A blockchain and smart contract enabled security mechanism for IoT applications has been reported recently for urban, financial, and network services. However, due to the power-intensive and a low-throughput consensus mechanism in existing blockchain, like Bitcoin and Ethereum, there are still challenges in integrating blockchain technology into resource-constrained IoT platforms. In this paper, Microchain, based on a hybrid Proof-of-Credit (PoC)-Voting-based Chain Finality (VCF) consensus protocol, is proposed to provide a secure, scalable and lightweight distributed ledger for IoT systems. By using a bias-resistant randomness protocol and a cryptographic sortition algorithm, a random subset of nodes are selected as a final committee to perform the consensus protocol. The hybrid consensus mechanism relies on PoC, a pure Proof of stake (PoS) protocol, to determine whether or not a participant is qualified to propose a block, given a fair initial distribution of the credit assignment. The voting-based chain finality protocol is responsible for finalizing a history of blocks by resolving conflicting checkpoint and selecting a unique chain. A proof-of-conception prototype is implemented and tested on a physical network environment. The experimental results verify that the Micorchain is able to offer a partially decentralized, scalable and lightweight distributed ledger protocol for IoT applications.
Public software repositories such as GitHub make transparent the development history of an open source software system. Source code commits, discussions about new features and bugs, and code reviews are stored and carefully attributed to the appropriate developers. However, sometimes governments may seek to analyze these repositories, to identify citizens who contribute to projects they disapprove of, such as those involving cryptography or social media. While developers who seek anonymity may contribute under assumed identities, their body of public work may be characteristic enough to betray who they really are. The ability to contribute anonymously to public bodies of knowledge is extremely important to the future of technological and intellectual freedoms. Just as in security hacking, the only way to protect vulnerable individuals is by demonstrating the means and strength of available attacks so that those concerned may know of the need and develop the means to protect themselves. \n \nIn this work, we present a method to de-anonymize source code contributors based on the authors' intrinsic programming style. First, we present a partial replication study wherein we attempt to de-anonymize a large number of entries into the Google Code Jam competition. We base our approach on Caliskan-Islam et al. 2015, but with modifications to the feature set and modelling strategy for scalability and feature-selection robustness. We did not achieve 0.98 F1 achieved in this prior work, but managed a still reasonable 0.71 F1 under identical experimental conditions, and a 0.88 F1 given more data from the same set. \n \nSecond, we present an exploratory study focused on de-anonymizing programmers who have contributed to a repository, using other commits from the same repository as training data. We train random-forest classifiers using programmer data collected from 37 medium to large open-source repositories. Given a choice between active developers in a project, we were able to correctly determine authorship of a given function about 75% of the time, without the use of identifying meta-data or comments. We were also able to correctly validate a contributor as the author of a questioned function with 80\\% recall and 65\\% precision. This exploratory study provides empirical support for our approach. \n \nFinally, we present the results of a similar, but more difficult study wherein we attempt de-anonymize a repository in the same manner, but without using the target repository as training data. To do this, we gather as much training data as possible from the repository's contributors through the Github API. We evaluate our technique over 3 repositories: Bitcoin, Ethereum (crypto-currencies) and TrinityCore (a game engine). Our results in this experiment starkly contrast our results in the intra-repository study showing accuracies of 35% for Bitcoin, 22% for Ethereum, and 21% for TrinityCore which had candidate set sizes of 6, 5, and 7 respectively. \n \nOur results indicate that we can do somewhat better than random guessing, even under difficult experimental conditions, but they also indicate some fundamental issues with the state of the art of Code Stylometry. In this work we present our methodology, results, and some comments on past empirical studies, the difficulties we faced, and likely hurdles for future work in the area.
Evan Brinckman, Andrey Kuehlkamp, Jarek Nabrzyski, Ian Taylor
As the public Ethereum network surpasses half a billion transactions and enterprise Blockchain systems becoming highly capable of meeting the demands of global deployments, production Blockchain applications are fast becoming commonplace across a diverse range of business and scientific verticals. In this paper, we reflect on work we have been conducting recently surrounding the ingestion, retrieval and analysis of Blockchain data. We describe the scaling and semantic challenges when extracting Blockchain data in a way that preserves the original metadata of each transaction by cross referencing the Smart Contract interface with the on-chain data. We then discuss a scientific use case in the area of Scientific workflows by describing how we can harvest data from tasks and dependencies in a generic way. We then discuss how crawled public blockchain data can be analyzed using two unsupervised machine learning algorithms, which are designed to identify outlier accounts or smart contracts in the system. We compare and contrast the two machine learning methods and cross correlate with public Websites to illustrate the effectiveness such approaches.
