Hulin Yang, Mingzhe Li, Jin Zhang, Alia Asheralieva · 6 authors
The advent of Ethereum 2.0 has introduced significant changes, particularly the shift to Proof-of-Stake consensus. This change presents new opportunities and challenges for arbitrage. Amidst these changes, we introduce BriDe Arbitrager, a novel tool designed for Ethereum 2.0 that leverages Bribery-driven attacks to Delay block production and increase arbitrage gains. The main idea is to allow malicious proposers to delay block production by bribing validators/proposers, thereby gaining more time to identify arbitrage opportunities. Through analysing the bribery process, we design an adaptive bribery strategy. Additionally, we propose a Delayed Transaction Ordering Algorithm to leverage the delayed time to amplify arbitrage profits for malicious proposers. To ensure fairness and automate the bribery process, we design and implement a bribery smart contract and a bribery client. As a result, BriDe Arbitrager enables adversaries controlling a limited (< 1/4) fraction of the voting powers to delay block production via bribery and arbitrage more profit. Extensive experimental results based on Ethereum historical transactions demonstrate that BriDe Arbitrager yields an average of 8.66 ETH (16,442.23 USD) daily profits. Furthermore, our approach does not trigger any slashing mechanisms and remains effective even under Proposer Builder Separation and other potential mechanisms will be adopted by Ethereum.
The sharing of private information is a daunting, multifaceted, and expensive undertaking. Furthermore, identity management is an additional challenge that poses significant technological, operational, and legal obstacles. Present solutions and their accompanying infrastructures rely on centralized models that are susceptible to hacking and can hinder data control by the rightful owner. Consequently, blockchain technology has generated interest in the fields of identity and access control. This technology is viewed as a potential solution due to its ability to offer decentralization, transparency, provenance, security, and privacy benefits. Nevertheless, a completely decentralized and private solution that enables data owners to control their private data has yet to be presented. In this research, we introduce DeAuth, a novel decentralized, authentication and authorization scheme for secure private data transfer. DeAuth combines blockchain, smart-contracts, decentralized identity, and distributed peer-to-peer (P2P) storage to give users more control of their private data, and permissioning power to share without centralized services. For this scheme, identity is proven using decentralized identifiers and verifiable credentials, while authorization to share data is performed using the blockchain. A prototype was developed using the Ethereum Blockchain and the InterPlanetary Files System, a P2P file sharing protocol. We evaluated DeAuth through a use-case study and metrics such as security, performance, and cost. Our findings indicate DeAuth to be viable alternative to using centralized services; however, the underlying technologies are still in its infancies and require more testing before it can supplant traditional services.
The relationship between doctors and patients is reinforced through the expanded communication channels provided by remote healthcare services, resulting in heightened patient satisfaction and loyalty. Nonetheless, the growth of these services is hampered by security and privacy challenges they confront. Additionally, patient electronic health records (EHR) information is dispersed across multiple hospitals in different formats, undermining data sovereignty. It allows any service to assert authority over their EHR, effectively controlling its usage. This paper proposes a blockchain enforced attribute-based access control in healthcare service. To enhance the privacy and data-sovereignty, the proposed system employs attribute-based access control, zero-knowledge proof (ZKP) and blockchain. The role of data within our system is pivotal in defining attributes. These attributes, in turn, form the fundamental basis for access control criteria. Blockchain is used to keep hospital information in public chain but EHR related data in private chain. Furthermore, EHR provides access control by using the attributed based cryptosystem before they are stored in the blockchain. Analysis shows that the proposed system provides data sovereignty with privacy provision based on the attributed based access control.
