Those working on Blockchain technologies have described several new innovative directions and novel services in the Internet of things (IoT), including decentralized trust, trusted and verifiable execution of smart contracts, and machine-to-machine communications and automation that reach beyond the mere exchange of data. However, applying blockchain principles in the IoT is a challenge due to the constraints of the end devices. Because of fierce cost pressure, the hardware resources in these devices are usually reduced to the minimum necessary for operation. To achieve the high coverage needed, low bitrate mobile or wireless technologies are frequently applied, so the communication is often constrained, too. These constraints make the implementation of blockchain nodes for IoT as standalone end-devices impractical or even impossible. We therefore investigated possible design approaches to decentralized applications based on the Ethereum blockchain for the IoT. We proposed and evaluated three application architectures differing in communication, computation, storage, and security requirements. In a pilot setup we measured and analyzed the data traffic needed to run the blockchain clients and their applications. We found out that with the appropriate designs and the remote server architecture we can strongly reduce the storage and communication requirements imposed on devices, with predictable security implications. Periodic device traffic is reduced to 2400 B/s (HTTP) and 170 B/s (Websocket) from about 18 kB/s in the standalone-device full client architecture. A notification about a captured blockchain event and the corresponding verification resulted in about 2000 B of data. A transaction sent from the application to the client resulted in an about 500 B (HTTP) and 300 B message (Websocket). The key store location, which affects the serialization of a transaction, only had a small influence on the transaction-related data. Raw transaction messages were 45 B larger than when passing the JSON transaction objects. These findings provide directions for fog/cloud IoT application designers to avoid unrealistic expectations imposed upon their IoT devices and blockchain technologies, and enable them to select the appropriate system design according to the intended use case and system constraints. However, for very low bit-rate communication networks, new communication protocols for device to blockchain-client need to be considered.
PeerCash is an decentralized application built on Ethereum blockchain technology. Decentralization means that there is no concept of having admin. Blockchain is a decentralized, distributed ledger secured technology which is immutable and verifiable. Every events in blockchain is recorded on blocks and it is encrypted using cryptography hashing. The advantage of PeerCash is that we can completely avoid the middle man from the web shopping payment system. That is we can completely remove the bank from interfering with our payment system and the buyer and seller can directly proceed their transaction and make their purchase. PeerCash transactions is completely recorded on blocks and the transactions is secured. So we can call PeerCash as a cryptocurrency. This paper describes about this application.
Blockchain's properties in addressing trust in highly decentralized environments can make it an enabler for novel sharing economy services. In this paper, we demonstrate the practicality of blockchain-based Secure IoT as a Service (SIoTaaS), where an IoT device can be rented from a service provider, securely and in a privacy-preserving fashion. Our framework allows the simultaneous operations of distinct providers of IoT-based sharing economy services at a large scale. Multiple parties can securely share text and multimedia in the context of location and point-of-interest sharing, perform financial transactions by hiding true identity of parties involved in various online transactions, perform user and IoT registration, transfer value transactions via Ethereum tokens between providers and consumers, as well as raw IoT data payload. This can turn smart room IoT devices, such as smart locks, light bulbs, air conditioning and fans into rentable business entities within a secure sharing economy platform. We will demonstrate such a proof of concept IoT sharing economy framework, which is specifically designed to support the temporary IoT needs of very large numbers of users, such as Hajj pilgrims concentrating for a short period of time at a single area in Saudi Arabia.
Niclas Kannengießer, Sebastian Lins, Tobias Dehling, Ali Sunyaev
When developing peer-to-peer applications on distributed ledger technology (DLT), a crucial decision is the selection of a suitable DLT design (e.g., Ethereum), because it is hard to change the underlying DLT design post hoc. To facilitate the selection of suitable DLT designs, we review DLT characteristics and identify trade-offs between them. Furthermore, we assess how DLT designs account for these trade-offs and we develop archetypes for DLT designs that cater to specific requirements of applications on DLT. The main purpose of our article is to introduce scientific and practical audiences to the intricacies of DLT designs and to support development of viable applications on DLT.
Niclas Kannengießer, Sebastian Lins, Tobias Dehling, Ali Sunyaev
When developing peer-to-peer applications on Distributed Ledger Technology (DLT), a crucial decision is the selection of a suitable DLT design (e.g., Ethereum) because it is hard to change the underlying DLT design post hoc. To facilitate the selection of suitable DLT designs, we review DLT characteristics and identify trade-offs between them. Furthermore, we assess how DLT designs account for these trade-offs and we develop archetypes for DLT designs that cater to specific quality requirements. The main purpose of our article is to introduce scientific and practical audiences to the intricacies of DLT designs and to support development of viable applications on DLT.