Blockchain systems, such as Ethereum, use an approach called "metering" to assign a cost to smart contract execution, an approach which is designed to incentivise miners to operate the network and protect it against DoS attacks. In the past, the imperfections of Ethereum metering allowed several DoS attacks which were countered through modification of the metering mechanism. This paper presents a new DoS attack on Ethereum which systematically exploits its metering mechanism. We first replay and analyse several months of transactions, during which we discover a number of discrepancies in the metering model, such as significant inconsistencies in the pricing of the instructions. We further demonstrate that there is very little correlation between the execution cost and the utilised resources, such as CPU and memory. Based on these observations, we present a new type of DoS attack we call Resource Exhaustion Attack, which uses these imperfections to generate low-throughput contracts. To do this, we design a genetic algorithm that generates contracts with a throughput on average 200 times slower than typical contracts. We then show that all major Ethereum client implementations are vulnerable and, if running on commodity hardware, would be unable to stay in sync with the network when under attack. We argue that such an attack could be financially attractive not only for Ethereum competitors and speculators, but also for Ethereum miners. Finally, we discuss short-term and potential long-term fixes against such attacks. Our attack has been responsibly disclosed to the Ethereum Foundation and awarded a bug bounty reward of 5,000 USD.
A key aspect of Federated Learning (FL) is the requirement of a centralized aggregator to maintain and update the global model. However, in many cases orchestrating a centralized aggregator might be infeasible due to numerous operational constraints. In this paper, we introduce BAFFLE, an aggregator free, blockchain driven, FL environment that is inherently decentralized. BAFFLE leverages Smart Contracts (SC) to coordinate the round delineation, model aggregation and update tasks in FL. BAFFLE boosts computational performance by decomposing the global parameter space into distinct chunks followed by a score and bid strategy. In order to characterize the performance of BAFFLE, we conduct experiments on a private Ethereum network and use the centralized and aggregator driven methods as our benchmark. We show that BAFFLE significantly reduces the gas costs for FL on the blockchain as compared to a direct adaptation of the aggregator based method. Our results also show that BAFFLE achieves high scalability and computational efficiency while delivering similar accuracy as the benchmark methods.
Abstract Cryptocurrencies as a new way of transferring assets and securing financial transactions have gained popularity in recent years. Transactions in cryptocurrencies are publicly available, hence, statistical studies on different aspects of these currencies are possible. However, previous statistical analysis on cryptocurrencies transactions have been very limited and mostly devoted to Bitcoin, with no comprehensive comparison between these currencies. In this study, we intend to compare the transaction graph of Bitcoin, Ethereum, Litecoin, Dash, and Z-Cash, with respect to the dynamics of their transaction graphs over time, and discuss their properties. In particular, we observed that the growth rate of the nodes and edges of the transaction graphs, and the density of these graphs, are closely related to the price of these currencies. We also found that the transaction graph of these currencies is non-assortative, i.e. addresses do not tend for transact with a particular type of addresses of higher or lower degree, and the degree sequence of their transaction graph follows the power law distribution.
In recent years, increasing attention has been devoted to cryptocurrencies, owing to their great development and valorization. In this study, we propose to analyse four of the major cryptocurrencies, based on their market capitalization and data availability: Bitcoin, Ethereum, Ripple, and Litecoin. We apply detrended fluctuation analysis (the regular one and with a sliding windows approach) and detrended cross-correlation analysis and the respective correlation coefficient. We find that Bitcoin and Ripple seem to behave as efficient financial assets, while Ethereum and Litecoin present some evidence of persistence. When correlating Bitcoin with the other cryptocurrencies under analysis, we find that for short time scales, all the cryptocurrencies have statistically significant correlations with Bitcoin, although Ripple has the highest correlations. For higher time scales, Ripple is the only cryptocurrency with significant correlation.