Sandro Rodriguez Garzon, Dennis Natusch, Artur Philipp, Axel Küpper · 6 authors
Authentication in TLS is predominately carried out with X.509 digital certificates issued by certificate au-thorities (CA). The centralized nature of current public key infrastructures, however, comes along with severe risks, such as single points of failure and susceptibility to cyber-attacks, potentially undermining the security and trustworthiness of the entire system. With Decentralized Identifiers (DID) alongside distributed ledger technology, it becomes technically feasible to prove ownership of a unique identifier without requiring an attestation of the proof's public key by a centralized and therefore vulnerable CA. This article presents DID Link, a novel authentication scheme for TLS 1.3 that empowers entities to authenticate in a TLS-compliant way with self-issued X.509 certificates that are equipped with ledger-anchored DIDs instead of CA-issued identifiers. It facilitates the exchange of tamper-proof and 3rd-party attested claims in the form of DID-bound Verifiable Credentials after the TLS handshake to complete the authentication with a full identification of the communication partner. A prototypical implementation shows comparable TLS handshake durations of DID Link if verification material is cached and reasonable prolongations if it is obtained from a ledger. The significant speed improvement of the resulting TLS channel over a widely used, DID-based alternative transport protocol on the application layer demonstrates the potential of DID Link to become a viable solution for the establishment of secure and trustful end-to-end communication links with decentrally managed digital identities.
Recent booming development of Generative Artificial Intelligence (GenAI) has facilitated model commercialization to reinforce the model performance, including licensing or trading Deep Neural Network (DNN) models. However, DNN model trading may violate the benefit of the model owner due to unauthorized replications or misuse of the model. Model identity auditing is a challenging issue in protecting DNN model ownership, and verifying the integrity and ownership of models is one of the critical obstacles. In this paper, we focus on the above issue and propose an \underline{A}ccumulator-enabled \underline{A}uditing for \underline{D}ecentralized \underline{Id}entity of DNN \underline{M}odel (A2-DIDM) that utilizes blockchain and zero-knowledge techniques to protect data and function privacy while ensuring the lightweight on-chain ownership verification. The proposed model presents a scheme of identity records via configuring model weight checkpoints with zero-knowledge proofs, which incorporates predicates to capture incremental state changes in model weight checkpoints. Our scheme ensures both computational integrity and programmability in DNN training process so that the uniqueness of the weight checkpoint sequence in a DNN model is preserved. %to ensure the correctness of model identity auditing, so that the uniqueness of the weight checkpoint sequence in a DNN model is preserved. A2-DIDM also addresses privacy protections in decentralized identity. We systematically analyze the security and robustness of our proposed model and further evaluate the effectiveness and usability of auditing DNN model identities. The code is available at https://github.com/xtx123456/A2-DIDM.git.
With the increasingly widespread application of machine learning, how to strike a balance between protecting the privacy of data and algorithm parameters and ensuring the verifiability of machine learning has always been a challenge. This study explores the intersection of reinforcement learning and data privacy, specifically addressing the Multi-Armed Bandit (MAB) problem with the Upper Confidence Bound (UCB) algorithm. We introduce zkUCB, an innovative algorithm that employs the Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARKs) to enhance UCB. zkUCB is carefully designed to safeguard the confidentiality of training data and algorithmic parameters, ensuring transparent UCB decision-making. Experiments highlight zkUCB's superior performance, attributing its enhanced reward to judicious quantization bit usage that reduces information entropy in the decision-making process. zkUCB's proof size and verification time scale linearly with the execution steps of zkUCB. This showcases zkUCB's adept balance between data security and operational efficiency. This approach contributes significantly to the ongoing discourse on reinforcing data privacy in complex decision-making processes, offering a promising solution for privacy-sensitive applications.
Pseudonyms are widely used in Cooperative Intelligent Transport Systems (C-ITS) to protect the location privacy of vehicles. However, the unlinkability nature of pseudonyms also enables Sybil attacks, where a malicious vehicle can pretend to be multiple vehicles at the same time. In this paper, we propose a novel protocol called zero-knowledge Proof of Distinct Identity (zk-PoDI,) which allows a vehicle to prove that it is not the owner of another pseudonym in the local area, without revealing its actual identity. Zk-PoDI is based on the Diophantine equation and zk-SNARK, and does not rely on any specific pseudonym design or infrastructure assistance. We show that zk-PoDI satisfies all the requirements for a practical Sybil-resistance pseudonym system, and it has low latency, adjustable difficulty, moderate computation overhead, and negligible communication cost. We also discuss the future work of implementing and evaluating zk-PoDI in a realistic city-scale simulation environment.
