Secure Protocols for Privacy-preserving Data Outsourcing, Integration, and Auditing

As the amount of data available from a wide range of domains has increased tremendously in recent years, the demand for data sharing and integration has also risen. The cloud computing paradigm provides great flexibility to data owners with respect to computation and storage capabilities, which makes it a suitable platform for them to share their data. Outsourcing person-specific data to the cloud, however, imposes serious concerns about the confidentiality of the outsourced data, the privacy of the individuals referenced in the data, as well as the confidentiality of the queries processed over the data. Data integration is another form of data sharing, where data owners jointly perform the integration process, and the resulting dataset is shared between them. Integrating related data from different sources enables individuals, businesses, organizations and government agencies to perform better data analysis, make better informed decisions, and provide better services. Designing distributed, secure, and privacy-preserving protocols for integrating person-specific data, however, poses several challenges, including how to prevent each party from inferring sensitive information about individuals during the execution of the protocol, how to guarantee an effective level of privacy on the released data while maintaining utility for data mining, and how to support public auditing such that anyone at any time can verify that the integration was executed correctly and no participants deviated from the protocol. In this thesis, we address the aforementioned concerns by presenting secure protocols for privacy-preserving data outsourcing, integration and auditing. First, we propose a secure cloud-based data outsourcing and query processing framework that simultaneously preserves the confidentiality of the data and the query requests, while providing differential privacy guarantees on the query results. Second, we propose a publicly verifiable protocol for integrating person-specific data from multiple data owners, while providing differential privacy guarantees and maintaining an effective level of utility on the released data for the purpose of data mining. Next, we propose a privacy-preserving multi-party protocol for high-dimensional data mashup with guaranteed LKC-privacy on the output data. Finally, we apply the theory to the real world problem of solvency in Bitcoin. More specifically, we propose a privacy-preserving and publicly verifiable cryptographic proof of solvency scheme for Bitcoin exchanges such that no information is revealed about the exchange's customer holdings, the value of the exchange's total holdings is kept secret, and multiple exchanges performing the same proof of solvency can contemporaneously prove they are not colluding

Fusion: Privacy-preserving distributed protocol for high-dimensional data mashup

© 2015 IEEE. In the last decade, several approaches concerning private data release for data mining have been proposed. Data mashup, on the other hand, has recently emerged as a mechanism for integrating data from several data providers. Fusing both techniques to generate mashup data in a distributed environment while providing privacy and utility guarantees on the output involves several challenges. That is, how to ensure that no unnecessary information is leaked to the other parties during the mashup process, how to ensure the mashup data is protected against certain privacy threats, and how to handle the high-dimensional nature of the mashup data while guaranteeing high data utility. In this paper, we present Fusion, a privacy-preserving multi-party protocol for data mashup with guaranteed LKC-privacy for the purpose of data mining. Experiments on real-life data demonstrate that the anonymous mashup data provide better data utility, the approach can handle high dimensional data, and it is scalable with respect to the data size

BroncoVote: Secure Voting System Using Ethereum’s Blockchain

Voting is a fundamental part of democratic systems; it gives individuals in a community the faculty to voice their opinion. In recent years, voter turnout has diminished while concerns regarding integrity, security, and accessibility of current voting systems have escalated. E-voting was introduced to address those concerns; however, it is not cost-effective and still requires full supervision by a central authority. The blockchain is an emerging, decentralized, and distributed technology that promises to enhance different aspects of many industries. Expanding e-voting into blockchain technology could be the solution to alleviate the present concerns in e-voting. In this paper, we propose a blockchain-based voting system, named BroncoVote, that preserves voter privacy and increases accessibility, while keeping the voting system transparent, secure, and cost-effective. BroncoVote implements a university-scaled voting framework that utilizes Ethereum’s blockchain and smart contracts to achieve voter administration and auditable voting records. In addition, BroncoVote utilizes a few cryptographic techniques, including homomorphic encryption, to promote voter privacy. Our implementation was deployed on Ethereum’s Testnet to demonstrate usability, scalability, and efficiency

SafePath: Differentially-private publishing of passenger trajectories in transportation systems

© 2018 Elsevier B.V. In recent years, the collection of spatio-temporal data that captures human movements has increased tremendously due to the advancements in hardware and software systems capable of collecting person-specific data. The bulk of the data collected by these systems has numerous applications, or it can simply be used for general data analysis. Therefore, publishing such big data is greatly beneficial for data recipients. However, in its raw form, the collected data contains sensitive information pertaining to the individuals from which it was collected and must be anonymized before publication. In this paper, we study the problem of privacy-preserving passenger trajectories publishing and propose a solution under the rigorous differential privacy model. Unlike sequential data, which describes sequentiality between data items, handling spatio-temporal data is a challenging task due to the fact that introducing a temporal dimension results in extreme sparseness. Our proposed solution introduces an efficient algorithm, called SafePath, that models trajectories as a noisy prefix tree and publishes ϵ-differentially-private trajectories while minimizing the impact on data utility. Experimental evaluation on real-life transit data in Montreal suggests that SafePath significantly improves efficiency and scalability with respect to large and sparse datasets, while achieving comparable results to existing solutions in terms of the utility of the sanitized data

A Certificateless One-Way Group Key Agreement Protocol for End-to-End Email Encryption

