In this paper, we propose a decentralized ride-sharing service atop public Blockchain, named B-Ride. Both riders/drivers can learn whether they can share rides while preserving their trip data, including pick-up/drop-off location, departure/arrival date. However, malicious users exploit the anonymity provided by the public blockchain to submit multiple ride requests or offers, while not committing to any of them, to find a better offer or make system unreliable. B-Ride solves this problem by introducing a time-locked deposit protocol by leveraging smart contract and zero-knowledge set membership proof. In a nutshell, both driver and rider have to show their good will and commitment by sending a deposit to the blockchain. Later, a driver has to prove to the blockchain on the agreed pick-up time that he arrived at the pick-up location. To preserve rider/driver privacy by hiding the exact pick-up location, the proof is performed using zero-knowledge set membership proof. Moreover, to ensure fair payment, a pay-as-you-drive methodology is introduced using the elapsed distance of driver/rider. In addition, we introduce reputation model to rate drivers based on their past behaviour without involving third-parties. Finally, we implement our protocol Ethereum test-net. The experimental results show applicability of our protocol atop existing real-world blockchains.

An energy trading system is essential for the successful integration of Electric Vehicles (EVs) into the smart grid. In this paper, leveraging blockchain technology, we first propose a privacy-preserving charging-station-to-vehicle (CS2V) energy trading scheme. The CS2V scheme is useful in crowded cities where there is a need for a charging infrastructure that can charge many EVs daily. We also propose a privacy-preserving vehicle-to-vehicle (V2V) energy trading scheme. The V2V scheme is useful when charging stations are not available or far and cheaper prices can be offered from EVs, e.g., if they charge from renewable energy sources. In the V2V scheme, the privacy of both charging and discharging EVs including location, time, and amount of power are preserved. To preserve privacy in both schemes, EVs are anonymous, however, a malicious EV may abuse the anonymity to launch Sybil attacks by pretending as multiple non-exiting EVs to launch powerful attacks such as Denial of Service (DoS) by submitting multiple reservations/offers without committing to them, to prevent other EVs from charging and make the trading system unreliable. To thwart the Sybil attacks, we use a common prefix linkable anonymous authentication scheme, so that if an EV submits multiple reservations/offers at the same timeslot, the blockchain can identify such submissions. To further protect the privacy of EV drivers, we introduce an anonymous and efficient blockchain-based payment system that cannot link individual drivers to specific charging locations. Our experimental results indicate that our schemes are secure and privacy-preserving with low communication and computation overheads.

Vehicular Ad Hoc Networks (VANETs) have the potential to enable the next-generation Intelligent Transportation Systems (ITS). In ITS, data contributed by vehicles can build a spatio-temporal view of traffic statistics, which can improve road safety and reduce slow traffic and jams. To preserve drivers’ privacy, vehicles should use multiple pseudonyms instead of only one identity. However, vehicles may exploit this abundance of pseudonyms and launch Sybil attacks by pretending to be multiple vehicles. Then, these Sybil (or fake) vehicles report false data, e.g., to create fake congestion or pollute traffic management data. In this article, we propose a Sybil attack detection scheme using proofs of work and location. The idea is that each road side unit (RSU) issues a signed time-stamped tag as a proof for the vehicle’s anonymous location. Proofs sent from multiple consecutive RSUs are used to create a trajectory which is used as vehicle anonymous identity. Also, contributions from one RSU are not enough to create trajectories, rather the contributions of several RSUs are needed. By this way, attackers need to compromise an infeasible number of RSUs to create fake trajectories. Moreover, upon receiving the proof of location from an RSU, the vehicle should solve a computational puzzle by running proof of work (PoW) algorithm. Then, it should provide a valid solution (proof of work) to the next RSU before it can obtain a proof of location. Using the PoW can prevent the vehicles from creating multiple trajectories in case of low-dense RSUs. To report an event, the vehicle has to send the latest trajectory to an event manager. Then, the event manager uses a matching technique to identify the trajectories sent from Sybil vehicles. The scheme depends on the fact that the Sybil trajectories are bounded physically to one vehicle, and therefore, their trajectories should overlap. Extensive experiments and simulations demonstrate that our scheme achieves high detection rate of Sybil attacks with low false negative and acceptable communication and computation overhead.

Financial Technology (FinTech) has expanded beyond simple mobile banking to online money transfers, crowdfunding, and managing individual investments. This reinforces the importance of ensuring security and privacy in FinTech, e.g., using Blockchain (hereafter referred to as Blockchain-based FinTech applications). In this work, we will systematically summarize recent Blockchain-based FinTech applications. As a result of the advancement of BFinTech, several novel cyberattacks have been evolved to potentially impact BFinTech functionalities. Thus, this work highlights the open research challenges and future research directions in Blockchain-based FinTech applications.

Smart power grids suffer from electricity theft cyber-attacks, where malicious consumers compromise their smart meters (SMs) to downscale the reported electricity consumption readings. This problem costs electric utility companies worldwide considerable financial burdens and threatens power grid stability. Therefore, several machine learning (ML)-based solutions have been proposed to detect electricity theft; however, they have limitations. First, most existing works employ supervised learning that requires the availability of labeled datasets of benign and malicious electricity usage samples. Unfortunately, this approach is not practical due to the scarcity of real malicious electricity usage samples. Moreover, training a supervised detector on specific cyberattack scenarios results in a robust detector against those attacks, but it might fail to detect new attack scenarios. Second, although a few works investigated anomaly detectors for electricity theft, none of the existing works addressed consumers’ privacy. To address these limitations, in this paper, we propose a comprehensive federated learning (FL)-based deep anomaly detection framework tailored for practical, reliable, and privacy-preserving energy theft detection. In our proposed framework, consumers train local deep autoencoder-based detectors on their private electricity usage data and only share their trained detectors’ parameters with an EUC aggregation server to iteratively build a global anomaly detector. Our extensive experimental results not only demonstrate the superior performance of our anomaly detector compared to the supervised detectors but also the capability of our proposed FL-based anomaly detector to accurately detect zero-day attacks of electricity theft while preserving consumers’ privacy.

Charging coordination is necessary for the successful integration of the Energy Storage Units (ESUs), including electric vehicles and home batteries, into the smart grid. To coordinate charging, the ESUs should send charging requests including time-to-complete-charging (TCC) and battery state-of-charge (SoC) to the charging controller (CC) for scheduling charging, but these data can reveal sensitive information on the ESUs’ owners such as their locations, when they return home and whether they are on travel. In this article, we propose centralized and decentralized privacy-preserving and collusion-resistant charging coordination schemes for ESUs. In the centralized scheme, ESUs authenticate their requests using anonymous tokens. To thwart linkability attacks where the CC uses TCC and SoC to link requests sent from the same ESU at consecutive time slots, an ESU needs to send multiple charging requests with different TCC and SoC values instead of only one request. In the decentralized scheme, charging is coordinated in a distributed way using a privacy-preserving data aggregation technique. The idea is that each ESU selects some ESUs to act as proxies, and shares a secret mask with each proxy. Then, each ESU adds a mask to its charging request and encrypts it so that by aggregating all requests, all masks are nullified and the total charging demand is known, and then it is used to compute the charging schedules. Due to using masking technique, the scheme is secure against collusion attacks. The results of extensive experiments and simulations confirm that our schemes are efficient and secure, and can preserve ESU owners’ privacy and thwart linkability attacks.