Merkle Tree Research Articles

A novel blockchain based electronic health record automation system for healthcare

Technology has widespread health records that may have been digitized into electronic health records (EHRs). In the present scenario, patients ought to have their health records across multiple hospitals in the geographical area. In such case accessibility of health data from one provider to another at the right time remains a major challenge, especially when patients are in a critical condition having access to fragmented health records from multiple sources into a single chain. In this paper, blockchain smart contracts are designed so as to provide a regulated solution to the need of patients, physicians, and health service providers. The proposed system aims to exchange health information on a blockchain platform to build a smart e-health system. The proposed system launches health models namely immutable patient log creation with Modified Merkle Tree data structure for secure storage and rapid access of health records, update medical records, health information exchange between different providers, and viewership contracts on the peer to peer blockchain network. In this system, blockchain is a clinical data repository that provides patients a complete, distributed ledger record containing records of all the events and seamless access to their electronic health records through healthcare providers. As an important feature, this system provides high security and integrity through cryptographic hash functions. The work has been carried out on a number of trials to check the effectiveness of the proposed system. The qualitative and quantitative metrics of the proposed system has been measured to evaluate the performance of resources, transactions per second, and the latency of a transaction.

Ephemeral Keys Authenticated with Merkle Trees and Their Use in IoT Applications.

Public key algorithms based on quasi-cyclic binary moderate-density parity-check codes (QC-MDPCs) and QC low-density parity-check codes (QC-LDPCs) codes for key encapsulation and encryption submitted to the NIST post-quantum competition (Bit Flipping Key Encapsulation (BIKE), QC-MDPC KEM, LEDA) are vulnerable against reaction attacks based on decoding failures. To protect algorithms, authors propose to limit the key usage, in the extreme (BIKE) to only use ephemeral public keys. In some authenticated protocols, we need to combine each key with a signature, which can lead to increased traffic overhead, especially given the large signature sizes of some of the proposed post-quantum signature schemes. We propose to combine ephemeral public keys with a simple Merkle tree to obtain a server authenticated key encapsulation/transport suitable for TLS-like handshake protocols. This allows a very simple public key verification on the client, leading to efficient protocols suitable for Internet of Things applications.

New proofs of ownership for efficient data deduplication in the adversarial conspiracy model

The primitive of proofs of ownership (PoWs) enables a prover to efficiently convince a verifier that he/she indeed owns a certain message in a knowledge-proof manner. As a result, it can prevent an adversary who only has a short information of the message from accessing the whole one. We argue that the existing PoWs based on Merkle hash tree and specific encodings are not much efficient if the size of message is sufficiently huge. In this paper, we first propose a new PoW protocol based on the chameleon hash function without key exposure. Interestingly, it is equivalent to having the prover compute a new collision of chameleon hashing as the proof in our construction. Therefore, the proposed protocol is much efficient since the computation and storage overhead of proof is independent of the size of the message. Moreover, we utilize the proposed PoWs to design a deduplication scheme over ciphertext.

SEEDDUP: A Three-Tier SEcurE Data DedUPlication Architecture-Based Storage and Retrieval for Cross-Domains Over Cloud

Data deduplication has become a promising technique that significantly reduces space utilization of cloud storage servers and optimizes the network bandwidth. A variety of deduplication techniques have been proposed to enhance the cloud server’s storage efficiency. Most of the deduplication schemes do not address global indexing and user privacy issues. This paper elucidates a novel three-tier secure data deduplication architecture (referred to as SEEDDUP) for data storage and retrieval in the cloud. SEEDDUP provides data deduplication with proper indexing and user privacy. In this work, the optimal chunk size, for a given file size and format, is calculated using Cuckoo Search Algorithm. The chunk existence in the cloud is verified by the hash value generated via SHA3-512. To improve data deduplication speed, Merkle Hash Tree based MapReduce (MHTMR) is used for fast index lookup, which improves the performance at data storage and retrieval. In addition, data are encrypted based on its sensitivity level (low and high) using Niederreiter Public Key Cryptosystem. With this new SEEDDUP architecture, only legitimate users can request data successfully for limited times (k) and spurious data requests cannot be processed or handled in the cloud. Experimental results show that the proposed SEEDDUP can reduce latency, achieved good throughput and deduplication efficiency (chunk size variance and security measures) in data deduplication.

