This paper introduces “SmartBLock”, a novel protocol that integrates smart lock management with the Bitcoin blockchain. By employing blockchain technology, the SmartBLock protocol eliminates the need for centralized databases (reducing the risk of data breaches) and ensures accountability for all access events. Authentication is accomplished through Bitcoin's cryptographic signature scheme. Additionally, SmartBLock is an open and manufacturer-agnostic protocol, relying on the open and permissionless Bitcoin blockchain rather than proprietary tools or protocols. Given the limited computational capabilities of Internet of Things (IoT) devices, achieving this integration presents a significant challenge. This paper provides a comprehensive review of the state of the art in smart lock protocols, details the design of the SmartBLock protocol, presents a proof-of-concept prototype to validate its feasibility, and offers a meticulous analysis of its security, privacy, and traceability features. • Literature review on blockchain-integrated smart locks. • Propose a smart lock protocol on Bitcoin for immutable and transparent management. • Provide a demonstration that the protocol is secure, private, and transparent. • Build a PoC for the proposal on an IoT device and gather evidence of its feasibility.

Federated learning (FL) has emerged as a privacy-preserving alternative to traditional machine learning, enabling collaborative model training without centralizing users’ data. While this decentralized approach enhances privacy, it introduces new trust assumptions. Specifically, that users honestly participate in the protocol. Simultaneously, the growing emphasis on fairness in machine learning has led to the development of fairness-aware FL schemes, which aim to ensure equitable model performance across diverse user groups. However, existing solutions for fair FL schemes rely on users truthfully reporting fairness-related metrics. This trust assumption opens the door to malicious behavior: users may manipulate these statistics to influence the global model, degrading its fairness, and/or its overall accuracy. Current frameworks lack mechanisms to detect or prevent such adversarial manipulation. This paper addresses this critical gap through two main contributions. First, as an example to illustrate our point, we empirically demonstrate the vulnerability of a representative fairness-aware FL framework to targeted attacks that exploit unverified fairness computations. Second, and most importantly, we propose a novel scheme (that can be integrated into existing fair FL schemes) that augments fairness-aware FL with verifiability. Our solution enables the detection of dishonest participants without compromising user privacy, thus strengthening the robustness of fairness-aware FL schemes.

The integration of blockchain technology with IoT architectures holds immense potential for advancing application design and enhancing security properties. However, the resource constraints typically present in IoT devices pose a challenge. This paper explores the feasibility of running a lightweight Bitcoin wallet on IoT devices and identifies the minimum requirements for their successful operation. A review of the literature is used to identify existing integration architectures and derive the wallet needs. The study evaluates performance metrics such as execution time, memory usage, network data transmission, and power consumption to determine the feasibility of deploying these architectures.

In many machine learning scenarios, training occurs outside the control of the model sponsor or the entity using the model. A growing concern in such settings revolves around model poisoning and data poisoning-how training is conducted and which data contributes to the process. This paper introduces a protective scheme against model and data poisoning attacks. Leveraging cryptographic primitives such as hashes, signature schemes, and zero-knowledge proofs, the scheme ensures the integrity of the training process. Hashing maintains the continuity of data from authenticated sensors, while signatures validate the data. In the end, zero-knowledge proofs verify the correct model computation by the entity carrying out the training process. By adopting this approach, model sponsors can securely delegate training tasks, guaranteeing the authenticity of the results. Implementation and testing demonstrate the scheme's feasibility, effectively countering data and model poisoning threats.

With the emergence of new technologies and the generalized use of social media, corporations have an invested economic interest in employing web-tracking techniques, but there is also the issue of protecting users’ privacy. In this field of research, only few articles introduce methods to evaluate website compliance in the use of current web-tracking techniques. Moreover, evaluating the level of compliance requires, in the majority of cases, manually implementing an extensive data analysis. In this paper, we present four new algorithms (CIA, CDA, BDA, and SCA) and a novel measure (WLoC) to evaluate user tracking compliance in websites and the level of confidence in the use of information-gathering technologies, by employing the recently published Website Evidence Collector (WEC) software from the European Data Protection Supervisor (EDPS). The paper also showcases a case study of the top 500 websites most visited by Alexa in Spain to evaluate the performance of the presented algorithms and metrics. Results reveal a novel procedure for obtaining categorized websites’ compliance and confidence levels of a set of websites under the current European legislation, thus updating and enhancing some of the previous research work.