Zhimin Gao, Lei Xu, Keshav Kasichainula, Lin Chen · 6 authors
Bitcoin brings a new type of digital currency that does not rely on a central system to maintain transactions. By benefiting from the concept of decentralized ledger, users who do not know or trust each other can still conduct transactions in a peer-to-peer manner. Inspired by Bitcoin, other cryptocurrencies were invented in recent years such as Ethereum, Dash, Zcash, Monero, Grin, etc. Some of these focus on enhancing privacy for instance crypto note or systems that apply the similar concept of encrypted notes used for transactions to enhance privacy (e.g., Zcash, Monero). However, there are few mechanisms to support the exchange of privacy-enhanced notes or assets on the chain, and at the same time preserving the privacy of the exchange operations. Existing approaches for fair exchanges of assets with privacy mostly rely on off-chain/side-chain, escrow or centralized services. Thus, we propose a solution that supports oblivious and privacy-protected fair exchange of crypto notes or privacy enhanced crypto assets. The technology is demonstrated by extending zero-knowledge based crypto notes. To address "privacy" and "multi-currency", we build a new zero-knowledge proving system and extend note format with new property to represent various types of tokenized assets or cryptocurrencies. By extending the payment protocol, exchange operations are realized through privacy enhanced transactions (e.g., shielded transactions). Based on the possible scenarios during the exchange operation, we add new constraints and conditions to the zero-knowledge proving system used for validating transactions publicly.
Zhimin Gao, Lei Xu, Keshav Kasichainula, Lin Chen · 6 authors
Bitcoin brings a new type of digital currency that does not rely on a central\nsystem to maintain transactions. By benefiting from the concept of\ndecentralized ledger, users who do not know or trust each other can still\nconduct transactions in a peer-to-peer manner. Inspired by Bitcoin, other\ncryptocurrencies were invented in recent years such as Ethereum, Dash, Zcash,\nMonero, Grin, etc. Some of these focus on enhancing privacy for instance crypto\nnote or systems that apply the similar concept of encrypted notes used for\ntransactions to enhance privacy (e.g., Zcash, Monero). However, there are few\nmechanisms to support the exchange of privacy-enhanced notes or assets on the\nchain, and at the same time preserving the privacy of the exchange operations.\nExisting approaches for fair exchanges of assets with privacy mostly rely on\noff-chain/side-chain, escrow or centralized services. Thus, we propose a\nsolution that supports oblivious and privacy-protected fair exchange of crypto\nnotes or privacy enhanced crypto assets. The technology is demonstrated by\nextending zero-knowledge based crypto notes. To address "privacy" and\n"multi-currency", we build a new zero-knowledge proving system and extend note\nformat with new property to represent various types of tokenized assets or\ncryptocurrencies. By extending the payment protocol, exchange operations are\nrealized through privacy enhanced transactions (e.g., shielded transactions).\nBased on the possible scenarios during the exchange operation, we add new\nconstraints and conditions to the zero-knowledge proving system used for\nvalidating transactions publicly.\n
Alexander Hentschel, Dieter Shirley, Layne Lafrance
Throughput limitations of existing blockchain architectures are one of the most significant hurdles for their wide-spread adoption. Attempts to address this challenge include layer-2 solutions, such as Bitcoin's Lightning or Ethereum's Plasma network, that move work off the main chain. Another prominent technique is sharding, i.e., breaking the network into many interconnected networks. However, these scaling approaches significantly increase the complexity of the programming model by breaking ACID guarantees increasing the cost and time for application development. In this paper, we describe a novel approach where we split the work traditionally assigned to cryptocurrency miners into two different node roles. Specifically, the selection and ordering of transactions are performed independently from their execution. The focus of this paper is to formalize the split of consensus and computation, and prove that this approach increases throughput without compromising security. In contrast to most existing proposals, our approach achieves scaling via separation of concerns, i.e., better utilization of network resources, rather than sharding. This approach allows established programming paradigms for smart contracts (which generally assume transactional atomicity) to persist without introducing additional complexity. We present simulations on a proof-of-concept network of 32 globally distributed nodes. While the consensus algorithm was identical in all simulations (a 2-step-commit protocol with rotating block proposer), block computation was either included in a consensus nodes' regular operations (conventional architecture) or delegated to specialized execution nodes (separation of concerns). Separation of concerns enables our system to achieve a throughput increase by a factor of 56 compared to conventional architectures without loss of safety or decentralization.