Over the years, email has evolved into one of the most widely used communication channels for both individuals and organizations. However, despite near ubiquitous use in much of the world, current information technology standards do not place emphasis on email security. Not until recently, webmail services such as Yahoo\u27s mail and Google\u27s gmail started to encrypt emails for privacy protection. However, the encrypted emails will be decrypted and stored in the service provider\u27s servers. If the servers are malicious or compromised, all the stored emails can be read, copied and altered. Thus, there is a strong need for end-to-end (E2E) email encryption to protect email user\u27s privacy. In this paper, we present a certificateless one-way group key agreement protocol with the following features, which are suitable to implement E2E email encryption: (1) certificateless and thus there is no key escrow problem and no public key certificate infrastructure is required; (2) one-way group key agreement and thus no back-and-forth message exchange is required; and (3) n-party group key agreement (not just 2- or 3-party). This paper also provides a security proof for the proposed protocol using proof by simulation . Finally, efficiency analysis of the protocol is presented at the end of the paper

Provisions: Privacy-preserving proofs of solvency for Bitcoin exchanges

Bitcoin exchanges function like banks, securely holding their customers\u27 bitcoins on their behalf. Several exchanges have suffered catastrophic losses with customers permanently losing their savings. A proof of solvency demonstrates that the exchange controls sufficient reserves to settle each customer\u27s account. We introduce Provisions, a privacy-preserving proof of solvency whereby an exchange does not have to disclose its Bitcoin addresses; total holdings or liabilities; or any information about its customers. We also propose an extension which prevents exchanges from colluding to cover for each other\u27s losses. We have implemented Provisions and show that it offers practical computation times and proof sizes even for a large Bitcoin exchange with millions of customers

Variance: Secure Two-Party Protocol for Efficient Asset Comparison in Bitcoin

Secure multiparty protocols are useful tools for parties wishing to jointly compute a function while keeping their input data secret. The millionaires\u27 problem is the first secure two-party computation problem, where the goal is to securely compare two private numbers without a trusted third-party. There have been several solutions to the problem; however, these solutions are either insecure in the malicious model or cannot verify the validity of inputs. In this paper, we introduce Variance, a privacy-preserving two-party protocol for solving Yao\u27s millionaires\u27 problem in a Bitcoin setting, in which each party controls several Bitcoin accounts (single and multi signature addresses) and they want to find out who owns more bitcoins without revealing (1) how many accounts they own or the addresses associated with their accounts, (2) the balance of any of their accounts, and (3) their total wealth of bitcoins while assuring the other party that they are not claiming more bitcoin than they possess. We utilize zero knowledge proofs to provide a solution to the problem, and subsequently prove that Variance is secure against active adversaries in the malicious model

Decentralized Secure Framework for Sharing and Managing Electronic Health Record Using Ethereum-based Blockchain Technology

Achieving data confidentiality, authenticity, and integrity while maintaining secure access control is essential in the medical sector. Implementing a blockchain-based technology to secure medical data makes the data decentralized and protects the intellectual property of the data. The decentralized system of blockchain along with the presence of smart contracts to automate tasks are the two major features that can be utilized to replace our current health system and invent a secure, flexible, and more reliable system for data protection. Using this technology will require patients to be accountable for their medical records while allowing authorized medical authorities to securely share anonymized medical data between multiple clinics, individual doctors, pharmacies, and insurance providers globally. Additionally, the electronic medical records (EMR) per patient will be stored for lifetime, which is important to pharmaceutical scientists to develop precise medicines. In order to build such robust system to protect medical data, my research focuses on the security aspect of the system by analyzing the blockchain technology constraints, and carefully designing and implementing a secure and scalable system using Ethereum blockchains, smart contracts, and cryptography. Therefore, it is significant to use this emerging technology to reduce millions of medical data breaches each year

Half Jury: Blockchain Audited Boltzmann Reputation Protocol for Computational Verification

Distributed networks of independently operating computers often require protocols to prove procedural integrity, data provenance, and accuracy. A potential solution to this problem is a distributed peer-to-peer network of nodes who rely on each other for computational validation; however, a robust system for measuring reputation is necessary for a dependable system. Each pre-existing implementation has its own features it targets for optimized performance, but the main requirements and challenges remain universal. Primarily, a hard measure of “trust” must be produced by the system as an operational metric for quantifying reliability of an operator or element in that system. With these considerations in mind, this paper proposes a three-part protocol implemented over a decentralized network. First is a novel system that dynamically scores nodes on historical performance using geometrically expanding historical intervals, each assigned an Inverted Harmonic Weight (IHW) used to calculate reputation. Second is the Slow Boltzmann Estimator (SBE), which takes the reputations of a stochastically determined quorum and produces a log-normal likelihood of good-faith behavior by the participants, invariant of their performance in the current quorum. Applied iteratively over an entire network, this system is able to perform the desired functions of removing consistently under-performing nodes, dynamically adjusting parameterization based on changing network conditions and node behavior, and optimize the global average reputation of the entire network

Exploring a Blockchain Protocol Utilizing Visualization Tactics

Despite the growing interest in blockchain technology, many visualizations are limited to displaying data scraped from the blockchain and fail to educate individuals on basic blockchain components and their functionalities. To address these limitations, it is imperative to develop visualizations that offer comprehensive insights into these domains. Our research focuses on providing conceptual understanding to the consensus process that underlies blockchain technology. This is accomplished through the implementation of a dynamic network visualization and an interactive educational tool. Further, a controlled user study is conducted to measure the effectiveness and usability of each tool. The findings demonstrate that our tools represent significant advancements in the field of blockchain visualization, effectively catering to the educational needs of both novice and proficient users