Blockchain Papers

Xun Yi, Zahir Tari, Feng Hao, Liqun Chen · 9 authors

No abstract is available for this record.

Alfaisal Albakri, Chafic Mokbel

Blockchain technology has attracted a lot of attention in the previous years as a secure way to protect transactions in different processes. It has been particularly used to define cryptocurrencies. While inherently secure against classical single node attacks, the blockchain cryptocurrencies have recently been subject to attacks by malwares able to capture a single user wallet and its included keys. In this work we propose the use of biometric cryptosystems to control the access to the wallets on single machines. After a brief description of the blockchain, the cryptocurrencies and the possible attacks, the paper describes the use of convolutional neural network face recognition as a tool to extract biometric features that help in a key binding approach to protect the personal data in the wallet. Experiments have been conducted on three independent face datasets and the results obtained are satisfactory. The equal error rate between false acceptance and false rejection is negligible when testing on images from the same dataset used for the training of the convolutional neural network. This generalizes well when experimenting on two other independent datasets. These results prove that face cryptosystems can be used to protect the access on sensitive data existing in the wallets of many cryptocurrencies.

John Minor

Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) evidence have become an important evidentiary focus in the courtroom. This type of evidence is routinely produced as business records under U.S. Federal Rules of Evidence for use in the emerging discipline of Forensic Cell Site Analysis. The research was undertaken to determine if evidence produced by operators should be classified as digital evidence and, if so, what evidence handling methodologies are appropriate to ensure evidence integrity. This research project resulted in the creation of a method of determining if business records produced by MNO/MVNO organizations are digital evidence and whether evidentiary integrity is maintained in the conveyance of evidence between MNO/MVNO records custodians, law enforcement investigators and attorneys in criminal and civil cases. Block-chain based Distributed Ledger Technology was examined as a feasible evidence integrity maintenance solution.

Gabriel Kaptchuk, Matthew Green, Ian Miers

In this work we investigate new computational properties that can be achieved by combining stateless trusted devices with public ledgers. We consider a hybrid paradigm in which a client-side device (such as a co-processor or trusted enclave) performs secure computation, while interacting with a public ledger via a possibly malicious host computer. We explore both the constructive and potentially destructive implications of such systems. We first show that this combination allows for the construction of stateful interactive functionalities (including general computation) even when the device has no persistent storage; this allows us to build sophisticated applications using inexpensive trusted hardware or even pure cryptographic obfuscation techniques. We further show how to use this paradigm to achieve censorship-resistant communication with a network, even when network communications are mediated by a potentially malicious host. Finally we describe a number of practical applications that can be achieved today. These include the synchronization of private smart contracts; rate limited mandatory logging; strong encrypted backups from weak passwords; enforcing fairness in multi-party computation; and destructive applications such as autonomous ransomware, which allows for payments without an online party.

Anton Bäckström

Zero-knowledge password policy checks (ZKPPC) were introduced in Kiefer and Manulis’ report from 2014. The protocol aimed to solve the longstanding issue with servers requiring clients to provide their password in plain text to ensure its strength. Their protocol was intended to eliminate the need for users to trust the server to store and handle passwords correctly while simultaneously allowing the server to know that the registered password was strong enough. This thesis has investigated the soundness of the protocol by Kiefer and Manulis and will present three new zero-day vulnerabilities discovered in the process. The vulnerabilities allow a dishonest user to prove adherence to the policy for invalid passwords. Additionally, the thesis presents our new Proof of Inequality which prevents one of these vulnerabilities, as well as an extension for an incomplete part of the protocol. The two remaining zero-day vulnerabilities are weaknesses in the protocol left for future research.

