Blockchain Papers

Christoph H.-J. Braun, Tobias Käfer

We showcase our approach to verify off-chained information using Linked Data, Smart Contracts, and RDF graph hashes stored on a Distributed Ledger. In this demo, we present our implementation and a use case from the supply chain domain.

Christoph H.-J. Braun, Tobias Käfer

We present an approach to verify off-chained information using Linked Data, Smart Contracts, and RDF graph hashes stored on a Distributed Ledger. We use the notion of a Linked Pedigree, i.e. a decentralised dataset for storing hyperlinked information, as modelling foundation. We evaluate our approach by comparing different ways to build the Smart Contract. We develop a cost model and show, based on our implementation, that for managing multiple Linked Pedigree instances, a single larger Smart Contract is superior to multiple smaller Smart Contracts for supply chains shorter than 50 participants.

Kris Joseph

The 2008 debut of Bitcoin marked the first large-scale implementation of blockchain technology, and its decentralized approach to monetary systems has since been abstracted to more generalized purposes like distributed computing. Platforms like Ethereum, which function as a global, decentralized computing and data storage system, promise to bring the cost of decentralized knowledge production in line with the efficiencies afforded by the centralized, integrated computing systems that currently dominate the knowledge economy. Blockchain technologies have been investigated for a wide range of information management purposes, but their exploration within the realm of library and information studies has largely been nascent. Though many applications within the field have been envisioned, few have been explored in depth. Among the many functions performed in the field of librarianship, the work of cataloguers—which has always been performed in a decentralized manner—represents an intriguing use case. A review of current shared-cataloguing practices reveals that catalogues have become largely-centralized, divorced from public participation, dominated by an ethos of efficiency at the cost of quality, and essentially unaltered since the shift from physical to electronic catalogue storage more than 40 years ago. The evolution of blockchain technologies, paired with an intentional approach to shared catalogues that is open for use, transparency, and public participation, is explored in a conceptual framework and design based on the Ethereum platform. A theoretical design scheme grounded in the affordances of Ethereum, shaped by the principles of open source software development, and guided by the best practices of existing social information production systems results in a proposal for Catagora: an open source, open-for-use, transparent and participatory shared-cataloguing platform that reverses the trend towards architectural and political centralization and promises novel catalogue features such as complete revision history and distributed collaboration on the content and quality of catalogue entries. Blockchain technology, alone, cannot disrupt shared cataloguing practices; such a shift involves the voluntary and eager participation of cataloguers and members of the public in order to sustain and grow the system. The Catagora design concept presented in this thesis incorporates accessibility, collaboration and reputational systems that are intended to foster open participation, but these alone cannot guarantee a thriving, shared-cataloguing alternative to existing systems. Further exploration, in the form of a live implementation, is warranted; and lessons from existing large-scale library technology projects suggest that a centrally-coordinated implementation, targeting key cataloguing partners and driven by a passionate project champion, may provide a more complete picture of the blockchain’s potential to support open, shared cataloguing for the benefit of information seekers.

Zhaofeng Ma, Weihua Huang, Hongmin Gao

With the development of Internet technology, transmitting, editing and misusing the digital multimedia bring great challenges in misusing detection for multimedia content protection. In this paper we proposed an artwork image digital rights management scheme for Internet misusing detection based on watermark and blockchain with robustness and high-level security. We embed artwork right information such as author, RightHolder, Date and Location information into the artwork image data. In the scheme, we use image Arnold transform to enhance the security and use image DCT coefficients of middle frequency to embed watermark for robustness. In the transparence of watermark, HVS and Watson models are used to control the watermark strength, which can enhance the invisibility. Once the suspicious image data from Internet are misused and spreading the image data on Internet without authorization, especially the high value artwork image data, we can trace the misuse responsibility by extracting the watermark. And according to the above algorithm, we implemented the scheme as DRMChain based on the consortium blockchain which stored the artwork and DRM information in an un-tampered ledger for decentralized rights confirmation. Large amount of experiments indicate the proposed watermark-based trusted blockchain DRM scheme is secure, robust, and for the protection and misuse detection of image data.

Alan Litchfield, Jeff Herbert

This paper presents a method for a decentralised peer-to-peer software license validation system using cryptocurrency blockchain technology to ameliorate software piracy, and to provide a mechanism for software developers to protect copyrighted works. Protecting software copyright has been an issue since the late 1970's and software license validation has been a primary method employed in an attempt to minimise software piracy and protect software copyright. The method described creates an ecosystem in which the rights and privileges of participants are observed.