Metadata-based measurements transmission verified by a Merkle Tree

The Data Stream Processing Strategy (DSPS) is focused on the automatization of measurement projects based on a measurement framework. The measurement adapter (MA) is an architecture component located on mobile devices aims to integrate heterogeneous data sources (i.e., sensors). The Gathering Function (GF) is the component responsible for interacting and receiving measures from the MAs, and it resides on the Stream Processing Engine (SPE). MA and GF share the project definition based on a measurement framework to foster data interoperability, while MA regulates the frequency, size, and route related to data transmission. As contributions (i) The brief data message is introduced to optimize the data transmission keeping immutable the hierarchical data organization based on the project definition, and (ii) The integrity record for mobile and SPE environments is described based on a Merkle Tree. This allows optimizing each data transaction, incorporating a historical integrity record both MA and SPE. The proposals and simulations have been implemented on the cincamimis, cincamipd, mair, and pabmmcommons libraries, which are freely available on GitHub under the terms of the Apache 2.0 licence. Four simulations are explained to detail how to measures were obtained. Interesting results show that the brief data message consumes 17.50 KB to transmit 1000 measures (2.4 times smaller than JSON), while a message with 200 measures could be generated and compressed using GZIP in 25.12 ms (2.43 times faster than JSON). 196 KB is required to keep 17 min of the integrity history in a MA, being created in 4.85 ms.

MHB*T based dynamic data integrity auditing in cloud storage

Integrity audit technology is proposed to protect data in remote cloud servers from being tampered with. However, the challenge is that the computational complexity is too large for users with resource-constrained devices during integrity verification. Also, many prior works lack support for dynamic operations. In this paper, a trusted third party is employed to complete the public auditing to reduce the computational complexity of users. Meanwhile, a trusted proxy server is employed to compute the tags under the delegation of the data owner. To improve the efficiency of data retrieval and support dynamic operations, a new authentication structure is proposed by combining Merkle Hash Tree and B* tree. Based on the new authentication structure, we propose a public integrity auditing scheme, which is secure against forge attacks under the assumptions of the discrete logarithm problem and the computational Diffie-Hellman problem in bilinear groups in the random oracle model. Security analysis and experiment results show that our scheme is provably secure and has low communication complexity and computational complexity.

Distributed Internet voting architecture: A thin client approach to Internet voting

Principles required for secure electronic voting using the Internet are known and published. Although the Internet voting functionalities and technologies are well-defined, none of the existing state-sponsored Internet voting approaches in use incorporate a total Internet-based system approach that includes voter registration, the voting process, and vote counting. The distributed Internet voting architecture concept discussed in this article uses a novel thin client approach to Internet voting. The architecture uses existing technologies and knowledge to create a viable whole system approach to Internet voting. This article describes various aspects and processes necessary to support an integrated approach. The application programming interface software for many of the critical functions was developed in Python and functionality tested. A virtual network, including a cloud-based functionality, was created and used to evaluate the various conceptual aspects of the proposed architecture. This included the concepts associated with programming and accessing smart cards, capturing and saving fingerprint data, structuring virtual private networks using tunneling and Internet Protocol Security, encrypting ballots using asymmetric encryption, using symmetric encryption for secret cookies, thin client interaction, and creating hash functions to be used within a blockchain structure in a Merkle tree architecture. The systems’ primary user targets are individuals remotely located from their home voting precincts and senior citizens who have limited mobility and mostly reside in assisted living facilities. The research supports the contention that a cybersecure Internet voting system that significantly reduces the opportunity for mail-in voter fraud, helps to ensure privacy for the voter, including nonrepudiation, nonattribution, receipt freeness, and vote acknowledgment can be created using existing technology.

LiteZKP: Lightening Zero-Knowledge Proof-Based Blockchains for IoT and Edge Platforms

This article presents <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> LiteZKP <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> a framework for supporting multiple anonymous payments using a smart contract-based zero-knowledge proof (ZKP) protocol on resource-limited devices. Specifically, to address challenges related to minimizing the computational overhead and offer a fully anonymous system, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> LiteZKP <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> includes novel schemes such a new merkle tree mechanism to reduce the burden of ZKP operations, and integrates smart contract-based ZKP with an off-chain payment channel to reduce the amount of ZKP operations when performing continuous data exchange. We present evaluation results of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> LiteZKP <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> from both PC-scale and resource-limited client devices and our results suggest that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> LiteZKP <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"/> reduces the latency and energy consumption by more than 55% on Internet of Things (IoT)/mobile edge computing platforms, while requiring only 8% of block processing fee compared to a naive ZKP-based scheme.