Wenzheng Liu, Xiaofeng Wang, Wei Peng, Qianqian Xing

Identity-based mutual authentication and key agreement (ID-MAKA) between a mobile user and cloud service provider is necessary for accessing any cloud services. In recent years, there are a large number of ID-MAKA schemes had been proposed on mobile cloud computing services to make authentication and accessing process more usability, security, and scalability. In this paper, we propose a new ID-MAKA scheme for mobile cloud computing, which firstly achieves remote biometric-based authentication(remote servers authenticate user's biometrics), single sign-on (a single credential and single registration for accessing multiple servers) and center-less authentication(the registration center does not participate in the access procedure) in one scheme. In order to realize this target, we design a ZK-token based on ECC and cryptographic hash function, and then artfully employ it to introduce the fuzzy extractor technology and zero-knowledge technology into our scheme. Therefore, the user can access multiple cloud computing servers by registering only once in the registration center, and cloud computing servers can complete the biometric-based remote authentication and key agreement for the user without the registration center participating. In this way, our scheme greatly improves usability, scalability, and security compared to other existing solutions. We give a formal security proof for our scheme by using Real-Or-Random(RoR) model and Burrows-Abadi-Needham (BAN) logic to show that the present scheme is secure and security analysis for other known attacks. Finally, according to the experiment result, our scheme has lower computation and communication cost compared with most existing related schemes.

Michail Sidorov, Ming Tze Ong, Ravivarma Vikneswaren Sridharan, Junya Nakamura · 6 authors

Previous research studies mostly focused on enhancing the security of radio frequency identification (RFID) protocols for various RFID applications that rely on a centralized database. However, blockchain technology is quickly emerging as a novel distributed and decentralized alternative that provides higher data protection, reliability, immutability, transparency, and lower management costs compared with a conventional centralized database. These properties make it extremely suitable for integration in a supply chain management system. In order to successfully fuse RFID and blockchain technologies together, a secure method of communication is required between the RFID tagged goods and the blockchain nodes. Therefore, this paper proposes a robust ultra-lightweight mutual authentication RFID protocol that works together with a decentralized database to create a secure blockchain-enabled supply chain management system. Detailed security analysis is performed to prove that the proposed protocol is secure from key disclosure, replay, man-in-the-middle, de-synchronization, and tracking attacks. In addition to that, a formal analysis is conducted using Gong, Needham, and Yahalom logic and automated validation of internet security protocols and applications tool to verify the security of the proposed protocol. The protocol is proven to be efficient with respect to storage, computational, and communication costs. In addition to that, a further step is taken to ensure the robustness of the protocol by analyzing the probability of data collision written to the blockchain.

Stephan Zöllner, Kim‐Kwang Raymond Choo, Nhien‐An Le‐Khac

Bitcoin is popular not only with consumers, but also with cybercriminals (e.g., in ransomware and online extortion, and commercial online child exploitation). Given the potential of Bitcoin to be involved in a criminal investigation, the need to have an up-to-date and in-depth understanding on the forensic acquisition and analysis of Bitcoins is crucial. However, there has been limited forensic research of Bitcoin in the literature. The general focus of existing research is on postmortem analysis of specific locations (e.g. wallets on mobile devices), rather than a forensic approach that combines live data forensics and postmortem analysis to facilitate the identification, acquisition, and analysis of forensic traces relating to the use of Bitcoins on a system. Hence, the latter is the focus of this paper where we present an open source tool for live forensic and postmortem analysing automatically. Using this open source tool, we describe a list of target artifacts that can be obtained from a forensic investigation of popular Bitcoin clients and Web Wallets on different web browsers installed on Windows 7 and Windows 10 platforms.

Evangelos A. Deirmentzoglou, Georgios Papakyriakopoulos, Constantinos Patsakis

Despite common arguments about the prevalence of blockchain technology, in terms of security, privacy, and immutability, in reality, several attacks can be launched against them. This paper provides a systematic literature review on long-range attacks for proof of stake protocols. If successful, these attacks may take over the main chain and partially, or even completely, rewrite the history of transactions that are stored in the blockchain. To this end, we describe how proof of stake protocols work, their fundamental properties, their drawbacks, and their attack surface. After presenting long-range attacks, we discuss possible countermeasures and their applicability.

Purathani Praitheeshan, Yi Wei Xin, Lei Pan, Robin Doss

No abstract is available for this record.

