A Blockchain Solution for Securing Real Property Transactions: A Case Study for Serbia

: The origins of digital money and blockchain technology goes back to the 1980s, but in the last decade, the blockchain technology gained large popularity in the ﬁnancial sector with the appearance of cryptocurrencies such as Bitcoin. However, recently, many other ﬁelds of application have been recognized, particularly with the development of smart contracts. Among them is the possible application of blockchain technology in the domain of land administration, mostly as a tool for transparency in the developing countries and means to ﬁght corruption. However, developed countries also ﬁnd interest in launching pilot projects to test their applicability in land administration domain for reasons such as to increase the speed and reduce costs of the real property transactions through a more secure environment. In this paper, we analyse how transactions are handled in Serbian land administration and how this process may be supported by modern ledger technologies such as blockchain. In order to analyse how blockchain could be implemented to support transactions in land information systems (LIS), it is necessary to understand cadastral processes and transactions in LIS, as well as legislative and organizational aspects of LIS. Transactions in cadastre comprise many actors and utilize both alphanumeric (descriptive or legal) data and geospatial data about property boundaries on the cadastral map. Based on the determined requirements for the blockchain-based LIS, we propose a system architecture for its implementation. Such a system keeps track of transactions in LIS in an immutable and tamper-proof manner to increase the security of the system and consequently increase the speed of transactions, efﬁciency, and data integrity without a signiﬁcant impact on the existing laws and regulations. The system is anticipated as a permissioned public blockchain implemented on top of the Ethereum network.


Introduction
Blockchain is a technology that many of us are becoming aware of and it is gaining increasing attention. However, its application outside of the finance sector and cryptocurrencies is still relatively limited. Nevertheless, this might change as benefits are increasingly realised, such as in simultaneously and securely sharing data and enabling communities of providers, such as in land administration, government, IoT (Internet of Things), and smart cities, healthcare, etc., to track sensitive information across time and space [1]. Bennett et al. [2] find that while uptake of non-relational and distributed databases and ledger technologies occurs, it remains mainly at the level of proof-of-concept, demonstrator, or a pilot.
Distributed ledgers are considered collections of replicated, shared, and synchronized digital data geographically spread across multiple locations. This technology enables transactional data to be created and shared across distributed network nodes [3]. In such peer-to-peer architecture, there is no central authority and all nodes contain a full copy of the ledger. The technologies used to implement such ledgers include blockchains. Blockchain The paper is structured as follows. After the introduction, theoretical background and related work are analysed to understand the application of this technology in the land administration domain. After that, the methodology for introducing blockchain technology in the land administration domain is described in Section 3. To analyse how blockchain could be implemented to support transactions in LIS, it is necessary to understand cadastral processes and transactions in LIS, as well as legislative and organizational aspects of LIS. Section 3 also presents a conceptual model of keeping track of changes in Serbian LIS to understand better what information the part of a blockchain transaction will be. Sections 4 and 5 present results. Section 4 presents the analysis of requirements for the implementation of blockchain-based LIS. The proposed system architecture for the implementation of blockchain-based LIS is shown in Section 5. Conclusions and future work are presented afterward.