Auditing Cache Data Integrity in the Edge Computing Environment

Edge computing allows app vendors to deploy their applications and relevant data on distributed edge servers to serve nearby users. Caching data on edge servers can minimize users' data retrieval latency. However, such cache data are subject to both intentional and accidental corruption in the highly distributed, dynamic, and volatile edge computing environment. Given a large number of edge servers and their limited computing resources, how to effectively and efficiently audit the integrity of app vendors' cache data is a critical and challenging problem. This article makes the first attempt to tackle this Edge Data Integrity (EDI) problem. We first analyze the threat model and the audit objectives, then propose a lightweight sampling-based probabilistic approach, namely EDI-V, to help app vendors audit the integrity of their data cached on a large scale of edge servers. We propose a new data structure named variable Merkle hash tree (VMHT) for generating the integrity proofs of those data replicas during the audit. VMHT can ensure the audit accuracy of EDI-V by maintaining sampling uniformity. EDI-V allows app vendors to inspect their cache data and locate the corrupted ones efficiently and effectively. Both theoretical analysis and comprehensively experimental evaluation demonstrate the efficiency and effectiveness of EDI-V.

Data Integrity Time Optimization of a Blockchain IoT Smart Home Network Using Different Consensus and Hash Algorithms

Data security is a major issue for smart home networks. Yet, different existing tools and techniques have not been proven highly effective for home networks’ data security. Blockchain is a promising technology because of the distributed computing infrastructure network that makes it difficult for hackers to intrude into the systems through the use of cryptographic signatures and smart contracts. In this paper, an architecture for smart home networks that could guarantee data integrity, robust security, and the ability to protect the validity of the blockchain transactions has been investigated. The system model is tested using various sizes of realistic datasets (30, 3 k, and 30 k to represent a small, medium, and large number of transactions, respectively). Four different consensus algorithms were considered, the conventional schemes concatenated hash transactions (CHT) and Merkle hash tree (MHT), as well as the newly proposed odd and even modified MHT (O&amp;E MHT) and modified MHT (MMHT). Moreover, 15 hash functions were also examined and compared to understand the effects of each consensus algorithms on the data integrity verification check execution time and the time optimization provided by the proposed MMHT algorithm. The results show that even though the CHT algorithm gives the lowest execution time, it is impractical for a blockchain implementation due to the requirement to copy the entire blockchain ledger in real time. Meanwhile, the O&amp;E MHT does not give any tangible benefit in the execution time. However, the proposed MMHT offers a minimum of 30% gain in time optimization than the conventional MHT algorithm typically used in blockchains. This work shows that the proposed MMHT consensus algorithm not only can identify malicious codes but has an improved data integrity check performance in smart homes, all while ensuring network stability.

Механізми інтеграції блокчейнів між собою

This paper considers the need for blockchain integration and the problems that arise along the way. The idea of transporting bitcoins by destroying them on one blockchain and creating a corresponding value on another blockchain is considered. A brief description of such concepts as bitcoin transaction and bitcoin block is given. The Merkle Tree data structure, its internal organization, and its benefits are described in detail. The algorithm for constructing a “Merkle Tree” for a block of transactions and the principle of constructing and verifying a “Merkle Path” for a given transaction are presented. Describes what is behind the concept of "proof of work" (Proof of Work) from both a technical and economic point of view. For the first time, a detailed algorithm for transporting bitcoins from one blockchain to another was proposed, which is mostly based on the data structure of the "Merkle tree" and the idea of "proof of work". The four main stages of this algorithm are given and explained. The scheme of the transaction destroying one bitcoin is resulted, its locking script is considered. A real example illustrates the creation and verification proof of existence of a transaction based on the Merkle tree. Given the detailed scheme of the transaction on the auxiliary blockchain, with its basic elements, namely: a chain of block headers, proof of existence based on the Merkle tree, encoded transaction from bitcoin blockchain. The connections between these elements are given and the algorithm of formation of the above-mentioned transaction is considered. The algorithm of transaction validation on the auxiliary blockchain from the point of view of the smart contract is considered step by step. The disadvantages of the idea of integrating blockchains with each other are described.

An improved data integrity validation model for cloud storage

Data integrity validation is considered to be an important tool to solve the problem that cloud subscribers cannot accurately know whether there are non-subjective changes in the data they upload to cloud servers. In this paper, a data integrity verification model based on dynamic successor tree index structure, Bloom filter and Merkle tree is proposed. The block labels generated according to the features of the dynamic successor tree index structure can sense whether changes have been made to the user's data, while the Merkle tree can track the cha*nged data blocks, enabling the user to effectively verify the integrity of the data stored in the cloud server and provide more effective protection for data.