Kriptovalute su novi oblik digitalnog novca koji funkcionira i nastaje na temelju složenih kriptografskih algoritama na računalnim mrežama. Ethereum je open-source program, zasnovan na blockchain tehnologiji, koja dozvoljava drugim programerima da grade i razvijaju decentralizirane aplikacije. Diplomski rad podijeljen je u tri glavna dijela. U prvom dijelu objašnjeni su osnovni pojmovi kako bi se razumjelo što su kriptovalute. U drugom dijelu rada objašnjeno je što je Ethereum, a u trećem dijelu opisani su osnovni principi rada i dijelovi koda Ethereum algoritma i programiranje u solidity programskom jeziku.
Iago Sestrem Ochôa, Rafael Alexandre Piemontez, Lucas M. C. e Martins, Valderi Reis Quietinho Leithardt · 5 authors
Blockchain technology has aroused the interest of researchers as it ensures security and privacy in decentralized applications. One of the platforms currently used for the development of new blockchain-based solutions is the Ethereum network. This article presents an experimental analysis of the scalability of this network to identify its cost and performance for several contracts in a simulated private Ethereum network. The results obtained demonstrate that storage operations for large amounts of data can prevent the use of blockchain due to the high cost of gas charged for this type of operation. The experiments also pointed out that processing operations which do not store information have a small cost of gas.
Summary With the increasing popularity of blockchain technologies in recent years, blockchain‐based decentralized applications (DApps for short in this paper) have been rapidly developed and widely adopted in many areas, being a hot topic in both academia and industry. Despite of the importance of DApps, we still have quite little understanding of DApps along with its ecosystem. To bridge the knowledge gap, this paper presents the first comprehensive empirical study of blockchain‐based DApps to date, based on an extensive dataset of 995 Ethereum DApps and 29,846,075 transaction logs over them. We make a descriptive analysis of the popularity of DApps, summarize the patterns of how DApps use smart contracts to access the underlying blockchain, and explore the worth‐addressing issues of deploying and operating DApps. Based on the findings, we propose some implications for DApp users to select proper DApps, for DApp developers to improve the efficiency of DApps, and for blockchain vendors to enhance the support of DApps.
Asma Lahbib, Khalifa Toumi, Anis Laouiti, Steven Martin
While smart factories are becoming widely recognized as a fundamental concept of Industry 4.0, their implementation has posed several challenges insofar that they generate, process, and exchange vast amounts of security critical and privacy sensitive data, which makes them attractive targets of attacks and unauthorized access. Security requirements in such scenario include integrity, confidentiality, traceability and notarization of exchanged data in the one hand plus access control, privacy and trust in the other one. In this context, we design a distributed resource management framework using the emerging smart contracts technology for Industry 4.0 applications and more specifically for smart factories environments. This last, named DRMF, utilizes three Ethereum smart contracts specifically a Governance Contract (GC), an Access Contract (AC) and a Lookup Contract (LC) that are respectively responsible for the registration of new joining entities as well as those requesting consensus partaking permissions, second the dynamic access authorization and third the mapping between the required services and contracts ensuring their management. Using the blockchain technology, this framework is expected to achieve distributed, flexible, verifiable and trustworthy access control in addition to a transparent, traceable and notarized resource usage and sharing. Results from a real implementation plus performance evaluation prove the proposed concept and demonstrate its feasibility.
Distributed Ledger Technology (DLT), also known as „Blockchain”, represents a new paradigm in how applications are designed and built. Even thoughthe blockchain emerged as a consumer-focused technology (form Bitcoin), it’s adoptionin the enterpriseenvironment has increased dramatically in the last years. The user’sfocus on privacy, security and transparency has motivated corporations to invest in distributed applications throughout their structure and operations. The main frameworks for enterprise blockchain solutions are coming from well established IT&C corporations like Microsoft (partnership with Ethereum), IBM (Hyperledger Fabric), JP Morgan (Quorum) and others.The blockchain technology is pretty new, and it cannot fully replace legacy centralized cloud-based solutions. The scalability issue of DLT is well-known, as the most advanced blockchain technologies can only process a few hundred transactions per second. This is nowhere near the speed of Visa’s payment system that can process more than 2000 transactions per second.