Blockchain and Smart Contracts
In order to provide clarity, this subsection briefly summarizes the key aspects of the blockchain technology and associated smart contracts. As already mentioned, blockchain technology allows for transactions and data to be recorded, exchanged, and synchronized across a distributed network of different network participants. A blockchain is a specific type of data structure used in some distributed ledgers that stores and transmits data in packages called blocks connected to each other in a digital chain [8] using an appendonly structure. It was firstly introduced with Bitcoin for the cryptocurrency [9]. However, blockchain can be applied in numerous other application areas [10].
As shown in Figure 1, a block contains the transactions data, a timestamp, a nonce number, and a reference in the form of a hash to the previous block, linking the two blocks together. This way, the chain of blocks is formed. The hash function receives the transactions data, the timestamp, the nonce, and the hash of the previous block and generates an output of a fixed length as the unique finger-print of the block. A hash cannot be changed unless the data itself are changed, but a slight alteration in data generates a very different hash code, so any change can be easily detected. Since the hash to the previous block is hashed together with other block's data, any change in the previous block will result in a different hash of that block which means that the two hashes will not match and the chain will be broken.
Blockchain is a technology that allows the trustless exchange of value within the network without explicit intermediaries [11]. Trust is replaced by cryptographic proof. Blocks can only be appended to the existing blockchain and it is not possible to delete a block once added to the chain. It means that the blockchain is an ever-growing (appendonly) data structure [12], constructed as an immutable list of records. Because of its distributed peer-to-peer architecture and built-in replication between all nodes, blocks in the blockchain are immutable. This means that the history of transactions cannot be erased or modified unless it is done on the majority of the nodes, and as long as there are more honest than corrupted nodes in the network, all data is safe.
To add a new block, blockchain requires a consensus algorithm. The most common consensus algorithm is proof-of-work (PoW), a computationally intensive algorithm in which a nod must guess a nonce such that the hash of a block being created is less than a target value determined by the blockchain network. Using the consensus algorithm, blockchain helps to reach a global view of the world [13]. 4  To add a new block, blockchain requires a consensus algorithm. The most common consensus algorithm is proof-of-work (PoW), a computationally intensive algorithm in which a nod must guess a nonce such that the hash of a block being created is less than a target value determined by the blockchain network. Using the consensus algorithm, blockchain helps to reach a global view of the world [13].
Decentralization, immutability, transparency and smart contracts are usually identified as the main features of the blockchain technology [14]. According to Nakamoto [9] decentralization is presented as substitution for trusted third parties for verifying transactions with no need for any kind of central authority. Immutability means that a transaction cannot be reversed or changed. Transparency allows all transactions in the blockchain to be publicly visible and transparent for interested parties. Furthermore, transparency may be considered the most important characteristic of a blockchain because it is impossible to manipulate the records in the network by a single entity without being noticed. This is the result of decentralization and immutability of transactions. All interested users (miners) of the network are responsible for the validation of each transaction. Through this, the platform can remain highly transparent and trustworthy, which refers to public blockchains.
Smart contracts are defined as a computerized transaction protocol that executes the terms of a contract recorded in a computer language as a set of instructions [15]. Smart contracts are computer programs (representing a business logic of a smart contract) that are able to automatically execute the terms of a contract among participants in a blockchain environment [16,17]. These programs define rules and consequences in the same way that a traditional legal contract would, but the entire process is automated and without the need for an intermediary. The original idea of smart contracts was introduced in 1996, but the Ethereum blockchain introduced its practical implementation. The creator of Ethereum, Buterin [18] defines a smart contract as a system that allows for assets to be automatically transferred according to some predefined rules. There is no trusted third party that will enforce these smart contracts. They are enforced by the consensus mechanism that a specific blockchain uses. The immutability that applies to transactions in the blockchain also applies to smart contracts.
Considering the access to the blockchain network, three types can be distinguished: public, private and hybrid. A public blockchain has no access restrictions and anyone can send and validate transactions. Such networks usually offer economic incentives for those Decentralization, immutability, transparency and smart contracts are usually identified as the main features of the blockchain technology [14]. According to Nakamoto [9] decentralization is presented as substitution for trusted third parties for verifying transactions with no need for any kind of central authority. Immutability means that a transaction cannot be reversed or changed. Transparency allows all transactions in the blockchain to be publicly visible and transparent for interested parties. Furthermore, transparency may be considered the most important characteristic of a blockchain because it is impossible to manipulate the records in the network by a single entity without being noticed. This is the result of decentralization and immutability of transactions. All interested users (miners) of the network are responsible for the validation of each transaction. Through this, the platform can remain highly transparent and trustworthy, which refers to public blockchains.
Smart contracts are defined as a computerized transaction protocol that executes the terms of a contract recorded in a computer language as a set of instructions [15]. Smart contracts are computer programs (representing a business logic of a smart contract) that are able to automatically execute the terms of a contract among participants in a blockchain environment [16,17]. These programs define rules and consequences in the same way that a traditional legal contract would, but the entire process is automated and without the need for an intermediary. The original idea of smart contracts was introduced in 1996, but the Ethereum blockchain introduced its practical implementation. The creator of Ethereum, Buterin [18] defines a smart contract as a system that allows for assets to be automatically transferred according to some predefined rules. There is no trusted third party that will enforce these smart contracts. They are enforced by the consensus mechanism that a specific blockchain uses. The immutability that applies to transactions in the blockchain also applies to smart contracts.
Considering the access to the blockchain network, three types can be distinguished: public, private and hybrid. A public blockchain has no access restrictions and anyone can send and validate transactions. Such networks usually offer economic incentives for those who validate transactions and use consensus algorithm such as PoW which is resource demanding. In private blockchains, participants and validators access are restricted and actors are selected in advance. Each of these two types has its advantages and disadvantages. Public blockchains are transparent and tamper-proof but are slow and with high computational costs. Private blockchains are more centralized but can deliver much higher throughput and speed with less computational costs. Therefore, hybrid blockchain is proposed as a combination of these two types to combine the advantages of both types while trying to limit the disadvantages. Thus, with the hybrid approach, a public blockchain may be employed to make the ledger accessible to the public, while using a private blockchain to control who can generate transactions in the ledger. Such approach seems to be the most suitable for LIS, whose data can be viewed by the general public, but only selected actors can insert changes into the system.
The main disadvantage of using blockchain is that it is still in its early stages, and there are no tools that are mature enough yet. Furthermore, since it is not useful for storing large amounts of data, blockchain shouldn't be used as primary storage but as some sort of index or transaction validation layer. To address the problem of combining data storage with a blockchain, there are a few attempts among which is BigchainDB [19]. BigchainDB does not change or enhances the blockchain technology; rather, it is a big data distributed database that adds blockchain characteristics. This option may be explored when there is a necessity to store a large amount of data with blockchain capabilities, rather than the essential transactional data. Furthermore, when a smart contract is added to the blockchain, it cannot be changed anymore, and it will perform conditions of the contract as initially programmed. This might cause severe issues if bugs and errors are present in the code. An example is the well-known DAO (Decentralized Autonomous Organization) attack [20], an event when a hacker exploited a flaw in the smart contract on the Ethereum network. This example shows how exploiting a security vulnerability that existed in the application layer on top of the blockchain could cause an undesired outcome. This is considered to be one of the major security concerns for smart contracts. In addition to technical vulnerabilities, the use of automated smart contracts also raises some legal and regulatory issues which need to be addressed [21].

