# SPIN: A Blockchain-Based Framework for Sharing COVID-19 Pandemic Information across Nations
## 3 Framework Analysis
### Security and Privacy  
Authentication: Peers and clients are authenticated using a public key infrastructure (PKI). The MSP component of Hyperledger Fabric handles authenticating members and verifying their identities. Moreover, for travel request transactions, SPIN verifies the identity of individuals by employing fingerprint authentication, explained in Section 2.3.  
Figure 3: Issuing and Verifying COVID-19 Certificates.  
This fingerprint authentication provides a highly secured mechanism by nature due to the fingerprint uniqueness of every single individual.  
Availability: Decentralized databases derived from blockchain technology are protected against the single point of failure. Therefore, any transaction can be executed between the main actors at all times, as a failure in such applications can be costly and burdensome. To enhance availability, a country may be physically represented by multiple peer nodes in the network. The blockchain consensus protocol impacts its availability characteristics. For our implementation, we employ the Raft protocol to reach a consensus, which is crash-fault-tolerant and continues to operate as long as the majority of nodes are running.  
Integrity: Blockchain technology features a temper-proof and immutable ledger that ensures the integrity of transactions. Moreover, when issuing transactions, either public or private, clients and their corresponding peers sign them. These digital signatures verify the identity of issuing clients and their corresponding peers and ensure that transactions have not been altered.  
Attribution and nonrepudiation: In order to issue transactions, clients and their corresponding peers must sign transactions with their private keys. Moreover, the hash of the private data is written to the blockchain, as evidence for the transaction. These mechanisms prove the issuance of transactions by peers and their clients, enabling attribution and accountability to verify transactions if needed.  
Authorization and confidentiality: SPIN employs a permissioned blockchain network. Peers represent countries, and they admit their clients, such as a hospital or border control, into the network. Furthermore, peers may assign read and write privileges to their clients. Public data are accessible to all peers of the network, while private data are only sent to the destination peers to access it.  
Anonymity: It is preserved and indeed a prominent feature in all the procedures including individuals' fingerprints. Cancelable biometrics, described in Section 2.3, is utilized to protect the original fingerprint of individuals without compromising any security aspects explained previously. Thus, the stored fingerprint templates cannot be linked to any individual. Thus, all the exchange of public and private data between the peers or between the peers and the local entities cannot be tracked back to the individuals.  
The right to delay the transaction: SPIN supports that any individual can schedule the execution of her transaction, so her information will not be sent to the destination peer until the scheduled time. This helps to increase the privacy of the individual as her information is stored only in the origin peer, while the destination peer does not have access to the individual's information until the scheduled time has passed.