Stuart Harshbarger, Rosa Heckle, Michael P. Collins
International Test & Evaluation Association (ITEA) For 45 years, we’ve been the catalyst for excellence in T&E – empowering professionals through education, fostering collaboration, and driving innovation that matters. Advance Your T&E Career What We Do Uniting global T&E leaders and experts to address technological challenges collaboratively.[2024
Smart contracts are susceptible to various security issues, among which access control (AC) vulnerabilities are particularly critical. While existing research has proposed multiple detection tools, the automatic and appropriate repair of AC vulnerabilities in smart contracts remains a challenge. Unlike commonly supported vulnerability types by existing repair tools, such as reentrancy, which are usually fixed by template-based approaches, the main obstacle of AC lies in identifying the appropriate roles or permissions amid a long list of non-AC-related source code to generate proper patch code, a task that demands human-level intelligence. Leveraging recent advancements in large language models (LLMs), we employ the state-of-the-art GPT-4 model and enhance it with a novel approach called ACFIX. The key insight is that we can mine common AC practices for major categories of code functionality and use them to guide LLMs in fixing code with similar functionality. To this end, ACFIX involves both offline and online phases. First, during the offline phase, ACFIX mines a taxonomy of common Role-based Access Control (RBAC) practices from 344,251 on-chain contracts, categorizing 49 role-permission pairs from the top 1,000 pairs mined. Second, during the online phase, ACFIX tracks AC-related elements across the contract and uses this context information along with a Chain-of-Thought pipeline to guide LLMs in identifying the most appropriate role-permission pair for the subject contract and subsequently generating a suitable patch. This patch will then undergo a validity and effectiveness check. To evaluate ACFIX, we built the first benchmark dataset of 118 real-world AC vulnerabilities, and our evaluation revealed that ACFIX successfully repaired 94.92% of them. This represents a significant improvement compared to the baseline GPT-4, which achieved only 52.54%.
Lakshmi Rama Kiran Pasumarthy, Hisham Ali, William J. Buchanan, Jawad Ahmad · 7 authors
There is an increasing need to share threat information for the prevention of widespread cyber-attacks. While threat-related information sharing can be conducted through traditional information exchange methods, such as email communications etc., these methods are often weak in terms of their trustworthiness and privacy. Additionally, the absence of a trust infrastructure between different information-sharing domains also poses significant challenges. These challenges include redactment of information, the Right-to-be-forgotten, and access control to the information-sharing elements. These access issues could be related to time bounds, the trusted deletion of data, and the location of accesses. This paper presents an abstraction of a trusted information-sharing process which integrates Attribute-Based Encryption (ABE), Homomorphic Encryption (HE) and Zero Knowledge Proof (ZKP) integrated into a permissioned ledger, specifically Hyperledger Fabric (HLF). It then provides a protocol exchange between two threat-sharing agents that share encrypted messages through a trusted channel. This trusted channel can only be accessed by those trusted in the sharing and could be enabled for each data-sharing element or set up for long-term sharing.
Koteswara Rao Kodepogu, Mudigonda Dharmateja, J. M. S. V. Ravi Kumar, Muraboina Hari Pavan Gopi Krishna · 5 authors
In this exploration, our paper delves into the intricate implementation of robust authentication and transaction management within educational blockchain systems.Our project showcases a commitment to privacy and integrity, safeguarding interactions through advanced cryptographic techniques.The multifaceted capabilities of blockchain technology are showcased through the seamless maintenance of student records, the facilitation of secure voting processes, and the optimization of token transfers, collectively contributing to an ecosystem characterized by enhanced security, transparency, and efficiency.Our study uncovers insights into blockchain's transformative potential in education, redefining paradigms by introducing security measures and transparency to student-admin interactions.We highlight the successful implementation of blockchainbased authentication and transaction management systems, leading to enhanced educational processes.Additionally, we briefly outline our research design and methodology, emphasizing the rigorous approach to exploring blockchain applications.
