Modern information systems, especially high-risk systems which work with important data lack proper security models. Decision support systems and recommendations they produce are extremely dependent on the data they produce recommendations on, hence they require the most secure data platform and transparent history of data input and changes. Many of such systems are centralized and are stored in a single place, like a data center or even a single machine, where important data can be lost easily. Most importantly, it can be tampered without many complications, as for the typical setup there are people who always have access to the system and its data, including people who know for sure how the system is made and who can act unnoticed, being bad actors. Through all of this can be solved by introducing proper monitoring mechanics and implementing best security practices like using secure protocols and encryption, this article describes methods which completely exclude data tampering possibility and add more important properties like data immutability, decentralization and fault tolerance on a platform level.
A structure of DSS knowledge base is shown in Fig. 1. The main elements of knowledge base are objects and connections between them. Knowledge base objects can be one of two types: target or project. Each knowledge base object has a name in short wording form. Semantic meaning of the object is specified by a keyword tuple with corresponding weights. This object can be quantitative or qualitative, threshold or quasi-linear. Projects have specific parameters: runtime and resources required. A connection between knowledge base objects can be positive or negative, it can have a time delay, compatibility groups. It is also characterized by a relative impact factor.
Because the recommendations of these systems depends on a data so much, a proper security model standard must be applied in order to prevent unauthorized or unexpected changes in the data, which may change the decision made by decision support system. There are several concepts related to security that should be reviewed. 1.1
In order to trust the recommendations of decision support system, one should trust the
developers of this system, algorithms behind the system, people that control and
maintain the system and those who interact with it and input information [
Having the decision support system that is fully under the control of one party, or even multiple parties enable them to make decisions regarding the data they own:
2. Which data to filter from the input and which to keep. 3. How to organize a decision support process. 4. How to tune the system for a specific case. 5. How to properly present and explain the recommendations.
All of these processes rely on people who work with the system, not to mention
those who input data and the system itself. In such a scheme there are too many points
of failure, the main of which are people themselves. In case of undesirable results, a
group of people can decide to slightly change the input data achieving the result they
desire on their own. Having a system in which much of the trust relies on people is
not desirable, as people never can be a source of genuine and logical decisions by
their nature [
Instead, it is much desirable to have a system which does not require the trust to its operators and is trusted on a global level. This eliminates any human errors, as well as intentional attempts to change something in the system, leaving this change unnoticed. 1.2
Decision support systems are extremely sensitive to any data they store and, most
importantly, take as an input, as even a slight modification in this data could
drastically change the result. People who input data to the system can do errors, both
accidentally or intentionally, and there is always a chance for them to play a bad role and
intentionally harm the output of the system by giving an invalid or ambiguous input.
Different methods can be used to reduce the input error, however, they cannot
eliminate it [
Moreover, the input data can always be reviewed and validated by other people. Hence the only thing bad actors can perform in order to change resulting decisions is to tamper with data and hide any evidence of it.
Traditional system security models feature many ways to protect data authenticity,
including encryption, data mirroring, backups, monitoring, and logging, but even if
the system is set up properly and is well-maintained, there is always a risk that
something can go wrong or is missing, and more importantly there is no way to ensure that
the data wasn’t changed from the moment of its entry [
Decentralized data platforms solve this problem by introducing immutable public
or permissioned ledger maintained by multiple parties that participate in a process of
validating this ledger. Hence, a single entry must be trusted by all or the majority of
network participants in order to be recorded on a ledger. Data is also recorded in a
cryptographically secure way, excluding the possibility of previous records
modification [
In traditional storage systems, there is a central database which stores all the records. To prevent possible data losses in case of emergency, these systems can be set to do regular backups. However, a special care needs to be taken in order to ensure that no data was lost, damaged or tampered. Usually, the systems which guarantee all these properties are very expensive to afford and maintain.
