In this paper, we provide a holistic survey of multimedia content protection applications in which blockchain technology is being used. A taxonomy is developed to classify these applications with reference to the technical aspects of blockchain technology, content protection techniques, namely, encryption, digital rights management, digital watermarking and fingerprinting (or transaction tracking), and performance criteria. The study of the literature reveals that there is currently no complete and systematic taxonomy dedicated to blockchain-based copyright protection applications. Moreover, the number of successfully developed blockchain-based content protection systems is very low. This points towards a research gap. To fill this gap, we propose a taxonomy that integrates technical aspects and application knowledge and can guide the researchers towards the development of blockchain-based multimedia copyright protection systems. Furthermore, the paper discusses some technical challenges and outlines future research directions.
Open access
Advanced Steganography and Watermarking Techniques
Benjamin Mariano, Yanju Chen, Yu Feng, Shuvendu K. Lahiri · 5 authors
This paper aims to shed light on how loops are used in smart contracts. Towards this goal, we study various syntactic and semantic characteristics of loops used in over 20,000 Solidity contracts deployed on the Ethereum blockchain, with the goal of informing future research on program analysis for smart contracts. Based on our findings, we propose a small domain-specific language (DSL) that can be used to summarize common looping patterns in Solidity. To evaluate what percentage of smart contract loops can be expressed in our proposed DSL, we also design and implement a program synthesis toolchain called Solis that can synthesize loop summaries in our DSL. Our evaluation shows that at least 56% of the analyzed loops can be summarized in our DSL, and 81% of these summaries are exactly equivalent to the original loop.
The quick jumps in developing new digital identity technologies have resulted in this trend of developing privacy-preserving solutions in Know Your Customer (KYC) verification systems. This article delves into the evolution of an Advanced Digital Identity Orchestration Engine to enhance privacy protection in the KYC processes. With the rise of concerns surrounding data privacy and security, traditional knowledge of customer systems which are based on centralized database, have faced major challenges including data breaches and unauthorized access. In contrast, the proposed identity orchestration engine draws on the use of Self-Sovereign Identity (SSI) principles, blockchain technology, and verifiable credentials to offer a decentralized, secure and privacy-preserving solution to identity management problem. This engine allows users to manage their personal identity information, and selectively share their information with entities they trust without losing their privacy. By leveraging decentralized identifiers (DIDs) and public key cryptography, the system is enabled to ensure the sensitive data isn't kept in a central place causing reduction in the odds of unauthorized access. Furthermore, features such as zero knowledge proofs (ZKPs) and selective disclosure provide the option for a granular control on what data is shared to ensure that only the required information is provided to comply with regulation requirements. This article also talks about integrating the orchestration engine with existing frameworks for KYC and explores the scalability, interoperability, and potential for this engine to help increase inclusivity in digital identity management. Through case studies and real-world examples, the paper points out the efficiency in working of this engine in getting better security and privacy and user experience in the process of KYC verification. Ultimately, the solution proposed creates a major step forward to privacy-preserving and user-centric digital Identity systems adapted both globally to regulatory requirements and to increase trust in digital financial services.
Francesco Bruschi, Vincenzo Rana, Alessio Pagani, Donatella Sciuto
The idea of Smart contracts foresees the possibility of automating contractual clauses using hardware and software tools and devices. One of the main perspectives of their implementation is the automation of interactions such as bets, collaterals, prediction markets, insurances. As blockchain platforms, such as Ethereum, offer very strong guarantees of untampered, deterministic execution, that can be exploited as smart contracts substrate, the problem of how to provide reliable information from the “outside world” into the contracts becomes central. In this article, we propose a system based on a Merkle tree representation of structured documents (such as all XML), with which it is possible to generate compact proofs on the content of web documents. The proofs can then be efficiently checked on-chain by a smart contract, to trigger contract action. We provide an end-to-end proof of concept, applying it to real use case scenarios, which allows us to give an estimate of the costs.
Context: Smart contracts and DApps are becoming increasingly important and widespread. DApps are often business-critical, and strong security guarantees must be ensured. However, developing safe and reliable smart contracts remains a challenging task. Despite growing literature, simple and actionable tools to address security issues are still lacking. Objective: This study identifies design patterns and best practices for DApp security. We categorize them into twelve critical areas based on their security goals and map them to the architecture of decentralized applications. For each item, we define concrete actions to support secure implementation. These are further structured into three security assurance checklists. Method: We analyze existing literature and manually review 224 security items, consolidating duplicates and harmonizing terminology. This process results in 84 unique items, divided into 36 design patterns and 48 best practices, further grouped into 12 categories. We also map the items into three checklists based on the development phase of DApp lifecycle. Finally, for each pattern and practice, we derive 374 actionable security tasks to guide secure development. Results: To the best of our knowledge, this is the most comprehensive and structured collection of DApp security items to date. The proposed framework and checklists help developers ensure the consistent and complete application of secure design principles. Conclusion: Focusing on Ethereum and Solidity, we present a comprehensive framework for improving DApp security. Our work supports ongoing efforts to reduce vulnerabilities in decentralized applications and provides developers with practical tools to build safer, more reliable systems.
