Zhipeng Gao, Lingxiao Jiang, Xin Xia, David Lo · 5 authors
Smart contracts have been increasingly used together with blockchains to automate financial and business transactions. However, many bugs and vulnerabilities have been identified in many contracts which raises serious concerns about smart contract security, not to mention that the blockchain systems on which the smart contracts are built can be buggy. Thus, there is a significant need to better maintain smart contract code and ensure its high reliability. In this paper, we propose an automated approach to learn characteristics of smart contracts in Solidity, which is useful for clone detection, bug detection and contract validation on smart contracts. Our new approach is based on word embeddings and vector space comparison. We parse smart contract code into word streams with code structural information, convert code elements (e.g., statements, functions) into numerical vectors that are supposed to encode the code syntax and semantics, and compare the similarities among the vectors encoding code and known bugs, to identify potential issues. We have implemented the approach in a prototype, named SmartEmbed,11.The anonymous replication packages can be accessed at:https://drive.google.com/file/d/1kauLT3y2IiHPkUlVx4FSTda-dVAyL4za/view?usp=sharing.and evaluated it with more than 22,000 smart contracts collected from the Ethereum blockchain. Results show that our tool can effectively identify many repetitive instances of Solidity code, where the clone ratio is around 90 percent. Code clones such as type-III or even type-IV semantic clones can also be detected accurately. Our tool can identify more than 1000 clone related bugs based on our bug databases efficiently and accurately. Our tool can also help to efficiently validate any given smart contract against a known set of bugs, which can help to improve the users’ confidence in the reliability of the contract.
The state-of-the-art approach to manage blockchains is to process blocks of transactions in a shared-nothing environment. Although blockchains have the potential to provide various services for high-performance computing (HPC) systems, HPC will not be able to embrace blockchains before the following two missing pieces become available: (i) new consensus protocols being aware of the shared-storage architecture in HPC, and (ii) new fault-tolerant mechanisms compensating for HPC's programming model---the message passing interface (MPI)---that is vulnerable for blockchain-like workloads. To this end, we design a new set of consensus protocols crafted for the HPC platforms and a new fault-tolerance subsystem compensating for the failures caused by faulty MPI processes. Built on top of the new protocols and fault-tolerance mechanism, a prototype system is implemented and evaluated with two million transactions on a 500-core HPC cluster, showing $6\times$, $12\times$, and $75\times$ higher throughput than Hyperldeger, Ethereum, and Parity, respectively.
Katarina Preikschat, Moritz Böhmecke‐Schwafert, Jan‐Paul Buchwald, Carolin Stickel
Summary Blockchain technology has the potential to bring transparency and trust to a multitude of use cases. Our research demonstrates that the technology can reduce asymmetric information in markets by bridging trust gaps. The combination of blockchain and Internet of Things technology that automatically collects sensor data, provides a feasible, decentralized technological solution for such an inefficient “Market of Lemons” coined by nobel laureate Georg Akerlof. In this paper, we develop a system prototype to reduce mileage fraud on the used car markets. Our work demonstrates the feasibility of a trusted system of records for (vehicle) data such as mileage data using a distributed database based on the public Ethereum network and smart contracts. We have identified eight requirements that are fulfilled by the prototype and the functional logic and design of thesolution can be reproduced to any other application area characterized by a lack of trust between actors or by the absence of a trusted central authority. However, the developed prototype suffers from similar limitations and challenges as the technology itself. Low throughput causes limitations in scalability and transaction costs are unpredictable. Further development of the blockchain technology and considering more cost‐efficient consensus mechanisms will address these issues.