In comparison, decentralized data platforms offer storage redundancy, but
eliminate all security and maintenance risks. Additionally, the decentralized system can be
configured in order to consume less storage if required [
While in traditional data platforms data is typically owned by one party, decentralized platforms are highly focused on the problem of information ownership. Unlike traditional data platforms, they are designed to not to concentrate all stored information, as well as computing power on a single party or even in hands of some group.
But this doesn’t mean that the information is not accessible nor is accessible to all parties. If we take blockchain as an example, every network participant in a decentralized system can obtain a copy of all information available, but the information itself can be both open or encrypted. However, in a properly set up decentralized system, one can be sure that the information recorded to the decentralized storage is permanent, and all data that belong to one party won’t change its hands to another, which is guaranteed by data immutability property of such systems [6]. 2
In order to protect a typical centralized computer system from all possible intrusions and attacks, which also applies to decision support systems, a lot of work must be performed. This, in turn, does not exclude the possibility of a hack and cannot guarantee that the system is fully protected. In other words, no matter how the system is protected, there is always a practical way to attack it.
Decentralized platforms, with blockchain technology as a primary example, offer a
solution to above problems: they eliminate risks of tampering with the system and
provide a data platform with a strictly determined way of how different parties can
interact with the platform and rules of any possible data manipulations within the
platform. Also, they offer a highly failure-resistant system, which means that even if
half of all network nodes will crash, the system will still continue to operate normally
[
Decentralized data platforms like blockchain guarantee by design that no single party can interrupt the normal, predictable functioning of the platform, as well as no data can be changed in an undefined way. In other words, there is no practical way to make a decentralized program produce a different result from expected, as well as tamper with any historical data [6].
The first successful application of a public decentralized platform was released in
2008 by Satoshi Nakamoto, the name used by the unknown person or a group of
people who originally developed Bitcoin – a peer-to-peer electronic cash system,
which is still under a high demand today [
However, there are other emerging technologies that try to address many blockchain issues. We will briefly describe them below.
Blockchain. Bitcoin and Ethereum, as the most widely adopted decentralized
platforms, are running using blockchain technology, which is one that is practically
proven to be secure and stable. Blockchain’s main disadvantage is its scalability issues,
which other decentralized data platforms try to address. However, blockchain
sharding, as the most recently introduced way to scale traditional blockchain platforms,
offers a way to increase blockchain throughput without compromising security [
The name “Blockchain” appeared directly from an underlying algorithm meaning –
the chain of blocks. Transactions in a blockchain are organized in blocks, and blocks
reference each other. This structure with cryptographically secured references
between blocks is called blockchain [
In blockchain, each next block must reference its previous block in order for the whole structure to be valid. This reference isn’t just a link – it’s a hash of a previous block. If a previous block’s contents changes, its hash changes, and thus the reference to modified block becomes invalid. Because the whole network in blockchain validates blocks, every invalid block is just ignored, leaving no chances to someone to tamper with data and being unnoticed.
The block size in blockchain is intentionally limited, which leads to scalability
issues [
Hashgraph uses a probabilistic-based consensus algorithm, as an opposite to blockchain’s deterministic consensus algorithms. For instance, to ensure that the particular transaction happened in hashgraph, a network participant uses a gossip protocol; it asks some of its peers about whether or not they have the same transaction recorded, and the transaction is considered valid when, for example, 2/3 of the peers respond positively.
Unlike blockchain, hashgraph doesn’t have a limit of transactions. Its tangle can theoretically become very big and still be able to handle all incoming transactions. But, on the other side, hashgraph is less resistant to attacks. By having enough power, the continuous attack on a hashgraph ledger can create a “parasitic“ hashgraph, which can prevent new transactions from happening as they might be considered invalid by more than 1/3 of the network, for example.
There are many examples where Ethereum and other similar technologies were adopted by businesses, government and healthcare, as well as many other fields of study. However, these platforms didn’t get massively adopted yet, as they all suffer from scalability or security issues. There are many different higher-level solutions were introduced like sharding, lightning network, plasma, and others, but still, they are all vulnerable in case of weak algorithms used. 2.2
A consensus algorithm in a decentralized network is a process used to achieve
agreement on a single data value or a network state among distributed network participants.
