This thesis presents a generalised comprehensive framework for evaluating anonymity of cryptocurrency schemes. The framework was developed using security modelling with emphasis on a wide range of factors affecting anonymity, irrespective of the underlying implementation. The case studies presented in the thesis demonstrate how this framework facilitates the evaluation of anonymity of different cryptocurrencies in a standardised manner and the analysis of these findings reveals the complexity of the notion of anonymity.
While distributed databases offer great promise their decentralized nature poses a number of security and privacy issues. In what ways can parties misbehave? If a database is truly distributed can a malicious actor hide their misdeeds by presenting conflicting views of the database? Can we overcome such deceit and either prevent it by eliminating trust assumptions or detect such perfidy and hold the malicious party to account? We study these questions across two distributed databases: RPKI (Resource Public Key Infrastructure), which is used to authenticate the allocation and announcement of IP prefixes; and Bitcoin, a cryptocurrency that utilizes a permissionless database called a blockchain to track the transfer and ownership of bitcoins. The first part of this dissertation focuses on RPKI and the potential of RPKI authorities to misbehave. We consider the methods, motivations, and impact of this misbehavior and how an RPKI authority can present inconsistent views to hide this misbehavior. After studying the problem we propose solutions to detect and identify such misbehavior. Now we turn our attention to Bitcoin. We look at ways an attacker can manipulate Bitcoin's Peer-to-Peer network to cause members of the network to have inconsistent views of Bitcoin's blockchain and subvert Bitcoin's core security guarantees. We then propose countermeasures to harden Bitcoin against such attacks. The final part of this dissertation discusses the problem of privacy in Bitcoin. Many of the protocols developed to address Bitcoin's privacy limitations introduce trusted parties. We instead design privacy enhancing protocols that use an untrusted intermediary to mix \aka anonymize, bitcoin transactions via blind signatures. To do this we must invent a novel blind signature fair-exchange protocol that runs on Bitcoin's blockchain. This dissertation favors a dirty slate design process. We work to layer protections on existing protocols and when we must make changes to the underlying protocol we carefully weigh compatibility and deployment considerations. This philosophy has resulted in some of the research described in this dissertation influencing the design of deployed protocols. In the case of Bitcoin our research is currently used to harden a network controlling approximately a trillion dollars.
Adeeba Naaz, T. V. Pavan Kumar B, Maria Francis, Kotaro Kataoka
Authentication while maintaining anonymity when availing a service over the internet is a significant privacy challenge. Anonymous credentials (AC) address this by providing the user with a credential issued by a trusted entity that convinces the service provider (SP) that the user is authenticated but reveals no other information. The existing AC schemes assume a single trusted authority (certifier) that validates all the user attributes. In practice, however, a user may require different attributes to be attested by different certifiers. This means that the user has to get multiple credentials, increasing the burden on theSPwho has to verify each one of them. Moreover, complete anonymity can be misused. We propose adecentralized threshold revocable anonymous credential (DTRAC)scheme over blockchains that supports ā a) attestation of attributes by multiple certifiers, and b) anonymity revocation through a set of distributed openers, by integrating threshold opening to the state-of-the-art threshold anonymous credential issuance scheme, Coconut [34]. DTRAC generates a single credential on attributes that are attested by multiple certifiers, freeing the SP from the hassle of verifying multiple credentials. We analyze the security of DTRAC formally in the universal composability (UC) framework. We also implement a prototype on Ethereum using smart contracts and give a detailed analysis of its performance.We compare the verification time for credentials with attributes attested by multiple certifiers in both DTRAC and Coconut and see that in terms of execution time and gas consumption, DTRAC performs significantly better than Coconut. It also scales better, with the performance gain of DTRAC over Coconut increasing linearly with the number of certifiers.
Blockchain technology is known as a decentralized, distributed ledger that records digital asset. It has been applied in numbers of aspects of society, including finance, judiciary and commerce. Ethereum is referred to as the next generation decentralized application platform. It is one of the most popular blockchain platforms that supports smart contracts. Smart contract is a set of codes that sored on blockchain and can be called and created as turing-complete programs running on the blockchain. Developers use smart contracts to build decentralized applications (Dapp) which has widely used cryptocurrency related project. As smart contracts become more popular and more valuable, they are faced with more risk of being hacked. As a result that smart contracts cannot be modified once deployed on the blockchain, it is a great challenge to fix and update deployed vulnerable contract which can lead to a huge loss of cryptocurrency and financial disorder. In this paper, we focus on Integer Bugs in Ethereum Smart Contracts and present ISmart, which protects deployed smart contracts against attacks caused by Integer Bugs. We implemented ISmart based on go-ethereum, a Ethereum client written in Go, by adding a simplified taint analysis component. In our preliminary, ISmart can prevent attacks accurately with little runtime overhead.
