CoChat
Sign Up
Cited by 339Blockchain Technology Applications and SecurityDigitalization, Law, and RegulationCloud Data Security Solutions

GDPR-Compliant Personal Data Management: A Blockchain-Based Solution

Open access
Truong, Nguyen Binh, Sun, Kai, Lee, Gyu Myoung, Guo, Yike·2020·IEEE Transactions on Information Forensics and Security
DOI 10.1109/tifs.2019.2948287
Open this paper in CoChat — free account

Abstract

The General Data Protection Regulation (GDPR) gives control of personal data back to the owners by appointing higher requirements and obligations on service providers who manage and process personal data. As the verification of GDPR-compliance, handled by a supervisory authority, is irregularly conducted; it is challenging to be certified that a service provider has been continuously adhering to the GDPR. Furthermore, it is beyond the data owner's capability to perceive whether a service provider complies with the GDPR and effectively protects her personal data. This motivates us to envision a design concept for developing a GDPR-compliant personal data management platform leveraging the emerging blockchain and smart contract technologies. The goals of the platform are to provide decentralised mechanisms to both service providers and data owners for processing personal data; meanwhile, empower data provenance and transparency by leveraging advanced features of the blockchain technology. The platform enables data owners to impose data usage consent, ensures only designated parties can process personal data, and logs all data activities in an immutable distributed ledger using smart contract and cryptography techniques. By honestly participating in the platform, a service provider can be endorsed by the blockchain network that it is fully GDPR-compliant; otherwise, any violation is immutably recorded and is easily figured out by associated parties. We then demonstrate the feasibility and efficiency of the proposed design concept by developing a profile management platform implemented on top of the Hyperledger Fabric permissioned blockchain framework, following by valuable analysis and discussion.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/tifs.2019.2948287

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Research on AI integration with IoT security and privacy protection is still in the initial stage, focusing mainly on concepts of models and policies; few solutions are in simulation stage but limited to specific application scenarios.

    “Research on AI integration IoT security and privacy protection is still in the initial stage, focusing mainly on the concept of models and policies. A few solutions are also in the simulation and simulation stage but are limited to specific application scenarios [108].”

    From A Survey of IoT Privacy Security: Architecture, Technology, Challenges, and Trends (2024) · cites this paper as [108]

    The Related Work section (p. 3) says that some blockchain-based access-control studies present only high-level designs, but it does not discuss AI integration with IoT. Searches for AI integration, machine learning, and simulation found no passage assessing the maturity or application limits of AI-based IoT security and privacy research. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 44

