Source-linked AI summary
Towards Blockchain-based Auditable Storage and Sharing of IoT Data
Hossein Shafagh, Lukas Burkhalter, Anwar Hithnawi, Simon Duquennoy
TL;DR
Cloud-centric IoT architectures create isolated data silos and leave users with limited control over their data. This paper designs a blockchain-based system for distributed access control, secure sharing, and decentralized storage of IoT data streams, with initial evaluations showing moderate overhead.
Problem
Cloud-centric IoT architectures create isolated data silos, limit users’ control over their data, and fall short of decentralized, resilient, auditable access control for IoT data streams.
Method
The system combines a blockchain-based distributed ledger for access permissions with off-chain storage and chunked, compressed, encrypted IoT data streams.
Results
Initial evaluation shows moderate overhead, including a 10% slowdown in request throughput when augmenting Amazon’s S3 storage with the system’s access control.
Takeaways & Limitations
The design supports fine-grained access control, secure sharing, access revocation, compressed-stream search, and locality-aware distributed storage for time-series IoT data.
Takeaways & Limitations
Existing decentralized storage efforts are optimized for file storage and fall short of accommodating IoT time-series data.
Abstract
from arXiv · showhide
Today the cloud plays a central role in storing, processing, and distributing data. Despite contributing to the rapid development of IoT applications, the current IoT cloud-centric architecture has led into a myriad of isolated data silos that hinders the full potential of holistic data-driven analytics within the IoT. In this paper, we present a blockchain-based design for the IoT that brings a distributed access control and data management. We depart from the current trust model that delegates access control of our data to a centralized trusted authority and instead empower the users with data ownership. Our design is tailored for IoT data streams and enables secure data sharing. We enable a secure and resilient access control management, by utilizing the blockchain as an auditable and distributed access control layer to the storage layer. We facilitate the storage of time-series IoT data at the edge of the network via a locality-aware decentralized storage system that is managed with the blockchain technology. Our system is agnostic of the physical storage nodes and supports as well utilization of cloud storage resources as storage nodes.
1 INTRODUCTION
IoT data is commonly routed through cloud-centric, siloed architectures that limit user control and leave important lifecycle security needs unmet. The paper proposes blockchain-based, user-owned access control and secure storage tailored to IoT data streams.
- Cloud-centric IoT architectures create isolated data silos and leave users with limited control over how their data is used.
- Existing IoT security efforts emphasize point-to-point communication but inadequately address lifecycle needs such as auditable access control and secure sharing.
- The proposed system targets decentralized, resilient, and auditable access control; secure storage; and compatibility with append-only IoT data streams.
- Decentralized storage efforts are optimized for file storage and do not adequately accommodate IoT time-series data.
- The design combines blockchain-based distributed permissions with scalable off-chain storage and application-layer chunking, compression, and encryption for IoT streams.
- The system supports cryptographically secure sharing with frequent key updates, access revocation, efficient search of compressed streams, and locality-aware distributed storage.
2 BACKGROUND
The background describes IoT architectures, cloud locality challenges, blockchain fundamentals, and alternative consensus models. It positions blockchain as a basis for decentralized identity, ownership, and access-management functions.
- Centralized cloud data centers increase client-service distance, causing variable latency and bandwidth; cloudlets address this by placing smaller data centers closer to users.
- IoT systems typically comprise low-power devices, an optional gateway, and a backend where collected data is stored.
- IoT devices have constrained CPU, RAM, and ROM resources, while preshared symmetric-key security does not scale to massive device populations.
- A blockchain is a distributed ledger whose cryptographically linked records are validated collectively by participating peers rather than controlled by one entity.
- Bitcoin records transactions in a blockchain, with miners verifying transactions and proposing blocks in exchange for computational-work rewards.
- Proof-of-work uses block-specific mathematical puzzles to limit any single miner’s ability to dominate the network and manipulate transaction history.
- Permissioned blockchains use authorized validators and can reach higher throughput, but their communication overhead is O(n^2), making only a few tens of validators practical.
3 SYSTEM DESIGN
The system separates blockchain-based access control from an off-chain, encrypted storage and routing plane designed for append-only IoT streams. It supports chunked time-series storage, efficient lookup, locality-aware distribution, and auditable security.
- Data Storage: The storage layer is agnostic to physical nodes and can use on-premises, cloud, or distributed peer-to-peer storage.The reference evaluation reports a 10% request-throughput slowdown with Amazon S3 augmentation and 150 ms store/get latency per chunk without caching.
- Control Plane: The control plane uses a public blockchain to store ownership and per-stream access permissions, including sharing and revocation.Transactions are publicly auditable, while stealth addresses can preserve permission privacy.
- Control Plane: Re-encryption tokens reduce communication overhead for sharing updated stream keys to O(1).Services re-encrypt ciphertexts under their own public keys without accessing plaintext, while key updates preserve current access.
- Data Plane: Data streams are split into cryptographically chained chunks, which improves time-local retrieval but prevents random record-level access.Chunks contain hash pointers to previous chunks, and most time-series queries access co-located records.
- Data Plane: Compression ratios reach 9.75 for one year of Fitbit data and 11.45 for Ava data, with encrypted compressed chunks reaching 11.08 at chunk size 2048.The system compresses chunks before encryption and uses timestamp-based mapping to locate the containing chunk.
- Privacy & Security: End-to-end encryption, signatures, and periodic blockchain identifiers protect confidentiality, ownership, integrity, and immutability.Only chunk identifiers are placed on-chain at intervals; intermediate chunks inherit immutability through chaining.
4 RELATED WORK
Related systems address privacy, sharing, chunking, or decentralized storage, but the paper distinguishes its design by combining auditable blockchain access control with secure sharing for IoT streams.
- Data Privacy & Access Control: OAuth relies on a central trusted entity for user-defined access policies, while Sieve uses key-homomorphic and attribute-based encryption to address related shortcomings.Anonymized collection is also discussed, but the passage notes that effective de-anonymization has been demonstrated.
- Data Privacy & Access Control: Enigma combines blockchain access control with off-chain data sharing but stores access logs on-chain and does not accommodate IoT stream data.The paper's focus on IoT data motivates design differences from Enigma and related approaches.
- IoT Storage: Bolt chunks IoT data and protects chunk confidentiality but retains a cloud-centric model, whereas other decentralized systems lack secure sharing or assume public data.The paper positions its approach against these storage and sharing boundaries.
5 CONCLUSION
The paper presents a distributed secure storage design for IoT time-series data with fine-grained access control and sharing. Initial evaluation indicates moderate overhead, while implementation and application work remain ongoing.
- Conclusion: The system targets fine-grained access control and sharing of time-series sensor data across IoT applications.It is introduced as a distributed secure data storage system for the Internet of Things.
- Conclusion: Initial performance results are promising and show moderate overhead from the system.The authors are finalizing a complete reference implementation and developing several IoT applications.