Privacy preserving file auditing schemes for cloud storage using verifiable random function

Users leverage the cloud storage to store data by uploading files to the cloud storage. They can use it to share files to work on collaborative projects. However, during administrative operations by cloud storage service provider (CSSP), there may be some inadvertent corruption of files during data migration and backup. Due to heavy demands, the cloud service provider may not update the desired files immediately when requested by the owner. As a result, a user of the file may receive an obsolete file. To ensure integrity and freshness of files, third party auditing (TPA) services should be supported by CSSP while maintaining the confidentiality of user files and preserving privacy of users. In this paper, three privacy preserving auditing schemes for files stored in cloud has been proposed. Verifiable random function, merkle hash tree and ciphertext-policy attribute-based encryption has been used to achieve the desired goals.

Identity authentication-based load balancing with Merkle hash tree for secured cloud data storage

Cloud computing allows users to store and process the data in the cloud in a simple manner. However, cloud security and load balancing remain as demanding issues in cloud server. An identity authentication load balancing based Merkle hashing (IALB-MH) technique is introduced for the user to access the cloud services with unique identity (ID). Initially each cloud user sends their ID to the CS for registration. The cloud service provider checks whether the user has authenticated or not by matching the cloud user ID with the ID in CS. Therefore, a load balancing is performed by avoiding the unauthorised access to data. A Merkle hash tree is constructed to store the user data with hash values in a secured manner with minimal storage space. Experimental evaluation is carried out on load balancing efficiency, attack detection rate, space and time complexity with respect to a number of cloud users and data.

Multi cloud-based secure privacy preservation of hospital data in cloud computing

The growth of cloud computing has led to privacy concerns abundantly. Any organisation/user sends all the information to the cloud service provider and so the organisation's/user's data security is a concern. Data privacy and security issues can be solved by establishing clear policies that enable authorised data access and security. User authentication is the primary basis for access control and so using cryptographic encryption mechanism like key policy attribute-based encryption we can provide strong authentication to ensure that data can be viewed by only who have to access it. Followed by which a never compromised integrity mechanism like SHA-256 hash mechanism is used to ensure that data is not modified in transit. These hashes are concatenated in a way to form top hash by structuring in a Merkle hash tree. They are used by the erasure code to find lost data during any of the crashes. To make it efficient and to find the data loss, third party auditors are installed to check and report any changes in any of the cloud storage. Data recovery is by means of retrieving the data from another cloud that has the replica of these data.

An Enhanced Blockchain-Based IoT Digital Forensics Architecture Using Fuzzy Hash

Due to businesses’ growing use of IoT services in their day-to-day operations and the increased use of smart devices, digital forensic investigations involving such systems will need increasingly sophisticated digital evidence collection and processing. The majority of IoT systems are composed of disparate software and hardware components, which may pose security and privacy concerns. Recently, blockchain technology was presented as one of the options for achieving IoT security via the use of an immutable ledger, a decentralized architecture, and strong cryptographic primitives. Integrating blockchain platforms with IoT-based applications, on the other hand, poses a number of difficulties owing to the trustworthiness, integrity, and real-time responsiveness of IoT data. However, certain IoT devices may be incompatible with existing blockchain-based IoT forensic methods for additional digital evidence processing owing to their usage of conventional hash. A critical feature of cryptographic hash functions is that even if just one bit of the input is altered, the output acts pseudo-randomly, making it impossible to identify identical files. However, in the field of computer forensics, it is essential to locate comparable files (e.g., various versions of a file); therefore, we need a hash function that preserves similarity. It is getting more difficult to establish how forensic investigators might utilize traces from such devices. To effectively deal with IoT digital forensics applications, this article presents an improved blockchain-based IoT digital forensics architecture that uses the fuzzy hash to construct the Blockchain’s Merkle tree in addition to the conventional hash for authentication. Fuzzy hashing enables the identification of potentially damning documents that might otherwise remain undiscovered using conventional hashing techniques. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, the digital forensics investigator will be able to verify their authenticity. To support the proof of concept, we simulated the suggested model.

LineageChain: a fine-grained, secure and efficient data provenance system for blockchains

The success of Bitcoin and other cryptocurrencies is drawing significant interest to blockchains. A blockchain system implements a tamper-evident ledger for recording transactions that modify some global states. The system captures the entire evolution history of the states. The management of that history, also known as data provenance or lineage, has been studied extensively in database systems. However, querying data history in existing blockchains can only be done by replaying all transactions. This approach is applicable to large-scale, offline analysis, but is not suitable for online transaction processing. In this paper, we identify a new class of blockchain applications whose execution logics depend on provenance information at runtime. We first motivate the need for adding native provenance support to blockchains. We then present LineageChain, a fine-grained, secure and efficient provenance system for blockchains. LineageChain exposes lineage information to smart contracts runtime via simple and elegant interfaces that efficiently and securely support provenance-dependent contracts. LineageChain captures provenance during contract execution and stores it in a Merkle tree. LineageChain provides a novel skip list index designed for efficient provenance queries. We have implemented LineageChain on top of Fabric and a blockchain optimized storage system called ForkBase. Our extensive evaluation of LineageChain demonstrates its benefits to the new class of blockchain applications, its high query performance and its small storage overhead.