Public blockchains in support of Smart Contracts (SC), like Ethereum enable everyone to represent scarce, valuable resources (like cryptocurrencies) as so-called tokens. Token issuing and management was the first blockchain use case. However, programming languages and runtime systems used in the current blockchains for their SCs lack a secure and straightforward way to implement and handle tokens. The unnecessary complexity in doing so can lead to erroneous implementation of tokens and applications built on top of these, including the loss or theft of tokens as it happened. The most known attack was "TheDAO" attack which led to the "loss" of tokens, valued at that time at approximately 60 M US Dollar. A better and secure token representation directly embedded into a SC runtime and SC programming language could prevent loss of tokens. Thus this paper presents an approach including parts of a programming language using it. The core of the model is to use opaque and substructural data types together with an onchain soundness checker to generically represent tokens securely as values similar to integers and booleans. Such opaque data types enforce that only a designated piece of code can create values of that type. The substructural data types allow arbitrary values to express scarcity by preventing the duplication and elimination of values. The on-chain soundness checker ensures that the deployed code does not violate guarantees given by the type system, which includes opaque and substructural data types.
Internet of Thing devices (IoT devices) are often constrained in terms of computing, memory, storage, power, and network resources. This makes them ill-suited to operate as first-class citizens on a blockchain, such as Ethereum, preventing the IoT devices from attaining the security guarantees that are available to better resourced nodes that are able to operate as full, validating nodes on the blockchain. IoT devices may use so-called light protocols to interact with the blockchain with minimal resource requirements, but these protocols provide only probabilistic security guarantees. In this position paper, we propose a new mechanism where an operator of IoT devices is able to send a “ground truth state” to the devices via a new mechanism, which we call “decentralized beacons”, enabling them to gain full security guarantees of the blockchain state.
Over the last few years, interest has emerged in blockchain, a decentralized ledger technology (DLT) created for use in cryptocurrencies, but with a great potential to be used in other application domains. One of them is supply chain management, tracking and tracing, which are key processes to the logistics industry, made difficult due to the lack of standards or trust between actors, miscommunication, fraud and bureaucratic delays, among other issues. In order to overcome some of these challenges, the solution presented in this dissertation proposes a blockchain system application created with Ethereum smart contracts technology. Its main purpose is to be used in supply chain and logistics for the tracking and tracing products, where the storage of important data is done and verified in a trustworthy, decentralized system. The technical solution presented here implements methods for tracking, certification, quality control and authentication, and integrates the communication of blockchain with IoT devices, which play an important role in monitoring products and automating these processes. This approach is validated by the development of a smart contract system and two browser-based applications to interact with it. The first application allows users to access and view their product’s tracking data, while the second bridges the communication between an Arduino UNO microcontroller collecting temperature readings and our smart contract system. The work presented here highlights the benefits of these technologies applied to logistics and validates the feasibility of this approach, ultimately giving insight into the capabilities, qualities, but also of the limitations a system like this can have.
Blockchains and smart contracts are an emerging, promising technology, that has received considerable attention. We use the blockchain technology, and in particular Ethereum, to implement a large-scale event-based Internet of Things (IoT) control system. We argue that the distributed nature of the "ledger," as well as, Ethereum's capability of parallel execution of replicated "smart contracts", provide the sought after automation, generality, flexibility, resilience, and high availability. We design a realistic blockchain-based IoT architecture, using existing technologies while by taking into consideration the characteristics and limitations of IoT devices and applications. Furthermore, we leverage blockchain's immutability and Ethereum's support for custom tokens to build a robust and efficient token-based access control mechanism. Our evaluation shows that our solution is viable and offers significant security and usability advantages.