Blockchain in Land Administration
With the addition of Turing-complete programming languages for developing smart contracts, blockchain shifted its focus from cryptocurrency to other areas of application in 2015 (known as blockchain 2.0). Therefore, it is not a surprise that application of blockchain in land administration is still in its early stages. Several countries have launched (pilot) projects to analyse the applicability of blockchain technology in land administration. Countries with such projects include Brazil [22], Dubai/UAE [23], Georgia [24], India [25], Kenya [26], Ghana [27], Ukraine [28], Sweden [29], Honduras/Factom [30], etc. The land department in Dubai uses blockchain technology to store real property transactions [31]. Blockchain start-up Ubitquity launched a real estate platform on the Bitcoin blockchain to track ownership of real estate titles in the US [32]. Graglia and Mellon [33] summarise the use of blockchain technology for land transactions by country, which is as follows: Brazil, Georgia and Dubai use a public blockchain to record documents related to land transactions. Sweden and Dubai use blockchain to record the progress of a transaction. Dubai and Georgia use a blockchain registry where a central database is replaced with a permissioned blockchain. However, for peer-to-peer land transactions where rights are transferred without intermediaries there are no known examples.
The Republic of Georgia is considered the first national government to use blockchain technology to store records of official transactions. Georgia uses a private permissioned blockchain to keep important records and then uses the public Bitcoin blockchain to publish hashes of essential documents [34]. The Land Registry of Sweden conducted a study of the possibilities of using blockchains as a technical solution for the real property transactions [35]. The study found that the time between signing a purchasing contract and registering the rights could be significantly reduced and even executed in near real-time, by increasing confidence in the land administration system while reducing the risk of errors and deliberate frauds. Buying and selling of real estate is realized through the use of smart contracts. However, a legal framework has proven to be an issue during the implementation, so a radical change in the land registration process is not anticipated. A solution proposes the implementation of a blockchain in addition to the existing land registry to record transactions on a private permissioned blockchain shared between various stakeholders.
While in the developed countries like Sweden, the main motivation to introduce blockchain in real property transactions is to increase transaction speed and reduce costs and possible errors, developing countries use it to improve transparency in property transactions and fight corruption because of the immutable nature of the blockchain. In Kenya, the blockchain-based land register is developed using the Ethereum blockchain network to create a single register of immutable and incorruptible land ownership records [36]. The ledger is public but has multiple permission levels to enable some aspects of the transaction to be kept private (such as sales price or sensitive personal information).
Some countries incorporated blockchain-based land registers as part of a broader eGovernment initiative to run government operations on a blockchain. One of the largest non-financial implementations of blockchain is the digital infrastructure of Estonia's government [36]. Estonia's government has developed infrastructure based on blockchain and includes registries such as the business registry, property registry, health registry, digital court documents, and official announcements. The technology enables the efficient detection of modifications to data and maintains the integrity of records.
Furthermore, Müller and Seifert [31] identified the main objectives of introducing a blockchain-based land registry, which can motivate using blockchain in the land administration domain in general. Those are: faster execution of transactions in the land register; automated notifications of changes in the land register; greater transparency and security of transactions; digital archives of contracts and other documents hashed on blockchain. Casino et al. [37] provided a systematic literature review of blockchain-based applications and identified land administration as one of the key potential domains that could benefit from it.
Anand et al. [30] analyse the use of coloured coins (a layer developed on top of the Bitcoin blockchain) to represent smart properties. The process of describing the property with a coloured coin token is called smart property. Savu et al. [38] propose a quality assurance framework based on blockchain technology which will allow a more transparent real property development market. Vos [39] describes the functioning of blockchain technology and the possible use or impact it may have on current land registry systems and the role of legal experts. Different blockchain platforms have been analysed and the possibility of use of smart contracts. Miscione et al. [40] analyse the blockchain technology that offers a model of distributed authentication, which does not depend on a central authority in the domain of land registries. Pisa and Juden [41] provide a view of the technology's potential and examine its potential role in addressing development challenges, including a secure digital infrastructure for verifying identity and securing property rights. Grigs et al. [42] analyse the use of blockchain in land administration with the conclusion that where the process of registration is in some way unreliable, blockchains may offer some advantages. Lemmen et al. [43] discuss available land administration standards and options for further standardisation, including standardisation of transactions of those rights, as a possible first step to implement a blockchain-based land administration system.
While most studies are concentrated on land registers, containing legal alphanumeric data about properties, property rights and right holders, some researchers focus on geospatial data i.e., surveying data about the properties' boundaries. Torun [44] focuses on surveying methods and projects and proposes the use of blockchain to minimize the boundary surveying problems caused by incautious actions to reduce errors that cause unsolvable problems at the surveying phase and has to be handled at courts. Bochove et al. [45] introduce the concept of bitsquares where squares of land replace coins as the units of transaction. Farnaghi and Mansourian [46] suggest that public participatory GIS should be developed as decentralized applications (DApp) based on Ethereum blockchain to have a fully transparent and reliable environment for public participation. The authors suggest that public blockchains are an appropriate solution for participatory mapping. Furthermore, The United States National Aeronautics and Space Administration (NASA) announced the use of smart contracts on the Ethereum blockchain in its SensorWeb program [47].
King et al. [48] introduce FOAM Protocol as the interoperable standard for location on Ethereum for sharing secure and decentralized geospatial data. Its purpose is to serve as a location layer for smart contracts and create a consensus-driven map. This allows building applications that are connected to verifiable physical addresses. By providing a proof of location, FOAM gives a spatial context that is not present in regular blockchains. Open Geospatial Consortium considers the adoption of the FOAM protocol as an OGC standard [6].
Some authors analyse benefits of the blockchain in land administration with the conclusion that the technology does not seem to be mature enough for application in land administration at this moment [49] and that the benefits do not yet outweigh the costs and challenges associated with implementing a prototype blockchain land registry system [50]. However, steps should be taken to lay the foundation for a blockchain system in the future. In this regard, Graglia and Melon [51] suggest that not only technical but also legal obstacles should be overcome. Furthermore, a good governance model should also play an important role and needs to be developed [52]. The World Bank [53] also aims to demonstrate the opportunities and challenges associated with blockchain technology in the field that significantly impacts governance.
In Serbia, several issues present in the national land administration may potentially be resolved using blockchain [54]. The blockchain technology, more precisely smart contracts, could bring improvements to the process of registering transactions in LIS which would result in a faster process of executing transactions and eliminating the possibility of "double spending". However, the authors of the study did not elaborate on details of how this could be achieved. Furthermore, the working group was formed, consisting of representatives of several different institutions including the National bank, Ministry of finance and other government representatives. This working group works on a document that will be the basis for the adoption of a legal act to regulate the field of blockchain technology in Serbia in the near future. Although the main focus of this working group is in the financial sector, other sectors are also considered in the overall eGovernment implementation, which brings us to the motivation how to integrate government registers (specifically land/cadastre register) into the blockchain.

Material and Methods
In order to analyse how blockchain could be implemented to support transactions in LIS, it is necessary to understand cadastral processes and transactions in LIS, as well as legislative and organizational aspects of LIS. The cadastral information system is maintained by the central geodetic authority. The Law on State Survey and Cadastre in Serbia [55] defines the geodetic-cadastral information system as a system that contains data and services for the basic geodetic works, real estate cadastre, the address register, network utility cadastre, etc. Its purpose is to enable data management, maintenance, access, and use of cadastral data (both alphanumeric and geospatial). In our previous work, these subsystems were thoroughly analysed together with their internal and external users (actors of the system). As a result of these activities, a set of use cases have been developed. Furthermore, a collection of conceptual models have been developed including a conceptual data model-LADM country profile [4], a domain model for the cadastral map with land use component [5] and a conceptual service model that describes cadastral processes [56,57]. These conceptual models of data and processes and implemented database schema [58] served as a basis for understanding processes and transactions in the cadastre.
Introducing blockchain technology in LIS consists of the following steps: • Getting requirements such as identity management for users or whether transactions should be recorded on a purely private or public blockchain or a hybrid approach should be used.
• Selection of the implementation blockchain platform. This choice depends on several factors, including the maturity of the platform, its capabilities, number of users, cost of implementation, and resource consumption, and how complex the implementation would be. • System design and the solution development.

