The health care ecosystem involves various interconnected stakeholders with different, and sometimes conflicting security and privacy needs. Sharing medical data, sometimes generated by remote medical devices, is a challenging task. Although several solutions exist in the literature covering functional requirements such as interoperability and scalability, as well as security & privacy requirements such as fine-grained access control and data privacy, balancing between them is not a trivial task as off-the-shelf solutions do not exist. On one hand, centralized cloud architectures provide scalability and interoperable access, but make strong trust assumptions. On the other, decentralized blockchain based solutions favor data privacy and independent trust management, but typically do not support dynamic changes of the underlying trust domains. To cover this gap, in this paper, we present a novel hierarchical multi expressive blockchain architecture. At the top layer, a proxy blockchain enables independently managed trust authorities to interoperate. End-users from different health care domains, such as hospitals or device manufacturers are able to access and securely exchange medical data, provided that a commonly agreed domain-wise access policy is enforced. At the bottom layer, one or more domain blockchains allow each domain (e.g. a hospital or device manufacturer) to enforce their policy and allow fine-grained access control with attribute-based encryption. This architecture is designed to provide the autonomous management of trusted medical data/devices and the transactions of mutually untrusted stakeholders, as well as an inherent forensics mechanism tailored for granular auditing. Smart contracts are used to enforce decentralized policies. Ciphertext-policy attribute based encryption (CP-ABE) is used to distribute the decryption process among end users and the system, as well as support an efficient credential revocation mechanism. We demonstrate the efficiency of the proposed architecture through a proof of concept implementation. Finally we analyse the major security and performance characteristics.

The Internet of Medical Things (IoMT) has revolutionized health care services by providing significant benefits in terms of patient well being and relevant costs. Traditional risk assessment methodologies, however, cannot be effectively applied in the IoMT context since IoMT devices form part of a distributed and trustless environment and naturally support functionalities that favor reliability and usability instead of security. In this work we present a survey of risk assessment and mitigation methodologies for IoMT. For conducting the survey, we assess two streams of literature. First, we systematically review and classify the current scientific research in IoMT risk assessment methodologies. Second, we review existing standards/best practices for IoMT security assessment and mitigation in order to i) provide a comparative assessment of these standards/best practices on the basis of predefined criteria (scope and/or coverage, maturity level, and relevant risk methodology applied) and ii) identify common themes for IoMT security controls. Based on the analysis, we provide various IoMT research and implementation gaps along with a road map of fruitful areas for future research. The paper could be of significant value to security assessment researchers and policymakers/stakeholders in the health care industry.

The Lightning Network (LN), a second-layer protocol built on top of the Bitcoin blockchain, is an innovative digital payment solution that offers increased convenience, speed, and cost-effectiveness to consumers and businesses alike. However, there is limited literature available on the characteristics of this nascent technology, the depth and breadth of the various business LN-related applications as well as relevant adoption/implementation challenges. This study aims to contribute to the understanding of the LN’s characteristics, its potential in enhancing business operations and its applicability across different sectors, while taking into account adoption and implementation challenges. We apply a narrative review methodology using a semi-systematic approach to examine new and emerging business models empowered by the LN and its characteristics, topology, performance, privacy and security. We analyze the data to identify key themes and trends in the literature, offering a critical analysis of the strengths and weaknesses of the existing literature. Based on the findings, we provide several clusters of fruitful areas for future research directions. This study not only provides crucial insights for businesses contemplating the adoption of LN to improve their operations and customer experience, but it also represents a substantial academic contribution, offering valuable knowledge and fostering further research in the fields of blockchain technology, FinTech and cryptocurrencies.

Bonds issuance is a highly technical and complicated process, entailing mutually untrusted stakeholders with sometimes conflicting objectives. Currently, the global bond market is faced with several pain points when it comes to bond issuance, like disparate regulatory frameworks, limited traceability and auditability, settlement failures, and inefficient issuance processes. Block-chain technology is capable of addressing some of the issues mentioned above. In this paper, we propose a block-chain-enabled green bond issuance architecture. In particular, we develop an adaptable and efficient system that reduces the intermediary costs and offers compliance, scalability, confidentiality, and security. The block-chain-enabled system also acts as a transparent yet fully controllable decentralized authority where the funds of qualified, environmentally friendly projects could be traced. Our proposed architecture considers the various aspects and the complexity of the bond issuance procedures and the special requirements of green bonds. The architecture is based on a five-step model from green bond initialization to archiving. To adjust the processes of bond issuance to a block-chain-enabled model, we use digital tokens based on the ERC-20 token standard. Within the smart contracts developed, we use various functions to handle the prerequisites of validators and regulators’ approval based on the documentation presented and the parameters of rate and maturity requested by the issuer. We use a separate smart contract to implemented forensic services. The overall system also considers various regulatory compliance instruments and enhances access of regulatory bodies to issuance records. We believe that the proposed architecture could be of significant value to researchers and practitioners from the financial domain.

The increasing integration of IoT devices in various sectors has created complex and dynamically changing interconnected systems. In several multi-authority and multi-domain applications, IoT devices may continuously change their connectivity status, leading to dynamic topologies; an IoT device may be connected to different gateways at different times, to support the provisioning of a distributed service. However, these complex environments increase exposure to security threats such as device spoofing or cloning attacks. Even worse, without continuous device inventorying, an adversary may easily duplicate a cloned device and concurrently connect compromised Sybil nodes at different gateways, without getting noticed. This paper proposes HA-CAAP, a hardware-assisted continuous authentication and attestation protocol for IoT devices. By using a PUF-based periodic authentication mechanism, gateways can continuously authenticate their connected devices and detect modifications in their connectivity status, in nearly real-time. Through a private blockchain, gateways are able to continuously exchange information about their connectivity state and securely share a dynamic device inventory, to detect possible Sybil attacks. In addition, by integrating a continuous gateway attestation mechanism in the blockchain, the protocol prevents non-trusted gateways from joining in and assures their integrity. To evaluate HA-CAAP, security is formally analyzed, while a proof-of-concept implementation is used to analyze the protocol’s performance, for realistic application scenarios.