Blockchain has been recognized as a secure technology with which unique and tamper-proof certificates can be issued. Today the secure and immutable storage of vital records, such as birth certificates, is of paramount importance. Traditional systems for recording and managing such documents are complex, tedious, and inaccessible for many. At present, issuing a certificate involves three stakeholders; Parents, Hospitals, and Registrars. The Parents must visit the Registrar and report the birth after which the Registrar verifies the birth, which is a time-intensive process for the Registrar. To address these challenges, we present a web application that leverages blockchain technology to record and manage birth certificates. By utilizing a decentralized and distributed ledger, our application improves accessibility, transparency, and increased security. This paper outlines the design, implementation, and evaluation of our birth certificate recording system, highlighting its benefits for hospitals, registrars, and individuals. Furthermore, limitations and the future work of this technology are discussed.
A paradox of compliance and privacy exists among an increasing number of users of Decentralized Finance (DeFi). While the Financial Action Task Force (FATF) has established Travel Rules to improve transparency for financial institutions to prevent money laundering, data protection regulations like GDPR require financial institutions to maintain secrecy about customer information. The existing DeFi architecture currently solves this problem via two approaches; it either sacrifices user anonymity in order to meet the regulatory standards set forth by government entities, or creates non-transparent environments that do not hold users accountable for their actions. This paper introduces a novel DLT architecture that balances the user’s requirement for anonymity with the regulatory requirements of the financial services sector through the application of Zero-Knowledge Proofs in combination with a Permissioned DLT. By utilizing a cryptographic pipeline that allows for shielded transactions, yet provides evidence that the transaction was valid and met all relevant regulatory requirements, the architecture enables compliance with regulatory standards and maintains anonymity. Furthermore, this architecture includes protocols for selective disclosure that will enable authorized third-party auditors to audit a user’s regulatory compliance automatically without exposing PII. Experimental results demonstrate that this architecture can be deployed and tested using Hyperledger Fabric and will support both consistent performance and scalability. Specifically, experimental results demonstrate that this architecture can operate commercially at a throughput rate of 1,200 TPS, which represents less than a 35 percent increase in the consumption of computing resources compared to the corresponding rates of fully transparent architectures. Finally, the security analysis proves mathematically that this architecture fulfills the compliance requirements for preventing fraudulent activities and prevents unauthorized de-anonymization of users.
Yu Gao, Carlo Campajola, Nicolò Vallarano, Andreia Sofia Teixeira · 5 authors
IOTA is a distributed ledger technology that relies on a peer-to-peer (P2P) network for communications. Recently an auto-peering algorithm was proposed to build connections among IOTA peers according to their "Mana" endowment, which is an IOTA internal reputation system. This paper's goal is to detect potential vulnerabilities and evaluate the resilience of the P2P network generated using IOTA auto-peering algorithm against eclipse attacks. In order to do so, we interpret IOTA's auto-peering algorithm as a random network formation model and employ different network metrics to identify cost-efficient partitions of the network. As a result, we present a potential strategy that an attacker can use to eclipse a significant part of the network, providing estimates of costs and potential damage caused by the attack. On the side, we provide an analysis of the properties of IOTA auto-peering network ensemble, as an interesting class of homophile random networks in between 1D lattices and regular Poisson graphs.