•
Analysis of the interaction patterns with other registers of public organisations within the eGovernment portal, considering the broader context of using blockchain technology in the eGovernment environment. • Development of business model and cost/benefit analysis to determine whether the reduction of transactions cost (through a more secure and automated environment with less need for human intervention) will outweigh the cost of implementation in the long term. • Initiation of the pilot project and creation of a testbed to verify the proposed solution.
In the first stage, a solution should have a minimal impact on the established practices and legislation in the cadastre in order to be accepted by the users. As already mentioned, the goal of the system is to increase security and speed of transactions and reduce costs of transactions, therefore, to provide the transaction validation layer, rather than to establish a truly decentralized system without an intermediary or central authority as blockchain in its essence tends to be. Some authors suggest that this might be a long-term process [2,51].

Transactions in Cadastral Information System
Data about real properties (both alphanumeric and geospatial) change over time due to different types of transactions in the cadastre. The land use or the area of a parcel may be changed, the parcels' boundaries may be changed through merging or splitting, the building can be built, changed or demolished, the right holders may be changed by purchase, gift or inheritance, restriction such as mortgages may be imposed or removed, etc. There are two types of changes of data in LIS that can be supported by the blockchain:

•
Changes of alphanumeric data (attribute data of spatial units or legal data about rights and right holders) usually as a result of the transfer of rights between parties, or change of characteristics of a spatial unit itself (e.g., a building has been expanded with additional floors); • Changes of spatial data (boundaries of cadastral parcels or buildings) as a result of surveying activities.
All these changes must be recorded so that the cadastral records are always in line with the actual situation on the ground. Also, information on previous real property conditions must be recorded. This means that a mechanism for storing data history should be provided. As described by Radulović [57], this mechanism works so that each real property has multiple instances with an exact indication in which time period it was active or is still active. Before the computerization of the system, such changes were recorded in a separate list of changes by the number of the change within the year and the exact date of the performed change. This system of recording changes has been retained, and even now changes are marked in this way. This means that each real property instance has two pairs of values (number of a change and a year) which refer to the changes by which the real property instance was created (activated) or by which it was deactivated. The active, i.e., valid instance of the real property has only the value of the change with which it was created, and it may not have this value if the real property has not changed since the establishment of the real estate cadastre. Thus, in the existing data structure, there are attributes that refer to the changes when the real property instance was created and deactivated ( Figure 2). As a result of the transformation of the existing LIS data structure to LADM based data model [4], the class RS_ChangeList was created, which contains list of changes described by the change number and a year of the change (attributes: numbercl, year), date of registration of the change (regdate), description of the change (description) and type of change that is taken from the codebook CL_ChangeType that contains types of changes ( Figure 3). One association refers to the change by which the real property instance is created (creates), and the other association refers to the change by which the real property instance is deactivated (deactivates). The conceptual data model is based on the real estate folio concept represented by the class RS_RealEstateFolio. This is a legacy paper document that aggregates right holders and rights on a property at a single point in time. The real estate folio document is issued by a cadastral office as an official document to prove rights in property related transactions.
tributes that refer to the changes when the real property instance was created and deactivated ( Figure 2). As a result of the transformation of the existing LIS data structure to LADM based data model [4], the class RS_ChangeList was created, which contains list of changes described by the change number and a year of the change (attributes: numbercl, year), date of registration of the change (regdate), description of the change (description) and type of change that is taken from the codebook CL_ChangeType that contains types of changes ( Figure 3). One association refers to the change by which the real property instance is created (creates), and the other association refers to the change by which the real property instance is deactivated (deactivates). The conceptual data model is based on the real estate folio concept represented by the class RS_RealEstateFolio. This is a legacy paper document that aggregates right holders and rights on a property at a single point in time. The real estate folio document is issued by a cadastral office as an official document to prove rights in property related transactions.   tablishment of the real estate cadastre. Thus, in the existing data structure, there are at-tributes that refer to the changes when the real property instance was created and deactivated ( Figure 2). As a result of the transformation of the existing LIS data structure to LADM based data model [4], the class RS_ChangeList was created, which contains list of changes described by the change number and a year of the change (attributes: numbercl year), date of registration of the change (regdate), description of the change (description) and type of change that is taken from the codebook CL_ChangeType that contains types of changes ( Figure 3). One association refers to the change by which the real property instance is created (creates), and the other association refers to the change by which the real property instance is deactivated (deactivates). The conceptual data model is based on the real estate folio concept represented by the class RS_RealEstateFolio. This is a legacy paper document that aggregates right holders and rights on a property at a single point in time. The real estate folio document is issued by a cadastral office as an official document to prove rights in property related transactions.   The process of conducting changes in LIS basically relies on a single database table. However, implementing the history of changes has been proved to be a complex and error-prone task, with the examples of deliberate changes in the database tables [58]. This creates the opportunity and gives the motivation to secure such records on a blockchain. Furthermore, the mentioned table is append-only which means that apart from inserting new rows no other operations, such as update or delete, should be allowed. This is in line with the blockchain transaction recording capabilities.
The main privacy issue related to transactions in LIS that has been witnessed in previous years is that the database containing transactions data can be compromised. There have been reported cases of deliberate or non-deliberate errors in the table of changes that might cause problems. Therefore, a lot of paper documents are kept supporting the integrity of data saved in the database. Blockchain may increase overall confidence in the system.
LIS data is public for reading except for personally sensitive information or details about restrictions (such as the value of a mortgage or creditor), but only selected users can modify data in it according to the assigned roles and privileges. At this point, these are selected employees of the cadastre in charge of these activities.

Requirements for Blockchain-Based LIS
In order to establish blockchain-based LIS, key requirements should be addressed to launch a blockchain-based cadastral system. This includes: • Analysis whether blockchain network should be public or private and authorised and how identity management will be handled.

•
What data will comprise one transaction in a blockchain.

•
How smart contracts will be used and what business logic should be implemented and executed on a blockchain.