Matteo Franceschi, Davide Morelli, David Plans, Alan Brown · 7 authors

The problem of protecting sensitive data like medical records, and enabling the access only to authorized entities is currently a challenge. Current solutions often require trusting some centralized entity which is in charge of managing the data. The disruptive technology of blockchains may offer the possibility to change the current scenario and give to the users the control on their personal data. In this paper we propose ComeHere, a system able to store medical records and to exploit the blockchain technology to control and track the access right transfer on the blockchain. The paper shows the current status of the project, presents a preliminary proof-of-concept implementation and discusses the future improvements of the system, and some critical issues which are still open.

Ivan Homoliak, Dominik Breitenbacher, Ondřej Hujňák, Pieter Hartel · 6 authors

With the recent rise of cryptocurrencies' popularity, the security and management of crypto-tokens have become critical. We have witnessed many attacks on users and providers, which have resulted in significant financial losses. To remedy these issues, several wallet solutions have been proposed. However, these solutions often lack either essential security features, usability, or do not allow users to customize their spending rules. In this paper, we propose SmartOTPs, a smart-contract wallet framework that gives a flexible, usable, and secure way of managing crypto-tokens in a self-sovereign fashion. The proposed framework consists of four components (i.e., an authenticator, a client, a hardware wallet, and a smart contract), and it provides 2-factor authentication (2FA) performed in two stages of interaction with the blockchain. To the best of our knowledge, our framework is the first one that utilizes one-time passwords (OTPs) in the setting of the public blockchain. In SmartOTPs, the OTPs are aggregated by a Merkle tree and hash chains whereby for each authentication only a short OTP (e.g., 16B-long) is transferred from the authenticator to the client. Such a novel setting enables us to make a fully air-gapped authenticator by utilizing small QR codes or a few mnemonic words, while additionally offering resilience against quantum cryptanalysis. We have made a proof-of-concept based on the Ethereum platform. Our cost analysis shows that the average cost of a transfer operation is comparable to existing 2FA solutions using smart contracts with multi-signatures.

Shu Yun Lim, Pascal Tankam Fotsing, Abdullah Almasri, Omar Musa · 7 authors

The Internet today lacks an identity protocol for identifying people and organizations. As a result, service providers needed to build and maintain their own databases of user information. This solution is costly to the service providers, inefficient as much of the information is duplicated across different providers, difficult to secure as evidenced by recent large-scale personal data breaches around the world, and cumbersome to the users who need to remember different sets of credentials for different services. Furthermore, personal information could be collected for data mining, profiling and exploitation without users' knowledge or consent. The ideal solution would be self-sovereign identity, a new form of identity management that is owned and controlled entirely by each individual user. This solution would include the individual's consolidated digital identity as well as their set of verified attributes that have been cryptographically signed by various trusted issuers. The individual provides proof of identity and membership by sharing relevant parts of their identity with the service providers. Consent for access may also be revoked hence giving the individual full control over its own data. This survey critically investigates different blockchain based identity management and authentication frameworks. A summary of the state-of-the-art blockchain based identity management and authentication solutions from year 2014 to 2018 is presented. The paper concludes with the open issues, main challenges and directions highlighted for future work in this area. In a nutshell, the discovery of this new mechanism disrupted the existing identity management and authentication solutions and by providing a more promising secure platform.

Nisha Malik, Priyadarsi Nanda, Arushi Arora, Xiangjian He · 5 authors

Authentication and revocation of users in Vehicular Adhoc Networks (VANETS) are two vital security aspects. It is extremely important to perform these actions promptly and efficiently. The past works addressing these issues lack in mitigating the reliance on the centralized trusted authority and therefore do not provide distributed and decentralized security. This paper proposes a blockchain based authentication and revocation framework for vehicular networks, which not only reduces the computation and communication overhead by mitigating dependency on a trusted authority for identity verification, but also speedily updates the status of revocated vehicles in the shared blockchain ledger. In the proposed framework, vehicles obtain their Pseudo IDs from the Certificate Authority (CA), which are stored along with their certificate in the immutable authentication blockchain and the pointer corresponding to the entry in blockchain, enables the Road Side Units (RSUs) to verify the identity of a vehicle on road. The efficiency and performance of the framework has been validated using the Omnet++ simulation environment.