In Blockchain, a consensus algorithm is used to agree on the latest state of a ledger,
which is supported by all network participants [
There are many consensus algorithms in existence, but there are just a few which
are practically proven to work and are widely used as of 2018: Proof of Work, Proof
of Stake and Delegated Proof of Stake. We will briefly introduce the main idea behind
these algorithms and compare them to each other.
Proof of Work. In a Proof of Work consensus algorithm, the blockchain network
agrees on a rule to accept the valid chain with the highest total complexity [
Adding each new block to a chain requires finding such a hash of a block that maps to a number which is below the given threshold called complexity. Finding this hash is not a trivial task; this task doesn’t have a known solution due to the pre-image resistance property of a hash function used. Thus, the only way to find a valid hash of the block is to try all possible values of a random number nonce which is used in hashing.
The first network participant called “miner” who generates a valid hash from a block broadcasts it to a network, while all other network participants accept this block because its hash is below the given complexity for a block. The next block’s complexity is deterministically computed from the complexity of previous blocks and time required for its mining so that no matter how powerful computers in the network are, there is always a stable approximate time between new blocks added to the network (15 seconds for Ethereum).
Because finding a right hash for a block is time and computational resources consuming task, network attracts more and more incentivized parties that try to find a right hash, making network complexity enormously big, which, in turn, makes any possible attacks to this network impractical.
Proof of Stake. Proof of Work algorithm requires a lot of energy for mining [
Proof of stake algorithm solves this problem by introducing virtual mining – a
pseudo-random deterministic way of identifying which party can produce the next
block, based on numerous factors. The primary factor which Proof of Stake takes into
account is the party’s stake – the number of virtual currency the party owns. In
Ethereum, for example, this currency is Ether. This means the more currency the party
has, the more blocks it can produce [
Proof of Stake doesn’t solve the problem of one party owning almost all currency, as well as Proof of Work doesn’t solve the problem of one party owning all computational powers. However, it is more efficient as it requires a very few computing resources when compared to Proof of Work.
Delegated Proof of Stake is one of the most complex consensus algorithms widely
used today. It works similar to Proof of Stake with the difference in the next block
producer selection algorithm. Delegated Proof of Stake block producer mechanism
works more like an election, where all network participants can vote for block
producers using their in-network currency, thus, increasing their chances to become
actual block producers [
Unlike Proof of Stake, there isa limited number of block producer involved, which allows higher scalability comparing to Proof of Work and Proof of Stake, as only a limited number of network participants do actual computations, while others just consume them as is. 2.3
Because there are tasks that one particular decentralized data platform cannot handle,
such as heavy computations or high throughput and reliability at the same time, there
are several different approaches of how the decentralized network can be set up in
order to fit the needs [
Public Decentralized Data Platforms. Public decentralized data platform is a
decentralized data platform intended for a public use, meaning that any party can
transact in its network. Just like the internet, but immutable, predictable and
censorshipresistant. Because the network of a decentralized data platform is public, any network
participant can transparently see and verify each transaction in it, ensuring that the
data was not corrupted or changed [
Ethereum is one of the most well-known public decentralized data platforms, which is able to handle a maximum of 15 transactions per second. Handling more transactions per second makes the system more centralized, as more resourced is required to support the network, while not every network participant can afford to have this resources available.
Public decentralized data platforms like Ethereum allow providing a maximal trust to a software solution based on them. However, sometimes, these platforms are not scalable enough, and for some cases, there is a point in using private or permissioned platforms.