Access Options and Identity Management
Current LIS is developed as a centralized ledger maintained by Republic Geodetic Authority. It uses the central database to store the data, while local databases from cadastral offices are replicated to the central database. Through this database replication mechanism, real-time access to the up-to-date cadastral data is achieved. Using this mechanism provided by the database management system, each change of data in a local cadastral office should be automatically transferred to the central database maintained by the central geodetic authority. The central database can then be accessed by the eCadastre web application (called knweb in Serbian cadastre) or national geoportal and users can search replicated data of all cadastral municipalities. This type of organization of data through data replication can be considered as a shared ledger, but it is fundamentally different than distributed shared ledgers such as blockchains which are not controlled by a single entity but by some or all network participants and there is no longer a single point of attack, which increases security.
As already mentioned, blockchain implementations may be private, public, or employ a hybrid approach where a permissioned system is built on top of a public blockchain infrastructure and controls who can access and generate transactions. The main advantage of such hybrid approach is better identity verification and management. Furthermore, such system can fit more easily into the existing legal and institutional framework, which is suitable for traditional systems such as LIS. However, to some degree, it removes a key benefit of the blockchain technology and that is the lack of a need for a central party. Nevertheless, it can be concluded that a blockchain-based LIS should use a hybrid approach. Therefore, the goal is to create a permissioned blockchain for the property rights transactions that is anchored to the public blockchain. This approach is already applied in some countries that use blockchain for land administration. The maintenance of such a system should be under the jurisdiction of government agencies such as the central mapping agency or an eGovernment portal. In such a system, nodes need permission from a central entity to access the network and make changes to the ledger. Access controls will include identity verification of the actors in LIS, which is another crucial aspect that should be resolved.
Actors in LIS have been described by Sladić et al. [56] and include external and internal users. Internal users are employees of the cadastre, while all the others are external (registered or unregistered) users, such as surveyors, banks, notaries, the general public, etc. LIS allows access for reading the limited set of data to the general public. There are two types of external users for viewing data: registered (legal persons such as banks, notaries, etc.) and unregistered i.e., general public. LIS ledger data is open and transparent (except for personal sensitive data such as personal number or address, details about restrictions such as mortgage amount, etc.). Only a selected group of users (cadastral employees) are allowed to modify the data and enter changes in the system. Therefore, a mechanism should be established for protecting data that is only available to registered users. These data can be additionally encrypted, and registered users will be able to decrypt it with their private keys.
Identity management of the selected group of users that have permission to generate transactions in the system is provided using Public Key Cryptography. A user has two keys: a private key that is only known to the user and a public key shared with the entire network. Electronic identification is defined by the Law on an electronic document, electronic identification and trust services in electronic business [59]. Users can sign in to eGovernment services using their qualified digital certificates, digital documents that bind the user's public key with the user identity and certificate authority that verified the certificate's contents. These qualified digital certificates enable users to securely log into the system and prove their identity are provided on a national level in Serbia. Permissioned blockchains require a user's identity to be verified before they can access or use the blockchain. Therefore, to create an account on a permissioned public blockchain network, a link to a real identity has to be made. Each user has to create his/her own account and login with the digital certificate. Similarly, legal entities can also possess their digital certificates.

Transactions of Alphanumeric Legal Data
As already mentioned, LIS in Serbia comprises two subsystems that contain alphanumeric data about property rights, right holders and attributes of properties such as area; and geospatial data (cadastral map) as a result of surveying activities. Each of these two types of data may be the subject of a blockchain transaction.
The transaction constitutes a data entry from a row from the table n_rs_changelist shown on Figure 3 (joined with other tables to retrieve all the necessary data, not only identifiers) which contains userId, unique identification of a property (administrative municipality, cadastral municipality, number and sub-number of the parcel, number of a building on the parcel/number of the part of parcel, number of a building unit), number of the change, type of the change and the description of the change. Furthermore, the transaction is filled with transaction details about change that has occurred (number of the change, type of a change, description, date, etc.). Moreover, documents such as contracts can also be hashed and stored in a transaction. Finally, a user that has conducted the change digitally signs the transaction with her/his private key. After being created, the transaction is inserted into a newly created block (along with some other valid transactions being created at the same time) and after being verified by the network, the block is added into the chain.
Transactions in the Serbian cadastre are supported by conducting changes in LIS, which is an append-only structure implemented using relational databases. This means that even if a transaction is canceled, the trace of it remains in the system, but it is deactivated, and a new state is created (returning to the old state prior to the transaction). This way, the history of changes is visible in the system at any point in time. The same mechanism is used in the append-only blockchain structure. This is the main reason why the blockchain transaction model fits well with the property transaction model in Serbia.

Transactions of Geospatial (Surveying) Data
Geospatial datasets in LIS (cadastral map) are produced as a result of surveying activities and are stored in the GIS datastore. So far, there is no standard on how to encode geospatial data on a blockchain, but OGC proposes the FOAM protocol to be adopted as a standard for geospatial information on a blockchain. FOAM protocol enables the location layer on top of the Ethereum blockchain network which provides a proof-of-location. Such location layer may enable surveyors to submit data about the survey results of a particular cadastral parcel or building boundary. In that way, it would be possible to track changes in time and solve the problem of inaccurate and not up-to-date cadastral spatial data. The users will then always have the latest and most accurate version of the data. All data changes will be possible to track and obtain the information on who made the change and when. Locations will be verified, and potential errors will be avoided.
The layers of the cadastral map are boundaries of administrative municipality, cadastral municipality, parcel, part of parcel, building, way of use, etc. These are mostly represented as polygon features. They can be represented in the vector format, such as WKT, GML, and GeoJSON, and further hashed to be inserted in a blockchain transaction or use FOAM protocol and its system of crypto-spatial coordinates (CSC) which need to be linked to form a polygon feature. However, the resolution of a CSC is considered to be about one square meter, which can only be used as a proof-of-location for geodetic works, rather than representing the geospatial feature itself, since cadastral boundaries surveying requires higher accuracy. Figure 4 shows an example of splitting a single parcel (that was originally numbered as 949) into four smaller parcels (949/1, 949/3, 949/4, 949/5) and a consequent change of parcel's boundaries which results in the change of geometries. The new parcels together with their boundaries are represented in GeoJSON format which are then hashed and added to a blockchain transaction data. Additional data about the party responsible for the parcel division is also added to the blockchain to track the history of changes. In such cases of splitting of a parcel, or in the cases of merging of parcels, geometry consistency should be checked prior to the insertion of the geometry in the blockchain. Poorly encoded geometry information would remain in the blockchain, so the only way to correct this is to conduct a new change (generate a new transaction) that will insert correct geometries, deactivating the previous ones. way, the history of changes is visible in the system at any point in time. The same mechanism is used in the append-only blockchain structure. This is the main reason why the blockchain transaction model fits well with the property transaction model in Serbia.