MohammadJavad Hajialikhani, MohammadMahdi Jahanara

Bitcoin and Ethereum are novel mechanisms for decentralizing the concept of money and computation. Extending decentralization to the human identity concept, we can think of using blockchain for creating a list of verified human identities with a one-person-one-ID property. UniqueID is a Decentralized Autonomous Organization(DAO) for maintaining human identities such that every physical human entity can have no more that one account. One part of this identity is simply the user's claim on one of his unique, permanent, and measurable characteristics -biometrics. Blockchain has proved its integrity as a platform for storing and performing computations on such claims. The biggest challenge here is to ensure that the user has submitted his own valid biometric data. Human verifiers can check if there is any inconsistency in other users' data, by peer-to-peer checks. For preventing bad behavior and centralization in the verification process, UniqueID benefits from novel governance mechanisms to choose verifiers and punish unjust ones. Also, there are incentives for honest verifiers and users by newly generated tokens. We show how the users' privacy can be preserved by using state-of-the-art cryptographic techniques, and so they can use their identity without any concerns for votings, financial and banking purposes, social media accounts, reputation systems etc.

Pontificia Univerisdad Javeriana, Bogotá-Colombia, Cra 7 no. 40-62, Colombia, Montes D. Juan, Rincón P. Andrés, Páez M. Rafael · 6 authors

No abstract is available for this record.

Mega Satish, Indranil Sengupta, K. Pratap

This paper presents the implementation of an interactive Zero Knowledge Password authentication scheme for commercial Web sites. In this scheme, a legitimate prover (client) can exchange a secret code (password) with a remote skeptic (server), in order to reveal his/her identification. Based on the validity of the secret code the skeptic then allows the prover to login to the site and access the web services. This paper introduces a protocol that integrates the concepts of Discrete Logarithm Problem (DLP) and Zero-Knowledge Proofs (ZKP). The protocol consists of three entities, namely, the prover, the skeptic, and the facilitator who interact with one another to generate the secret code. When tested, the time to carry out various operations related to this protocol was reasonably small (under 4 seconds). Our scheme is resistant to man-in-the-middle attack and discourages replaying previously intercepted secret codes. We also propose two modifications to our basic scheme to make it resistant against the attack on Integrity and Denial of Service attack (DOS).

Hoang-Long Nguyen, Jean-Philippe Eisenbarth, Claudia‐Lavinia Ignat, Olivier Perrin

No abstract is available for this record.

Pelin Angın, Melih Burak Mert, Okan Mete, Azer Ramazanli · 6 authors

No abstract is available for this record.

Yang Xu, Guojun Wang, Jidian Yang, Ju Ren · 6 authors

The emerging network computing technologies have significantly extended the abilities of the resource‐constrained IoT devices through the network‐based service sharing techniques. However, such a flexible and scalable service provisioning paradigm brings increased security risks to terminals due to the untrustworthy exogenous service codes loading from the open network. Many existing security approaches are unsuitable for IoT environments due to the high difficulty of maintenance or the dependencies upon extra resources like specific hardware. Fortunately, the rise of blockchain technology has facilitated the development of service sharing methods and, at the same time, it appears a viable solution to numerous security problems. In this paper, we propose a novel blockchain‐based secure service provisioning mechanism for protecting lightweight clients from insecure services in network computing scenarios. We introduce the blockchain to maintain all the validity states of the off‐chain services and edge service providers for the IoT terminals to help them get rid of untrusted or discarded services through provider identification and service verification. In addition, we take advantage of smart contracts which can be triggered by the lightweight clients to help them check the validities of service providers and service codes according to the on‐chain transactions, thereby reducing the direct overhead on the IoT devices. Moreover, the adoptions of the consortium blockchain and the proof of authority consensus mechanism also help to achieve a high throughput. The theoretical security analysis and evaluation results show that our approach helps the lightweight clients get rid of untrusted edge service providers and insecure services effectively with acceptable latency and affordable costs.