Custom tokens are an integral component of decentralized applications (dapps) deployed on Ethereum and other blockchain platforms. For Ethereum, the ERC20 standard is a widely used token interface and is interoperable with many existing dapps, user interface platforms, and popular web applications (e.g., exchange services). An ERC20 security issue, known as the "multiple withdrawal attack", was raised on GitHub and has been open since November 2016. The issue concerns ERC20's defined method approve() which was envisioned as a way for token holders to give permission for other users and dapps to withdraw a capped number of tokens. The security issue arises when a token holder wants to adjust the amount of approved tokens from N to M (this could be an increase or decrease). If malicious, a user or dapp who is approved for N tokens can front-run the adjustment transaction to first withdraw N tokens, then allow the approval to be confirmed, and withdraw an additional M tokens. In this paper, we evaluate 10 proposed mitigations for this issues and find that no solution is fully satisfactory. We then propose 2 new solutions that mitigate the attack, one of which fully fulfills constraints of the standard, and the second one shows a general limitation in addressing this issue from ERC20's approve method.
Bitcoin, which emerged in 2008 and is now being used rapidly in various sectors, is a crypto currency. Bitcoin was revealed by Satoshi Nakamoto (who or who is not specific to the person or a group). An official or private regulator is exported independently of the institution and therefore has no guarantee. Bitcoin was first used in the market in 2009. Although more than one crypto currency has emerged, Bitcoin has maintained its leadership since its release. However, in the years ahead, another crypto currency, Ethereum, will also go ahead of Bitcoin. Although there are countries that are prohibited to be used in countries of the world, the number of countries in which it is used is increasing day by day. In Turkey, shipping fees, employee salaries, cost of books, such as food shopping are being used in many fields.
The paper proposes the link between cryptocurrency implementation in the financial sector and energy consumption worldwide. The underlying mechanism of this blockchain infrastructure is described, practical cases of its adoption in various segments of the financial sector are provided. This paper tries to explain the power consumption of the cryptocurrency mining at the case of Bitcoin, Ethereum, Monero, Litecoin. Since mining is not regulated by the state, and even banned in some countries, it is difficult to find accurate data on how much electricity is spent on it. Method of Herfindahl–Hirschman is used for efficiency estimate of crypto market.Keywords: energy consumption, mining pools, bitcoin, blockchain, cryptocurrency, cloud mining.JEL Classifications: G32, G34, O33.DOI: https://doi.org/10.32479/ijeep.7685
A blockchain is a tamper-proof distributed transaction registry; first popularized by Bitcoin [1], it has now been extended to support storage of arbitrary state and computations in-ledger. Ethereum [2] and its smart contract model have proven to be a very popular choice for this task, routinely managing assets valued in the billions. However, development of such contracts has been anything but easy. While formally specified, the Ethereum execution platform is based on a low-level machine, quite similar to assembly; semantics for contract operations such as call are quite complex, and the need for resource management creates unanticipated modes of failure. The dominant day-to-day programming platform for Ethereum is Solidity [3], an Object-Oriented language that identifies contracts with objects. While reasoning about Solidity programs is much easier than for their bytecode counterparts, it is not extent of challenges either, and moreover, Solidity lacks a source-level semantics, which forces developers to reason over output bytecode again. In this short paper we explore the main barriers to lift in order to achieve a principled compilation strategy for Solidity. We will review the standard concepts on verified and secure compilation, and frame them in the context of the Ethereum platform.
Sebastian Henningsen, Daniel Teunis, Martin Florian, Björn Scheuermann
Ethereum is a decentralized Blockchain system that supports the execution of Turing-complete smart contracts. Although the security of the Ethereum ecosystem has been studied in the past, the network layer has been mostly neglected. We show that Go Ethereum (Geth), the most widely used Ethereum implementation, is vulnerable to eclipse attacks, effectively circumventing recently introduced (Geth v1.8.0) security enhancements. We responsibly disclosed the vulnerability to core Ethereum developers; the corresponding countermeasures to our attack where incorporated into the v1.9.0 release of Geth. Our false friends attack exploits the Kademlia-inspired peer discovery logic used by Geth and enables a low-resource eclipsing of long-running, remote victim nodes. An adversary only needs two hosts in distinct /24 subnets to launch the eclipse, which can then be leveraged to filter the victim's view of the Blockchain. We discuss fundamental properties of Geth's node discovery logic that enable the false friends attack, as well as proposed and implemented countermeasures.
