In recent years, Ethereum, which is a leading application for realizing blockchain services, has received much attention for its usability and functionality. Ethereum executes smart contracts and arbitrary programmable calculations, in addition to cryptocurrency trading. However, cyberattacks target misconfigured Ethereum clients with application programming interface (API) enabled, specifically JSON-RPC. Herein, we propose EtherWatch, a framework to detect and analyze malicious and/or suspicious Ethereum accounts using three data sources (a honeypot, an internet-wide scanner, and a blockchain explorer). The honeypot, named Etherpot, leverages a proxy server placed between a real Ethereum client and the internet. It modifies client responses to attract attackers, identifies malicious accounts, and analyzes their behaviors. Using scan results from Shodan, we also detect suspicious Ethereum accounts registered on multiple nodes. Finally, we utilize Etherscan, a well-known blockchain explorer, to track and analyze the activities of the detected accounts. During six weeks of observations, we discovered 538 hosts attempting to call JSON-RPC of our honeypots using 41 types of methods, including a type of unreported attack in the wild. Specifically, we observed account hijacking, mining, and smart contract attacks. We detected 16 malicious accounts using the honeypots and 64 suspicious accounts from the Shodan scan results, with five overlapping accounts. Finally, from Etherscan, we collected records of activities related to the detected accounts, including transactions of 21.50 ETH and mining of 22.61 ETH (equivalent to 39,494 US$ and 41,533 US$, respectively, as of June 9, 2023).
Nan Xiao, Zhaoshun Wang, Xiaoxue Sun, Junfeng Miao
To address challenges in digital evidence collection and responsibility determination for industrial safety accidents involving industrial Internet of Things (IIoT) device nodes, this paper proposes a blockchain-based digital forensic scheme within the IIoT communication architecture. The scheme utilizes a decentralized blockchain storage mechanism to enable remote storage of digital forensic data. Additionally, it leverages smart contract mechanisms to facilitate efficient retrieval and tracing of related evidence chains. To enhance data security of IIoT device nodes, a token mechanism is implemented for access control. Moreover, to meet real-time evidence acquisition requirements in IIoT, an efficient batch consensus mechanism is proposed. Experimental simulations demonstrate the superiority of the novel consensus algorithm compared to the traditional Delegated Proof-of-Stake (DPOS) consensus in the proposed scheme for the IIoT environment. It meets speed requirements for evidence collection, ensuring tamper-proof, non-repudiable, and permanent storage of digital forensic data. Consequently, the application of blockchain technology for judicial access and evidence storage has made significant contributions to digital forensics within the IIoT context.
Kai Ma, Jintao Huang, Ningyu He, Zhuo Wang · 5 authors
Non-fungible tokens (NFTs) drive the prosperity of the Web3 ecosystem. By November 2023, the total market value of NFT projects reached approximately 16 billion USD. Accompanying the success of NFTs are various security issues, i.e., attacks and scams are prevalent in the ecosystem. While NFTs have attracted significant attentions from both industry and academia, there is a lack of understanding of kinds of NFT security issues. The discovery, in-depth analysis, and systematic categorization of these security issues are of significant importance for the prosperous development of the NFT ecosystem. To fill the gap, we performed a systematic literature review related to NFT security, and we have identified 142 incidents from 213 security reports and 18 academic papers until October 1st, 2023. Through manual analysis of the compiled security incidents, we have classified them into 12 major categories. Then we explored potential solutions and mitigation strategies. Drawing from these analyses, we established the first NFT security reference frame. Except, we extracted the characteristics of NFT security issues, i.e., the prevalence, severity, and intractability. We have indicated the gap between industry and academy for NFT security, and provide further research directions for the community. This paper, as the first SoK of NFT security, has systematically explored the security issues within the NFT ecosystem, shedding light on their root causes, real-world attacks, and potential ways to address them. Our findings will contribute to the future research of NFT security.