Open access
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
In this paper, a variety of cloud service combinations is used to form the control core of a smart home, realize data forwarding, storage, and analysis in the cloud, and complete the remote management of smart home devices. This paper studies the secure access control of smart home data combined with the blockchain technology and password technology to realize the secure and efficient access control of smart home data. The system can achieve the goal of independent research and development. Aiming at the problem that the access control of a smart home is generally managed by thirdāparty authorized institutions and there is an unauthorized access, a blockchainābased smart home (BSH) access control scheme is proposed. The scheme extends the attributeābased access control model (ABAC) and applies the blockchain technology to the smart home ABAC model to realize fineāgrained access control. In the scheme, the resource provider first publishes the access control policy of the resource to the blockchain. If the resource visitor wants to access the resource, he needs to submit an access request to the blockchain and use an SM2 threshold signature to process the transaction proposal. The endorsement peer node in the blockchain runs the access control policy smart contract to decide whether to grant access rights. This scheme can ensure that resource providers can participate in all the processes of access control and avoid the risk of unauthorized access caused by the centralized management of the third party. Finally, the simulation experiment is carried out on the Hyperledger Fabric alliance chain development platform. The results show that the BSH access control scheme has good applicability in the smart home scenario.
Elham Shammar, Ammar T. Zahary, Asma A. Al-Shargabi
The Internet of Things (IoT) is emerging from its infancy and establishing itself as a component of the future Internet. However, the ability to manage a huge number of IoT devices is one of the IoT technical challenges. To implement access control, traditional schemes typically rely on a trusted central organization. Traditional centralized access control systems of the IoT lead to the shortcomings of a single point of failure, low overall system efficiency, and ethical and privacy issues. To overcome such challenges, an attributeābased access control model using Hyperledger Fabric blockchain (ABACāHLFBC) is proposed in this paper. By adopting ABAC, it is no longer to create access control lists (ACLs) or assign roles to all system users. Instead, ABAC grants access based on the attributes presented by the target. No one is permitted access unless he/she possesses sufficient attributes that correspond to the access policy. The Hyperledger Fabric Raft consensus mechanism has been used to verify the transaction on the proposed model because it has a demanding feature for faster and less complicated consensus in comparison to the Kafka ordering service. To evaluate the proposed model, it has been tested against the most recent previous work, called fabricāiot model. The proposed model has been tested and evaluated in two parts. The first part tests the cost time using a client test program written in Golang. The second part tests the latency and throughput using the Hyperledger Caliper benchmark tool. Results show that the proposed model efficiently outperforms the previous work in terms of the performance metrics mentioned above.
Rongyu Xiao, Guozi Sun, Jiale Yang, Yao Wang Ā· 5 authors
Public chains represented by Bitcoin and Ethereum do not require users to use their real names, and transaction data are open to the whole network. Analysed based on this, researchers have achieved the deanonymization of blockchain transactions to a certain extent. Based on the existing blockchain transaction privacy protection scheme, the true link relationship between the transaction sender and receiver is hidden, which brings difficulties to regulation. In this paper, we propose a cryptocurrency mixing service RBSmix, which allows users to reestablish their financial privacy in Bitcoin and related cryptocurrencies. RBSmix, through blind signature to prevent attackers from linking input and output addresses, by the threshold secret sharing algorithm, encryption technology, and a regulation team, combined with the idea of voting, tracks the source of funds for illegal addresses. Experiments show that the scheme scales to large numbers of users and can provide users with better privacy protection.
Blockchain is a distributed system that confirms security and reliability. It has started a new era of a solid and consensus system. Because of blockchain's emphasis on security, many other operations and processes are adopting the same reliable approach. Almost all processes and operations are now encouraged to be computed electronically in the digital Ethereum network that has been presented. In the current situation, we have seen what the conduction of elections has done to the worsening situation of the Covid-19 Pandemic. The proposed system uses an Ethereum network on a blockchain platform to implement a college voting system, making use of the Aadhar API. E-voting will help to support transparency and voters' trust to reduce corruption and unreliability in the voting processes. The use of this system will allow a voter to vote from home while also having the assurity that this process is completely secure and reliable due to the use of blockchain technology.
