A Privacy-Preserving Decentralized Storage with Payments Based on a Blockchain
Total Page:16
File Type:pdf, Size:1020Kb
A Privacy-preserving Decentralized Storage with Payments Based on a Blockchain Dissertation zur Erlangung des Doktorgrades Dr. rer. nat. der Fakultat¨ fur¨ Ingenieurwissenschaften, Informatik und Psychologie der Universitat¨ Ulm Henning Johannes Gustav Kopp aus Villingen-Schwenningen 2018 Institut f¨urVerteilte Systeme Universit¨atUlm, Deutschland Amtierender Dekan: Prof. Maurits Ortmanns Gutachter: Prof. Frank Kargl Gutachter: Prof. Frederik Armknecht Tag der Promotion: 20.12.2018 Summary Recently, the paradigm of cloud storage has seen wide acceptance in industry and for personal use. One of its core principles is to outsource storage, such that users can be billed flexibly by their actual demand. However, outsourcing storage such as private data or business secrets leads to privacy problems, as control over the data is lost to the storage provider. This is intensified by the fact that often privacy is considered only as an afterthought in these systems and not integrated into the design from the beginning. Privacy-preserving alternatives to these centralized cloud storage providers are peer-to-peer systems like Freenet or GNUnet. In these systems, participants can donate storage to other users of the system. Privacy plays a vital role in these systems, as, e. g., participants are unable to access data of other users if they are not authorized to do so, even if the data of the other users resides on their own hard disk. However, these decentralized systems suffer from limited contribution due to a lack of incentives to participate. Naively enhancing these systems with the possibility of payments such that storage providers can earn money, infringes privacy, since tracing of payment flows provides links between users and their storage providers. Consequently, a form of anonymous payment needs to be considered when enhancing such storage systems with remuneration. A very similar problem of providing incentives for protocol adoption is solved by the digital currency Bitcoin which rewards participants by uncloneable currency units which are themselves called bitcoins. Although Bitcoin is not privacy-preserving, the scenario of such blockchain architectures is very similar to a peer-to-peer storage platform and thus provides a good starting point. We provide two designs of a decentralized storage system with incentives for the participants to contribute. Our first design exchanges the proof of work mining process of a blockchain by publicly verifiable proofs of storage. These are cryptographic proofs that allow a storage provider to convince a verifier that it has stored some data of another participant. While this approach leads to a working system, it is not able to provide the envisioned privacy and security guarantees. Although the link between storage provider and user is severed, the link between a storage provider and its stored file is still observable. Further, the sender and receiver are revealed for transfers of digital cash which are unrelated to a file, as in Bitcoin. i ii Improving on our first design, we provide a second design of a privacy- preserving storage. Here, the senders and receivers of transactions are anony- mous due to our use of linkable ring signatures and one-time payment addresses. The storage is managed via smart storage contracts which are special transac- tions that grant the storage provider a financial reward if the storage provider is able to provide proofs of storage at predetermined times. Since storage contracts constitute a special form of transactions, linkable ring signatures and one-time payment addresses are applicable to storage smart contracts as well, where they provide anonymity of the user and storage provider. After introducing our two designs of a privacy-preserving storage system, we focus on selected building blocks of our architecture. We provide a thorough comparison between different publicly verifiable proof of storage schemes. Further, we design a new publicly verifiable proof of storage scheme from a modification of the Guillou-Quisquater identification protocol whose security is based on the RSA-assumption. We implemented all discussed proof of storage schemes and provide benchmarks regarding their real-world performance. Since our second storage system design relies on the wasteful proof of work mining process of Bitcoin, we propose a novel mining algorithm based on proofs of human work. These are solutions to problems that only humans are able to solve efficiently and thus prove cryptographically that an amount of human work has been performed. In contrast to a CAPTCHA, these proofs of human work are publicly verifiable. Our construction of a proof of human work relies