Open access
3 source records
Peer-to-Peer Network Technologies
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Victor Cook, Zachary Painter, Christina Peterson, Damian Dechev
Smart contract transactions demonstrate issues of performance and correctness that application programmers must work around. Although the blockchain consensus mechanism approaches ACID compliance, use cases that rely on frequent state changes are impractical due to the block publishing interval of $O(10^1)$ seconds. The effective isolation level is Read-Committed, only revealing state transitions at the end of the block interval. Values read may be stale and not match program order, causing many transactions to fail when a block is committed. This paper perceives the blockchain as a transactional data structure, using this analogy in the development of a new algorithm, Hash-Mark-Set (HMS), that improves transaction throughput by providing a Read-Uncommitted view of state variables. HMS creates a directed acyclic graph (DAG) from the pending transaction pool. The transaction order derived from the DAG is used to provide a Read-Uncommitted view of the data for new transactions, which enter the DAG as they are received. An implementation of HMS is provided, interoperable with Ethereum and ready for use in smart contracts. Over a wide range of transaction mixes, HMS is demonstrated to improve throughput. A side product of the implementation is a new technique, Runtime Argument Augmentation (RAA), that allows smart contracts to communicate with external data services before submitting a transaction. RAA has use cases beyond HMS and can serve as a lightweight replacement for blockchain oracles.
İbrahim Korkmaz Kahraman, Habib Küçükşahin, Emin ÇAĞLAK
Forecasting models based on the assumption that returns are normally distributed do not perform sufficiently on shallow markets. These models are more likely to fail in the estimation of the extreme points that can be reached especially at high volatility markets, and this situation is led to investors in predicting volatility. In the volatility forecasting of crypto money, which is seen as an alternative investment tool for the financial investors, single volatility models such as, ARCH, GARCH, T-GARCH, GARCH-M, E-GARCH, and I-GARCH and long memory models (AP-GARCH and C-GARCH) was utilized. In addition, the most suitable model was tried to be tested among the models used for volatility estimation. In this context, the price data of Bitcoin, Ethereum and Ripple cryptocurrency with the highest market value in the crypto money market have been utilized between 24/08/2016-07/05/2018. According to the results of the research, for Bitcoin and Ethereum, the volatility effect of the shocks is permanent and the effect of the positive shocks is more than that of the negative shocks, whereas for Ripple, the volatility effect of the shocks is transient and the passivity of the volatility is short.
Oliver Stengele, Andreas Baumeister, Pascal Birnstill, Hannes Hartenstein
The integrity of executable binaries is essential to the security of any device that runs them. At best, a manipulated binary can leave the system in question open to attack, and at worst, it can compromise the entire system by itself. In recent years, supply-chain attacks have demonstrated that binaries can even be compromised unbeknownst to their creators. This, in turn, leads to the dissemination of supposedly valid binaries that need to be revoked later.
João Antônio Aparecido Cardoso, Felipe Takeshi Ishizu, Jeferson Tadeu De Lima, Jefferson de Souza Pinto
Goal: The present work aims to present how the use of a blockchain two-factor authentication solution 2FA on a page developed on WordPress can contribute to the information security regarding user authentication. Design/Methodology/Approach: The research method employed is characterized as an exploratory research, since all the analysis is based on the theoretical reference data available on the subject. A field research was carried out in relation to the implementation of the multi-factor authentication plugin Hydro Raindrop MFA, which uses blockchain technology offered by The Hydrogen Technology Corporation and the Project Hydro platform over the Ethereum network. Thus, this paper sought to present and conceptualize some of the technologies used, pointing out their contribution to information security. Results: The main results showed that the use of decentralized technology, such as blockchain and the Hydro Raindrop Plugin, can contribute considerably in the process of user authentication, which may strengthen the safeguard of the information and assets of individuals and organizations by inhibiting or reducing the possibility of successful a hacker attack. This solution is at the forefront of innovation with regard to data security because it uses advanced blockchain technology. It might contribute in a satisfactory way to the preservation of critical data and information that are the core value of many organizations of the industry 4.0. Limitations of the investigation: This research was limited to analyzing how the implementation of the Hydro Raindrop multi-factor authentication solution on a WordPress page can be beneficial to ensure information security. Practical implications: This study’s findings can contribute to entities interested in cybersecurity. As a suggestion for future works, analyses of plugins or similar solutions available on the market in distinct types of websites, or performance comparisons between them, may be relevant to contribute to scientific research. Originality/Value: This work can contribute in an innovative way to scientific research, since it addresses a recently created solution that uses blockchain technology as its basis for a safer method of authentication.
