Protecting secrets is a key challenge in our contemporary information-based era. In common situations, however, revealing secrets appears unavoidable, for instance, when identifying oneself in a bank to retrieve money. In turn, this may have highly undesirable consequences in the unlikely, yet not unrealistic, case where the bank's security gets compromised. This naturally raises the question of whether disclosing secrets is fundamentally necessary for identifying oneself, or more generally for proving a statement to be correct. Developments in computer science provide an elegant solution via the concept of zero-knowledge proofs: a prover can convince a verifier of the validity of a certain statement without facilitating the elaboration of a proof at all. In this work, we report the experimental realisation of such a zero-knowledge protocol involving two separated verifier-prover pairs. Security is enforced via the physical principle of special relativity, and no computational assumption (such as the existence of one-way functions) is required. Our implementation exclusively relies on off-the-shelf equipment and works at both short (60 m) and long distances ($\geqslant$400 m) in about one second. This demonstrates the practical potential of multi-prover zero-knowledge protocols, promising for identification tasks and blockchain applications such as cryptocurrencies or smart contracts.
Open access
3 source records
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
Since a smart dust Internet of Things (IoT) system includes a very large number of devices sometimes deployed in hard-access areas, it is very difficult to prevent security attacks and to alleviate bottleneck phenomena. In this paper, we propose a lightweight blockchain scheme that helps device authentication and data security in a secure smart dust IoT environment. To achieve our goals, (1) we propose the structure of the lightweight blockchain and the algorithm of processing the blockchain. In addition, (2) we reorganize the linear block structure of the conventional blockchain into the binary tree structure in such a way that the proposed blockchain is more efficient in a secure smart dust IoT environment. Experiments show that the proposed binary tree-structured lightweight blockchain scheme can greatly reduce the time required for smart dust device authentication, even taking into account the tree transformation overhead. Compared with the conventional linear-structured blockchain scheme, the proposed binary tree-structured lightweight blockchain scheme achieves performance improvement by up to 40% (10% in average) with respect to the authentication time.
The interconnection of private resources on public infrastructure, user mobility and the emergence of new technologies (vehicular networks, sensor networks, Internet of things, etc.) have added new requirements in terms of security on the server side as well as the client side. Examples include the processing time, mutual authentication, client participation in the choice of security settings and protection against traffic analysis. Internet of Things (IoT) is in widespread use and its applications cover many aspects of today's life, which results in a huge and continuously increasing number of objects distributed everywhere.Security is no doubt the element that will improve and strengthen the acceptability of IoT, especially that this large scale deployment of IoT systems will attract the appetite of the attackers. The current cyber-attacks that are operational on traditional networks will be projected towards the Internet of Things. Security is so critical in this context given the underlying stakes; in particular, authentication has a critical importance given the impact of the presence of malicious node within the IoT systems and the harm they can cause to the overall system. The research works in this thesis aim to advance the literature on IoT authentication by proposing three authentication schemes that satisfy the needs of IoT systems in terms of security and performance, while taking into consideration the practical deployment-related concerns. One-Time Password (OTP) is an authentication scheme that represents a promising solution for IoT and smart cities environments. This research work extends the OTP principle and propose a new approach to generate OTP based on Elliptic Curve Cryptography (ECC) and Isogeny to guarantee the security of such protocol. The performance results obtained demonstrate the efficiency and effectiveness of our approach in terms of security and performance.We also rely on blockchains in order to propose two authentication solutions: first, a simple and lightweight blockchain-based authentication scheme for IoT systems based on Ethereum, and second, an adaptive blockchain-based authentication and authorization approach for IoT use cases. We provided a real implementation of our proposed solutions. The extensive evaluation provided, clearly shows the ability of our schemes to meet the different security requirements with a lightweight cost in terms of performance.