on secure multiparty computation, which is a well-known cryptographic primitive with multiple known feasible instantiations. The only other instantiation of a proof of human-work known to date relies on indistinguishability obfuscation|a cryptographic primitive that is only speculated to exist and where no secure instantiation is currently known. As a third building block, we turn our attention to routing in payment channels. Payment channels are widely regarded as a solution to the low transaction throughput of blockchains. As an example, Bitcoin allows for around 7 transactions per second globally. Payment channels are bilateral channels, which include a balance that can be updated. Only the opening and the closing of the channel is written to the blockchain. Inside the channel, there can be multiple updates to the payment which are not written to the blockchain. The design of payment channels guarantees that no participant can cheat by persisting older transaction states to the blockchain. A network of payment channels operates as an overlay network to the blockchain and allows for routing of transactions over multiple hops. Up to now, routing algorithms in this setting have only been discussed from a purely technological perspective without taking into account the economical impact, like capacity constraints, routing fees, cost of locked capital, and the focus on the cheapest route (as opposed to the shortest route). Our treatment provides the first economic-technical analysis of routing in payment channels. We provide measurements of the cheapest route and the number of failed transactions due to capacity constraints using our custom simulator. In summary, our results show that it is possible to design a decentralized privacy-preserving storage system with remuneration for it participants. With the addition of anonymous payments we hope to increase participation beyond that of traditional decentralized storage systems. Short contents 1 Introduction 1 2 Background 9 3 Basic Design 37 4 Privacy Enhanced Design 59 5 A Comparison of Publicly Verifiable Proofs of Storage 85 6 uMine: A Mining Algorithm based on Human Work 113 7 The Economical Impact on Routing in Payment Channel Networks 133 8 Conclusion & Outlook 149 Author's Publications 157 Bibliography 159 iii Contents 1 Introduction 1 1.1 Research Questions and Contribution . 2 1.2 Outline . 6 1.3 Notation . 8 2 Background 9 2.1 Privacy . 9 2.1.1 Privacy by Design . 9 2.1.2 Privacy Patterns . 11 2.1.3 Privacy Design Strategies . 11 2.1.4 Privacy Enhancing Technologies (PETs) . 13 2.2 Blockchain Technology . 13 2.2.1 Bitcoin and the Blockchain . 13 2.2.2 Beyond Bitcoin . 19 2.3 Proofs of Storage . 28 2.4 Related Work . 31 2.4.1 Permacoin and Retricoin . 32 2.4.2 Filecoin . 32 2.4.3 Anonymous Storage Systems . 34 2.4.4 Summary . 35 3 Basic Design 37 3.1 Our Scheme . 38 3.1.1 Overview . 39 3.1.2 The Blockchain and Mining Process . 41 3.1.3 The Store Transaction . 44 3.1.4 Fetching Files . 45 3.2 Security and Privacy Analysis . 48 3.2.1 Security . 48 3.2.2 Privacy . 51 3.3 Conclusion . 58 4 Privacy Enhanced Design 59 4.1 Building Blocks . 61 iv CONTENTS v 4.1.1 Linkable Ring Signatures . 61 4.1.2 One-time Payment Addresses . 66 4.2 Roles . 68 4.3 Design of our System . 68 4.3.1 Mining . 69 4.3.2 Anonymous Payments . 70 4.3.3 File Handling . 72 4.4 Security and Privacy Analysis . 76 4.4.1 Privacy Properties . 76 4.4.2 Security Analysis . 79 4.5 Additional Considerations . 81 4.5.1 Files . 81 4.5.2 Blockchain Transmissions . 81 4.5.3 File Transmissions . 82 4.5.4 Summary . 82 4.6 Conclusion . 82 5 A Comparison of Publicly Verifiable Proofs of Storage 85 5.1 Preliminaries . 88 5.1.1 Identification Protocol . 88 5.1.2 Proof of Storage . 90 5.2 Proofs of Storage . 94 5.2.1 Proof of Storage from Guillou-Quisquater . 94 5.2.2 Shoup Proof of Storage . 98 5.2.3 Shacham-Waters Proof of Storage . 99 5.3 Evaluation . 103 5.3.1 Method . 103 5.3.2 Results and Discussion . 104 5.3.3 Verification Preprocessing . 105 5.4 Modifications for Use in our Storage System . 107 5.5 Future Work . 109 5.5.1 Anonymous Proofs of Storage . 110 5.5.2 Post-quantum Security . 110 5.6 Conclusion . 112 6 uMine: A Mining Algorithm based on Human Work 113 6.1 Building Blocks . 114 6.1.1 Slow Hash Functions . 114 6.1.2 Captchas . 115 6.1.3 Proof of Human-work Puzzles . 118 6.1.4 Multiparty Computation Protocol . 119 6.2 Our Construction . 120 6.2.1 Overview . 120 6.2.2 Our Proof of Human-Work . 120 6.2.3 Block Generation . 124 6.2.4 Choosing the Captcha Generators . 126 6.3 Security . 128 6.4 Notes on Implementing our Scheme . 130 6.5 Related Work . 131 6.6 Conclusion . 132 vi CONTENTS 7 The Economical Impact on Routing in Payment Channel Networks 133 7.1 Background . 135 7.2 Challenges . 137 7.3 Our Approach . 138 7.3.1 Notation .