The Bitcoin peer-to-peer network ensures the consensus between the different nodes responsible for the propagation of the blocks containing the validated bitcoin transactions. The quality and safety of this network are therefore particularly essential. In this work, we present a study of the public nodes that form the backbone of the Bitcoin p2p network. We analyze the results of our measurement campaign that was made following a well-defined and reproducible methodology. In particular we analyze several criteria that can affect the network resilience: distribution and security assessment of the clients' versions, churn, detection of Sybil nodes, dynamicity and popularity of peers. We also investigate the countermeasures deployed to prevent an accurate inference of the network topology and show their effectiveness.
Eduardo Takeo Ueda, Marcelo Moro Da Silva, Anderson Silva, Norisvaldo Ferraz · 8 authors
Transparency and security in an electoral process are fundamental to the legitimacy of the results and the confidence of voters. Thus, it is necessary to assess opportunities to improve traditional voting systems. Among the main problems is the lack of transparency, due to the impossibility of a voter checking their vote and the lack of access to the source from which the results are obtained. Another problem is mobility, due to the impossibility of performing remote voting, as traditional voting systems continue to require the physical presence of the voter in an electoral zone. Thus, the objective of this work is to propose a voting system that is functional, transparent, safe, and accessible to everyone. Voters can vote through a mobile application with biometric authentication using fingerprint and password access. In our proposal, votes are registered in an Ethereum Blockchain through a Smart Contract, allowing the voter to check their vote. The results are expected to collaborate with the evolution of studies necessary to improve traditional voting systems, especially in fundamental aspects such as security, transparency, and mobility.
U ovom diplomskom radu je izrađena mobilna aplikacije za glasovanje koristeći blockchain tehnologiju. Aplikacija pruža funkcionalnost kreiranja vlastitih izbora i glasovanje na drugim izborima preko skeniranja QR koda ili unosom adrese glasovanja. Za autentikaciju je korišten Firebase servis dok je za pohranu podataka korišten ethereum blockchain uz pomoć alata Truffle, Ganache, web3 i Solidity programskog jezika. Mobilna aplikacija je kreirana unutar Flutter programskog okvira po DDD arhitekturalnom dizajnu programske podrške. Kroz rad je opisano i trenutno stanje elektroničkog glasovanja i njegove tehnologije, doprinos blockchaina konceptu mobilnog glasovanja i sigurnosne mane ovakvog načina glasovanja.
In a competitive market, online auction systems enable optimal trading of digital products and services. Bidders can participate in existing blockchain-based auctions while protecting the confidentiality of their bids in a decentralized, transparent, secure, and auditable manner. However, in a competitive market, parties would prefer not to disclose their interests to competitors, and to remain anonymous during auctions. In this paper, we firstly analyze the specific requirements for blockchain-based anonymous fair auctions. We present a formal model tailored to study auction systems that facilitate anonymity, as well as a generic protocol for achieving bid confidentiality and bidder anonymity using existing cryptographic primitives such as designated verifier ring signature. We demonstrate that it is secure using the security model we presented. Towards the end, we demonstrate through extensive simulation results on Ethereum blockchain that the proposed protocol is practical and has minimal associated overhead. Furthermore, we discuss the complexity and vulnerabilities that a blockchain environment might introduce during implementation.