The development of fifthāgeneration (5G) mobile communication technology has become a major driver to the growth of Internet of Things (IoT) applications. As a promising networking paradigm, softwareādefined networking (SDN) makes IoT more flexible and agile by decoupling control plane from data plane. With a large number of heterogeneous devices accessing to the network, we need to divide the network into several domains and each domain is managed by an SDN controller. Controllers share topologies with each other to form global view of the entire network, which is used for crossingādomain path routing. However, crossingādomain routing requires global trust between multiple controllers. The reason is that if the malicious controller shares misleading topologies, the rest of controllers may calculate mistaken crossingādomain paths. As a result, packets are forwarded to the domain that is managed by the malicious controller and dropped deliberately, which is known as the blackāhole attack. To this end, we present a blockchainābased architecture to ensure secure routing among multiple domains in SDNāenabled IoT networks. All SDN controllers are equipped with blockchains, and they upload abstract topologies to the blockchain via the smart contract. Thus, the genuine view of the entire network can be gained from the blockchain due to its consensus and immutability. In addition, we use the concept of reputation that consists of the local reputation and the global reputation to further protect routing reliability, and the global reputation is reserved in the blockchain. Compared with benchmark architectures, the emulation results show that our proposed method can effectively build trust between multiple controllers and ensure secure routing among multiple domains.
The Internet of Things (IoT) is an information carrier based on the Internet and traditional telecommunications networks. Access control is an important part of the service architecture, which can effectively solve the security issues in IoT. Therefore, many solutions adopt the access control to solve some security problems. However, these existing solutions cannot easily deploy access control in the IoT. As a decentralized, non-tamperable, and highly credible distributed ledger technology, blockchain is in line with the current trend of network development. To improve the transparency, non-tampering of the access control process and traceability and auditability of access flow changes, we propose a blockchain-based access control scheme for the IoT, which uses a combination of on-chain and off-chain to reduce the storage pressure of the blockchain. On the one hand, we deploy policy decision points (PDP) and other components on the smart contract in the form of chain code to better judge and execute decision-making. On the other hand, we put policy administration points (PAP) in the off-chain organization to reduce the storage pressure of the blockchain and make better access flow transformation and traceability. Ultimately, we concluded through feasibility analysis that our solution can maintain high throughput in a large-scale transaction volume environment.
Valeh Farzaliyev, Jan Willemson, Jaan Kristjan Kaasik
Abstract Mixānetworks were first proposed by Chaum in the late 1970sāearly 1980s as a general tool for building anonymous communication systems. Classical mixānet implementations rely on standard public key primitives (e.g., ElGamal encryption) that will become vulnerable when a sufficiently powerful quantum computer will be built. Thus, there is a need to develop quantumāresistant mixānets. This article focuses on the application case of electronic voting where the number of votes to be mixed may reach hundreds of thousands or even millions. We propose an improved architecture for latticeābased postāquantum mixānets featuring more efficient zeroāknowledge proofs while maintaining established security assumptions. Our current implementation scales up to 100,000 votes, still leaving a lot of room for future optimisation.
As the most successful cryptocurrency, bitcoin has become the primary target of attackers. The security risks existing in bitcoin network (P2P networks) may pose serious threats to itself. It has been proved that network attackers of the autonomous system level could isolate a specific set of bitcoin nodes using prefix hijacking attacks; since this attack achieves bitcoin partition by deleting all data packets of the victim node, it is easy to be discovered by the victim node, and cannot maintain a longāterm connection (the partition will disappear after canceling the BGP hijacking) (Apostolaki M et al. (2017)). This paper proposes a new attack schemeāeclipse attack method based on BGP hijacking (BHE). The attack can occupy the network connection of the victim node, and only need to delete part of the TCP handshaking packets of the victim node during the attack, and it makes the attack more hidden and can occupy the network connection of the victim node for a long time. The innovation of the BHE attack is that it can control the peering decision of the victim node by controlling the victim nodeās internal peer database (new table and tried table) and preventing the victim node from establishing a good connection. It enables the attacker to occupy all network connections of the victim node and become its natural network middleman. We verify the feasibility of the BHE attack through experimental evaluation and demonstrate that an attacker who can launch BGP hijacking may occupy all connections of the victim node within 20 minutes (ignoring the time of traffic diversion). To reduce the attackās impact, the paper provides some countermeasures that can use in practice according to the basic characteristics of the attack.