Marco Marcozzi, Ernestas Filatovas, Linas Stripinis, Remigijus Paulavičius
The consensus protocol plays a vital role in the performance and security of a specific Distributed Ledger Technology (DLT) solution. Currently, the traditional classification of consensus algorithms relies on subjective criteria, such as protocol families (Proof of Work, Proof of Stake, etc.) or other protocol features. However, such classifications often result in representatives with strongly different characteristics belonging to the same category. To address this challenge, a quantitative data-driven classification methodology that leverages machine learning—specifically, clustering—is introduced here to achieve unbiased grouping of analyzed consensus protocols implemented in various platforms. When different clustering techniques were used on the analyzed DLT dataset, an average consistency of 78% was achieved, while some instances exhibited a match of 100%, and the lowest consistency observed was 55%.
In recent years, Wireless Sensor Networks (WSNs) have become integral in various applications ranging from environmental monitoring to defense. However, the security and reliability of these networks remain a paramount concern due to their susceptibility to various types of cyber-attacks and failures. This paper proposes a novel integration of blockchain technology with WSNs to address these challenges. Blockchain, with its decentralized and tamper-resistant ledger, offers a robust framework to enhance the security and reliability of sensor networks. The study begins by analyzing the current security threats and challenges faced by WSNs, emphasizing the need for a solution that can ensure data integrity, confidentiality, and network resilience. We then introduce blockchain technology and discuss its key features such as decentralization, immutability, and consensus algorithms, which are beneficial in creating a secure and reliable WSN environment. Subsequently, we present a detailed architecture of how blockchain can be integrated with WSNs. This includes the deployment of a lightweight blockchain protocol suited for the limited computational resources of sensor nodes. We also explore the use of smart contracts for automated, secure data handling and network management within WSNs. To validate the proposed integration, we conduct a simulations based on network attacks. The results demonstrate significant improvements in the security and reliability of WSNs when blockchain is implemented. This is evidenced by enhanced resistance to common attacks, such as data manipulation and node compromise and increased network uptime.
Fernando Román-García, Juan Hernández‐Serrano, Óscar Esparza
This article introduces the Non-Repudiable Data Exchange (NoRDEx) protocol, designed to ensure non-repudiation in data exchanges. Unlike traditional non-repudiation and fair exchange protocols, NoRDEx can be considered decentralized as it eliminates the need for a centralized Trusted Third Party (TTP) by using a Distributed Ledger Technology (DLT) to store cryptographic proofs without revealing the exchanged message. NoRDEx is an optimistic non-repudiation protocol, as it only uses the DLT in case of a dispute. The protocol has been implemented and tested in real-world environments, with performance assessments covering cost, overhead, and execution time. A formal security analysis using the Syverson Van Oorschot (SVO) logical model demonstrates NoRDEx’s ability to resolve disputes securely.
This document serves as a reference for the architectural design and implementation of a secure decentralized data sharing framework. The framework leverages Distributed Ledger Technology (DLT) to ensure data integrity and immutability, while incorporating multi-party computation, fully homomorphic encryption and Trusted Execution Environments for privacy preservation. The document also explores the GAIA-X framework to further strengthen data security within the decentralized environment.
Jan 1, 2024·Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences
With the rise of decentralized systems and applications that run over multiple blockchains, there is a growing need for architectures and bridges that ensure the trusted transfer of data and assets between the chains. zkBridge (ACM CCS'22) is a cross-chain bridge protocol that was proposed for non-permissioned blockchain and uses a network of relays, each working (for example as a light node) on a blockchain. A relay communicates with a corresponding smart contract on another chain to transfer data from the first chain to the second, and the smart contract on the second chain is used to verify the correctness of the received data from the first chain. zkBridge designs and implements optimized zero-knowledge proofs, that minimize the work of the smart contract on the second chain to verify the correctness of the received data. In this paper, we consider applications that work across two or more permissioned blockchains. We propose sigBridge that uses the framework of zkBridge but replaces the costly zero-knowledge proof computation with a pair of algorithms based on the consensus algorithm of the first chain. The algorithms will be run by a relay node on the first chain and a smart contract on the second chain and provide verifiability of data and asset transfer from the first chain to the second. The pair of algorithms are significantly more efficient compared to generating zero-knowledge proofs, verifying them, or running the full consensus algorithm of the first blockchain. We then show how a decentralized user-centric resource-sharing application will work over this architecture. We give a proof-of-concept implementation of an attribute-based access control system for a resource-sharing application that runs over two private Ethereum blockchains, and report the computation costs of the protocol.