Open access
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Johann Stockinger, Bernhard Haslhofer, Pedro Moreno-Sánchez, Matteo Maffei
We present a first measurement study on two popular wallets with built-in distributed CoinJoin functionality, Wasabi and Samourai, in the context of the broader Bitcoin ecosystem. By applying two novel heuristics, we can effectively pinpoint 25,070 Wasabi and 134,569 Samourai transactions within the first 689,255 (2021-07-01) blocks. Our study reveals a somewhat steady adoption of these services and found a growing trend with a total amount of 190,777.11 mixed BTC with a value of ca. 3.02 B USD. Within the recent six months, we measured an average monthly mixing throughput of 5410.98 BTC (ca. 240.14 M USD). Among all actors, which were directly or indirectly involved in CoinJoins, we also found a lower-bound of 32 distinct exchanges and traced a lower-bound of 6683.19 BTC (ca. 95.98 M USD) mixed coins received by exchanges. Our analysis further shows that linking heuristics over Wasabi and Samourai transactions allows us to narrow down the anonymity set provided by these wallets over time. Furthermore, we estimate the number of mixing outputs that are handled in Wasabi and Samourai correspondingly over time. Overall, this is the first paper to provide a comprehensive picture of the adoption of distributed CoinJoin and to discuss implications for end-users, cryptoasset exchanges, and regulatory bodies.
Rainer Stütz, Johann Stockinger, Pedro Moreno-Sánchez, Bernhard Haslhofer · 5 authors
We present a first measurement study on the adoption and actual privacy of two popular decentralized CoinJoin implementations, Wasabi and Samourai, in the broader Bitcoin ecosystem. By applying highly accurate (> 99%) algorithms we can effectively detect 30,251 Wasabi and 223,597 Samourai transactions within the block range 530,500 to 725,348 (2018-07-05 to 2022-02-28). We also found a steady adoption of these services with a total value of mixed coins of ca. 4.74 B USD and average monthly mixing amounts of ca. 172.93 M USD) for Wasabi and ca. 41.72 M USD for Samourai. Furthermore, we could trace ca. 322 M USD directly received by cryptoasset exchanges and ca. 1.16 B USD indirectly received via two hops. Our analysis further shows that the traceability of addresses during the pre-mixing and post-mixing narrows down the anonymity set provided by these coin mixing services. It also shows that the selection of addresses for the CoinJoin transaction can harm anonymity. Overall, this is the first paper to provide a comprehensive picture of the adoption and privacy of distributed CoinJoin transactions. Understanding this picture is particularly interesting in the light of ongoing regulatory efforts that will, on the one hand, affect compliance measures implemented in cryptocurrency exchanges and, on the other hand, the privacy of end-users.
Ethereum is a public blockchain platform with smart contract. However, it has transaction privacy issues due to the openness of the underlying ledger. Decentralized mixing schemes are presented to hide transaction relationship and transferred amount, but suffer from high transaction cost and long transaction latency. To overcome the two challenges, we propose the idea of batch accounting, adopting batch processing at the time of accounting. For further realization, we introduce payment channel technology into decentralized mixer. Since intermediate transactions between two parties do not need network consensus, our scheme can reduce both transaction cost and transaction latency. Moreover, we provide informal definitions and proofs of our scheme's security. Finally, our scheme is implemented based on zk-SNARKs and Ganache, and experimental results show that the higher number of transactions in batch, the better our scheme performs.
Open access
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Bitcoin and many other similar Cryptocurrencies have been in existence for\nover a decade, prominently focusing on decentralized, pseudo-anonymous\nledger-based transactions. Many protocol improvements and changes have resulted\nin new variants of Cryptocurrencies that are known for their peculiar\ncharacteristics. For instance, Storjcoin is a Proof-of-Storage-based\nCryptocurrency that incentivizes its peers based on the amount of storage owned\nby them. Cryptocurrencies like Monero strive for user privacy by using\nprivacy-centric cryptographic algorithms. While Cryptocurrencies strive to\nmaintain peer transparency by making the transactions and the entire ledger\npublic, user privacy is compromised at times. Monero and many other\nprivacy-centric Cryptocurrencies have significantly improved from the original\nBitcoin protocol after several problems were found in the protocol. Most of\nthese deficiencies were related to the privacy of users. Even though Bitcoin\nclaims to have pseudo-anonymous user identities, many attacks have managed to\nsuccessfully de-anonymize users. In this paper, we present some well-known\nattacks and analysis techniques that have compromised the privacy of Bitcoin\nand many other similar Cryptocurrencies. We also analyze and study different\nprivacy-preserving algorithms and the problems these algorithms manage to\nsolve. Lastly, we touch upon the ethics, impact, legality, and acceptance of\nimposing these privacy algorithms.\n
Philipp Winter, Anna Harbluk Lorimer, Peter Snyder, Benjamin Livshits
Much of the recent excitement around decentralized finance (DeFi) comes from hopes that DeFi can be a secure, private, less centralized alternative to traditional finance systems but the accuracy of these hopes has to date been understudied; people moving to DeFi sites to improve their privacy and security may actually end up with less of both.