Vulnerabilities of smart contract are certainly one of the limiting factors for wider adoption of blockchain technology. Smart contracts written in Solidity language are considered due to common adoption of the Ethereum blockchain platform. Despite its popularity, the semantics of the language is not completely documented and relies on implicit mechanisms not publicly available and as such vulnerable to possible attacks. In addition, creating formal semantics for the higher-level language provides support to verification mechanisms. In this paper, a novel approach to smart contact verification is presented that uses ontologies in order to leverage semantic annotations of the smart contract source code combined with semantic representation of domain-specific aspects. The following aspects of smart contracts, apart from source code are taken into consideration for verification: business logic, domain knowledge, run-time state changes and expert knowledge about vulnerabilities. Main advantages of the proposed verification approach are platform independence and extendability.
Panos Kudumakis, Thomas Wilmering, M. Sandler, Victor Rodrı́guez-Doncel · 6 authors
The Moving Picture Experts Group (MPEG) is an International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) working group that develops media coding standards. These standards include a set of ontologies for the codification of intellectual property rights (IPR) information related to media. The Media Value Chain Ontology (MVCO) facilitates rights tracking for fair, timely, and transparent payment of royalties by capturing user roles and their permissible actions on a particular IP entity. The Audio Value Chain Ontology (AVCO) extends MVCO functionality related to the description of IP entities in the audio domain, e.g., multitrack audio and time segments. The Media Contract Ontology (MCO) facilitates the conversion of narrative contracts to digital ones. Furthermore, the axioms in these ontologies can drive the execution of rights-related workflows in controlled environments, e.g., blockchains, where transparency and interoperability is favored toward fair trade of music and media. Thus, the aim of this article is to create awareness of the MPEG IPR ontologies developed in the last few years and the work currently taking place addressing the challenge identified toward the execution of such ontologies as smart contracts on blockchain environments.
The use of digital documents is exploding around the world due to the improvement of productivity and the convenience of access and backup of data.Usually, digital documents are managed by a document management system (DMS) which provides access control of the documents with access permission (e.g., password or account).However, when a user who has permission for the documents can directly access the digital document, it can occur a serious security problem.For example, when a malicious attacker gets access permission of a digital document, the document is able to be leaked.In addition, when a user who has authority behaves maliciously for his own benefit, the digital document can be easily falsified by the user.To handle these issues, we propose a new digital document management system for the security of digital documents which distributes the access permissions of the digital document.The proposed system encrypts a digital document with a key and stores the encrypted document into Interplanetary File System(IPFS).In addition, to distribute access permission of the digital document, it manages the key via Shamir's secret sharing scheme and blockchain.We implement our proposed system using Golang on Linux and evaluate the system on local IPFS and Ethereum testnet.The experimental results show that the proposed system provides high security of the digital document with minor performance overhead compared with the existing system.
Bruno Bernardo, Raphaël Cauderlier, Basile Pesin, Julien Tesson
Tezos is a smart-contract blockchain. Tezos smart contracts are written in a low-level stack-based language called Michelson. In this article we present Albert, an intermediate language for Tezos smart contracts which abstracts Michelson stacks as linearly typed records. We also describe its compiler to Michelson, written in Coq, that targets Mi-Cho-Coq, a formal specification of Michelson implemented in Coq.
Smart contract has greatly improved the services and capabilities of blockchain, but it has become the weakest link of blockchain security because of its code nature. Therefore, efficient vulnerability detection of smart contract is the key to ensure the security of blockchain system. Oriented to Ethereum smart contract, the study solves the problems of redundant input and low coverage in the smart contract fuzz. In this paper, a taint analysis method based on EVM is proposed to reduce the invalid input, a dangerous operation database is designed to identify the dangerous input, and genetic algorithm is used to optimize the code coverage of the input, which construct the fuzzing framework for smart contract together. Finally, by comparing Oyente and ContractFuzzer, the performance and efficiency of the framework are proved.
