a dual chain structure of private blockchain and consortium blockchain. The technology of permission separation and property revocation ensures that data cannot be arbitrarily modified, thus solving the security problem of access control. Protect data privacy by protecting against quantum attacks with Number Theory Research Unit (NTRU) encryption. Besides, we have proposed a ring signature solution based on the lattice to address the issue of too large signatures and the key lengths that secures the sharing of EMR data. We provide extensive security analysis and performance analysis to demonstrate that the GAC-PSPR scheme is effective and secure.
Many Blockchain-as-a-Service (BaaS) providers have emerged with the growing interest in BaaS among enterprises. However, current BaaS providers can pose a potential security threat in the context of a centralized service provider and for clients that depend on the provider. In this study, we first consider the problem of auditing BaaS and develop an Enforcer architecture for trustworthy BaaS.
Recently, blockchain technology has received substantial attention from researchers and developers. Although some research explores the uses of the blockchain and practice it in the real world, blockchain has not yet been applied widely in the education area. The goal of this research is to present an academic records verification platform which is cost-effective and secure based on the blockchain. Previous research on the applications of the blockchain and the RSA algorithm lays a strong foundation for this study. The decentralized nature of the blockchain is utilized to testify the academic honesty of students, and RSA algorithm protects the privacy of individuals. Plus, the demands of different groups of people contribute to constructing a user-friendly platform. Next, the framework of the platform is presented, including the procedures of verification and query, and the traditional platform of student record verification and this platform are compared. Lastly, the conclusion analyzes the efficiency and explains the way how the platform is useful to people and a few limitations existing in the practice of the platform. This research studys established papers to analyze novel technology, the demands of people and the analysis of traditional platform for proposing a novel framework of the student record verification platform. The result shows that the platform is more cost-effective and convenient than conventional way of verification.
Felipe Zimmerle da N. Costa, Ruy J. G. B. de Queiroz
Distributed consensus and Blockchains are popular among the cryptocurrencies where no one except the coin users, owns the data and transactions. No different to open source repositories, where the data belongs to the users. In this work, we present a way of having a repository for software packages in a Blockchain with distributed consensus, supported by the idea of the also demonstrated proof-of-download.
Conventional blockchain implementations with append-only semantics do not support deleting or overwriting data in confirmed blocks. However, many industry-relevant use cases require the ability to delete data, especially when personally identifiable information is stored or when data growth has to be constrained. Existing attempts to reconcile these contradictions compromise on core qualities of the blockchain paradigm, as they include backdoor-like approaches such as central authorities with elevated rights or usage of specialized chameleon hash algorithms in chaining of the blocks. The contribution of this paper is a novel architecture for the blockchain ledger and consensus, which uses a tree of context chains with simultaneous validity. A context chain captures the transactions of a closed group of entities and persons, thus structuring blocks in a precisely defined way. The resulting context isolation enables consensus-steered deletion of an entire context without side effects to other contexts. We show how this architecture supports truncation, data rollover and separation of concerns, how the GDPR regulations can be fulfilled by this architecture and how it differs from sidechains and state channels.
Christian Rondanini, Barbara Carminati, Federico Daidone, Elena Ferrari
Nowadays, organizations need to set higher and higher business goals in order to cope with market requirements. Indeed, a widespread strategy for organizations is to join in inter-organizational processes, which set collaborations and resource sharing among involved organizations. However, the possible lack of trust among the organizations poses relevant issues on the processing of sensitive resources. A promising approach to cope with this issue is leveraging on blockchain technology. Thanks to its design and consensus algorithm, blockchain provides a trustworthy infrastructure that allows partners involved in the collaboration to monitor and perform audits on the workflow transitions. In general, the focus of the existing blockchain-based workflow management solutions is mainly workflow coordination. However, a challenging characteristic of some workflows is that they require the exchange of a big amount of data that has to be managed off-chain, that is, directly exchanged between data producer and consumer. This off-chain data sharing should be secured and controlled such to follow the workflow execution.To cope with this challenge, in this paper, we propose a controlled information sharing in inter-organizational workflows enforced via smart contracts. Smart contracts are designed to coordinate the workflow execution, as well as to deploy a set of authorizations granting access only to the task executor and only to those resources needed for task execution and only during the task activation. We have also run a set of experiments to show the feasibility of our approach.