In this work, we improve the state of DeFi by conducting the first measurement of the privacy and security properties of popular DeFi applications. We find that DeFi applications suffer from the same kinds of privacy and security risks that frequent other parts of the Web. For example, we find that one common tracker has the ability to record Ethereum addresses on over 56% of websites analyzed. Further, we find that many trackers on DeFi sites can trivially link a user's Ethereum address with PII (e.g., name or demographic information) or phish users.
This work also proposes remedies to the vulnerabilities we identify, in the form of improvements to the most common cryptocurrency wallet. Our wallet modification replaces the user's real Ethereum address with site-specific addresses, making it harder for DeFi sites and third parties to (i) learn the user's real address and (ii) track them across sites.
Philipp Winter, Anna Harbluk Lorimer, Peter J. Snyder, Benjamin Livshits
Much of the recent excitement around decentralized finance (DeFi) comes from hopes that DeFi can be a secure, private, less centralized alternative to traditional finance systems. However, people moving to DeFi sites in hopes of improving their security and privacy may end up with less of both as recent attacks have demonstrated. In this work, we improve the understanding of DeFi by conducting the first Web measurements of the security, privacy, and decentralization properties of popular DeFi front ends. We find that DeFi applications -- or dapps -- suffer from the same security and privacy risks that frequent other parts of the Web but those risks are greatly exacerbated considering the money that is involved in DeFi. Our results show that a common tracker can observe user behavior on over 56% of websites we analyzed and many trackers on DeFi sites can trivially link a user's Ethereum address with PII (e.g., user name or demographic information), or phish users by initiating fake Ethereum transactions. Lastly, we establish that despite claims to the opposite, because of companies like Amazon and Cloudflare operating significant Web infrastructure, DeFi as a whole is considerably less decentralized than previously believed.
Public Key Infrastructure (PKI) is the fundamental of secure digital communications. It provides a secure means to authenticate identities over the Internet. Symmetric or asymmetric encryption schemes are widely used in identity authentication in any kind of PKI. The conventional PKI has several drawbacks due to the centralized and non-transparent design. Several recent research works utilize blockchain technology to overcome the limitations of conventional implementations of PKI. Blockchain-based PKI integrates blockchain technology with PKI to form a new type of decentralized PKI (DPKI). Several works utilize the currency property in blockchains to implement the reward-and-punishment mechanism. In this paper, we propose a smart contract-based PKI which utilizes the Ethereum smart contract to build a new type of blockchain-based PKI with the reward-and-punishment mechanism using ERC-20 tokens. It has several advantages over previous implementations of similar research that use Ethereum’s main currency—Ether.
Abstract The Bitcoin P2P network currently represents a reference benchmark for modern cryptocurrencies. Its underlying protocol defines how transactions and blocks are distributed through all participating nodes. To protect user privacy, the identity of the node originating a message is kept hidden. However, an adversary observing the whole network can analyze the spread pattern of a transaction to trace it back to its source. This is possible thanks to the so-called rumor centrality , which is caused by the symmetry in the spreading of gossip -like protocols. Recent works try to address this issue by breaking the symmetry of the Diffusion protocol, currently used in Bitcoin, and leveraging proxied broadcast. Nonetheless, the complexity of their design can be a barrier to their adoption in real life. In this work, we propose Clover, a novel transaction relay protocol that protects the source of transaction messages with a simple, yet effective, design. Compared to previous solutions, our protocol does not require building propagation graphs, and reduces the ability of the adversary to gain precision by opening multiple connections towards the same node. Experimental results show that the deanonymization accuracy of an eavesdropper adversary against Clover is up to 10 times smaller compared to Diffusion.