Transactions of Geospatial (Surveying) Data
Geospatial datasets in LIS (cadastral map) are produced as a result of surveying activities and are stored in the GIS datastore. So far, there is no standard on how to encode geospatial data on a blockchain, but OGC proposes the FOAM protocol to be adopted as a standard for geospatial information on a blockchain. FOAM protocol enables the location layer on top of the Ethereum blockchain network which provides a proof-of-location. Such location layer may enable surveyors to submit data about the survey results of a particular cadastral parcel or building boundary. In that way, it would be possible to track changes in time and solve the problem of inaccurate and not up-to-date cadastral spatial data. The users will then always have the latest and most accurate version of the data. All data changes will be possible to track and obtain the information on who made the change and when. Locations will be verified, and potential errors will be avoided.
The layers of the cadastral map are boundaries of administrative municipality, cadastral municipality, parcel, part of parcel, building, way of use, etc. These are mostly represented as polygon features. They can be represented in the vector format, such as WKT, GML, and GeoJSON, and further hashed to be inserted in a blockchain transaction or use FOAM protocol and its system of crypto-spatial coordinates (CSC) which need to be linked to form a polygon feature. However, the resolution of a CSC is considered to be about one square meter, which can only be used as a proof-of-location for geodetic works, rather than representing the geospatial feature itself, since cadastral boundaries surveying requires higher accuracy. Figure 4 shows an example of splitting a single parcel (that was originally numbered as 949) into four smaller parcels (949/1, 949/3, 949/4, 949/5) and a consequent change of parcel's boundaries which results in the change of geometries. The new parcels together with their boundaries are represented in GeoJSON format which are then hashed and added to a blockchain transaction data. Additional data about the party responsible for the parcel division is also added to the blockchain to track the history of changes. In such cases of splitting of a parcel, or in the cases of merging of parcels, geometry consistency should be checked prior to the insertion of the geometry in the blockchain. Poorly encoded geometry information would remain in the blockchain, so the only way to correct this is to conduct a new change (generate a new transaction) that will insert correct geometries, deactivating the previous ones.

Smart Contracts in LIS
As previously discussed, smart contracts are programs that are written on the underlying blockchain and are executed automatically by nodes on the network. Smart contracts allow for business logic to be programmed on top of the blockchain transaction. Blockchain enable smart contracts to control real-world assets, such as real property, land titles, escrows, etc. without the need for an intermediary. This is due to the fact that the nodes in the distributed network have the ability to enforce a contract by executing code.
In addition to recording changes in LIS, blockchain by the means of smart contracts can be used to fully automate transactions in LIS such as buying and selling a property which in this case can be considered an asset of value. An overview of the workflow is as follows ( Figure 5):

1.
Buyer and seller initiate the property transaction.

2.
The notary draws up a contract and the buyer and seller sign the contract.

3.
A bank can access and have insight into the signed contract. The buyer transfers the payment to the seller's account (online or offline in the bank).

4.
A bank notifies that a transfer has been made and that a transfer of ownership may be initiated. 5.
The system will notify the cadastral office to initiate the process of transfer of absolute rights (right of ownership), i.e., register the rights to the new owner. The change will be conducted in LIS. 6.
The system will also notify the tax administration about the change of ownership. A taxpayer is obligated to pay the tax for the transfer of absolute rights, which is the cost of the transaction in the amount of 3% of the price of the real estate. In the case of a new condominium bought from a legal person, VAT is paid instead of the tax for transfer of rights (10% of the price of the real estate). A condition that has to be met is that a buyer is exempt from payment of this tax if he/she does not own any other property or in the case of the new condominium bought from the legal person, VAT should be returned to the buyer. Tax administration also maintains the collection of the taxes on ownership of properties and the data in this register is often not up to date. 7.
All documents and records about the transaction are added to the blockchain. Blockchain, in general, tends to remove intermediaries with its distributed nature. While at this stage of development it is too early to explore such an option, it can be considered in a long-term period, particularly because the technology of smart contracts is anticipated for automated businesses, i.e., businesses run automatically. In that case, selling of a property can be done without an intermediary. The system will notify all relevant institutions and government bodies, such as a bank about the payment, cadastre to regis- In this workflow there exist intermediaries such as the notary or a real estate agent that should be granted a privilege to access the system and, in the case of a notary, insert changes in the system. This is how the workflow functions in practice, and it is unlikely that it will be changed in the near future. Therefore, although the disruptiveness of the blockchain technology reflects in the fact that no intermediaries are needed, at this point intermediaries are necessary because of the legal framework. Property transactions are a part of the traditional legal framework that is unlikely to be changed in the near future. While the role of a real estate agent is to connect the buyer and a seller, the notary conducts all the legal affairs related to transfer of ownership including administrative activities such as obtaining a real estate folio document from cadastre as a proof of ownership, as well as initiating the procedure for registration.
Blockchain, in general, tends to remove intermediaries with its distributed nature. While at this stage of development it is too early to explore such an option, it can be considered in a long-term period, particularly because the technology of smart contracts is anticipated for automated businesses, i.e., businesses run automatically. In that case, selling of a property can be done without an intermediary. The system will notify all relevant institutions and government bodies, such as a bank about the payment, cadastre to register the transfer of rights, tax administration to calculate taxes, local court to validate the contract, etc. At the end of the process, the buyer will receive the notification that his/her rights to the newly acquired property are registered. She/he can also track all the completed phases in the process. It is worth mentioning that a presented workflow enables all involved stakeholders to be included in all process activities, whether it is just viewing the data and process status or performing activities in the workflow. This enables transparency of the process is fully accomplished.