Bitcoin is the most widely used cryptocurrency for illegal trade in current darknet markets. Owing to the anonymity of its addresses, even though transaction flows are globally visible, Bitcoin clustering remains one of the most challenging and open problems in illegal Bitcoin transaction analysis. In this article, to resolve this problem, we propose a novelmulti-layer heuristicalgorithm for Bitcoin clustering, which leverages on-chain transactions as well as off-chain application data in the real world. For this purpose, we first explored the unique characteristics of darknet market ecosystems including their trading systems. By conducting an in-depth analysis of the data manually collected for 11 months, we found that some darknet market review data disclosed transactions containing Bitcoin value and item delivery information. We then identified unique Bitcoin addresses associated with the disclosed information, owned by the same darknet providers. Based on address ownership, more accurate market clusters could be created, which have not previously been identified by other clustering algorithms. According to our experimental results, approximately 31.68% of the darknet market review data matched real Bitcoin transactions, and 122 hidden clusters associated with Silk Road 4 were found. This indicates that the proposed algorithm can complement existing clustering methods and significantly reduce the false negative rate by up to 91.7%.
Purpose: Bitcoin, the most prominent among cryptocurrencies, is a peer-to-peer (āP2Pā) electronic currency and payment system used based on mutual trust. The study aims to measure awareness of Bitcoin, which has recently become popular among investors with its rapidly increasing use. To this end, a questionnaire was applied to the participants to evaluate their opinions and preferences regarding Bitcoin. With this purpose in mind, a questionnaire was applied to the academics of Erzincan Binali Yıldırım University in Turkey. Methodology: In the process of analysing the obtained data, frequency analysis and the chi-square test method were used by using the SPSS 26.0 software package. Results: According to the results of the study, it was observed that 51.6% of the academics (159 persons) had knowledge of Bitcoin, and while 31.5% of the academics participating in the study (97 persons) considered they would buy Bitcoin within five years, 57% (176 persons) conceived the use of Bitcoin would increase within ten years. Despite all these positive attitudes, it was also observed that 45.5% (140 people) considered Bitcoin as unreliable and 51.6% (159 persons) would prefer gold instead of using Bitcoin. As for the opinion of academics, it was concluded that gold and other different investment tools would be preferred instead of Bitcoin despite its increasing use. Conclusion: This research is important as it is the first research study in the field, which means that no similar study has been conducted in Turkey before, and it is thus expected to greatly contribute to the literature within the context of the importance and originality of the study.
Muhammad Shoaib Farooq, Usman Iftikhar, Adel Khelifi
A widespread mistrust towards the traditional voting system has made democratic voting in any country very critical. People have seen their fundamental rights being violated. Other digital voting systems have been challenged due to a lack of transparency. Most voting systems are not transparent enough; this makes it very difficult for the government to gain voters’ trust. The reason behind the failure of the traditional and current digital voting system is that it can be easily exploited. The primary objective is to resolve problems of the traditional and digital voting system, which include any kind of mishap or injustice during the process of voting. Blockchain technology can be used in the voting system to have a fair election and reduce injustice. The physical voting systems have many flaws in it as well as the digital voting systems are not perfect enough to be implemented on large scale. This appraises the need for a solution to secure the democratic rights of the people. This article presents a platform based on modern technology blockchain that provides maximum transparency and reliability of the system to build a trustful relationship between voters and election authorities. The proposed platform provides a framework that can be implemented to conduct voting activity digitally through blockchain without involving any physical polling stations. Our proposed framework supports a scalable blockchain, by using flexible consensus algorithms. The Chain Security Algorithm applied in the voting system makes the voting transaction more secure. Smart contracts provide a secure connection between the user and the network while executing a transaction in the chain. The security of the blockchain based voting system has also been discussed. Additionally, encryption of transactions using cryptographic hash and prevention of attack 51% on the blockchain has also been elaborated. Furthermore, the methodology for carrying out blockchain transactions during the process of voting has been elaborated using Blockchain Finally, the performance evaluation of the proposed system shows that the system can be implemented in a large-scale population.
Ali Benabdallah, Antoine Audras, Louis Coudert, Nour El Madhoun Ā· 5 authors
Today, the abstention rate continues to rise, largely due to the need to travel to vote. This is why remote e-voting will increase the turnout by allowing everyone to vote without the need to travel. It will also minimize the risks and obtain results in a faster way compablack to a traditional vote with paper ballots. In fact, given the high stakes of an election, a remote e-voting solution must meet the highest standards of security, reliability, and transparency to gain the trust of citizens. In literature, several remote e-voting solutions based on blockchain technology have been proposed. Indeed, the blockchain technology is proposed today as a new technical infrastructure for several types of IT applications because it allows to remove the TTP and decentralize transactions while offering a transparent and fully protected data storage. In addition, it allows to implement in its environment the smart-contracts technology which is used to automate and execute agreements between users. In this paper, we are interested in reviewing the most revealing e-voting solutions based on blockchain technology.
