EOSIO has become one of the most popular blockchain platforms since its mainnet launch in June 2018. In contrast to the traditional PoW-based systems (e.g., Bitcoin and Ethereum), which are limited by low throughput, EOSIO is the first high throughput Delegated Proof of Stake system that has been widely adopted by many decentralized applications. Although EOSIO has millions of accounts and billions of transactions, little is known about its ecosystem, especially related to security and fraud. In this paper, we perform a large-scale measurement study of the EOSIO blockchain and its associated DApps. We gather a large-scale dataset of EOSIO and characterize activities including money transfers, account creation and contract invocation. Using our insights, we then develop techniques to automatically detect bots and fraudulent activity. We discover thousands of bot accounts (over 30% of the accounts in the platform) and a number of real-world attacks (301 attack accounts). By the time of our study, 80 attack accounts we identified have been confirmed by DApp teams, causing 828,824 EOS tokens losses (roughly \$2.6 million) in total.
With the recent considerable developments in the Internet of Things (IoT), billions of resource-constrained devices are interconnected through the internet. Monitoring this huge number of IoT devices that are heterogeneous in terms of underlying communication protocols and data format is challenging. The majority of existing IoT device monitoring solutions heavily rely on centralized architectures. Since using centralized architectures comes at the expense of trusting an authority, it has several inherent drawbacks, including vulnerability to security attacks, lack of data privacy, and unauthorized data manipulation. Hence, a new decentralized approach is crucial to remedy these drawbacks. One of the most promising technologies which is widely used to provide decentralization is blockchain. Additionally, to ease the burden of communication overhead and computational power on resource-constrained IoT devices, fog computing can be exploited to decrease communication latency and provide better network scalability. In this paper, we propose a scalable blockchain-based architecture for monitoring IoT devices using fog computing. To demonstrate the feasibility and usability of the proposed solution, we have implemented a proof-of-concept prototype, leveraging Ethereum smart contracts. Finally, a comprehensive evaluation is conducted. The evaluation results indicate that the proposed solution is significantly scalable and compatible with resource-constrained IoT devices.
With the recent considerable developments in the Internet of Things (IoT),\nbillions of resource-constrained devices are interconnected through the\ninternet. Monitoring this huge number of IoT devices that are heterogeneous in\nterms of underlying communication protocols and data format is challenging. The\nmajority of existing IoT device monitoring solutions heavily rely on\ncentralized architectures. Since using centralized architectures comes at the\nexpense of trusting an authority, it has several inherent drawbacks, including\nvulnerability to security attacks, lack of data privacy, and unauthorized data\nmanipulation. Hence, a new decentralized approach is crucial to remedy these\ndrawbacks. One of the most promising technologies which is widely used to\nprovide decentralization is blockchain. Additionally, to ease the burden of\ncommunication overhead and computational power on resource-constrained IoT\ndevices, fog computing can be exploited to decrease communication latency and\nprovide better network scalability.\n In this paper, we propose a scalable blockchain-based architecture for\nmonitoring IoT devices using fog computing. To demonstrate the feasibility and\nusability of the proposed solution, we have implemented a proof-of-concept\nprototype, leveraging Ethereum smart contracts. Finally, a comprehensive\nevaluation is conducted. The evaluation results indicate that the proposed\nsolution is significantly scalable and compatible with resource-constrained IoT\ndevices.\n
Moses Arhinful Acquah, Na Chen, Jeng‐Shyang Pan, Hong-Mei Yang · 5 authors
Biometrics, with its uniqueness to every individual, has been adapted as a security authentication feature by many institutions. These biometric data are processed into templates that are saved on databases, and a central authority centralizes and controls these databases. This form of storing biometric data, or in our case fingerprint template, is asymmetric and prone to three main security attacks, such as fake template input, template modification or deletion, and channel interception by a malicious attacker. In this paper, we secure an encrypted fingerprint template by a symmetric peer-to-peer network and symmetric encryption. The fingerprint is encrypted by the symmetric key algorithm: Advanced Encryption Standard (AES) algorithm and then is uploaded to a symmetrically distributed storage system, the InterPlanetary File system (IPFS). The hash of the templated is stored in a decentralized blockchain. The slow transaction speed of the blockchain has limited its use in real-life applications, such as large file storage, hence, the merge with IPFS to store just the hashes of large files. The encrypted template is uploaded to the IPFS, and its returned digest is stored on the Ethereum network. The implementation of IPFS prevents storing the raw state of the fingerprint template on the Ethereum network in order to reduce cost and also prevent identity theft. This procedure is an improvement of previous systems. By adopting the method of template hashing, the proposed system is cost-effective and efficient. The experimental results depict that the proposed system secures the fingerprint template by encryption, hashing, and decentralization.