Proposed System Architecture for the Implementation of Blockchain-Based LIS
In this section, we analyse options for the possible implementation of a blockchainbased LIS and propose the system architecture. We explored several blockchain implementations to select the most appropriate one, based on the previously described requirement for the blockchain-based LIS. There are several options for the implementation which include: using some of the existing blockchain-based solutions for land administration, using available blockchain networks (Bitcoin, Ethereum, Ripple, etc.) for the development or developing own solution that meets all the requirements which may be a more costly and more complex solution. Many blockchain applications are built on top of public blockchains, predominantly Bitcoin and Ethereum. As previously discussed, the proposed solution is to create a permissioned blockchain for the property rights registration and tracking of transfer of ownership and other transactions in the real estate cadastre (history of changes), that is anchored to the public blockchain. In contrast, the private blockchain is more efficient, it is not trustful, and there is still a single point of attack. We have anticipated that a public blockchain is used for property transactions. However, at this point, it is not expected that anyone can generate transactions in LIS, but only a selected group of users. That is why the permissioned layer on top of the public blockchain is needed.
This approach of using the public blockchain network with a permission layer has already been introduced in practice in some countries such as in Georgia where the Bitcoin network has been used. Other solutions in the land administration domain use Ethereum instead, which allows support for smart contracts that can support legal affairs in property transactions. Ethereum can be considered the most popular blockchain for smart contract applications and it is the second-largest public blockchain after Bitcoin. In addition to the support to smart contracts, Ethereum also has higher transaction throughputs than Bitcoin, although transactions in land administration are not as frequent as financial transactions. Considering the property transaction rate, which is much lower than the rate of financial transactions, the speed of transactions shouldn't be an issue of any of public blockchain networks, neither Bitcoin nor Ethereum. Despite being an open permissionless network, it can be used with an additional permission layer to control access to the network. Furthermore, FOAM also uses the Ethereum blockchain to add a location layer for smart contracts which can be used as a proof-of-location for surveying activities. However, the Bitcoin network can be used too, and some implementations in the domain of land administration already use this network, while Ethereum has been chosen primarily because of smart contract implementation.
To extend LIS to support transactions on the blockchain, a special decentralised application (DApp) has to be developed and deployed on a blockchain [60]. A decentralized application (DApp) is an application that runs on a distributed computing system (network of nodes) instead of a single server. DApps are essentially applications that implement smart contract business logic. They include both frontend and backend similar to the traditional web application, while the smart contract is related to the implementation of the backend business logic of the application. DApps entered into wider use with the blockchains such as Ethereum. The backend of a DApp represents business logic which is running on a decentralised peer-to-peer network of nodes. This contrasts with the traditional backend of a web application hosted on a single (centralized) server. By means of DApps, blockchain is not only a transaction data storage, but can also execute business logic. Smart contracts usually contain necessary conditions for a transaction to occur.
There are two types of accounts in the Ethereum network: those that are owned by users (real persons) and those that are owned by smart contracts/DApps. On such smart contract accounts, DApp for LIS would be hosted. Therefore, one or more specialized DApps should be developed. This DApp is accessed indirectly through frontend application by referent in cadastre that conducts a change. A user that performs a change will sign in with his/her electronic certificate to prove his/her identity. A single blockchain transaction will contain all the relevant details about conducted change (such as the number and a year of change, type of change, description of the change, userId of a user that conducted a change, information about the property, rights and right holders, etc.). It will contain all the information related to that change which may be observed as a single row in n_rs_changelist table in the LIS database joined with tables linked by foreign keys (tables: n_rs_realestatefolio, n_rs_partofparcel, n_rs_owner, n_rs_ownership). Practically, it records one state of a real estate folio at a single point in time that aggregates properties, rights and restrictions and right holders. In this way, a change is made immutable and tamper-proof, and the only way to correct that change if entered information is not correct is to conduct a new change, but the trace of it will remain permanent, which will prevent malicious changes of data. All sensitive information must be encrypted by a referent so that only those with the correct key can be shown the information since the network is public, and all transactions may be seen by all. Another DApp is intended for notaries to store hashes of documents during the transfer of rights activities. Figure 6 shows the difference between a traditional web application, such as the eCadastre service called knweb used in Serbia for viewing data about property rights, and the decentralized application (DApp) hosted and executed on the blockchain network. Figure 6a shows a traditional three-tier architecture that includes the database used for storing all land-related data in LIS, the application server that hosts backend and frontend (these can also be deployed on separate servers) and a client that accesses the frontend application. To access the geospatial data, OGC geospatial services are used. On the other hand, Figure 6b shows a smart contract/DApp running on the Ethereum blockchain network. Ethereum Virtual Machine (EVM) is used to provide security and execute the code of a smart contract by computers on the Ethereum network. Frontend code of a DApp is written in JavaScript and can send requests to its backend DApp. Furthermore, the frontend can be hosted on decentralized storage such as Swarm [61] or IPFS [62].
The deployment diagram of the general system architecture is shown in Figure 7. The web-based LIS (backend) is hosted on a central server or data centre employed at the national mapping agency. It uses DApp to access the public blockchain to store transactions. Users can access the system using the frontend of the web application. The system architecture includes traditional LIS components such as database server or web server for alphanumeric and geospatial data, but also blockchain network accessed through the API of the application layer and client devices (desktop, laptop, mobile . . . ). The workflow is as follows (Figure 8). The user (cadastral referent that conducts a change) is registered on the LIS but will have exclusive access to a decentralized application (DApp). The user also has a unique hash ID as his crypto address. DApp will primarily be used by cadastral referents to insert changes in the cadastre. Since these entries will The workflow is as follows (Figure 8). The user (cadastral referent that conducts a change) is registered on the LIS but will have exclusive access to a decentralized application (DApp). The user also has a unique hash ID as his crypto address. DApp will primarily be used by cadastral referents to insert changes in the cadastre. Since these entries will be stored on the blockchain network, the data will be immutable. This will ensure that records will be tamper-proof yet available to all. The DApp frontend uses standard web technologies for frontend development, namely HTML, CSS, and JavaScript to render a page and retrieve details from the database with the help of smart contracts on the blockchain network. The workflow is as follows (Figure 8). The user (cadastral referent that conducts a change) is registered on the LIS but will have exclusive access to a decentralized application (DApp). The user also has a unique hash ID as his crypto address. DApp will primarily be used by cadastral referents to insert changes in the cadastre. Since these entries will be stored on the blockchain network, the data will be immutable. This will ensure that records will be tamper-proof yet available to all. The DApp frontend uses standard web technologies for frontend development, namely HTML, CSS, and JavaScript to render a page and retrieve details from the database with the help of smart contracts on the blockchain network. In our proposed implementation, all the details about transactions in LIS are also stored or retrieved through DApp. The frontend for DApp is developed in HTML, CSS and JavaScript and uses Web3.js API (https://github.com/ethereum/web3.js/) to interact with smart contracts on the Ethereum network and store land transaction/change details In our proposed implementation, all the details about transactions in LIS are also stored or retrieved through DApp. The frontend for DApp is developed in HTML, CSS and JavaScript and uses Web3.js API (https://github.com/ethereum/web3.js/) to interact with smart contracts on the Ethereum network and store land transaction/change details on a blockchain. Web3.js is a collection of libraries that allow interaction with a local or remote Ethereum node. Smart contracts on Ethereum are stored on EVM and their business logic is written in Solidity programming language [63]. Solidity code is compiled to bytecode that is executable on the EVM. The DApp is developed and tested using the Truffle environment [64], which provides the possibility to implement a local blockchain network for the purpose of development and testing. After this DApp may be directly deployed to the live Ethereum blockchain network without further changes.
System upgrade may involve further development and extension of DApp to accommodate an additional role representing the notaries and their privileges. This will include property transactions such as purchasing real estates and signing contracts. Prior to the completion of the final transfer of ownership, clients will complete the transactions with regular fiat currency, since it is unlikely that a cryptocurrency will be enabled or used for property transactions in the near future and the system will use traditional payment methods. Furthermore, fully automated property transactions without intermediaries are not likely in the mid-term. However, such a possibility may exist in the future if the technology achieves a sufficient level of maturity, appropriate regulatory framework, and wider user acceptance.