In the area of blockchains, a wallet is anything that manages the access to cryptocurrencies and tokens. Off-chain wallets appear in different forms, from paper wallets to hardware wallets to dedicated wallet apps, while on-chain wallets are realized as smart contracts. Wallet contracts are supposed to increase trust and security by being transparent and by offering features like daily limits, approvals, multiple signatures, and recovery mechanisms. The most prominent platform for smart contracts in general and the token ecosystem im particular, and thus also for wallet contracts is Ethereum. Our work aims at a better understanding of wallet contracts on Ethereum, since they are one of the most frequently deployed smart contracts. By analyzing source code, bytecode, and execution traces, we derive usage scenarios and patterns. We discuss methods for identifying wallet contracts in a semi-automatic manner by looking at the deployed bytecodes and the on-chain interaction patterns. We extract blueprints for wallets and compile a ground truth. Furthermore, we differentiate characteristics of wallets in use, and group them into six types. We provide numbers and temporal perspectives regarding the creation and use of wallets. For the 40 identified blueprints, we compile detailed profiles. We analyze the data of the Ethereum main chain up to block 11,500,000, mined on December 22, 2020.
Electronic Health Records (EHRs) have improved many aspects of healthcare and allowed for easier patient management for medical providers. Blockchains have been proposed as a promising solution for supporting Electronic Health Records (EHRs), but have also been linked to scalability concerns about supporting real-world healthcare systems. This paper quantifies the scalability issues and bottlenecks related to current blockchains and puts into perspective the limitations blockchains have with supporting healthcare systems. Particularly we show that well known blockchains such as Bitcoin, Ethereum, and IOTA cannot support transactions of a large scale hospital system such as the University of Kentucky HealthCare system and leave over 7.5M unsealed transactions per day. We then discuss how bottlenecks of blockchains can be relieved with sidechains, enabling well-known blockchains to support even larger hospital systems of over 30M transactions per day. We then introduce the Patient-Healthchain architecture to provide future direction on how scaling blockchains for EHR systems with sidechains can be achieved.
Ethereum is one of the most popular blockchain systems that supports more than half a million transactions every day and fosters miscellaneous decentralized applications with its Turing-complete smart contract machine. Whereas it remains mysterious what the transaction pattern of Ethereum is and how it evolves over time. In this paper, we study the evolutionary behavior of Ethereum transactions from a temporal graph point of view. We first develop a data analytics platform to collect external transactions associated with users as well as internal transactions initiated by smart contracts. Three types of temporal graphs, user-to-user, contract-to-contract and user-contract graphs, are constructed according to trading relationship and are segmented with an appropriate time window. We observe a strong correlation between the size of user-to-user transaction graph and the average Ether price in a time window, while no evidence of such linkage is shown at the average degree, average edge weights and average triplet closure duration. The macroscopic and microscopic burstiness of Ethereum transactions is validated. We analyze the Gini indexes of the transaction graphs and the user wealth in which Ethereum is found to be very unfair since the very beginning, in a sense, "the rich is already very rich".
The information systems of decentralized organizations are now networked as components of a global information system. Organizations, individuals and software act autonomously and are at the same time cooperatively involved in the creation of services. The planning and execution of the necessary interactions in the form of processes are not under the control of individuals. For the development and execution of processes under decentralized coordination, this work proposes an approach based on blockchain technologies. This addresses, on the one hand, the design of decentralized organizations and, on the other hand, the coordination of development that is distributed within such systems and is not centrally controlled. The thesis describes the decentralization and the model-based development of process-oriented systems from an organizational theory perspective. The focus is then on decentralized blockchain systems as development and execution platforms, with which the binding nature and integrity of transactions between a priori unknown nodes of a network can be guaranteed. The development and execution of processes are implemented on this basis using a model-based approach. This is established by an architectural framework for conceptual modeling, for cooperative modeling and for the tracking of instances. The conceptual modeling of networks, processes and instances makes use of the semantic object model (SOM) in order to map the task level of decentralized organizations to a decentralized task management level. The cooperative modeling and the tracking of instances use technologies for distributed version management in connection with smart contracts of the blockchain system Ethereum. The demonstration of the applicability of the approach based on a case study and a software implementation concludes the work.