Open access
Biometric Identification and Security
Advanced Steganography and Watermarking Techniques
Marsha Chikita Intania Putri, Parman Sukarno, Aulia Arif Wardana
Authentication is a method for securing an account by verifying the user identity by inputting email with a password. Two factor authentications is an authentication system that combines the first-factor authentication with the second factor. General two factor authentication by entering an email or username with a password are similar. However, two factor authentication requires additional information that must be inputted by the user. Additional information can be in the form of tokens or one-time passwords (OTP). Two factor authentications generally still uses third-party services to generate token or OTP still have vulnerable because can attacked from tokens steal through MITM and found that the generated tokens with the same value. Therefore, we propose a two-factor authentication framework based on ethereum blockchain with dApp as token generation system. Firstly, outcome from the analysis of the system, next succeeded in creating a two-factor authentication system without using third-parties. Second, token system generate up to 3164 different tokens in one second and has been collisions tested. Third, security method to protect token from MITM attack. The attacker unable to get access caused all the checking are done by dApp user authentication.
In the emerging world of IoT applications, machines are going to be at the endpoints of the Internet engaging in complex Machine to Machine (M2M) communications. Be it a personal assistant (softbot)making an appointment with a doctor or an autonomous car filling fuel or charging at a refueling station, in the future, it is going to be M2M communications without human intervention. In such a scenario, robust and secure technology is essential to record every M2M transactions. This paper makes use of blockchain, a distributed ledger technology for intelligent transportation systems. It is proposed that blockchain networks such as Ethereum have the foundations to record and satisfy the transaction that has happened between the machines. A permissioned Ethereum blockchain the smart contract is used for recording each every transaction that come off between the car and electric station. An algorithm is proposed to recharge the autonomous electric vehicles as a case study.
Blockchain technology allows the formation of a distributed record of a digital event in a decentralized manner where no third-party controls data and related transactions. This technology was used early for value transfer but now it has a wide range of applications in various fields such as healthcare, banking, the internet of things and many more. In the education sector, it gives numerous chances for decentralized management of records in educational institutions. Certificates distributed in colleges or universities are mostly hard copy. Students submit these certificates while applying for jobs at public or private sectors, where all these certificates are needed to be verified manually, it is very time-consuming process. There can be incidents where students may produce the fake certificate and it is difficult to identify them. This problem of fake academic certificates has been a longstanding issue in the academic community. There are chances that some may have produce the certificate which is not legit and that may get unnoticed by the verifier during the verification process. Because of the above situation, ineligible candidate will get a chance illegally. The key issues in Certificate verification for Workplace, banks and other businesses are in storage, retrieval and access to data with security. Blockchain technology can be enforced to solve these troubles in storing and accessing of data. This technology provides a common shared platform from where to store, retrieve and access documents securely. The very nature of the technology is in the distributed, shared, open ledgers, verifiable by all. This problem can be solved by storing the digital certificates on the Blockchain.
With the evolving complexity of software systems, interest in software performance analysis has increasingly grown in recent years. Its main objective is to optimize software applications by analyzing its structure, behavior and dependencies, from design to code. Blockchain technologies, also known as distributed ledger technologies, have gained a lot of popularity in the recent years. Particularly the Ethereum blockchain, which apart from having its own cryptocurrency, is programmable. Meaning that developers can use it to create new decentralized applications which rely on smart contracts. Smart contracts are immutable computer programs that run deterministically in the context of the Ethereum Virtual Machine. The main purpose of this report is to explain the process of development of a tool to assist Ethereum developers to visually analyze static and dynamic behaviour of their smart contracts to improve their performance through optimizing gas usage.