The exploitation of smart-contract vulnerabilities can have catastrophic consequences such as the loss of millions of pounds worth of crypto assets. Formal verification can be a useful tool in identifying vulnerabilities and proving that they have been fixed. In this paper, we present a formalisation of Solidity and the Ethereum blockchain using the Solid language and its blockchain; a Solid program is obtained by explicating/desugaring a Solidity program. We make some abstractions that over-approximate the way in which Solidity/Ethereum behave. Based on this formalisation, we create Solidifier: a bounded model checker for Solidity. It translates Solid into Boogie, an intermediate verification language, that is later verified using Corral, a bounded model checker for Boogie. Unlike much of the work in this area, we do not try to find specific behavioural/code patterns that might lead to vulnerabilities. Instead, we provide a tool to find errors/bad states, i.e. program states that do not conform with the intent of the developer. Such a bad state, be it a vulnerability or not, might be reached through the execution of specific known code patterns or through behaviours that have not been anticipated.
Licensing is one of the essential means of exploiting the monetary value of a musical work, and yet it is an area fraught with many issues and transactional costs which make it a difficult process for individuals and organizations. Many issues in music licensing arise from the legal complexity (e.g., national and international copyright law), business complexity (authentication, tracking, accounting, etc.), value web complexity (transparency of relationships among stakeholders), and technical complexity (e.g., establishing a global repertoire database for music, sufficient metadata standards) of working with music. Then, in addition to these issues, there are specific transactional costs (identification, negotiation, monitoring, and enforcement) associated with the licensing process. To mitigate the complexity and transactional costs associated with music and the licensing process, researchers and technologists have been investigating how new technologies and design models from the Web3 space, such as blockchain, linked data and Ricardian Contracts, can automate processes to reduce complexity, speed up payments, improve tracking, and provide other benefits in the music industry. In our report, we make our own attempt to reduce the complexity and transactional costs in the licensing process by developing an automated music license. In doing so, we first conducted a literature review scoping the intersection of music complexity and Web3 technologies to provide background and context to automating music licensing. Then we developed the Practical Tokenized Drafting (PTD) method, a set of core principles and practices for drafting Ricardian Contracts that interact with Web3 technologies (RC-Web3 Templates), and the Tokenized Music License (TML), an RC-Web3 Template standard form for music licensing on the OpenLaw platform. Both the PTD and TML can be adapted to meet the needs of music industry stakeholders and provide guidance to legal practitioners in drafting RC-Web3 Templates.
Access control management is an integral part of maintaining the security of an application. Although there has been significant work in the field of cloud access control mechanisms, however, with the advent of Distributed Ledger Technology (DLT), on-chain access control management frameworks hardly exist. Existing access control management mechanisms are tightly coupled with the business logic, resulting in governance issues, non-coherent with existing Identity Management Solutions, low security, and compromised usability. We propose a novel framework to implement dynamic role-based access control for decentralized applications (dApps). The framework allows for managing access control on a dApp, which is completely decoupled from the business application and integrates seamlessly with any dApps. The smart contract architecture allows for the independent management of business logic and execution of access control policies. It also facilitates secure, low cost, and a high degree of flexibility of access control management. The proposed framework promotes decentralized governance of access control policies and efficient smart contract upgrades. We also provide quantitative and qualitative metrics for the efficacy and efficiency of the framework. Any Turing complete smart contract programming language is an excellent fit to implement the framework. We expect this framework to benefit enterprise and non-enterprise dApps and provide greater access control flexibility and effective integration with traditional and state of the art identity management solutions.
This research explores Law Enforcement Agency (LEA) applications for digital watermarking performed on the camera in real time, combining this with Distributed Ledger Technology (DLT) to suggest workable systems for data cataloguing and image integrity. Reference implementations of both technologies are developed and evaluated for their effectiveness and suitability for these purposes.
Open access
Advanced Steganography and Watermarking Techniques
Sina Rafati Niya, Sebastian Allemann, Arik Gabay, Burkhard Stiller
Data leaks and privacy scandals have been a growing concern of the last decade. While most traditional, i.e., centralized, online platforms require users to register with their personal data, they potentially expose the user's identity and data to be used for unintended purposes. This work proposes TradeMap as an integrated architecture, designing and enabling an online end-to-end (e2e) trading market place, while supporting anonymous management features. TradeMap addresses the Swiss Financial Market Supervisory Authority (FINMA) regulations by designing a FINMA-complaint Know Your Customer (KYC) platform. Additionally, TradeMap is based on blockchains and employs Ethereum Smart Contracts (SC). Thus, trust and anonymity between the market place and the KYC system relies on zero knowledge proof-based SCs used for user identification processes. With this management approach proposed, the user authentication is only verified within the KYC platform, providing a legally valid and fully anonymous online trading platform.
Tezos is a blockchain launched in June 2018. It is written in OCaml and supports smart contracts. Its smart contract language is called Michelson and it has been designed with formal verification in mind. In this article, we present Mi-Cho-Coq, a Coq framework for verifying the functional correctness of Michelson smart contracts. As a case study, we detail the certification of a Multisig contract with the Mi-Cho-Coq framework.