  1. [1][1] H. Shafagh, L. Burkhalter, A. Hithnawi, and S. Duquennoy, 'Towards blockchain-based auditable storage and sharing of IoT data,' in Proc. Cloud Comput. Secur. Workshop , 2017, pp. 45-50. -
  2. [2][2] R. Li, T. Song, B. Mei, H. Li, X. Cheng, and L. Sun, 'Blockchain for large-scale Internet of Things data storage and protection,' IEEE Trans. Services Comput. , vol. 12, no. 5, pp. 762-771, Sep./Oct. 2019. -
  3. [3][3] S. Wang, Y. Zhang, and Y. Zhang, 'A blockchain-based framework for data sharing with fine-grained access control in decentralized storage systems,' IEEE Access , vol. 6, pp. 38437-38450, 2018. -
  4. [4][4] J. Benet, 'IPFS-Content addressed, versioned, P2P file system,' Jul. 2014, arXiv:1407.3561 . [Online]. Available: https://arxiv.org/abs/ 1407.3561 - · arXiv
  5. [5][5] G. Zyskind, O. Nathan, and A. Pentland, 'Decentralizing privacy: Using blockchain to protect personal data,' in Proc. IEEE Secur. Privacy Workshops , May 2015, pp. 180-184. -
  6. [6][6] L. A. Linn and M. B. Koo, 'Blockchain for health data and its potential use in health it and health care related research,' in Proc. ONC/NIST Use Blockchain Healthcare Res. Workshop . Gaithersburg, MD, USA: ONC/NIST, 2016, pp. 1-10. -
  7. [7][7] A. Azaria, A. Ekblaw, T. Vieira, and A. Lippman, 'MedRec: Using blockchain for medical data access and permission management,' in Proc. 2nd Int. Conf. Open Big Data (OBD) , Aug. 2016, pp. 25-30. -
  8. [8][8] M. J. M. Chowdhury, A. Colman, M. A. Kabir, J. Han, and P. Sarda, 'Blockchain as a notarization service for data sharing with personal data store,' in Proc. 17th IEEE Int. Conf. Trust, Secur. Privacy Comput. Commun. (TrustCom) , Aug. 2018, pp. 1330-1335. -
  9. [9][9] R. Neisse, G. Steri, and I. Nai-Fovino, 'A blockchain-based approach for data accountability and provenance tracking,' in Proc. 12th Int. Conf. Availability, Rel. Secur. , 2017, p. 14. -
  10. [10][10] B. Faber, G. Michelet, N. Weidmann, R. R. Mukkamala, and R. Vatrapu, 'BPDIMS: A blockchain-based personal data and identity management system,' in Proc. 52nd Hawaii Int. Conf. Syst. Sci. , 2019, pp. 1-10. -
  11. [11][11] C. Wirth and M. Kolain, 'Privacy by blockchain design: A blockchainenabled GDPR-compliant approach for handling personal data,' in Proc. 1st ERCIM Blockchain Workshop, Eur. Soc. Socially Embedded Technol. (EUSSET) , 2018, pp. 1-7. -
  12. [12][12] M. Walport et al. , Distributed Ledger Technology: Beyond Blockchain , vol. 1. London, U.K.: Government Office for Science, 2016. -
  13. [14][14] I. P. Team, EU General Data Protection Regulation (GDPR): An Implementation and Compliance Guide . Cambridge, U.K.: IT Governance, 2017. -
  14. [16][16] M. Crosby, P. Pattanayak, S. Verma, and V. Kalyanaraman, 'Blockchain technology: Beyond bitcoin,' Appl. Innov. , vol. 2, nos. 6-10, p. 71, 2016. -
  15. [17][17] F. Tschorsch and B. Scheuermann, 'Bitcoin and beyond: A technical survey on decentralized digital currencies,' IEEE Commun. Surveys Tuts. , vol. 18, no. 3, pp. 2084-2123, 3rd Quart., 2016. -
  16. [18][18] N. B. Truong, T.-W. Um, B. Zhou, and G. M. Lee, 'Strengthening the blockchain-based Internet of value with trust,' in Proc. IEEE Int. Conf. Commun. (ICC) , May 2018, pp. 1-7. -
  17. [20][20] W. Wang et al. , 'A survey on consensus mechanisms and mining strategy management in blockchain networks,' IEEE Access , vol. 7, pp. 22328-22370, 2019. -
  18. [21][21] A. Gervais, G. O. Karame, K. Wüst, V. Glykantzis, H. Ritzdorf, and S. Capkun, 'On the security and performance of proof of work blockchains,' in Proc. ACM SIGSAC Conf. Comput. Commun. Secur. , 2016, pp. 3-16. -
  19. [22][22] A. Kiayias, A. Russell, B. David, and R. Oliynykov, 'Ouroboros: A provably secure proof-of-stake blockchain protocol,' in Proc. Int. Cryptol. Conf. Santa Barbara, CA, USA: Springer, 2017, pp. 357-388. -
  20. [23][23] I. Bentov, C. Lee, A. Mizrahi, and M. Rosenfeld, 'Proof of activity: Extending bitcoin's proof of work via proof of stake,' IACR Cryptol. ePrint Arch. , vol. 2014, p. 452, 2014. -