Online voting is a trend that is gaining momentum in modern society. It has great potential to decrease organizational costs and increase voter turnout. It eliminates the need to print ballot papers or open polling stations-voters can vote from wherever there is an Internet connection. Despite these benefits, online voting solutions are viewed with a great deal of caution because they introduce new threats. A single vulnerability can lead to large-scale manipulations of votes. Electronic voting systems must be legitimate, accurate, safe, and convenient when used for elections. Nonetheless, adoption may be limited by potential problems associated with electronic voting systems. Blockchain technology came into the ground to overcome these issues and offers decentralized nodes for electronic voting and is used to produce electronic voting systems mainly because of their end-to-end verification advantages. This technology is a beautiful replacement for traditional electronic voting solutions with distributed, non-repudiation, and security protection characteristics. The following article gives an overview of electronic voting systems based on blockchain technology. The main goal of this analysis was to examine the current status of blockchain-based voting research and online voting systems and any related difficulties to predict future developments. This study provides a conceptual description of the intended blockchain-based electronic voting application and an introduction to the fundamental structure and characteristics of the blockchain in connection to electronic voting. As a consequence of this study, it was discovered that blockchain systems may help solve some of the issues that now plague election systems. On the other hand, the most often mentioned issues in blockchain applications are privacy protection and transaction speed. For a sustainable blockchain-based electronic voting system, the security of remote participation must be viable, and for scalability, transaction speed must be addressed. Due to these concerns, it was determined that the existing frameworks need to be improved to be utilized in voting systems.
Open access
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
For a citizen, voting is the fundamental tool to bring change in the country for good governance, through electing suitable candidates or a party to give them the power to govern. There are many forms of elections be it in the democratic or monarch systems. Each way, the vote has the power to elect the next people’s representatives. For a long time, paper-based voting was the only system being used globally for years; after the dot-com bubble, many countries emerged with electronic voting. But the problems such as security, transparency, and integrity of elections and the voting process are still under question. The issue with paper-based voting was accessibility, voter turns around and tallies, electronic voting has its own advantages and disadvantages such as a single point of failure, trustful systems, and loopholes to forge the electronic voting systems to alter the outcomes. To solve the problems related to the electronic voting process security, integrity, and transparency, an advanced approach is required to adopt. With the advancement of technologies, 4th industry revolution technologies give us Blockchain, Distributed Ledger and Smart Contract types of technologies which may be beneficial to solve the current problems in electronic voting systems. In this paper, we proposed a research-based case study to implement Decentralized Electronic Voting using Smart Contracts (DEV-SC) to solve security, transparency, and integrity-related problems available in the electronic voting process. This will ensure and enhance the voting process easily, trustable, and verifiable.
Caciano dos Santos Machado, Renan R. S. dos Santos, Carla Merkle Westphall
Community networks are prone to free-riders, i.e., participants who take advantage of cooperation from others' routers but do not contribute reciprocally. In this paper, we present HARPIA, a system for credit-based incentive mechanisms for data forwarding in community networks aimed to prevent selfish behavior. HARPIA does not require a trusted third-party or tamper-resistant security modules as in other incentive mechanisms. Instead, it uses a distributed accounting scheme (DPIFA) to estimate the balance of data forwarding contribution and consumption of each network router and settle correspondent cryptocurrency debts on an Ethereum smart contract. On-chain settlement transactions are performed every HARPIA cycle (e.g., daily, weekly, monthly) and must be validated by at least m-of-n network routers using a multi-signature scheme (MuSig). We also realized a performance evaluation, security threat assessment, and cryptocurrency costs estimation. Results show that our proposal is suitable for community networks with up to 64 infrastructure routers under specific m-of-n MuSig thresholds.