Raising incidents of security threats among active sessions is an increasing concern in IoT environment. Continuous authentication was introducing to be superior to traditional authentication schemes by constantly verify usersâ identities on an ongoing basis and spot the moment at which an illicit attacker seizes control of the session. However, several challenges remain unsolved. This research aims to investigate the power of Blockchain technology to provide real-time and non-intrusive continuous authentication for the IoT environment. Accordingly, a distributed and scalable continuous authentication solution based on Blockchain technology called CAB-IoT was proposed. It enabled fog nodes layer that tackles the limitations of IoT resources by providing localized processing of heavy continuous authentication-related tasks for a group of IoT devices. Besides, CAB-IoT introduced a trust module that depends on the face recognition machine learning model to detect outliers and abnormal access. Moreover, mutual authentication between end-users and fog nodes is also designed, as well as secure communication between the authenticated nodes. The results demonstrate a lightweight continuous authentication solution that achieved the desired balance between security and performance requirements where it was observed in a real-world environment for truly performance results. Security analysis and attack analysis are also considered during the evaluation.
In tracing the (robotically automated) logistics of large quantities of goods, inexpensive passive RFID tags are preferred for cost reasons. Accordingly, security between such tags and readers have primarily been studied among many issues of RFID. However, the authenticity of data cannot be guaranteed if logistics services can give false information. Although the use of blockchain is often discussed, it is simply a recording system, so there is a risk that false records may be written to it. As a solution, we propose a design in which a digitally signing, location-constrained and tamper-evident reader atomically writes an evidence to blockchain along with its reading and writing a tag. By semi-formal modeling, we confirmed that the confidentiality and integrity of the information can be maintained throughout the system, and digitally signed data can be verified later despite possible compromise of private keys or signature algorithms, or expiration of public key certificates. We also introduce a prototype design to show that our proposal is viable. This makes it possible to trace authentic logistics information using inexpensive passive RFID tags. Furthermore, by abstracting the reader/writer as a sensor/actuator, this model can be extended to IoT in general.
Blockchain is one of the most trending technologies in past five years and it is called the new generation of the internet. Bitcoin was the first technology that used blockchain concept in its system. Blockchain has intense attention from academic community, developers and programmers, because of its distinctive properties such as decentralization, persistency, anonymity and auditability. Blockchain technology has evolved and is applicable in various applications outside the field. This paper provides background on blockchain technology and presents a suitable and logical solution for user authentication based on blockchain via the unified smart pass platform that allows the user to login with all service providers channels.
Anders Dalskov, Daniele Lain, Enis Ulqinaku, Kari Kostiainen · 5 authors
Encrypted cloud storage services are steadily increasing in popularity, with many commercial solutions currently available. In such solutions, the cloud storage is trusted for data availability, but not for confidentiality. Additionally, the user's device is considered secure, and the user is expected to behave correctly. We argue that such assumptions are not met in reality: e.g., users routinely forget passwords and fail to make backups, and users' devices get stolen or become infected with malware. Therefore, we consider a more extensive threat model, where users' devices are susceptible to attacks and common human errors are possible. Given this model, we analyze 10 popular commercial services and show that none of them provides good confidentiality and data availability. Motivated by the lack of adequate solutions in the market, we design a novel scheme called Two-Factor Encryption (2FE) that draws inspiration from two-factor authentication and turns file encryption and decryption into an interactive process where two user devices, like a laptop and a smartphone, must interact. 2FE provides strong confidentiality and availability guarantees, as it withstands compromised cloud storage, one stolen or compromised user device at a time, and various human errors. 2FE achieves this by leveraging secret sharing with additional techniques such as oblivious pseudorandom functions and zero-knowledge proofs. We evaluate 2FE experimentally and show that its performance overhead is small. Finally, we explain how our approach can be adapted to other related use cases such as cryptocurrency wallets.