Open access
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Over the last decade, Bitcoin has revolutionized the global economic and technological landscape, inspiring a new generation of blockchain-based technologies. Its protocol is today among the most influential for cryptocurrencies and distributed networks. In particular, the P2P layer represents a reference point for all permissionless blockchains, which often implement its solutions in their network layer. Unfortunately, the Bitcoin network protocol lacks a strong security model, leaving it exposed to several threats. Attacks at this level can affect the reliability and trustworthiness of the consensus layer, mining the credibility of the whole system. It is therefore of utmost importance to properly understand and address the security of the Bitcoin P2P protocol. In this paper, we give a comprehensive and detailed overview of known network-level attacks in Bitcoin, as well as the countermeasures that have been implemented in the protocol. We propose a generic network adversary model, and propose an objective-based taxonomy of the attacks. Finally, we identify the core weaknesses of the protocol and study the relationship between different types of attack. We believe our contribution can help both new and experienced researchers have a broader and deeper understanding of the Bitcoin P2P network and its threats, and allow for a better modeling of its security properties.
With the rapid development of Non-Fungible Token (NFT) market, various types of digital artwork are published via NFT in recent years for sale. In the current NFT system, ownerās address of each NFT is stored in plaintext. This leads to a severe privacy problem: once a personās blockchain address is known, all his NFT assets are viewable, which may further cause problems related to the privacy of holding sensitive NFT or premeditated scams to high-value NFT owners. However, due to the limitation of Ethereum and smart contract, it is hard to prevent others from tracking the owner of NFT. Meanwhile, current state-of-the-art NFT research usually assumes the relation between blockchain address and ownerās identity is unknown, thus creating theso-called anonymity. In this paper, based on the most popular NFT marketplace OpenSeaās system, we propose a new exchange scheme to hides the address of NFT owner during trading. To achieve our goal, a proof of commitment scheme is exploited to bind the owner to an NFT while hiding the identity. Moreover, An anonymous payment method is designed to prevent attackers from tracing the Ether flow in NFT trading. Our scheme is proven to be secure against curious users and malicious active attackers. Implementation on testnet also shows that the increased gas cost is acceptable, meaning it is suitable for application.
Open access
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Abstract We proxy retail investor attention through Google Trends and find that fungible and non-fungible crypto tokens generate greater attention from high-gambling propensity regions. Crypto attention is higher during bubble-like episodes in the crypto market and for more lottery-like tokens. Moreover, retail crypto attention decreases after sports gambling is legalized. Higher token attention is associated with more contributors and higher fundraising. However, consumer credit default rates spike after periods of high crypto attention, but solely in the subprime segment. Overall, our findings suggest that gambling preferences strongly predict retail investor interest in the crypto market.
The development of Web3 ā a stack of decentralised technologies underpinned by blockchains ā isnāt simply a technical or financing challenge, it is also a problem of innovation and entrepreneurial discovery. In this paper we apply the lens of user innovation toolkit theory to the development of Web3. Toolkits are an organizational design solution to an innovation problem with sticky and local information. Our aim is to explore how toolkits theory applies to Web3 innovation, proposing that Web3 innovation is being organized through toolkits (e.g., blockchains, token standards, DAO frameworks) that enable efficient organization of sticky information to facilitate innovation. The contribution of this paper is the first application of toolkits theory to Web3, reframing its development as a problem of entrepreneurship and innovation in the context of distributed information. We provide implications for the role of developers as user innovators, the economic problem of emergent toolkit stacking, and the design of toolkit business models.
Yujia Tang, Chang Xu, Can Zhang, Yan Wu Ā· 5 authors
Abstract Tornado Cash, the most popular non-custodial coin mixer on Ethereum, is widely used to protect the privacy of addresses. However, some inappropriate transaction behaviors in Tornado Cash mixing mechanism lead to the risk of privacy leakage. More specifically, the malicious attackers can link multiple addresses of the same users according to the transaction data. Motivated by the above problem, this paper systematically analyzes the privacy issues of Tornado Cash for the first time. In this paper, we give the macroscopic analysis of Tornado Cash based on the on-chain data and formalize two types of transaction patterns. Focus on the presented transaction patterns, we propose three heuristic clustering rules to link the usersā addresses, which reduce the size of usersā anonymity set. Finally, we perform the experiment on real Tornado Cash transaction data to describe the effectiveness of the proposed clustering rules.