Bo Zhao, Liming Fang, Hanyi Zhang, Chunpeng Ge · 7 authors
With the development of information technology, films, music, and other publications are inclined to be distributed in digitalized form. However, the low cost of data replication and dissemination leads to digital rights problems and brings huge economic losses. Up to now, existing digital rights management (DRM) schemes have been powerless to deter attempts of infringing digital rights and recover losses of copyright holders. This paper presents a YODA-based digital watermark management system (Y-DWMS), adopting non-repudiation of smart contract and blockchain, to implement a DRM mechanism to infinitely amplify the cost of infringement and recover losses copyright holders suffered once the infringement is reported. We adopt game analysis to prove that in Y-DWMS, the decision of non-infringement always dominates rational users, so as to fundamentally eradicate the infringement of digital rights, which current mainstream DRM schemes cannot reach.
Open access
Advanced Steganography and Watermarking Techniques
Lyra2REv2 is a hashing algorithm that consists of a chain of individual hashing algorithms, and it is used as a proof-of-work function in several cryptocurrencies. The most crucial and exotic hashing algorithm in the Lyra2REv2 chain is a specific instance of the general Lyra2 algorithm. In this work, we present the first hardware implementation of the specific instance of Lyra2 that is used in Lyra2REv2 and we explain how several properties of this algorithm can be exploited in order to optimize the design. Moreover, we present an FPGA-based hardware implementation of a full miner chain for Lyra2REv2 on a Xilinx Multi-Processor System on Chip. Our proposed Lyra2REv2 miner chain is shown to be significantly more energy efficient than both a GPU and a commercially available FPGA-based miner. Finally, we also explain how our simplified Lyra2 and Lyra2REv2 architectures can be modified with minimal effort to also support the recent Lyra2REv3 chained hashing algorithm.
Blockchain-based platforms are emerging as a transformative technology that\ncan provide reliability, integrity, and auditability without trusted entities.\nOne of the key features of these platforms is the trustworthy decentralized\nexecution of general-purpose computation in the form of smart contracts, which\nare envisioned to have a wide range of applications. As a result, a rapidly\ngrowing and active community of smart-contract developers has emerged in recent\nyears. A number of research efforts have investigated the technological\nchallenges that these developers face, introducing a variety of tools,\nlanguages, and frameworks for smart-contract development, focusing on security.\nHowever, relatively little is known about the community itself, about the\ndevelopers, and about the issues that they face and discuss. To address this\ngap, we study smart-contract developers and their discussions on two social\nmedia sites, Stack Exchange and Medium. We provide insight into the trends and\nkey topics of these discussions, into the developers' interest in various\nsecurity issues and security tools, and into the developers' technological\nbackground.\n
Robert Norvill, Beltran Fiz, Radu State, Andréa Cullen
Ethereum smart contracts have become common enough to warrant the need for standards to ensure ease of use. The most well known standard was created for the emerging token ecosystem and the exchanges serving it: the ERC20 standard. In this work we use the function selectors present in Ethereum smart contract bytecode to define contract purpose. Contracts are clustered according to the selectors they have. A Reverse look-up from selectors to function names is used to label clusters. We use the function names in clusters to suggest candidates for ERC standardisation.
We have reviewed the potential impact of blockchain technology on the music industry by analyzing the views of academia and the industry experts. The music industry had rapid changes from the physical market to the digital market in the past decades. The consumers download and stream music online and mobile during the digital dominant market. While streaming music has been recently growing at a fast rate, fair distribution of revenue to the artists continues to be an issue. Some industry experts believe that the issue of fair distribution of revenue to the artist may be resolved using blockchain technology, while some are skeptical about the application or the duration of impact. The blockchain may enhance speedier payment using smart contracts, provide additional revenue and promote the music if excellent fan support is achieved. The positive impact on the music industry may only be possible if there are detailed consideration of the industry and careful understanding of the customers.
The current legal and economic infrastructure facilitating data collection practices and data analysis has led to extreme over-collection of data and the overall loss of personal privacy. Data over-collection has led to a secondary market for consumer data that is invisible to the consumer and results in a person's data being distributed far beyond their knowledge or control. In this paper, we propose a Data Market framework and design for personal data management and privacy protection in which the individual controls and profits from the dissemination of their data. Our proposed Data Market uses a market-based approach utilizing blockchain distributed ledgers for data distribution transparency and control and digital rights management technologies to provide for data confidentiality and secure distribution of the data. Our market framework and design provides an economic, legal, and advanced technology infrastructure that protects an individuals' right to privacy while nurturing a flourishing information economy.