Private Decentralized Data Platforms. Because public decentralized data
platforms cannot afford big throughput due to security reasons, there is an option to
launch a private network, which will be only accessible to a particular number of
parties [
While private networks are closer to traditional centralized platforms, they borrow some useful properties from decentralized ones, like immutable network history and fault tolerance.
and private decentralized data platforms, finding the golden mean between two. These
platforms are often referenced as consortium platforms (for example, consortium
blockchain). They function just like public platforms but have more restrictions on
who can access the platform and, more importantly, who can perform which
transactions [
Speaking of the blockchain technology, in a permissioned decentralized system there may be a pre-defined set of parties who can assemble blocks. For instance, in a bank system where more than 10 banks are involved, each bank as a network participant can have an equal weight, leading to everyone have the same influence on the network. The rules are strictly defined in a system, and once one instance does not follow these rules it exists to the chain which is considered invalid by all other parties, thus leaving the network.
The biggest example of permissioned blockchain today is Hyperledger Fabric, providing a flexible blockchain-based platform that can be set up for almost any needs. While it is highly configurable, there is still no possible configuration in which the blockchain will be scalable, highly available and secure at the same time. 3
Decentralized data platform application can bring the following properties to the highrisk systems:
Regarding decision support systems, there are several possible applications. We describe 2 of them, based on a fully public access control model and semi-public permissioned model.
Private and consortium security models of decentralized data platforms are quite challenging to set up properly, so we do not recommend setting them up for individual organizations, rather than joining to already existing private or consortium decentralized data platforms. 3.1
One of the main applications is to build a system fully on top of a decentralized platform. This is always the most desirable scenario, however, it has two disadvantages: 1. It requires developing a solution which doesn’t have functional bugs or special method development which allows updating the solution without further centralization risks. 2. The reliable public decentralized platform which solves a scalability problem does not exist yet, which limits the number of operations that can be performed in a decentralized ledger.
In a case of the full decentralization, regarding decision support system, experts are using the client which is connected to a decentralized data platform directly, making the direct contributions to a global public ledger of a decentralized data platform. The entered data becomes immutable immediately after the entry, and all its possible future changes are practically excluded. The diagram demonstrating the process of information entry, processing and verifying is depicted in figure 4.
The client used for the data entry by experts uses the decentralized identity – an account in terms of the decentralized data platform. These accounts are registered before the data entry
Thus, after the result is processed by the decision support system, each recommendation given by the system is compared and verified against input data, which is 100% legit. Moreover, in case of decentralized data platform can handle the load and computing resources required to process the input data and produce a decision, the whole decision support system can be built on top of the decentralized data platform. 3.2
Taking into account that the public security model currently does not fit all the needs of a scalable and, as a result, reliable system, we suggest another approach to creating a reliable and secure trustless system for high-risk decision support systems based on permissioned decentralized data platforms.
This security model decreases the required space of stored data within the decentralized platform, making it cheaper to use. For example, it can reduce the cost of each complete decision support process to $0.03 in equivalent, when using Ethereum decentralized platform usage (the average cost of one transaction in the main Ethereum network, as of 11/8/2018).
In this security model, the data is entered into the system using a regular centralized database. After the data is entered by all experts, this data is cryptographically hashed with a strong hashing algorithm and is published to a public decentralized data platform as a proof of the data state. Later, the input information is disclosed and experts confirm that the resulting hash corresponds to an input data indeed. This data can be confirmed by any provisioning expert and saved for further proof that the output was produced from the legit input. This procedure is somehow similar to obtaining a digital signature for every information entered to the system, but without a practical way to change the signature itself.
Figure 5 demonstrates this approach. The only information that goes to a decentralized secure ledger is a hashed information, which stands as a proof of legit input data that is compared to the original input after the decision support process is finished. In this scenario it is important to mention that the original data can be lost, resulting in having a hash that does not correspond to any data. But at least, for the consumer, this will mean that the process of decision support was not organized properly and the produced decision can be forged.
High-risk systems, including decision support systems, require the most secure program and infrastructure environment to function. Decentralized data platforms, which is an emerging technology nowadays, is the only way for systems and applications to practically exclude any tampering risks and intrusion possibility. By utilizing the decentralized security model proposed in this article high-risk systems can expect their data and processing to be safe and predictable regardless of how the internal system is developed and maintained.