Abstract Blockchain technology and Internet of Things technology are two new technologies formed in the current transmission of information technology. In the implementation of its technical control, it can scientifically control the information sharing work and realize the artificial adjustment of the transmission control of the Internet of Things technology. In this paper, research on the Internet of Things data sharing model based on block chain with a view to provide guidance to the security of Things data sharing technology under the block chain. In this paper, Hyperledger Fabric block chain platform-based platform, proposed a block-based chain of IOT data sharing model, security and data privacy is an enhancement, obtained by the performance of the test model. Throughput is maximized when the write transaction sending frequency is 100 TPS and the query transaction sending frequency is 250 TPS. The maximum write throughput is 60 TPS, which is better than Bitcoin and Ethereum on the public chain, which proves the feasibility of the model implementation. This model can achieve storage and sharing without the help of a third-party centralized organization, and directly establish trust between participants, which can ensure the safe sharing of data.
G Pazhev, Gr. Spasov, Mitko Shopov, Galidiya Petrova
Abstract The paper presents an implementation of a smart home architecture with two gateways based on collaboration of blockchain technology and Internet of Things (IoT) Message oriented middleware (MOM) architecture for management of internal home appliances. A basic overview of IoT MOM, MQTT (Message Queue Telemetry Transfer) protocol and blockchain architectures is made and the key characteristics and consensus algorithms are presented. Some challenges and the Ethereum smart contracts concept of the blockchain technology are discussed.
Open access
Blockchain Technology Applications and Security
IoT and Edge/Fog Computing
Advanced Steganography and Watermarking Techniques
Recently the blockchain technology has been actively studied due to its great potentiality. The smart contract is a key mechanism of the blockchain system. Due to the short history of the smart contract, many issues have not been solved yet. One main issue is vulnerability and another main issue is cost optimization. While the vulnerability of smart contract has been actively studied, the cost optimization has been rarely studied. In this paper, we propose two cost optimization methods for smart contracts running on the blockchain system. Triggering a function in a smart contract program code may require costs and it is repeated continuously. So the minimization of costs required to trigger a function of smart contract while maintaining the performance equally is very important. The proposed two methods minimize the usage of expensive permanent variables deployed on the blockchain system. We apply the proposed two methods to three prevalent blockchain platforms: Ethereum, Klaytn and Tron. Evaluation experiments verify that the proposed scheme significantly reduces the costs of functions in the smart contract written with Solidity.
Luca Foschini, Andrea Gavagna, Giuseppe Martuscelli, Rebecca Montanari
Hyperledger Fabric, created and supported by the Linux Foundation and IBM, is one of the most popular open-source blockchain permissioned platforms that has been already used in many industrial scenarios. One of the main characteristics of this platform is that it provides a smart contract system that relies on general-purpose languages instead of an ad hoc one. In fact, a chaincode in the Fabric platform (the equivalent of the Ethereum smart contract) is a software program which encapsulates the business logic for the creation and modification of logical assets in the ledger that can be written in different general-purpose programming languages (currently Java, Go, and Node.js). This paper analyses the transaction performance of the Fabric platform by identifying at a fine-grained degree level the factors that most contribute to the overall overhead. In particular, we focus on how the transaction latency is affected by the programming language adopted for implementing the chaincode and by varying the number of participating endorser peers. Finally, the paper shows a thorough test assessment aimed at evaluating the impact of the different chaincode implementation on performance overhead. As it emerges from our experimental results, Go is the most performing programming language.
Traditional paper certificates and electronic certificates have difficulties in preservation and management, not to mention other problems concerning inconvenient verification, poor reliability, anti-counterfeiting and anti-tampering. This paper proposes a scheme designed to build a decentralized certificate system that is based on blockchain technology and smart contract, in which a set of blockchain certificate system aiming at providing blockchain certificate services for college students' innovation and entrepreneurship competition is developed. In this system, certain functions of the certificate about management, issuing, verification and revocation are realized via smart contract. Signer information, certificate template and certificate information are stored in a smart contract that adopts structured data, thereby realizing more convenient callings in querying and validating certificate.
