# A Blockchain-Based Privacy-Preserving and Fair Data Transaction Model in IoT
## 4 System Model
### System Overview  
In the model, data is perturbed using local differential privacy before the transaction to protect data privacy, and verifiable encrypted signatures are used to ensure the fairness of the transaction. An arbitration committee is established to replace the traditional single arbitrator, with the intention of preventing potential collusion between dishonest parties and the arbitrator during the transaction. The system assumes that IoT devices are programmable and can implement local differential privacy. The model views IoT devices as nodes in the blockchain, which can effectively prevent single-point failures. It also securely records information about data disturbances and transactions in an immutable manner to ensure the traceability of transactions. The system overview is illustrated in Figure 1. As depicted in Figure 1, the system primarily consists of four components: data consumers, data providers, the arbitration committee, and the blockchain. Specifically, data consumers issue data transaction requests. Data nodes that meet the requirements and are interested can apply to become data providers for a given transaction. After the application is approved, the data provider will consider their privacy and reward needs to determine their privacy budget and perturb their local data preparation for transactions. The transaction employs verifiable encrypted signatures to sign the transaction agreement, with the arbitration public key synthesized by a random subset of \(t\) members from the arbitration committee. Ultimately, the blockchain records transactional information, including data perturbations, to facilitate traceability. Further details on each component of the model will be explained below. 1. Data Consumers: Based on their specific needs, they issue a data trading request. Data consumers may need to ensure the size of transaction data due to statistical and other business needs. Meanwhile, the smaller the privacy budget of differential privacy, the lower the availability of transaction data. Therefore, the minimum data volume and minimum privacy budget are specified in the data transaction request. Subsequently, they make a payment that serves as a deposit to prevent any malicious behavior on their part. Data nodes that meet the criteria of the consumer's request and are interested in it can apply to participate in this data transaction. Ultimately, a transaction agreement is signed using a verifiable encrypted signature, after which they obtain the dataset, now distorted with noise, and paid compensation. 2. Data Providers: Refers to nodes that meet the demands of the data consumers and successfully partake in the data transaction. These providers aspire to earn compensation from the current data transaction. However, they might be unable to meet the data volume requirements of the data consumer individually due to limitations in their storage or limited data resources. When data providers apply to join a transaction, they must declare their own data size. If the cumulative data size of all the providers does not meet the consumer's needs, the transaction is then canceled. Similarly, to prevent malicious behavior, data providers must also pay a deposit when applying to participate in the transaction. 3. Arbitration Committee: This committee is selected through mutual consultation between both trading parties and is exclusively valid for the current transaction. Committee members are also required to pay a deposit to prevent malicious behavior, such as delaying or refusing arbitration. At the same time, in order to motivate committee members, they will receive rewards after completing the arbitration on time, which come from both parties involved in the transaction that require arbitration. The number of members, \(r\), in the committee adheres to the rule \(t<r\leq 2t-1\). After the committee's formation, each member receives a secret share \(s_{i}\) of the arbitration private key, distributed by the key management entity.