Digital credentials represent crucial elements of digital identity on the Internet. Credentials should have specific properties that allow them to achieve privacy-preserving capabilities. One of these properties is selective disclosure, which allows users to disclose only the claims or attributes they must. This paper presents a novel approach to selective disclosure BLS-MT-ZKP that combines existing cryptographic primitives: Boneh-Lynn-Shacham (BLS) signatures, Merkle hash trees (MT) and zero-knowledge proof (ZKP) method called Bulletproofs. Combining these methods, we achieve selective disclosure of claims while conforming to selective disclosure requirements. New requirements are defined based on the definition of selective disclosure and privacy spectrum. Besides selective disclosure, specific use cases for equating digital credentials with paper credentials are achieved. The proposed approach was compared to the existing solutions, and its security, threat, performance and limitation analysis was done. For validation, a proof-of-concept was implemented, and the execution time was measured to demonstrate the practicality and efficiency of the approach.
The increasing complexity of cloud computing has prompted a greater emphasis on protecting the privacy, integrity, and security of data stored and processed in the cloud. Data privacy is safeguarded through access control, but existing models such as Role Based Access Control (RBAC) and Attribute Based Access Control (ABAC) rely on a centralized server. If this server is compromised, it poses significant risks to data security. To address this issue, there is a need for Distributed ABAC (DABAC) system for OpenStack services based on blockchain. The unique features of blockchain enables access control systems which ensures data integrity and privacy. Additionally, blockchain offers a level of transparency for both the resource owner and a user. In this work, we propose a smart contract based ABAC system. We implemented the proposed work using an Ethereum blockchain and OpenStack cloud. Furthermore, we evaluated two consensus algorithms for scalability analysis of DABC mechanism. The results demonstrate that DABAC performs better than ABAC in ensuring fine-grade access control with proof of stake consensus algorithm providing better scalability.
Self-sovereign identity models and decentralized, blockchain-based identity management can prevent digital ecosystem data breaches and misuse, the study finds. As digital services proliferate and personal data becomes more valuable, central database-based identity systems expose users to single-point failures, unauthorized access, identity theft, and large-scale breaches. This paper analyzes how decentralized IDs, verifiable credentials, and cryptographic verification reduce middlemen, enable selective disclosure, and promote identity governance privacy. Important academic, industrial, and technical contributions show that blockchain anchors credentials in distributed ledgers rather than institutional repositories, improving authentication, traceability, and tamper resistance while limiting undesired access. Immutable audit trails, user-controlled credentials, and reduced central authority dependency have been touted, but empirical performance data, scalability, interoperability, and comparative evaluations of public and permissioned blockchain environments are lacking. These findings explain self-sovereign identity architecture, which lets trusted authority issue credentials but users store and control them directly through digital wallets utilizing cryptographic proofs instead of database lookups. Users can control or withdraw data sharing while maintaining identity. Transparency, limited disclosure, and contextual data presentation prevent cross-platform tracking and increase user autonomy. The research shows how zero-knowledge proofs and predicate-based validation verify credentials without disclosing sensitive data, protecting privacy. Birthdates and locations are not needed to verify age- and location-based limits. SSI master key-derived domain-specific identities reduce correlation hazards and prevent service surveillance. Consent-based sharing, selective disclosure, and cryptographic compartmentalization decrease data collection and profiling. Decentralised blockchain verification maintains credentials usable when the issuer is offline, preventing service disruptions and third-party participation.