Blockchain technology innovatively removes the need for intermediaries and establishes a trust-less trust system by peer-to-peer networks and distributed ledger technology. It is still difficult to clarify the specific degree of decentralization of blockchain even though the decentralized characteristic of the system is derived from this system structure. Namely, the criteria for determining whether decentralized are not well established and do not reflect the real world well. So we propose two approaches to measure the degree of decentralization of blockchain system that currently exists: Censorship resistance and geographical diversity. This paper outlines the meaning of each decentralization quotient and explains how those indices can be applied in respect of the user protection.
Even with all the advances we have seen in secure digital technology, the most secure way to currently cast a vote on election day consist of a hand-marked paper ballot. When extenuating circumstances arise, offering a voting environment that is accessible and safe for everyone, but also secure can be a difficult task under the current voting system. This paper discusses one proposed electronic voting system which uses blockchain technology. Based on a review of literature on blockchain technology and specific implementations of voting systems, a summary of relevant background information as well as implementation protocol are provided. Even though experts believe that societies are not currently ready to implement systems like the one described in this paper, the technology to create a secure and efficient system does exist, and could one day become available.
Open access
Blockchain Technology Applications and Security
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
The Internet of things (IoT) is an active, real-world area in need of more investigation. One of the top weaknesses in security challenges that IoTs face, the centralized access control server, which can be a single point of failure. In this paper, Dynamic-IoTrust, a decentralized access control smart contract based aims to overcome distrusted, dynamic, trust and authentication issues for access control in IoT. It also integrates dynamic trust value to evaluate users based on behavior. In particular, the Dynamic-IoTrust contains multiple Main Smart Contract, one Register Contract, and one Judging Contract to achieve efficient distributed access control management. Dynamic-IoTrust provides both static access rights by allowing predefined access control policies and also provides dynamic access rights by checking the trust value and the behavior of the user. The system also provides to detected user misbehavior and make a decision for user trust value and penalty. There are several levels of trusted users to access the IoTs device. Finally, the case study demonstrates the feasibility of the Dynamic-IoTrust model to offer a dynamic decentralized access control system with trust value attribute to evaluate the internal user used IoTs devices.
IoT group communication allows users to control multiple IoT devices simultaneously. A convenient method for implementing this communication paradigm is by leveraging software-defined networking (SDN) and allowing IoT endpoints to “advertise” the resources that can be accessed through group communication. In this paper, we propose a solution for securing this process by preventing IoT endpoints from advertising “fake” resources. We consider group communication using the constrained application protocol (CoAP), and we leverage Web of Things (WoT) Thing Description (TD) to enable resources’ advertisement. In order to achieve our goal, we are using linked-data proofs. Additionally, we evaluate the application of zero-knowledge proofs (ZKPs) for hiding certain properties of a WoT-TD file.
Smart cities use the Internet of Things (IoT) devices such as connected sensors, lights, and meters to collect and analyze data to improve infrastructure, public utilities, and services. However, the true potential of smart cities cannot be leveraged without addressing many security concerns. In particular, there is a significant challenge for provisioning a reliable access control solution to share IoT data among various users across organizations. We present a novel entitlement-based blockchain-enabled access control architecture that can be used for smart cities (and for any ap-plication domains that require large-scale IoT deployments). Our proposed entitlement-based access control model is flexible as it facilitates a resource owner to safely delegate access rights to any entities beyond the trust boundary of an organization. The detailed design and implementation on Ethereum blockchain along with a qualitative evaluation of the security and access control aspects of the proposed scheme are presented in the paper. The experimental results from private Ethereum test networks demonstrate that our proposal can be easily implemented with low latency. This validates that our proposal is applicable to use in the real world IoT environments.