Investigation of the security of the Ethereum Ropsten test network in connection with the Echosafe application used to record verbal contracts developed by Blocksafe Kft
Open access
Hungarian Social, Economic and Educational Studies
The challenge of automatically determining the correctness of test executions is referred to as the test oracle problem and is one of the key remaining issues for automated testing. The goal in this paper is to solve the test oracle problem in a way that is general, scalable and accurate. To achieve this, we use supervised learning over test execution traces. We label a small fraction of the execution traces with their verdict of pass or fail. We use the labelled traces to train a neural network (NN) model to learn to distinguish runtime patterns for passing versus failing executions for a given program. Our approach for building this NN model involves the following steps, 1. Instrument the program to record execution traces as sequences of method invocations and global state, 2. Label a small fraction of the execution traces with their verdicts, 3. Designing a NN component that embeds information in execution traces to fixed length vectors, 4. Design a NN model that uses the trace information for classification, 5. Evaluate the inferred classification model on unseen execution traces from the program. We evaluate our approach using case studies from different application domains: 1. Module from Ethereum Blockchain, 2. Module from PyTorch deep learning framework, 3. Microsoft SEAL encryption library components, 4. Sed stream editor, 5. Value pointer library and 6. Nine network protocols from Linux packet identifier, L7-Filter. We found the classification models for all subject programs resulted in high precision, recall and specificity, over 95%, while only training with an average 9% of the total traces. Our experiments show that the proposed neural network model is highly effective as a test oracle and is able to learn runtime patterns to distinguish passing and failing test executions for systems and tests from different application domains.
Vasilios Mavroudis, Karl Wüst, Aritra Dhar, Kari Kostiainen · 5 authors
Permissionless blockchains offer many advantages but also have significant limitations including high latency. This prevents their use in important scenarios such as retail payments, where merchants should approve payments fast. Prior works have attempted to mitigate this problem by moving transactions off the chain. However, such Layer-2 solutions have their own problems: payment channels require a separate deposit towards each merchant and thus significant locked-in funds from customers; payment hubs require very large operator deposits that depend on the number of customers; and side-chains require trusted validators. In this paper, we propose Snappy, a novel solution that enables recipients, like merchants, to safely accept fast payments. In Snappy, all payments are on the chain, while small customer collaterals and moderate merchant collaterals act as payment guarantees. Besides receiving payments, merchants also act as statekeepers who collectively track and approve incoming payments using majority voting. In case of a double-spending attack, the victim merchant can recover lost funds either from the collateral of the malicious customer or a colluding statekeeper (merchant). Snappy overcomes the main problems of previous solutions: a single customer collateral can be used to shop with many merchants; merchant collaterals are independent of the number of customers; and validators do not have to be trusted. Our Ethereum prototype shows that safe, fast (<2 seconds) and cheap payments are possible on existing blockchains.
Cloud auctions provide cost-effective strategies for cloud VM allocation. Most existing cloud auctions simply assume that the auctioneer is trustable, and thus the fairness of auctions can be easily achieved. However, in fact, such a trustable auctioneer may not exist, and the fairness is non-trivial to guarantee. In this work, for the first time, we propose a decentralized cloud VM auction and trade framework based on blockchain. We realize both auction fairness and trade fairness among participants (e.g., cloud provider and cloud users) in this system, which guarantees the interest of each party will not suffer any loss as long as it follows the protocol. Furthermore, we implement our system through the local blockchain and Ethereum official test blockchain, carry out experimental simulations, and demonstrate the feasibility of our system.
Yuanyuan Zhang, Stephen Chan, Jeffrey Chu, Hana Sulieman
The market for cryptocurrencies has experienced extremely turbulent conditions in recent times, and we can clearly identify strong bull and bear market phenomena over the past year. In this paper, we utilise algorithms for detecting turnings points to identify both bull and bear phases in high-frequency markets for the three largest cryptocurrencies of Bitcoin, Ethereum, and Litecoin. We also examine the market efficiency and liquidity of the selected cryptocurrencies during these periods using high-frequency data. Our findings show that the hourly returns of the three cryptocurrencies during a bull market indicate market efficiency when using the detrended-fluctuation-analysis (DFA) method to analyse the Hurst exponent with a rolling window. However, when conditions turn and there is a bear-market period, we see signs of a more inefficient market. Furthermore, our results indicated differences between the cryptocurrencies in terms of their liquidity during the two market states. Moving from a bull to a bear market, Ethereum and Litecoin appear to become more illiquid, as opposed to Bitcoin, which appears to become more liquid. The motivation to study the high-frequency cryptocurrency market came from the increasing availability of higher-frequency cryptocurrency-pricing data. However, it also comes from a movement towards higher-frequency trading of cryptocurrency. In addition, the efficiency of cryptocurrency markets relates not only to whether prices are predictable and arbitrage opportunities exist, but, more widely, to topics such as testing the profitability of trading strategies and determining the maturity of cryptocurrency markets.