  21. [25][25] Y. Gilad, R. Hemo, S. Micali, G. Vlachos, and N. Zeldovich, 'Algorand: Scaling byzantine agreements for cryptocurrencies,' in Proc. 26th Symp. Operating Syst. Princ. , 2017, pp. 51-68. -
  22. [27][27] A. Kosba, A. Miller, E. Shi, Z. Wen, and C. Papamanthou, 'Hawk: The blockchain model of cryptography and privacy-preserving smart contracts,' in Proc. IEEE Symp. Secur. Privacy (SP) , May 2016, pp. 839-858. -
  23. [28][28] G. Wood, 'Ethereum: A secure decentralised generalised transaction ledger,' Ethereum Project Yellow Paper , vol. 151, pp. 1-32, Apr. 2014. -
  24. [29][29] C. Cachin, 'Architecture of the hyperledger blockchain fabric,' in Proc. Workshop Distributed Cryptocurrencies Consensus Ledgers , vol. 310, 2016, pp. 1-4. -
  25. [32][32] F. Tian, 'An agri-food supply chain traceability system for China based on RFID & blockchain technology,' in Proc. 13th Int. Conf. Service Syst. Service Manage. (ICSSSM) , Jun. 2016, pp. 1-6. -
  26. [33][33] N. Hackius and M. Petersen, 'Blockchain in logistics and supply chain: Trick or treat?' in Proc. Hamburg Int. Conf. Logistics (HICL) , 2017, pp. 3-18. -
  27. [34][34] X. Liang, S. Shetty, D. Tosh, C. Kamhoua, K. Kwiat, and L. Njilla, 'ProvChain: A blockchain-based data provenance architecture in cloud environment with enhanced privacy and availability,' in Proc. 17th IEEE/ACM Int. Symp. Cluster, Cloud Grid Comput. , May 2017, pp. 468-477. -
  28. [35][35] M. Ali, J. Nelson, R. Shea, and M. J. Freedman, 'Blockstack: A global naming and storage system secured by blockchains,' in Proc. Annu. Tech. Conf. (USENIX/ATC) , 2016, pp. 181-194. -
  29. [36][36] H. A. Kalodner, M. Carlsten, P. Ellenbogen, J. Bonneau, and A. Narayanan, 'An empirical study of namecoin and lessons for decentralized namespace design,' in Proc. WEIS , 2015, pp. 1-21. -
  30. [38][38] J.-H. Lee, 'BIDaaS: Blockchain based ID as a service,' IEEE Access , vol. 6, pp. 2274-2278, 2017. -
  31. [39][39] Z. Chen, S. Chen, H. Xu, and B. Hu, 'A security authentication scheme of 5G ultra-dense network based on block chain,' IEEE Access , vol. 6, pp. 55372-55379, 2018. -
  32. [40][40] O. Novo, 'Blockchain meets IoT: An architecture for scalable access management in IoT,' IEEE Internet Things J. , vol. 5, no. 2, pp. 1184-1195, Apr. 2018. -
  33. [43][43] R. Neisse, G. Steri, I. N. Fovino, and G. Baldini, 'SecKit: A modelbased security toolkit for the Internet of Things,' Comput. Secur. , vol. 54, pp. 60-76, Oct. 2015. -
  34. [44][44] M. Berberich and M. Steiner, 'Blockchain technology and the GDPRhow to reconcile privacy and distributed ledgers,' Eur. Data Protection Law Rev. , vol. 2, p. 422, Mar. 2016. -
  35. [46][46] D. Johnson, A. Menezes, and S. Vanstone, 'The elliptic curve digital signature algorithm (ECDSA),' Int. J. Inf. Secur. , vol. 1, no. 1, pp. 36-63, Aug. 2001. -
  36. [47][47] D. Schwartz, N. Youngs, and A. Britto, 'The ripple protocol consensus algorithm,' Ripple Labs Inc White Paper , vol. 5, p. 8, Feb. 2018. -
  37. [48][48] S. Liu, P. Viotti, C. Cachin, and V. Quéma, and M. Vukoli´ c, '{XFT}: Practical fault tolerance beyond crashes,' in Proc. 12th USENIX)Symp. Operating Syst. Design Implement. (OSDI) , 2016, pp. 485-500. -
  38. [50][50] H. Zhao, P. Bai, Y. Peng, and R. Xu, 'Efficient key management scheme for health blockchain,' CAAI Trans. Intell. Technol. , vol. 3, no. 2, pp. 114-118, Jun. 2018. -
  39. [51][51] L. Luu, D.-H. Chu, H. Olickel, P. Saxena, and A. Hobor, 'Making smart contracts smarter,' in Proc. ACM SIGSAC Conf. Comput. Commun. Secur. , 2016, pp. 254-269. -
  40. [52][52] S. Meiklejohn et al. , 'A fistful of bitcoins: Characterizing payments among men with no names,' in Proc. Conf. Internet Meas. Conf. , 2013, pp. 127-140. -
  41. [53][53] E. Androulaki et al. , 'Hyperledger fabric: A distributed operating system for permissioned blockchains,' in Proc. 13th EuroSys Conf. , 2018, p. 30. -
  42. [54][54] C. Gentry, 'Fully homomorphic encryption using ideal lattices,' in Proc. STOC , vol. 9. 2009, pp. 169-178. -