Communication security between IoT devices is a major concern in this area, and the blockchain has raised hopes that this concern will be addressed. In the blockchain concept, the majority or even all network nodes check the validity and accuracy of exchanged data before accepting and recording them, whether this data is related to financial transactions or measurements of a sensor or an authentication message. In evaluating the validity of an exchanged data, nodes must reach a consensus in order to perform a special action, in which case the opportunity to enter and record transactions and unreliable interactions with the system is significantly reduced. Recently, in order to share and access management of IoT devices information with distributed attitude a new authentication protocol based on blockchain is proposed and it is claimed that this protocol satisfies user privacy preserving and security. However, in this paper, we show that this protocol has security vulnerabilities against secret disclosure, replay, traceability, and <a:math xmlns:a="http://www.w3.org/1998/Math/MathML" id="M1"> <a:mtext>Token</a:mtext> </a:math> reuse attacks with the success probability of 1 and constant complexity of also 1. We also proposed an improved blockchain-based authentication protocol (IBCbAP) that has security properties such as secure access management and anonymity. We implemented IBCbAP using JavaScript programming language and Ethereum local blockchain. We also proved IBCbAPâs security both informally and formally through the Scyther tool. Our comparisons showed that IBCbAP could provide suitable security along with reasonable cost.
An important feature of Proof-of-Work (PoW) blockchains is full dynamic availability, allowing miners to go online and offline while requiring only 50% of the online miners to be honest. Existing Proof-of-stake (PoS), Proof-of-Space and related protocols are able to achieve this property only partially, either putting the additional assumption that adversary nodes to be online from the beginning and no new adversary nodes come online afterwards, or use additional trust assumptions for newly joining nodes.We propose a new PoS protocol PoSAT which can provably achieve dynamic availability fully without any additional assumptions. The protocol is based on the longest chain and uses a Verifiable Delay Function for the block proposal lottery to provide an arrow of time. The security analysis of the protocol draws on the recently proposed technique of Nakamoto blocks as well as the theory of branching random walks. An additional feature of PoSAT is the complete unpredictability of who will get to propose a block next, even by the winner itself. This unpredictability is at the same level of PoW protocols, and is stronger than that of existing PoS protocols using Verifiable Random Functions.
Oday Ali Hassen, Ansam A. Abdulhussien, Saad M. Darwish, Zulaiha Ali Othman · 6 authors
Blockchain technology has been commonly used in the last years in numerous fields, such as transactions documenting and monitoring real assets (house, cash) or intangible assets (copyright, intellectual property). The internet of things (IoT) technology, on the other hand, has become the main driver of the fourth industrial revolution, and is currently utilized in diverse fields of industry. New approaches have been established through improving the authentication methods in the blockchain to address the constraints of scalability and protection in IoT operating environments of distributed blockchain technology by control of a private key. However, these authentication mechanisms do not consider security when applying IoT to the network, as the nature of IoT communication with numerous entities all the time in various locations increases security risks resulting in extreme asset damage. This posed many difficulties in finding harmony between security and scalability. To address this gap, the work suggested in this paper adapts multimodal biometrics to strengthen network security by extracting a private key with high entropy. Additionally, via a whitelist, the suggested scheme evaluates the security score for the IoT system with a blockchain smart contract to guarantee that highly secured applications authenticate easily and restrict compromised devices. Experimental results indicate that our system is existentially unforgeable to an efficient message attack, and therefore, decreases the expansion of infected devices to the network by up to 49 percent relative to traditional schemes.
It is well known that users on open blockchains are tracked by an industry providing services to governments, law enforcement, secret services, and alike. While most blockchains do not protect their users' privacy and allow external observers to link transactions and addresses, a growing research interest attempts to design add-on privacy solutions to help users regain their privacy on non-private blockchains. In this work, we propose to our knowledge the first censorship resilient mixer, which can reward its users in a privacy-preserving manner for participating in the system. Increasing the anonymity set size, and diversity of users, is, as we believe, an important endeavor to raise a mixer's contributed privacy in practice. The paid-out rewards can take the form of governance tokens to decentralize the voting on system parameters, similar to how popular "DeFi farming" protocols operate. Moreover, by leveraging existing "Defi" lending platforms, AMR is the first mixer design that allows participating clients to earn financial interests on their deposited funds. Our system AMR is autonomous as it does not rely on any external server or third party. The evaluation of our AMR implementation shows that the system supports today on Ethereum anonymity set sizes beyond thousands of users, and a capacity of over $66,000$ deposits per day, at constant system costs. We provide a formal specification of our zksnark-based AMR system, a privacy and security analysis, implementation, and evaluation with both the MiMC and Poseidon hash functions.
Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
The Internet of Things (IoT) is built on a strong internet infrastructure and many wireless sensor devices. Presently, Radio Frequency Identification embedded (RFID-embedded) smart cards are ubiquitous, used for many things including student ID cards, transportation cards, bank cards, prepaid cards, and citizenship cards. One example of places that require smart cards is libraries. Each library, such as a university library, city library, local library, or community library, has its own card and the user must bring the appropriate card to enter a library and borrow material. However, it is inconvenient to bring various cards to access different libraries. Wireless infrastructure has been well developed and IoT devices are connected through this infrastructure. Moreover, the development of biometric identification technologies has continued to advance. Blockchain methodologies have been successfully adopted in various fields. This paper proposes the BlockMetrics library based on integrated technologies using blockchain and finger-vein biometrics, which are adopted into a library collection management and access control system. The library collection is managed by image recognition, RFID, and wireless sensor technologies. In addition, a biometric system is connected to a library collection control system, enabling the borrowing procedure to consist of only two steps. First, the user adopts a biometric recognition device for user authentication and then performs a collection scan with the RFID devices. All the records are recorded in a personal borrowing blockchain, which is a peer-to-peer transfer system and permanent data storage. In addition, the user can check the status of his collection across various libraries in his personal borrowing blockchain. The BlockMetrics library is based on an integration of technologies that include blockchain, biometrics, and wireless sensor technologies to improve the smart library.
Nowadays, it is still a major challenge to design a secure cross-domain authentication protocol for heterogeneous wireless networks with different security parameters. As a new technology, blockchain has attracted peopleâs attention because of its tamper-proof and decentralized characteristics. In this paper, we propose a cross-domain authentication and key agreement system based on smart contract of blockchains. Public keys of the nodes are managed using the smart contracts, and the system parameters are confirmed by contract query. On this basis, a cross-domain authentication and key agreement protocol is designed. In this protocol, roaming users can select temporary authentication parameters according to the system parameters of the roaming domain to complete authentication and key agreement, and users are anonymous in the process. Security of the protocol is demonstrated under the CK model, and two formal analysis tools are used to further analyze the protocol. Since the protocol does not have complex cryptographic operations and certificate verification, it has lower computational and communication overhead.
<span>Text password has long been a dominant approach to user authentication used by a huge quantity of Internet services. Web applications are now widely used for the implementation of a range of significant services. The securing of such applications has thus become a significant process. Currently the frequent use of passwords and the need for them make them more vulnerable to theft or guesswork. In the proposed research, the researcher designed an algorithm that has the ability to perform registration or to access web applications safely. The researcher designed an algorithm in the proposed research, which has the ability to securely perform registration or access web applications. The proposed idea based on the notion of Zero-knowledge proof. A complex generation of random number initiated by proposed novel 6D-Hyper chaotic system. The bottom line is that both parties (web application, user), have a secret number. These two numbers used to do the process of registration without requiring a password. Results from the research showed the importance of the proposed method by which the keys were managed and distributed in a safe and effective way.</span>
Abstract As blockchain is increasingly valued, the application of blockchain and its security has become a research hotspot. Not only that, more and more ordinary users are paying attention to the blockchain and beginning to trade commodities in cryptocurrencies. The blockchain wallet is a program for users to manage and stores their private keys. Furthermore, the private key is the userâs unique credential to the cryptocurrency in the blockchain. But for now, blockchain wallets are only using passwords to authenticate users, which poses a potential risk to private key security. To mitigate this risk, this paper proposes a continuous authentication approach based on user mouse behavioral biometrics. The approach was experimentally shown to be able to authenticate once per second with an average FAR and FRR of 6.92% and 6.18%, respectively.