Blockchain is evolving to be a secure and reliable platform for secure data sharing in application areas such as the financial sector, supply chain management, food industry, energy sector, internet of things and healthcare. In this paper, we review existing literature and applications available for the healthcare system using blockchain technology. Besides, this work also proposes multiple workflows involved in the healthcare ecosystem using blockchain technology for better data management. Different medical workflows have been designed and implemented using the ethereum blockchain platform which involves complex medical procedures like surgery and clinical trials. This also includes accessing and managing a large amount of medical data. Within the implementation of the workflows of the medical smart contract system for healthcare management, the associated cost has been estimated for this system in terms of a feasibility study which has been comprehensively presented in this paper. This work would facilitate multiple stakeholders who are involved within the medical system to deliver better healthcare services and optimize cost.
Sri Aravinda Krishnan Thyagarajan, Adithya Bhat, Bernardo Magri, Daniel Tschudi · 5 authors
Although blockchains aim for immutability as their core feature, several instances have exposed the harms with perfect immutability. The permanence of illicit content inserted in Bitcoin poses a challenge to law enforcement agencies like Interpol, and millions of dollars are lost in buggy smart contracts in Ethereum. A line of research then spawned on Redactable blockchains with the aim of solving the problem of redacting illicit contents from both permissioned and permissionless blockchains. However, all the existing proposals follow the build-new-chain approach for redactions, and cannot be integrated with existing systems like Bitcoin and Ethereum. We present Reparo, a generic protocol that acts as a publicly verifiable layer on top of any blockchain to perform repairs, ranging from fixing buggy contracts to removing illicit contents from the chain. Reparo facilitates additional functionalities for blockchains while maintaining the same provable security guarantee; thus, Reparo can be integrated with existing blockchains and start performing repairs on the pre-existent data. Any system user may propose a repair and a deliberation process ensues resulting in a decision that complies with the repair policy of the chain and is publicly verifiable. Our Reparo layer can be easily tailored to different consensus requirements, does not require heavy cryptographic machinery and can, therefore, be efficiently instantiated in any permission-ed or -less setting. We demonstrate it by giving efficient instantiations of Reparo on top of Ethereum (with PoS and PoW), Bitcoin, and Cardano. Moreover, we evaluate Reparo with Ethereum mainnet and show that the cost of fixing several prominent smart contract bugs is almost negligible. For instance, the cost of repairing the prominent Parity Multisig wallet bug with Reparo is as low as 0.000000018% of the Ethers that can be retrieved after the fix.
In efforts to meet the targets of carbon emissions reduction in power systems, policy makers formulate measures for facilitating the integration of renewable energy sources and demand side carbon mitigation. Smart grid provides an opportunity for bidirectional communication among policy makers, generators and consumers. With the help of smart meters, increasing number of consumers is able to produce, store, and consume energy, giving them the new role of prosumers. This thesis aims to address how smart grid enables prosumers to be appropriately integrated into energy markets for decarbonising power systems. \n \nThis thesis firstly proposes a Stackelberg game-theoretic model for dynamic negotiation of policy measures and determining optimal power profiles of generators and consumers in day-ahead market. Simulation results show that the proposed model is capable of saving electricity bills, reducing carbon emissions, and increasing the penetration of renewable energy sources. Secondly, a data-driven prosumer-centric energy scheduling tool is developed by using learning approaches to reduce computational complexity from model-based optimisation. This scheduling tool exploits convolutional neural networks to extract prosumption patterns, and uses scenarios to analyse possible variations of uncertainties caused by the intermittency of renewable energy sources and flexible demand. Case studies confirm that the proposed scheduling tool can accurately predict optimal scheduling decisions under various system scales and uncertain scenarios. Thirdly, a blockchain-based peer-to-peer trading framework is designed to trade energy and carbon allowance. The bidding/selling prices of individual prosumers can directly incentivise the reshaping of prosumption behaviours. Case studies demonstrate the execution of smart contract on the Ethereum blockchain and testify that the proposed trading framework outperforms the centralised trading and aggregator-based trading in terms of regional energy balance and reducing carbon emissions caused by long-distance transmissions.