Balázs Bodó, Daniel J. Gervais, João Pedro Quintais

This article offers a normative analysis of key blockchain technology concepts from the perspective of copyright law. Some features of blockchain technologies—scarcity, trust, transparency, decentralized public records and smart contracts—seem to make this technology compatible with the fundamentals of copyright. Authors can publish works on blockchain creating a quasi-immutable record of initial ownership, and encode ‘smart’ contracts to license the use of works. Remuneration may happen on online distribution platforms where the smart contracts reside. In theory, such an automated setup allows for the private ordering of copyright. Blockchain technology, like Digital Rights Management 20 years ago, is thus presented as an opportunity to reduce market friction, and increase both licensing efficiency and the autonomy of creators. Yet, some of the old problems remain. The article examines the differences between new, smart-contract-based private ordering regime and the fundamental components of copyright law, such as exceptions and limitations, the doctrine of exhaustion, restrictions on formalities, the public domain and fair remuneration.

Santiago Bragagnolo, Henrique Rocha, Marcus Denker, Sté́phane Ducasse

Smart contracts are embedded procedures stored with the data they act upon.Debugging deployed Smart Contracts is a difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded.In this technical report, we present SmartInspect to address the lack of inspectability of a deployed contract.Our solution analyses the contract state by using decompilation techniques and a mirror-based architecture to represent the object responsible for interpreting the contract state.SmartInspect allows developers and also end-users of a contract to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code.

Simon Kim

Ethereum, a cryptocurrency currently valued at 46 billion US dollars, has grown over 6,500% in the last 12 months. Despite the growth in value, we still have very limited Ethereum network visibility. In this thesis, we analyze the Ethereum network from two vantage points: the DEVp2p network and the Ethereum Mainnet. The DEVp2p peer-to- peer (P2P) network was developed specifically for and ultimately underlies the Ethereum Mainnet. We examine overall composition of the DEVp2p network. We analyze our peer connections on the Ethereum Mainnet—the main Ethereum network established on top of DEVp2p. We compare the Ethereum network’s properties to those of other well-studied P2P networks, namely BitTorrent and Gnutella. We develop novel techniques to measure the Ethereum P2P network and gain visibility into this previously opaque network.

Florian Kammueller, Manfred Kerber, Christian W. Probst

This paper applies machine assisted formal methods to explore insider threats for auctions. Auction systems, like eBay, are an important problem domain for formal analysis because they challenge modelling concepts as well as analysis methods. We use machine assisted formal modelling and proof in Isabelle to demonstrate how security and privacy goals of auction protocols can be formally verified. Applying the costly scrutiny of formal methods is justified for auctions since privacy and trust are prominent issues and auctions are sometimes designed for one-off occasions where high bids are at stake. For example, when radio wave frequencies are on sale, auctions are especially created for just one occasion where fair and consistent behaviour is required. Investigating the threats in auctions and insider collusions, we model and analyze auction protocols for insider threats using the interactive theorem prover Isabelle. We use the existing example of a fictitious cocaine auction protocol from the literature to develop and illustrate our approach. Combining the Isabelle Insider framework with the inductive approach to verifying security protocols in Isabelle, we formalize the cocaine auction protocol, prove that this formal definition excludes sweetheart deals, and also that collusion attacks cannot generally be excluded. The practical implication of the formalization is demonstrated by code generation. Isabelle allows generating code from constructive specifications into the programming language Scala. We provide constructive test functions for cocaine auction traces, prove within Isabelle that these functions conform to the protocol definition, and apply code generation to produce an implementation of the executable test predicate for cocaine auction traces in Scala.