Summary Since digital artworks are indeed digital content, they face the inherent problem digital content has: the link between content and its original author is very difficult to keep. Additionally, retaining control over digital copies of the content is also a challenging task. Digital coins have solved this very same problem through cryptocurrencies (for instance, Bitcoin) and have opened the door to apply the same techniques to other similar scenarios where ownership of digital assets needs to be preserved. In this paper, we propose BArt, a transparent and distributed mechanism for artists to commercialize their digital artwork, keeping control of the copies, monetizing its usage, and maintaining ownership. BArt allows artists to publicly register their work in the Bitcoin blockchain and sell usage rights in exchange for bitcoins. Buyers are allowed to exert the acquired rights. Proper behavior from all parties is enforced by the system with cryptography and economic incentives.

The Lightning Network is a second layer technology running on top of Bitcoin and other Blockchains. It is composed of a peer-to-peer network, used to transfer raw information data. Some of the links in the peer-to-peer network are identified as payment channels, used to conduct payments between two Lightning Network clients (i.e., the two nodes of the channel). Payment channels are created with a fixed credit amount, the channel capacity. The channel capacity, together with the IP address of the nodes, is published to allow a routing algorithm to find an existing path between two nodes that do not have a direct payment channel. However, to preserve users' privacy, the precise balance of the pair of nodes of a given channel (i.e. the bandwidth of the channel in each direction), is kept secret. Since balances are not announced, second-layer nodes probe routes iteratively, until they find a successful route to the destination for the amount required, if any. This feature makes the routing discovery protocol less efficient but preserves the privacy of channel balances. In this paper, we present an attack to disclose the balance of a channel in the Lightning Network. Our attack is based on performing multiple payments ensuring that none of them is finalized, minimizing the economical cost of the attack. We present experimental results that validate our claims, and countermeasures to handle the attack.

This paper presents a classifier architecture that is able to deal with classification of interlinked entities when the only information available is the existing relationships between these entities, i.e. no semantic content is known for either the entities or their relationships. After proposing a classifier to deal with this problem, we provide extensive experimental evaluation showing that our proposed method is sound and that it is able to achieve high accuracy, in most cases much higher than other already existing algorithms configured to tackle this very same problem. The contributions of this paper are twofold: first, it presents a classifier for interlinked entities that outperforms most of the existing algorithms when the only information available is the relationships between these entities; second, it reveals the power of using label independent (LI) features extracted from network structural properties in the bootstrapping phases of relational classification.

The separation between the public and private spheres on online social networks is known to be, at best, blurred. On the one hand, previous studies have shown how it is possible to infer private attributes from publicly available data. On the other hand, no distinction exists between public and private data when we consider the ability of the online social network (OSN) provider to access them. Even when OSN users go to great lengths to protect their privacy, such as by using encryption or communication obfuscation, correlations between data may render these solutions useless. In this article, we study the relationship between private communication patterns and publicly available OSN data. Such a relationship informs both privacy-invasive inferences as well as OSN communication modelling, the latter being key toward developing effective obfuscation tools. We propose an inference model based on Bayesian analysis and evaluate, using a real social network dataset, how archetypal social graph features can lead to inferences about private communication. Our results indicate that both friendship graph and public traffic data may not be informative enough to enable these inferences, with time analysis having a non-negligible impact on their precision.

Web crawlers are complex applications that explore the Web for different purposes. Web crawlers can be configured to crawl online social networks (OSNs) to obtain relevant data about their global structure. Before a web crawler can be launched to explore the Web, a large amount of settings have to be configured. These settings define the crawler's behavior and they have a big impact on the collected data. Both the amount of collected data and the quality of the information that it contains are affected by the crawler settings and, therefore, by properly configuring these web crawler settings we can target specific goals to achieve with our crawl. In this paper, we review the configuration choices that an attacker who wants to obtain information from an OSN by crawling it has to make to conduct his attack. We analyze different scheduler algorithms for web crawlers and evaluate their performance in terms of how useful they are to pursue a set of different adversary goals.