Information security incident under-reporting is unambiguously a business problem, as identified by a variety of sources, such as ENISA (2012), Symantec (2016), Newman (2018) and more. This research project identified the underlying issues that cause this problem and proposed a solution, in the form of an innovative artefact, which confronts a number of these issues. This research project was conducted according to the requirements of the Design Science Research Methodology (DSRM) by Peffers et al (2007). The research question set at the beginning of this research project, probed the feasible formation of an incident reporting solution, which would increase the motivational level of users towards the reporting of incidents, by utilizing the positive features offered by existing solutions, on one hand, but also by providing added value to the users, on the other. The comprehensive literature review chapter set the stage, and identified the reasons for incident underreporting, while also evaluating the existing solutions and determining their advantages and disadvantages. The objectives of the proposed artefact were then set, and the artefact was designed and developed. The output of this development endeavour is “IRDA”, the first decentralized incident reporting application (DApp), built on “Quorum”, a permissioned blockchain implementation of Ethereum. Its effectiveness was demonstrated, when six organizations accepted to use the developed artefact and performed a series of pre-defined actions, in order to confirm the platform’s intended functionality. The platform was also evaluated using Venable et al’s (2012) evaluation framework for DSR projects. This research project contributes to knowledge in various ways. It investigates blockchain and incident reporting, two domains which have not been extensively examined and the available literature is rather limited. Furthermore, it also identifies, compares, and evaluates the conventional, reporting platforms, available, up to date. In line with previous findings (e.g Humphrey, 2017), it also confirms the lack of standard taxonomies for information security incidents. This work also contributes by creating a functional, practical artefact in the blockchain domain, a domain where, according to Taylor et al (2019), most studies are either experimental proposals, or theoretical concepts, with limited practicality in solving real-world problems. Through the evaluation activity, and by conducting a series of non-parametric significance tests, it also suggests that IRDA can potentially increase the motivational level of users towards the reporting of incidents. This thesis describes an original attempt in utilizing the newly emergent blockchain technology, and its inherent characteristics, for addressing those concerns which actively contribute to the business problem. To the best of the researcher’s knowledge, there is currently no other solution offering similar benefits to users/organizations for incident reporting purposes. Through the accomplishment of this project’s pre-set objectives, the developed artefact provides a positive answer to the research question. The artefact, featuring increased anonymity, availability, immutability and transparency levels, as well as an overall lower cost, has the potential to increase the motivational level of organizations towards the reporting of incidents, thus improving the currently dismaying statistics of incident under-reporting. The structure of this document follows the flow of activities described in the DSRM by Peffers et al (2007), while also borrowing some elements out of the nominal structure of an empirical research process, including the literature review chapter, the description of the selected research methodology, as well as the “discussion and conclusion” chapter.
The world experienced unprecedented growth in international trade in the past few decades. In this resulting environment of global competition, several new companies have spawned and are spawning. Sellers are often under immense pressure by the market players to accept open-account trade terms, shipping goods before receiving payment, leaving them exposed to increased risk. This creates working capital challenges for firms, especially small and medium enterprises. To mitigate this supply chain risk, several supplier-led and buyer-led supply chain finance solutions are facilitated by banks and financial technology companies. However, because of the new Basel III regulation framework for banks and several other Supply Chain Finance (SCF) adoption barriers, like fraudulent activities, many firms are unable to reap SCF’s full benefits. This study explains various SCF instruments, the key drivers in their growth and their adoption barriers. This study then focuses on the novel blockchain technology and smart contracts by delving deep into their history, components, limitations, risks and use cases. Using the knowledge gathered in the process, a proof-of-concept blockchain and smart contract is developed using the Ethereum platform, which can facilitate normal business, purchase order finance, reverse factoring and reverse securitization. To test the smart contract, four use cases for each SCF instrument mentioned are demonstrated. A JavaScript-based unit test is done to test the smart contract’s correct deployment and onboarding of actors along with their business and financing interactions – access controls to business documents, reverting malicious transactions and correct fund transfer. As a result of various assumptions taken in the development process, the smart contract works only as a basic proof-of-concept and lacks robustness on the ground of scalability and security. As a result, a future model is laid out which will use various software and hardware oracles for autonomous operations while using a complex system of a storage contract, a permanent contract which stores all the data, and logic contract, upgradable contract which can be changed any number of times, with a proxy contract making delegated “function” calls to logic contract to reduce the gas usage due to external function calls.
