# A Blockchain-Based Privacy-Preserving and Fair Data Transaction Model in IoT
## 4 System Model
### Threats and Security Goals  
The system assumes the data provided by the data providers is genuine. These nodes have undergone rigorous review before joining and aim to achieve a successful transaction with a high-quality noisy dataset. However, they could potentially face challenges related to privacy, security, or fair reward. The following discusses the threats faced by the system and the security goals achieved in responding to these threats.  
Threat 1: Privacy leakage of data providers. The information offered by data providers could pose severe adverse consequences, such as the exposure of sensitive details (names, addresses, phone numbers, social accounts, etc.). Malicious entities may use this information to pose threats to users' personal safety and assets. In addition to personal information, other data provided can also be used for data analysis to reveal preferences, interests, behaviors, etc. This may have adverse effects, such as dynamic pricing based on big data.  
Security Goal 1: Privacy protection of local data. Throughout the data transaction process, without voluntarily disclosing their local data, data providers will not compromise the privacy of sensitive data. No data provider can directly or indirectly access the real data information of other data providers during the cooperative transaction process. Data providers use local differential privacy to perturb sensitive data before uploading it, rather than sending plaintext, which ensures that no one can infer the provider's local data information from the perturbed dataset.  
Threat 2: The erroneous behavior of participants. Mainly including three types of incorrect behavior: (1) data providers deceitfully report a larger data size to garner more compensation while providing a smaller actual size; (2) after receiving payment, the data provider intentionally fails to send the perturbed dataset, which will result in direct losses for the data consumer; (3) after obtaining the perturbed dataset, data consumers intentionally withhold payments, which will result in direct losses for the data provider.  
Security Goal 2: Fair protection of reward for data providers. The system weighs a data provider's reward based on three key aspects: (1) size of the local data size, which remains unchanged after perturbation. (2) Privacy budget: a smaller privacy budget means higher privacy protection and lower data availability, which means less reward, and vice versa. (3) Credibility value: only by diligently participating in data perturbation and trading more data size can providers elevate their credibility score, with those erring seeing a reduction. High credibility ensures more rewards. Additionally, the system also implements punitive measures. Providers who misbehave will be fined and honest providers will be compensated.  
Security Goal 3: Secure transactions. The transaction process utilizes the verifiable encrypted signature technology. Both parties first agree on the transaction terms. Followingthis, the data consumer signs the agreement using a verifiable encrypted signature, which anyone can verify for validity. Once the signature's validity is confirmed, the data provider furnishes the perturbed dataset. After receiving this dataset, the data consumer uses their private key to extract their signature, completing the transaction. If the data consumer cheats and refuses to use their key, the data provider can appeal to the arbitration committee for decryption and penalize the deceitful party.