Blockchain-based voting, including liquid voting, has been extensively studied in recent years. However, it remains challenging to implement liquid voting on blockchain using Ethereum smart contract. The challenge comes from the gas limit, which is that the number of instructions for processing a ballot cannot exceed a certain amount. This restricts the application scenario with respect to algorithms whose time complexity is linear to the number of voters, i.e., O(n). As the blockchain technology can well share and reuse the resources, we study a model of liquid voting on blockchain and propose a fast algorithm, named Flash, to eliminate the restriction. The key idea behind our algorithm is to shift some on-chain process to off-chain. In detail, we first construct a Merkle tree off-chain which contains all voters' properties. Second, we use Merkle proof and interval tree to process each ballot with O(log n) on-chain time complexity. Theoretically, the algorithm can support up to 21000 voters with respect to the current gas limit on Ethereum. Experimentally, the result implies that the consumed gas fee remains at a very low level when the number of voters increases. This means our algorithm makes liquid voting on blockchain practical even for massive voters.
We discuss the problem of facilitating tax auditing assuming "programmable money", i.e., digital monetary instruments that are managed by an underlying distributed ledger. We explore how a taxation authority can verify the declared returns of its citizens and create a counter-incentive to tax evasion by two distinct mechanisms. First, we describe a design which enables auditing it as a built-in feature with minimal changes on the underlying ledger's consensus protocol. Second, we offer an application-layer extension, which requires no modification in the underlying ledger's design. Both solutions provide a high level of privacy, ensuring that, apart from specific limited data given to the taxation authority, no additional information - beyond the information already published on the underlying ledger - is leaked.
Anti-piracy is fundamentally a procedure that relies on collecting data from the open anonymous population, so how to incentivize credible reporting is a question at the center of the problem. Industrial alliances and companies are running anti-piracy incentive campaigns, but their effectiveness is publicly questioned due to the lack of transparency. We believe that full transparency of a campaign is necessary to truly incentivize people. It means that every role, e.g., content owner, licensee of the content, or every person in the open population, can understand the mechanism and be assured about its execution without trusting any single role. We see this as a distributed system problem. In this paper, we present Argus, a fully transparent incentive system for anti-piracy campaigns. The groundwork of Argus is to formulate the objectives for fully transparent incentive mechanisms, which securely and comprehensively consolidate the different interests of all roles. These objectives form the core of the Argus design, highlighted by our innovations about a Sybil-proof incentive function, a commit-and-reveal scheme, and an oblivious transfer scheme. In the implementation, we overcome a set of unavoidable obstacles to ensure security despite full transparency. Moreover, we effectively optimize several cryptographic operations so that the cost for a piracy reporting is reduced to an equivalent cost of sending about 14 ETH-transfer transactions to run on the public Ethereum network, which would otherwise correspond to thousands of transactions. With the security and practicality of Argus, we hope real-world anti-piracy campaigns will be truly effective by shifting to a fully transparent incentive mechanism.
Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Building an electronic voting system that meets legislators' legal criteria has been a long-standing challenge. Distributed ledger technologies are a revolutionary innovation in the field of information technology. Blockchain technologies can be used in an unlimited number of ways to profit from sharing economies. All current electronic voting methods have a fundamental design problem. They're designed to be tightly controlled, which means there seems to be one source in charge of the code base, database, and system outputs, as well as the monitoring tools to ensure the results are accurate. Due to the lack of an independently verified output, these centralized systems struggle to gain the trustworthiness necessary by voters, either restricting voter participation or casting doubt on the election's declared results. The study seeks to use the cryptographic ledger as a safe transaction database to establish an immutable, verifiable, and secure online voting system. Voters will be able to independently audit the inclusion of their vote, as well in the election's overall outcome, using this public ledger, while knowing that the results cannot be altered due to the immutability of the Blockchain.