  43. [55][55] V. Goyal, O. Pandey, A. Sahai, and B. Waters, 'Attribute-based encryption for fine-grained access control of encrypted data,' in Proc. 13th ACM Conf. Comput. Commun. Secur. , 2006, pp. 89-98. -
  44. [56][56] I. C. Lin and T. C. Liao, 'A survey of blockchain security issues and challenges,' Int. J. Netw. Secur. , vol. 19, no. 5, pp. 653-659, 2017. <!-- image --> Nguyen Binh Truong received the B.Sc., M.Sc., and Ph.D. degrees from Liverpool John Moores University, U.K., Pohang University of Science and Technology, South Korea, and Hanoi University of Science and Technology, Vietnam, in 2008, 2013, and 2018, respectively. He was a Software Engineer with DASAN Networks, from 2012 to 2015, a leading company on networking products and services in South Korea. He is currently a Research Associate with the Department of Computing, Data Science Institute, Imperial College London, U.K. His research interests include security, privacy, and trust for IoT, blockchain, personal data management, fog, edge, and cloud computing. <!-- image --> A <!-- image --> Kai Sun received the B.Eng. degrees in computer science from the Harbin Institute of Technology and the University of Birmingham in 2009 and the M.Sc. degree and the Ph.D. degree in computing from Imperial College London in 2010 and 2014, respectively. From 2014 to 2017, she was a Research Associate with the Data Science Institute, Imperial College London. She is currently the Lab Manager of the HNA Centre of Future Data Ecosystem. Her research interests include translational research management, network analysis, and decentralised systems. Gyu Myoung Lee received the B.S. degree from Hongik University and the M.S. and Ph.D. degrees from the Korea Advanced Institute of Science and Technology (KAIST), South Korea, in 1999, 2000, and 2007, respectively. He is currently a Reader with the Department of Computer Science, Liverpool John Moores University, U.K. He is also an Adjunct Professor with KAIST. His research interests include future networks, IoT, and multimedia services. He has actively contributed to standardization in ITU-T as a Rapporteur, oneM2M, and IETF. He is the Chair of the ITU-T Focus Group on data processing and management to support IoT and smart cities and communities. <!-- image --> Yike Guo received the B.Sc. degree in computing science from Tsinghua University, China, in 1985, and the Ph.D. degree in computational logic from Imperial College London in 1993. He is currently a Professor of computing science with the Department of Computing, Imperial College London, and the Founding Director of the Data Science Institute, Imperial College London. His research interests are in the areas of data mining for large-scale scientific applications, including distributed data mining methods, machine learning, and informatics systems. He is a member of Academia Europaeaa and a fellow of the Royal Academy of Engineering.

Cited by

Sorted by citations

Authors
Truong, N. B., Sun, K., Lee, G. M., & Guo, Y.
Affiliations
Imperial College London (GB)
ORCID
Venue
IEEE Transactions on Information Forensics and Security
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2020
Volume
15
Pages
1746-1761
ISSN
  • 1556-6013 (ISSN-L)
  • 1556-6021
DOI
10.1109/tifs.2019.2948287
OpenAlex
W2931380835
Cited by
339
References
1
Citations by year
2026: 22 · 2025: 41 · 2024: 56 · 2023: 69 · 2022: 60 · 2021: 63 · 2020: 23 · 2019: 5
FWCI
46.97
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Transactions on Information Forensics and Security (publishedVersion, cc-by)
  • Liverpool John Moores University (acceptedVersion)
  • Rare & Special e-Zone (The Hong Kong University of Science and Technology) (submittedVersion)
  • arXiv (Cornell University)
Funders
Imperial College London
Topics
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
Keywords
GDPR compliance, personal information management, blockchain, smart contracts, data provenance, data ownership, decentralized data processing, Hyperledger Fabric, permissioned blockchain, data protection, immutability

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review