The field of post-quantum cryptography studies cryptographic systems that are secure against an adversary in possession of a quantum computer. In 2017, the National Institute of Standards and Technology (NIST) initiated a process to standardize quantum-resistant public-key cryptographic algorithms (NIST PQC Project). In this thesis we analyze the performance and security of the Bit-Flipping Key Encapsulation Mechanism (BIKE) -- one of the candidates in the NIST PQC project which advanced to the second round of the standardization process. BIKE is a code-based cryptographic system featuring three different variants of the protocol. In the first round of the NIST PQC project BIKE offered security only against chosen-plaintext attacks (CPA). In the second round, BIKE introduced three new variants that are claimed to be secure also against chosen-ciphertext attacks (CCA). Firstly, we build a secure implementation of the CCA protocol and show that its performance characteristics are only negligibly worse than the CPA variant. In the key decapsulation phase of the protocol BIKE uses a decoding algorithm which fails with some probability, called the Decoding Failure Rate (DFR). We analyze the DFR of two decoders used in BIKE, Back-Flip and Black-Gray, and propose a new decoder, called Black-Gray-Flip, that achieves the same DFR as the two previously used decoders while being almost twice as fast. Finally, we propose an algorithm for inversion of binary polynomials in a polynomial ring used in BIKE-2, the second variant of BIKE. Our implementation of the inversion significantly outperforms previously used algorithms. With this and the fact that the bandwidth requirement for BIKE-2 is the smallest among the three variants, BIKE-2 is positioned as the preferable variant of BIKE. The second part of this thesis studies the Legendre pseudorandom function (PRF) which is proposed to be used in the context of blockchains. We present a new algorithm for cryptanalysis of the Legendre PRF. The complexity of our algorithm is lower than the previous best known algorithm. Moreover, we show the results of breaking three Legendre PRF challenges posed by the Ethereum foundation. The most difficult challenge that we solved set the new record which is not broken so far.
Central bank digital currencies have been on the rise for the past few years, especially after the emergence of cryptocurrencies like Bitcoin, Ethereum, Ripple and others. Leading central banks like the People's Bank of China and Riksbanken (Swedish Central Bank), and some of the other central banks around the world have been looking to develop and test central bank digital currencies around the world. Nonetheless, the main question that we need to answer is if the cryptocurrencies or central bank digital currencies (CDBC) will become the main form of money in the future or will these currencies harmoniously co-exist within the economy paradigm? This paper applies monetary and political economy concepts to discuss how a potential central bank digital currency can be developed and how it would compete with cryptocurrencies. In conclusion, however, the introduction of a central bank digital currency will reduce the monetary policies issues rather than create new issues and this paper will explain how this can be achieved.
Київський національний економічний університет імені Вадима Гетьмана, Михайло ОРЄХОВ, Т.В. Орєхова, Донецький національний університет імені Василя Стуса
The paper analyzes the role of digital currencies in the global financial system, the peculiarities of their use. The paper pays attention to the characteristics of the historical preconditions for the emergence of electronic payments and, as a consequence, digital currencies. The paper analyzes the features of the emergence and functioning of major global cryptocurrencies - Bitcoin, Ripple and Ethereum. The advantages of cryptocurrencies, the authors of the study include unlimited opportunities for transactions, no borders, transaction speed. Among the disadvantages of cryptocurrencies is the lack of a proper level of knowledge, which leads to the spread of fraud. The paper presents the volume and share of bitcoin trade in different markets during the period from January 2013 to January 2018. The results of the study allow us to conclude that the modern cryptocurrency market, despite the fact that the evolution of electronic money is in its infancy, and cash is still the most important form of payment for retail transactions, is highly competitive and fragmented.