Md. Abdur Rahman, M. Shamim Hossain, George Loukas, Elham Hassanain · 7 authors

Mobile edge computing (MEC) is being introduced and leveraged in many domains, but few studies have addressed MEC for secure in-home therapy management. To this end, this paper presents an in-home therapy management framework, which leverages the IoT nodes and the blockchain-based decentralized MEC paradigm to support low-latency, secure, anonymous, and always-available spatiotemporal multimedia therapeutic data communication within an on-demand data-sharing scenario. To the best of our knowledge, this non-invasive, MEC-based IoT therapy platform is first done by our group. This platform can provide a full-body joint range of motion data for physically challenged individuals in a decentralized manner. With MEC, the framework can provide therapy diagnostic and analytical data on demand to a large portion of humanity who are either born with disabilities or became disabled due to accidents, war-time injuries, or old age. For security, the framework uses blockchain–Tor-based distributed transactions to preserve the therapeutic data privacy, ownership, generation, storage, and sharing. Our initial test results from a complete implementation of the framework show that it can support a sufficiently large number of users without considerable increase in mean processing time.

Shuangyu He, Qianhong Wu, Xizhao Luo, Zhi Liang · 8 authors

Effective cryptocurrency key management has become an urgent requirement for modern cryptocurrency. Although a large body of cryptocurrency wallet-management schemes has been proposed, they are mostly constructed for specific application scenarios and often suffer from weak security. In this paper, we propose a more effective, usable, and secure cryptocurrency wallet-management system based on semi-trusted social networks, therein allowing users to collaborate with involved parties to achieve some powerful functions and recovery under certain circumstances. Furthermore, we employ an identity-based hierarchical key-insulated encryption scheme to achieve time-sharing authorization and present a semi-trusted portable social-network-based wallet-management scheme that provides the features of security-enhanced storage, portable login on different devices, no-password authentication, flexible key delegation, and so on. The performance analysis shows that our proposed schemes require minimal additional overhead and have low time delays, making them sufficiently efficient for real-world deployment.

Michael Brengel, Christian Rossow

We study key leakage in the context of cryptocurrencies. First, we consider the problem of explicit key leakage occurring on open-source intelligence platforms. To do this, we monitor the Pastebin feed from Sep 2017–Mar 2018 to find exposed secret Bitcoin keys, revealing that attackers could have stolen 22.40 BTC worth roughly $178,000 given current exchange rates. Then, we focus on implicit key leakage by exploiting the wrong usage of cryptographic primitives and scan Bitcoin’s blockchain for ECDSA nonce reuse. We systematically outline how an attacker can use duplicate r values to leak nonces and secret keys, which goes beyond the simple case where the same nonce and the same key have been used in conjunction more than once. Our results show that ECDSA nonce reuse has been a recurring problem in the Bitcoin ecosystem and has already been exploited by attackers. In fact, an attacker could have exploited nonce reuse to steal 412.80 BTC worth roughly $3.3 million.

James Brogan, Immanuel Baskaran, Navin Ramachandran

The on-demand digital healthcare ecosystem is on the near horizon. It has the potential to extract a wealth of information from "big data" collected at the population level, to enhance preventive and precision medicine at the patient level. This may improve efficiency and quality while decreasing cost of healthcare delivered by professionals. However, there are still security and privacy issues that need to be addressed before algorithms, data, and models can be mobilized safely at scale. In this paper we discuss how distributed ledger technologies can play a key role in advancing electronic health, by ensuring authenticity and integrity of data generated by wearable and embedded devices. We demonstrate how the Masked Authenticated Messaging extension module of the IOTA protocol can be used to securely share, store, and retrieve encrypted activity data using a tamper-proof distributed ledger.