Fariba Ghaffari, E. Bertin, Julien Hatin, Noël Crespi
As the first step in preserving system security, Authentication and Access Control (AAC) plays a vital role in all businesses. Recently, emerging the blockchain and smart contract technology has attracted significant scientific interest in research areas like authentication and access control processes. In the context of authentication and access control, blockchain can offer greater data and rule confidentiality and integrity, as well as increasing the availability of the system by removing the single point of failure in the procedure. To categorize and find the most important open problems in this research area, having a comprehensive review is crucial. To the best of our knowledge, for the first time in this survey, we aim to describe the current state of the art in deploying blockchain and smart contracts specifically in authentication and access control. Following an introduction to AAC and blockchain technology, we present a brief background of distributed ledger technology, access control and authentication. To offer a clearer understanding of the state of the art, we propose taxonomy to categorize the existing methods based on their type, application environment and their justification for exploiting blockchain. For the conclusion of the paper, we examined the advantages and disadvantages of the proposed method in different contexts like security, resource consumption and privacy. Also we discussed about the future work.
Muhammad Tahir, Muhammad Sardaraz, Shakoor Muhammad, Muhammad Saud Khan
Blockchain and IoT are being deployed at a large scale in various fields including healthcare for applications such as secure storage, transactions, and process automation. IoT devices are resource-constrained, have no capability of security and self-protection, and can easily be hacked or compromised. Furthermore, Blockchain is an emerging technology with immutability features which provide secure management, authentication, and guaranteed access control to IoT devices. IoT is a cloud-based internet service in which processing and collection of userâs data are accomplished remotely. Smart healthcare also requires the facility to provide the diagnosis of patients located remotely. The smart health framework faces critical issues such as data security, costs, memory, scalability, trust, and transparency between different platforms. Therefore, it is important to handle data integrity and privacy as the userâs authenticity is in question due to an open internet environment. Several techniques are available that primarily focus on resolving security issues i.e., forgery, timing, denial of service and stolen smartcard attacks, etc. Blockchain technology follows the rules of absolute privacy to identify the users associated with transactions. The motivation behind the use of Blockchain in health informatics is the removal of the centralized third party, immutability, improved data sharing, enhanced security, and reduced overhead costs in distributed applications. Healthcare informatics has some specific requirements associated with the security and privacy along with the additional legal requirements. This paper presents a novel authentication and authorization framework for Blockchain-enabled IoT networks using a probabilistic model. The proposed framework makes use of random numbers in the authentication process which is further connected through joint conditional probability. Hence, it establishes a secure connection among IoT devices for further data acquisition. The proposed model is validated and evaluated through extensive simulations using the AVISPA tool and the Cooja simulator, respectively. Experimental results analyses show that the proposed framework provides robust mutual authenticity, enhanced access control, and lowers both the communication and computational overhead cost as compared to others.
Wei Feng, Zheng Yan, Laurence T. Yang, Qinghua Zheng
Mobile crowdsourcing (MCS) has become an effective data collection method due to its mobility, low cost, and flexibility. However, since centralized MCS confronts severe security and privacy risks in reality, many researchers are devoted to building a decentralized MCS system based on blockchain. Despite the effectiveness of these schemes, they fail to offer anonymous authentication on the trust of MCS nodes, although privacy is a main concern in MCS and trust plays an important role in a series of MCS activities, such as worker selection and truth discovery. Nevertheless, anonymous authentication on trust is not a trivial issue since trust evaluation usually conflicts with anonymity, which is a necessary privacy requirement in an open MCS environment. To tackle this problem, we leverage Intel software guard extension (SGX) and propose a scheme to anonymously authenticate trust with trustworthy trust evaluation in a blockchain-based MCS system. The scheme employs an SGX-enabled cloud server to periodically alter user public/private key pairs and mix newly altered keys among a number of faked keys in order to ensure unlinkability. Besides, we consider the unique features of MCS and work out a novel trust evaluation method by aggregating both subjective feedback and objective behaviors. Finally, we conduct several analyses and experiments to illustrate its security and efficiency.