Marjan Škrobot

The main purpose of Password-Authenticated Key Exchange (PAKE) is to allow secure authenticated communication over insecure networks between two or more parties who only share a low-entropy password. It is common practice that the secret key derived from a PAKE execution is used to authenticate and encrypt some data payload using symmetric key protocols. Unfortunately, most PAKEs of practical interest, including three protocols considered in this thesis, are studied using so-called game-based models, which -- unlike simulation models -- do not guarantee secure composition per se. However, Brzuska et al. (CCS 2011) have shown that a middle ground is possible in the case of authenticated key exchange that relies on Public-Key Infrastructure (PKI): the game-based models do provide secure composition guarantees when the class of higher-level applications is restricted to symmetric-key protocols. The question that we pose in this thesis is whether or not a similar result can be exhibited for PAKE. Our work answers this question positively. More specifically, we show that PAKE protocols secure according to the game-based Real-or-Random (RoR) definition of Abdalla et al. (PKC 2005) allow for automatic, secure composition with arbitrary, higher-level symmetric key protocols. Since there is evidence that most PAKEs secure in the Find-then-Guess (FtG) model of Bellare et al. (EUROCRYPT 2000) are in fact secure according to the RoR definition, we can conclude that nearly all provably secure PAKEs enjoy a certain degree of composition, one that at least covers the case of implementing secure channels. Although many different protocols that accomplish PAKE have been proposed over last two decades, only a few newcomers managed to find their way to real world applications - albeit lacking an intense and prolonged public scrutiny. As a step in the direction of providing one, this dissertation considers the security and efficiency of two relatively recently proposed PAKE protocols - Dragonfly and J-PAKE. In particular, we prove the security of a very close variant of Dragonfly employing the standard FtG model which incorporates forward secrecy. Thus, our work confirms that Dragonfly's main flows are sound. Furthermore, we contribute to the discussion by proposing and examining (in the RoR model of security) two variants of J-PAKE - which we call RO-J-PAKE and CRS-J-PAKE - that each makes the use of two less zero-knowledge proofs than the original protocol, at the cost of an additional security assumption. Our work reveals that CRS-J-PAKE has an edge in terms of efficiency over J-PAKE for both standard group choices: subgroups of finite fields and elliptic curves. The same is true for RO-J-PAKE, but only when instantiated with elliptic curves.

Helena Haapio

No abstract is available for this record.

Luis Ibáñez, Elena Simperl

No abstract is available for this record.

Jean Lancrenon, Marjan Škrobot, Qiang Tang

Recently, the password-authenticated key exchange protocol J-PAKE of Hao and Ryan (Workshop on Security Protocols 2008) was formally proven secure in the algebraic adversary model by Abdalla et al. (IEEE S&P 2015). In this paper, we propose and examine two variants of J-PAKE - which we call RO-J-PAKE and CRS-J-PAKE - that each makes the use of two less zero-knowledge proofs than the original protocol. We show that they are provably secure following a similar strategy to that of Abdalla et al. We also study their efficiency as compared to J-PAKE’s, also taking into account how the groups are chosen. Namely, we treat the cases of subgroups of finite fields and elliptic curves. Our work reveals that, for subgroups of finite fields, CRS-J-PAKE is indeed more efficient than J-PAKE, while RO-J-PAKE is much less efficient. On the other hand, when instantiated with elliptic curves, both RO-J-PAKE and CRS-J-PAKE are more efficient than J-PAKE, with CRS-J-PAKE being the best of the three. Regardless of implementation, we note that RO-J-PAKE enjoys a looser security reduction than both J-PAKE and CRS-J-PAKE. CRS-J-PAKE has the tightest security proof, but relies on an additional trust assumption at setup time.

Motoki Kitahara, Junpei Kawamoto, Kouichi Sakurai

In the digital world, so many copyrighted works are made in an illegal way because it is easy to keep and copy. Digital Rights Management has proposed to prevent this theft. Contents providers often bring in one server who has charge of managing the normal user, but there are some problems that it flocks to the server. Against this problem, P2P based DRM system has considered. All users can transfer the encrypted content to other users, so the content server does not have to load so much traffic from users. As a problem with this method, it is hard to figure out usage situation of contents because P2P based system is divided into many pieces of users. In this paper, we propose a new P2P based DRM system using Bitcoin protocol, which is one of the electric commerce. Bitcoin protocol, timestamp server saves all transactions to prevent double spending. We can bring out all usage situations to apply this system.

Sławomir Grzonkowski

Recently we have observed a growing demand for secure technologies for e-commerce that do not put customers at risk of identity theft. We have also experienced the advent of Web 2.0 which has led to new business models and which has changed the way users interact with the Web. This thesis proposes a set of strategies and enhancements towards providing improved security and privacy in such new settings. We introduce a novel concept: Fair Rights Management (FRM). It can be classified as a usage control solution. FRM enables a flexible way of managing digital content. There was a need to provide additional security extensions to keep such a flexible model applicable. Thus, in our approach we take advantage of trust obtained from social networks. This is also the reason why we created an efficient zero-knowledge proof protocol that is lightweight enough to be deployed within existing web-applications. The proposed protocol is also successfully integrated with Semantic Web architecture and associated components. It enables practical Web and mobile applications which employ trust-based transactions as part of their workflow. This core contribution overcomes various disadvantages of prior art and enables a range of new applications and potentially new business models. We show that compared to existing Usage Control Models (UCON) (i) FRM is a step towards fair use in the digital world and we also argue that our approach is enforced by law; (ii) the participants of the proposed solution do not put their privacy at risk. Our research shows that existing infrastructure is sufficient to support ZKP-based solutions; and thus, it is feasible to offer the users enhanced privacy within existing deployed solutions.