AudiTEE: Efficient, General-Purpose and Privacy-Preserving Audit for Distributed Ledgers

Privacy-preservation and effective auditing are two desirable but challenging requirements on distributed ledgers. To meet the requirements, this paper presents an auditing scheme, called as AudiTEE, which can audit a distributed ledger in a generic, efficient, and privacy-preserving manner. AudiTEE leverages Trusted Execution Environment (TEE) to generate confidential but auditable transactions and realize arbitrary, efficient and confidential audit on them. Unfortunately, TEE suffers from some inherent barriers and is itself not a complete solution for fast audit. To tackle these challenges, AudiTEE takes advantage of KAMT (K-anonymity Authentication Based on Merkle Tree) protocol for efficient management on account and user-defined anonymous transactions. Further, to achieve a complete and fast audit with unlinkability, TEE doesn’t process through all but only a comparatively small part of transactions according to a special ktag attached on each transaction to ensure that a user cannot hide transactions from auditor even when auditor is blind with who is involved in each transaction on the ledger. Apart from the above, AudiTEE allows flexible control on user behaviors. We implement a concrete instance of AudiTEE under a bank setting and demonstrate the scalability with all its core functionalities.

On Differential Privacy-Based Framework for Enhancing User Data Privacy in Mobile Edge Computing Environment

The potential growth in data mining has an important aspect on security due to the consideration of the data as an asset. The provisioning of protection in a public infrastructure fails to ensure privacy disclosure of an individual’s information. Differential Privacy (DP) is a promising solution for assuring privacy protection by injecting noise using the Laplace mechanism or Exponential mechanism. The access of data by analysts is performed via edge devices. A common problem identified from previous research work is the leakage of privacy at the edge layer and data accessed by unauthorized people. To address the problem, this paper proposes DP-FCNN, that implements Differential Privacy using a Fuzzy Convolution Neural Network (FCNN) with Laplace Mechanism for injecting noise. The processes handled here are data processing and query processing. The dataset is uploaded by the data owner to the data provider, who is responsible for injecting noise and then encrypting with Piccolo encryption before uploading it into the cloud. Based on the uploaded dataset, the data owner constructs a hash index from the extracted key attributes by using the BLAKE2s algorithm for performing hashing. The hash index is fed into the edge server to form a Merkle hash tree due to the data leakage at the edge is eliminated. On the other hand, requests/queries by the data analyst are authenticated by the data provider. The hash tree in the edge server then searches for the corresponding data, extracting it from the cloud and delivers it to the data analyst in an encrypted format. Every authenticated data analyst is provided with a decryption key for retrieving the query result. This is implemented using Java and the results show better efficiency in terms of scalability, processing time and accuracy.

Privacy Preserving Dynamic Provable Data Possession with Batch Update for Secure Cloud Storage

Cloud Server (CS) is an untrusted entity in cloud paradigm that may hide accidental data loss to maintain its reputation. Provable Data Possession (PDP) is a model that allows Third Party Auditor (TPA) to verify the integrity of outsourced data on behalf of cloud user without downloading the data files. But this public auditing model faces many security and performance issues such as: unnecessary computational burden on user as well as on TPA, to preserve identities of users from TPA during auditing, support for dynamic updates etc. Many PDP schemes creates computational burden either on TPA or Cloud User. To balance this overhead between TPA and User, this paper proposes Privacy-Preserving Dynamic Provable Data Possession (P2DPDP) scheme, which is based on ODPDP scheme. In ODPDP scheme, user relieves the burden by signing a contract with TPA regarding verification of his outsourced data. But this scheme generates computation overhead on TPA. To reduce this computation overhead of TPA, our P2DPDP scheme uses Indistinguishability Obfuscation (IO) with one-way function such as message authentication code to make a lightweight auditing process. P2DPDP scheme uses Rank-based Merkle Tree (RBMT) to support dynamic updates in batch mode which greatly reduces computation overhead of TPA. ODPDP lacks privacy which is maintained in P2DPDP using ring signature technique. Our experimental results demonstrate the reduced verification time and computation cost compared to existing schemes.