Open access
2 source records
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Mario R. Morales, Luis Rosero-Correa, Santiago Morales Cardoso
La implementación de nuevas tecnologías en cualquier tipo de institución surge de la necesidad de generar mejoras en los procesos que éstas realizan con el fin de ofrecer mejores productos y servicios. En este artículo se analiza la propuesta de factibilidad de una aplicación basada en la tecnología Blockchain y en los contratos inteligentes para reproducir el proceso de asignar títulos académicos a estudiantes sin necesidad de un ente central, terceras personas y procesos burocráticos mientras se aprovecha las características de estas tecnologías como la transparencia, la seguridad y la inmutabilidad. Así, se desarrolló dos contratos inteligentes complementarios entre sí aprovechando las características que existen actualmente para crear estructuras que representan objetos de la vida real y funciones que manejen estas estructuras como parámetros. Estos contratos se ejecutaron en un entorno virtualizado el que se simuló una cadena de bloques de Ethereum con el conjunto de herramientas de Truffle. Se evaluó los contratos inteligentes ingresando datos de prueba y con estos registros almacenados en la cadena de bloques se ejecutó el proceso de asignar los títulos académicos a los estudiantes a través de una función dentro del contrato inteligente principal. Para validar que el proceso se ejecutó correctamente, se realizó consultas a la cadena de bloques y se verificó que los registros de asignaciones de títulos se generaron y almacenaron en la cadena de bloques con éxito. De esta manera se pudo concluir que es factible el modelo propuesto basado en tecnología blockchain y contratos inteligentes.
Pınar Kaya Soylu, Mustafa Okur, Özgür Çatıkkaş, Ayca Altintig
This paper examines the volatility of cryptocurrencies, with particular attention to their potential long memory properties. Using daily data for the three major cryptocurrencies, namely Ripple, Ethereum, and Bitcoin, we test for the long memory property using, Rescaled Range Statistics (R/S), Gaussian Semi Parametric (GSP) and the Geweke and Porter-Hudak (GPH) Model Method. Our findings show that squared returns of three cryptocurrencies have a significant long memory, supporting the use of fractional Generalized Auto Regressive Conditional Heteroscedasticity (GARCH) extensions as suitable modelling technique. Our findings indicate that the Hyperbolic GARCH (HYGARCH) model appears to be the best fitted model for Bitcoin. On the other hand, the Fractional Integrated GARCH (FIGARCH) model with skewed student distribution produces better estimations for Ethereum. Finally, FIGARCH model with student distribution appears to give a good fit for Ripple return. Based on Kupieck’s tests for Value at Risk (VaR) back-testing and expected shortfalls we can conclude that our models perform correctly in most of the cases for both the negative and positive returns.
Ferenc Béres, István András Seres, András A. Benczúr, Mikerah Quintyne-Collins
Ethereum is the largest public blockchain by usage. It applies an account-based model, which is inferior to Bitcoin's unspent transaction output model from a privacy perspective. Due to its privacy shortcomings, recently several privacy-enhancing overlays have been deployed on Ethereum, such as non-custodial, trustless coin mixers and confidential transactions. In our privacy analysis of Ethereum's account-based model, we describe several patterns that characterize only a limited set of users and successfully apply these quasi-identifiers in address deanonymization tasks. Using Ethereum Name Service identifiers as ground truth information, we quantitatively compare algorithms in recent branch of machine learning, the so-called graph representation learning, as well as time-of-day activity and transaction fee based user profiling techniques. As an application, we rigorously assess the privacy guarantees of the Tornado Cash coin mixer by discovering strong heuristics to link the mixing parties. To the best of our knowledge, we are the first to propose and implement Ethereum user profiling techniques based on quasi-identifiers. Finally, we describe a malicious value-fingerprinting attack, a variant of the Danaan-gift attack, applicable for the confidential transaction overlays on Ethereum. By incorporating user activity statistics from our data set, we estimate the success probability of such an attack.
Oliver James Scholten, David Zendle, James Alfred Walker
Decentralised gambling applications are a new way for individuals to engage in online gambling. Decentralised gambling applications are distinguished from traditional online casinos in that individuals use cryptocurrency as a stake. Furthermore, rather than being stored on a traditional server, decentralised gambling applications are stored on a cryptocurrency’s blockchain.Previous work in the player behaviour tracking literature has examined the spending profiles of gamblers on traditional online casinos. However, parallel work has not taken place in the decentralised gambling domain. The profile of gamblers on decentralised gambling applications are therefore not known.This paper explores 2,232,741 transactions from 24,234 unique addresses to three such applications operating atop the Ethereum cryptocurrency network over 583 days. We present spending profiles across these applications, providing the first detailed summary of spending behaviours in this technologically advanced domain. We find that the typical user spends approximately \$110 equivalent across a median of 6 bets in a single day, although heavily involved bettors spend approximately \$100,000 equivalent over a median of 644 bets across 35 days. Our findings suggest that the use of decentralised gambling applications typically involves lower and less frequent expenditures than other online casinos, but that the most heavily involved players in this new domain spend substantially more. Our findings also demonstrate the use of these applications as a research platform, specifically for large scale longitudinal in-vivo data analysis.