Jan 1, 2020·Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences
Daniel Miehle, Andreas Pfurtscheller, Bernd Bruegge
Current Vehicle-to-Vehicle solutions cannot ensure the authenticity of safety-critical vehicle and traffic data. Moreover, they do not allow malicious vehicles to be detected and eliminated. However, this is becoming mandatory, as more and more vehicles are on the road and communicating with each other. We propose a system called Starling, which focuses on trusted coordinated obstacle mapping using blockchain technology and a distributed database. Starling enables vehicles to share detected obstacles with other vehicles in a secure and verifiable manner, thus improving road safety. It ensures that data was not manipulated, changed, or deleted and is based on an open protocol so that vehicles can exchange data regardless of their manufacturer. In a case study, we demonstrate how a consensus is reached among vehicles and conduct a comprehensive evaluation of the Starling system using Ethereum and the InterPlanetary File System.
The use of digital documents is exploding around the world due to the improvement of productivity and the convenience of access and backup of data.Usually, digital documents are managed by a document management system (DMS) which provides access control of the documents with access permission (e.g., password or account).However, when a user who has permission for the documents can directly access the digital document, it can occur a serious security problem.For example, when a malicious attacker gets access permission of a digital document, the document is able to be leaked.In addition, when a user who has authority behaves maliciously for his own benefit, the digital document can be easily falsified by the user.To handle these issues, we propose a new digital document management system for the security of digital documents which distributes the access permissions of the digital document.The proposed system encrypts a digital document with a key and stores the encrypted document into Interplanetary File System(IPFS).In addition, to distribute access permission of the digital document, it manages the key via Shamir's secret sharing scheme and blockchain.We implement our proposed system using Golang on Linux and evaluate the system on local IPFS and Ethereum testnet.The experimental results show that the proposed system provides high security of the digital document with minor performance overhead compared with the existing system.
In recent years, cryptocurrencies implemented on top of Blockchains became very popular, with Bitcoin as the most prominent example. However, novel Blockchain-based platforms such as Ethereum also support distributed applications beyond cryptocurrencies through so-called smart contracts. Technically, smart contracts are programs, whose code and execution state is stored in the Blockchain, inherently featuring the ability to transfer (electronic) money during their execution. In this Bachelor thesis, we investigate how smart contracts can be used to implement a distributed crowdsensing application for tracking mobile objects by a crowd of privately owned mobile devices. Such a system could be used, for instance, to nd lost or stolen objects, such as keys, vehicles (cars, bicycles, . . . ), or pets tagged with short-range radio transmitters implemented using readily available Bluetooth or RFID technology. These objects can then be detected by smartphones of private users in the vicinity of the object, effectively implementing a huge sensor network covering many parts of the world without any upfront investments by a central entity. Although highly attractive, implementing a crowdsensing application on top of a Blockchain platform such as Ethereum comes with several challenges. First of all, users need incentives to participate in searching for mobile objects. A natural incentive is a monetary reward that participants automatically receive through the smart contract when reporting sightings (timestamped positions) of wanted objects. However, this directly brings up the problem of malicious participants (attackers) who try to get the reward without actually executing the work of searching for the object by simply reporting fake positions. Therefore, one major goal of this Bachelor thesis is to counter such attacks by proposing effective counter-measures, and implementing and evaluating them for the Ethereum platform. In detail, we propose a basic reputation-based approach for detecting fake positions which judges each sighting made by a mobile devices according to the reputation of that device, implemented by a smart contract. Furthermore, advanced attacks are identified compromising the basic reputation-based approach and effective counter-measures to these advanced attacks are proposed. Identified advanced attacks include reputation farming, where the attacker tries to aggregate reputation first before launching the attack, and the so-called copycat attack, where the attacker simply copies already submitted valid sightings form honest participants, making his fake positions indistinguishable from valid positions. Our evaluations analyses the monetary cost of executing smart contracts with and without our security mechanisms. The results show that the overhead included by our reputation-based approach is at maximum 45% of the cost of a smart contract without implemented security mechanisms.