Smart contracts are autonomous software executing predefined conditions. Two of the biggest advantages of the smart contracts are secured protocols and transaction costs reduction. On the Ethereum platform, an open-source blockchain-based platform, smart contracts implement a distributed virtual machine on the distributed ledger. To avoid denial of service attacks and monetize the services, payment transactions are executed whenever code is being executed between contracts. It is thus natural to investigate if predictive analysis is capable to forecast these interactions. We have addressed this issue and propose an innovative application of the tensor decomposition CANDECOMP/PARAFAC to the temporal link prediction of smart contracts. We introduce a new approach leveraging stochastic processes for series predictions based on the tensor decomposition that can be used for smart contracts predictive analytics.
Victor Zakhary, Mohammad Javad Amiri, Sujaya Maiyya, Divyakant Agrawal · 5 authors
Permissionless blockchains (e.g., Bitcoin, Ethereum, etc) have shown a wide success in implementing global scale peer-to-peer cryptocurrency systems. In such blockchains, new currency units are generated through the mining process and are used in addition to transaction fees to incentivize miners to maintain the blockchain. Although it is clear how currency units are generated and transacted on, it is unclear how to use the infrastructure of permissionless blockchains to manage other assets than the blockchain's currency units (e.g., cars, houses, etc). In this paper, we propose a global asset management system by unifying permissioned and permissionless blockchains. A governmental permissioned blockchain authenticates the registration of end-user assets through smart contract deployments on a permissionless blockchain. Afterwards, end-users can transact on their assets through smart contract function calls (e.g., sell a car, rent a room in a house, etc). In return, end-users get paid in currency units of the same blockchain or other blockchains through atomic cross-chain transactions and governmental offices receive taxes on these transactions in cryptocurrency units.
Developments in Blockchain, smart contract, and decentralized application (“dApps”) technology have enabled new types of software that can improve efficiency within law firms by increasing speed at which attorneys may draft and execute contracts. Smart contracts and dApps are self-executing software that reside on a blockchain. Custom smart contracts can be built in a modular manner in order to emulate contracts that are commonly generated and executed in law firms. Such contracts include those for the transfer of services, goods, and title. This article explores exactly how implementations of smart contracts for law firms may look.
Automatic test generation typically aims to generate inputs that explore new paths in the program under test in order to find bugs. Existing work has, therefore, focused on guiding the exploration toward program parts that are more likely to contain bugs by using an offline static analysis. In this paper, we introduce a novel technique for targeted greybox fuzzing using an online static analysis that guides the fuzzer toward a set of target locations, for instance, located in recently modified parts of the program. This is achieved by first semantically analyzing each program path that is explored by an input in the fuzzer's test suite. The results of this analysis are then used to control the fuzzer's specialized power schedule, which determines how often to fuzz inputs from the test suite. We implemented our technique by extending a state-of-the-art, industrial fuzzer for Ethereum smart contracts and evaluate its effectiveness on 27 real-world benchmarks. Using an online analysis is particularly suitable for the domain of smart contracts since it does not require any code instrumentation---instrumentation to contracts changes their semantics. Our experiments show that targeted fuzzing significantly outperforms standard greybox fuzzing for reaching 83% of the challenging target locations (up to 14x of median speed-up).
In this paper we propose and analyze a community-driven platform for flexibility provision based on a distributed ledger. We introduce and analyze the platform for the use case of a self-organized decentralized virtual power plant consisting of a local community of individual prosumers with photovoltaic-storages located on a low voltage feeder. Like a virtual power plant, it aggregates small-scale assets and is able to provide ancillary services in the form of active power provision to the electrical power system. However, the decentralized virtual power plant provides a direct flexibility market access of the distributed assets without the need for a third party. Thus, balancing group managers or system operators can directly interact with the distributed assets in an aggregated way without the need for an aggregator. The solution approach uses a heuristic algorithm for the coordination combined with a distributed ledger and democratic consensus within the community. We propose the concept in detail, describe the prototypical implementation based on a consortium Ethereum blockchain and discuss results of the proof-of-concept. Our numerous test runs with up to 20 participants showed that the coordinated flexibility provision, energy sharing and according financial settlement works in practice, but would need an upgrade concerning the smart-meter hardware for an implementation in the field. We analyze the impact of the coordination interval on the community self-sufficiency and determine that one minute intervals are enough to reach 96% of the optimum. We evaluate the storage and communication effort and conclude with suggestions for future improvements and other possible applications of the decentralized platform like aggregated flexibility coordination between balancing group managers and system operators.