Sarang Chaudhari, Michael Clear, Philip Bradish, Hitesh Tewari
Uniquely identifying individuals across the various networks they interact with on a daily basis remains a challenge for the digital world that we live in, and therefore the development of secure and efficient privacy preserving identity mechanisms has become an important field of research. In addition, the popularity of decentralised decision making networks such as Bitcoin has seen a huge interest in making use of distributed ledger technology to store and securely disseminate end user identity credentials. In this paper we describe a mechanism that allows one to store the COVID-19 vaccination details of individuals on a publicly readable, decentralised, immutable blockchain, and makes use of a two-factor authentication system that employs biometric cryptographic hashing techniques to generate a unique identifier for each user. Our main contribution is the employment of a provably secure input-hiding, locality-sensitive hashing algorithm over an iris extraction technique, that can be used to authenticate users and anonymously locate vaccination records on the blockchain, without leaking any personally identifiable information to the blockchain.
An identity management including authentication and authorization in a network environment is a critical security factor. Various models for identity management have been developed continually, from the silo model to the federated model and to the recently introduced self-sovereign identity (SSI) model. In particular, SSI makes users manage their own information by themselves independently of any organizations. SSI utilizes the newly emerged blockchain technology and many studies of it are in progress. However, SSI has not had wide public use because of its low compatibility and inconvenience. This is because it involves an unfamiliar user experience and an immature process. To solve this problem, this paper proposes a new blockchain-based SSI model that complies with the popular and mature standard of OAuth 2.0. Using blockchain, the proposed model secures usersâ data sovereignty where users can use and control their own information in a decentralized manner, instead of depending on a specific monopolistic service-providers. Users and clients who are familiar with the existing OAuth can easily accept the proposed model and apply it, which makes both usability and scalability of the model excellent. This paper confirmed the feasibility of the proposed model by implementing it and a security analysis was performed. The proposed model is expected to contribute to the expansion of both blockchain technology and SSI.
Recently, the interest around the Blockchain concept has grown faster and, as a consequence, several studies about the possibility of exploiting such technology in different application domains have been conducted. Most of these studies highlighted the benefits that the use of the blockchain could bring in those contexts where integrity and authenticity of the data are important, e.g., for reasons linked to regulations about consumersâ healthcare. In such cases, it would be important to collect data, coming in real-time through sensors, and then store them in the blockchain, so that they can become immutable and tamper-proof. In this paper, the design and development of a software framework that allows Internet-of-Things (IoT) devices to interact directly with an Ethereum-based blockchain are reported. The proposed solution represents an alternative way for integrating a wide category of IoT devices without relying on a centralized intermediary and third-party services. The main application scenario for which the project has been conceived regards food-chain traceability in the Industry 4.0 domain. Indeed, the designed system has been integrated into the depiction of a use case for monitoring the temperature of fish products within a warehouse and during the delivery process.
In recent years, blockchain-related technologies and applications have gradually emerged. Blockchain technology is essentially a decentralized database maintained by the collective, and it is now widely applied in various fields. At the same time, with the growth of medical technology, medical information is becoming increasingly important in terms of patient identity background, medical payment records, and medical history. Medical information can be the most private information about a person, but due to issues such as operation errors within the network or a hacking attack by a malicious person, there have been major leaks of sensitive personal information in the past. In any case, this has become an issue worth studying to ensure the privacy of patients and protect these medical materials. On the other hand, under the current medical system, the patientâs EMR (electronic medical record) cannot be searched across the hospital. When the patient attends the hospital for treatment, repeated examinations will occur, resulting in a waste of medical resources. Therefore, we propose a blockchain-based secure inter-hospital EMR sharing system in this article. Through the programmatic authorization mechanism by smart contracts, the security of EMR is guaranteed. In addition to the essential mutual authentication, the proposed scheme also provides and guarantees data integrity, nonrepudiation, user untraceability, forward and backward secrecy, and resistance to replay attack.