This paper applies biomimetic engineering to the problem of permissionless Byzantine consensus and achieves results that surpass the prior state of the art by four orders of magnitude. It introduces a biologically inspired asymmetric Sybil-resistance mechanism, Proof-of-Balance, which can replace symmetric Proof-of-Work and Proof-of-Stake weighting schemes.
The biomimetic mechanism is incorporated into a permissionless blockchain protocol, Key Retroactivity Network Consensus (KRNC), which delivers ~40,000 times the security and speed of today's decentralized ledgers. KRNC allows the fiat money that the public already owns to be upgraded with cryptographic inflation protection, eliminating the problems inherent in bootstrapping new currencies like Bitcoin and Ethereum.
The paper includes two independently significant contributions to the literature. First, it replaces the non-structural axioms invoked in prior work with a new formal method for reasoning about trust, liveness, and safety from first principles. Second, it demonstrates how two previously overlooked exploits, book-prize attacks and pseudo-transfer attacks, collectively undermine the security guarantees of all prior permissionless ledgers.
Huan Zhou, Xue Ouyang, Jinshu Su, Cees de Laat · 5 authors
There lacks trust between the cloud customer and provider to enforce traditional cloud SLA (Service Level Agreement) where the blockchain technique seems a promising solution. However, current explorations still face challenges to prove that the off-chain SLO (Service Level Objective) violations really happen before recorded into the on-chain transactions. In this paper, a witness model is proposed implemented with smart contracts to solve this trust issue. The introduced role, "Witness", gains rewards as an incentive for performing the SLO violation report, and the payoff function is carefully designed in a way that the witness has to tell the truth, for maximizing the rewards. This fact that the witness has to be honest is analyzed and proved using the Nash Equilibrium principle of game theory. For ensuring the chosen witnesses are random and independent, an unbiased selection algorithm is proposed to avoid possible collusions. An auditing mechanism is also introduced to detect potential malicious witnesses. Specifically, we define three types of malicious behaviors and propose quantitative indicators to audit and detect these behaviors. Moreover, experimental studies based on Ethereum blockchain demonstrate the proposed model is feasible, and indicate that the performance, ie, transaction fee, of each interface follows the design expectations.
The potentiality of Blockchain technology is widespread and applied to diverse fields. Blockchain is a distributed ledger of transactions that store immutable records in chronological order in an append-only mode. Hence, humongous data is stored on the blockchain and will continuously expand over time. Blockchain has been rapidly adopted by many businesses for storing the provenance data because of its salient features like immutability, robustness and tamperproof. Blockchain stores data provenance as transactions that are collected from sources like a centralized cloud or decentralized cloud that helps in identifying cybercrimes. This paper emphasizes on the different approaches of querying the data provenance transactions stored in Ethereum Blockchain based on various search parameters using REST API web services. The approach not only queries based on the first-class data elements like blocks, transactions, account address and contract address but also queries based on the provenance data stored on the Ethereum Blockchain explained with a use case LegalProv.
Hamza Baqa, Nguyen B. Truong, Noël Crespi, Gyu Myoung Lee · 5 authors
The emerging Blockchain (BC) and Distributed Ledger technologies have come to impact a variety of domains, from capital market sectors to digital asset management in the Internet of Things (IoT). As a result, more and more BC-based decentralized applications for numerous cross-domain services have been developed. These applications implement specialized decentralized computer programs called Smart Contracts (SCs) which are deployed into BC frameworks. Although these SCs are open ato public, it is challenging to discover and utilize such SCs for a wide range of usages from both systems and end-users because such SCs are already compiled in form of byte-codes without any associated meta-data. This motivates us to propose a solution called Semantic SC (SSC) which integrates RESTful semantic web technologies in SCs, deployed on the Ethereum Blockchain platform, for indexing, browsing and annotating such SCs. The solution also exposes the relevant distributed ledgers as Linked Data for enhancing the discovery capability. To achieve this goal, the OWL-S service ontology is extended by incorporating some domain specific terminologies, which are used in the development of the proposed SSCs. As a result, SSC can be utilized to enrich queries for a domain-specific terms across multiple distributed ledgers, which greatly increases the discovery capability of decentralized IoT applications and services. Contribution in standardization is also discussed. We believe that our research work takes the first steps towards connecting BC-based decentralized services with semantic web services in order to provide better IoT ecosystems.