Discussion
With the development of the blockchain technology, many new application areas arise and one of them is in the domain of land administration. There are a number of potential advantages of using blockchain instead of traditional centralized ledgers in this domain. These can be summarized as greater transparency, easier auditability, decentralization, possible disintermediation, speed and efficiency of transactions, transaction cost reductions, automation of businesses through programmability, etc. Blockchain technology has the potential to help governments to maintain their registers in an immutable and temper-proof manner and increase the resilience of such registers generally ensuring the integrity of government records and services leading to a more powerful eGovernment ecosystem, with reduced frauds, corruption, errors, possible cyber-attacks, and paper-intensive administrative processes. Blockchain has the potential to strengthen the relationship between government and citizens in terms of transparency and trust, which is particularly important in countries in transition. These general advantages of blockchain also applies in the land administration domain to maintain trustful land registers.
However, the blockchain technology and its implementations are still in their early developments, especially in the domain outside cryptocurrencies (compared to traditional databases that are widely in use for preserving data in LIS) so new risks and challenges may arise including both legal and technological concerns that need to be resolved. The process may also lead to fundamental changes in roles and responsibilities of the stakeholders in the land sector. Therefore, it is necessary first to build a prototype implementation to test the proposed framework before going further into the overall implementation and deployment of blockchain technology as part of LIS.
Considering the choice of platform, the public permissioned blockchain based on Ethereum seems to be a reasonable solution since it supports smart contracts and provides development tools and libraries. Private blockchains do not require a computationally expensive PoW consensus mechanism for transactions validation, which is one of the major concerns for using the public blockchain because network participants are selected and trusted in advance. However, Ethereum, as a public blockchain network uses this mechanism, but in comparison to Bitcoin, Ethereum requires significantly less computing resources and the consensus mechanism is much faster. There are other consensus mechanisms, such as proof of stake (PoS), which rewards seniority over computing power and is less costly in terms of processing power. Many blockchains, such as Ethereum [63], are gradually shifting to the Proof of Stake consensus mechanism because of a significant decrease in power consumption and improved scalability. Furthermore, no software is immune to technical vulnerabilities. Failures such as the DAO attack on the Ethereum have shown that weaknesses in smart contracts can be exploited to create undesired results, which is considered as one of the major security threats for using smart contracts. In addition to technical vulnerabilities, the use of automated smart contracts also raises a number of legal and regulatory issues.
In public blockchains, such as Ethereum, all transactions are open and visible to all network members, although they can be encrypted to control access to them. Since LIS is the permissioned system, it is worth exploring other platforms that are permissioned/private blockchains in their nature, such as Hyperledger Fabric [65]. The advantage of these systems, apart from more flexible identity management to easily register users and assign privileges in a secure environment, is also less computational power. Private blockchains are also considered consortium blockchains, governed by a single entity such as the central mapping agency in the case of LIS. However, despite being more efficient, a private blockchain is not as trustful as a public blockchain. Apart from the fact that there is still a single point of attack for the network, there is still a central authority that controls the network. Therefore, only public blockchains can provide full transparency of transactions, which is one of the main goals to achieve in property transactions.
Considering the choice of platform, Ethereum and Hyperledger Fabric are popular blockchains implementations used by many applications. However, they still have design problems to deal with, such as scalability or vulnerabilities at the application layer in the case of Ethereum smart contracts. Therefore, other blockchain networks can be considered for the implementation as well, such as Bitcoin, Ripple, or Corda. Computations that can be done using Ethereum smart contracts can also be done on Bitcoin, but at a higher layer. Further work in this area may analyse the benefits of the possible use of other networks for the implementation.
Apart from technical limitations imposed by the chosen blockchain platform, the legal framework is considered one of the main obstacles for the automatization of property transactions without intermediaries. Fully automated property transactions without intermediaries are not likely in mid-term, although such a possibility may exist in the future if the technology achieves sufficient level of maturity, appropriate regulatory framework and wider user acceptance. The elimination of intermediaries will be considered in future work.
Another limitation of the proposed solution reflects the fact that this is still a theoretical approach. It analyses the role of blockchain technology to secure transactions and provide transparency in LIS and its requirements. Furthermore, it provides overall system design. Although separate components have been developed and tested, the overall architecture is yet to be proved in practice which is considered the future work.

Conclusions
In this paper we propose the system architecture for blockchain-based LIS that keeps track of transactions in LIS in immutable and tamper-proof manner to increase the security of the system and consequently increase the speed of transactions, efficiency and data integrity without significant impact on existing laws and regulations. The system is anticipated as a permissioned public blockchain implemented on top of the Ethereum network. In the paper, we provided the theoretical framework and overall system design. Future work will include building a prototype and testing it on a case study in a selected municipality. After this is proven to be successful, implementation and deployment may be approached. Furthermore, it is necessary to resolve in more detail how geospatial data will be stored on a blockchain to support surveying activities and support transactions that involve geospatial data. This needs to be aligned with the geospatial standards. Furthermore, this study may represent a roadmap of how different government registers may be developed on top of a blockchain to be a part of the announced blockchain-based eGovernment in Serbia. For that purpose, to support and adopt blockchain technology, a legal framework is already in the process of development in Serbia. Since location plays an important role in decision making at all government levels, a comprehensive and interoperable geospatial solution for blockchain needs to be developed.