This paper proposes a real-time chain and a novel embedded Markovian queueing model with variable bulk arrival (VBA) and variable bulk service (VBS) in order to establish and assure a theoretical foundation to design a blockchain-based real-time system with particular interest in Ethereum. Based on the proposed model, various performances are simulated in a numerical manner in order to validate the efficacy of the model by checking good agreements with the results against intuitive and typical expectations as a baseline. A demo of the proposed real-time chain is developed in this work by modifying the open source of Ethereum Geth 1.9.11. The work in this paper will provide both a theoretical foundation to design and optimize the performances of the proposed real-time chain, and ultimately address and resolve the performance bottleneck due to the conventional block-synchrony by employing an asynchrony by the real-time deadline to some extent.
Proof-of-Work~(PoW) based blockchains typically allocate only a tiny fraction (e.g., less than 1% for Ethereum) of the average interarrival time~($\mathbb{I}$) between blocks for validating transactions. A trivial increase in validation time~($τ$) introduces the popularly known Verifier's Dilemma, and as we demonstrate, causes more forking and increases unfairness. Large $τ$ also reduces the tolerance for safety against a Byzantine adversary. Solutions that offload validation to a set of non-chain nodes (a.k.a. off-chain approaches) suffer from trust issues that are non-trivial to resolve. In this paper, we present Tuxedo, the first on-chain protocol to theoretically scale $τ/\mathbb{I} \approx 1$ in PoW blockchains. The key innovation in Tuxedo is to separate the consensus on the ordering of transactions from their execution. We achieve this by allowing miners to delay validation of transactions in a block by up to $ζ$ blocks, where $ζ$ is a system parameter. We perform security analysis of Tuxedo considering all possible adversarial strategies in a synchronous network with end-to-end delay $Δ$ and demonstrate that Tuxedo achieves security equivalent to known results for longest chain PoW Nakamoto consensus. Additionally, we also suggest a principled approach for practical choices of parameter $ζ$ as per the application requirement. Our prototype implementation of Tuxedo atop Ethereum demonstrates that it can scale $τ$ without suffering the harmful effects of naive scaling in existing blockchains.
Atomic Crosschain Transaction technology allows composable programming across permissioned Ethereum blockchains. It allows for inter-contract and inter-blockchain function calls that are both synchronous and atomic: if one part fails, the whole call graph of function calls is rolled back. This paper analyses the processing overhead of using this technique compared to using multiple standard non-atomic single blockchain transactions. The additional processing is analysed for three scenarios involving multiple blockchains: the Hotel - Train problem, Supply Chain with Provenance, and an Oracle. The technology is shown to reduce the performance of Hyperledger Besu from 375 tps to 39.5 tps if all transactions are instigated on one node, or approaching 65.2 tps if the transactions are instigated on a variety of nodes, for the Hotel-Train scenario.
The Layer 2 Atomic Cross-Blockchain Function Calls protocol allows composable programming across Ethereum blockchains. It allows for inter-contract and inter-blockchain function calls that are both synchronous and atomic: if one part fails, the whole call graph of function calls is rolled back. Existing atomic cross-blockchain function call protocols are Blockchain Layer 1 protocols, which require changes to the blockchain platform software to operate. Blockchain Layer 2 technologies such as the one described in this paper require no such changes. They operate on top of the infrastructure provided by the blockchain platform software. This paper introduces the protocol and a more scalable variant, provides an initial safety and liveness analysis, and presents the expected overhead of using this technology when compared to using multiple non-atomic single blockchain transactions. The overhead is analysed for three scenarios involving multiple blockchains: the Hotel and Train problem, Supply Chain with Provenance, and an Oracle. The protocol is shown to provide 93.8 or 186 cross-blockchain function calls per second for the Hotel and Train scenario when there are many travel agencies, for the standard and scalable variant of the protocol respectively, given the Ethereum client, Hyperledger Besu's performance of 375 tps, assuming a block period of one second, and assuming all transactions take the same amount of time to execute as the benchmark transactions.