Arlen Brickman, Yiğit Baykara, Miguel Carabaño, Sean Hacking
Background: Distributed ledger technology (DLT) enables the creation of tamper-resistant, decentralized, and secure digital ledgers. A non-fungible token (NFT) represents a record on-chain associated with a digital or physical asset, such as a whole-slide image (WSI). The InterPlanetary File System (IPFS) represents an off-chain network, hypermedia, and file sharing peer-to-peer protocol for storing and sharing data in a distributed file system. Today, we need cheaper, more efficient, highly scalable, and transparent solutions for WSI data storage and access of medical records and medical imaging data. Methods: WSIs were created from non-human tissues and H&E-stained sections were scanned on a Philips Ultrafast WSI scanner at 40× magnification objective lens (1 μm/pixel). TIFF images were stored on IPFS, while NFTs were minted on the Ethereum blockchain network in ERC-1155 standard. WSI-NFTs were stored on MetaMask and OpenSea was used to display the WSI-NFT collection. Filebase storage application programing interface (API) were used to create dedicated gateways and content delivery networks (CDN). Results: A total of 10 WSI-NFTs were minted on the Ethereum blockchain network, found on our collection "Whole Slide Images as Non-fungible Tokens Project" on Open Sea: https://opensea.io/collection/untitled-collection-126765644. WSI TIFF files ranged in size from 1.6 to 2.2 GB and were stored on IPFS and pinned on 3 separate nodes. Under optimal conditions, and using a dedicated CDN, WSI reached retrieved at speeds of over 10 mb/s, however, download speeds and WSI retrieval times varied significantly depending on the file and gateway used. Overall, the public IPFS gateway resulted in variably poorer WSI download retrieval performance compared to gateways provided by Filebase storage API. Conclusion: Whole-slide images, as the most complex and substantial data files in healthcare, demand innovative solutions. In this technical report, we identify pitfalls in IPFS, and demonstrate proof-of-concept using a 3-layer architecture for scalable, decentralized storage, and access. Optimized through dedicated gateways and CDNs, which can be effectively applied to all medical data and imaging modalities across the healthcare sector. DLT and off-chain network solutions present numerous opportunities for advancements in clinical care, education, and research. Such approaches uphold the principles of equitable healthcare data ownership, security, and democratization, and are poised to drive significant innovation.
Recently, smart contracts were introduced as a necessity to automatically execute specific operations within blockchain systems. The popularity and diversity of blockchain systems attracted intensive attentions from academia, industry and other sectors. Blockchain systems were implemented using different programming languages that used in defining the triggering events and their consequent actions within the smart contract. In this article, we propose a digital evidences preservation framework that supports logic-based smart contracts to manage entries associated with digital evidences. Combining logic-based approach and blockchain systems may result in ensuing contracts that have technical advantages over procedural coding. The paper shows the motivation for choosing logic-based approach to define a smart contract. We introduce the rules and structure of the proposed logic-based contract.
Deebakkarthi Chinnasame Rani, Sai Ganesh Janakiraman, K. S. Chandra, Elambharathi Padmavathi Thangavel · 7 authors
Presented herein is a novel algorithm for multi-round, zero-knowledge proof (ZKP), devised specifically for authenticating factorisation proofs within a variety of cryptographic applications. This advanced algorithm, while maintaining computational complexity within acceptable bounds, offers a secure and proficient solution. The functionality of the algorithm is marked by multiple rounds of interaction between the Prover and Verifier. Initially, the Prover generates a random value and calculates a commitment. Subsequently, the Verifier issues a random challenge, eliciting a computed response from the Prover. To validate the proof, the Verifier verifies the equality of the commitment and the computed response. Efficaciousness of the proposed multi-round ZKP algorithm is demonstrated across diverse input sizes and parameters. Results indicate a success rate exceeding 90% on average, showcasing the robustness of the method. The recurring interaction between the Verifier and Prover enhances the Prover's authentication, thereby improving the algorithm’s reliability. Implementation of the algorithm, achievable through standard cryptographic tools and protocols, can fortify the security of multiple cryptographic applications. A significant application can be found in Digital Identity Management Systems (DIMS). Currently, these systems are vulnerable to a myriad of threats, including identity spoofing, data breaches, and internal security risks. The application of the ZKP algorithm can simultaneously augment security and withhold sensitive information, potentially transforming the DIMS security landscape. Future research may focus on improving the efficiency and scalability of the multi-round ZKP algorithm. There also remains a vast potential for exploring additional applications of this technique within various cryptographic domains.
Digital forensics, a crucial subset of cybersecurity, encompasses sophisticated tools and methodologies for the interpretation, analysis, and investigation of digital evidence, facilitating the identification and mitigation of cybercrimes and security breaches. With the advent of cryptocurrencies, an array of unique challenges has emerged in the domain of digital forensic investigations. This review elucidates the prevailing state of digital forensic practices vis-Ã -vis cryptocurrencies, emphasizing the obstacles and limitations inherent in probing decentralized and intricate technologies. Notable deficiencies in extant investigative practices were observed. Solutions proffered encompass the formulation of novel software applications tailored for cryptocurrency analyses, the integration of machine learning and artificial intelligence capabilities, and the employment of advanced analytics to discern patterns and irregularities within blockchain transactions. Furthermore, a pioneering methodology, merging traditional digital forensic strategies with blockchain-specific techniques, is posited for efficacious cryptocurrency inquiries. The analysis underscores the imperative for a renewed paradigm in digital forensic examinations to surmount the challenges integral to cryptocurrency probes. By forging novel methodologies and standardizing investigative procedures, support for legal enforcement endeavors can be enhanced, facilitating the efficacious detection and prosecution of cryptocurrency-associated misdemeanors.
Eleonora Rosati is a Professor of Intellectual Property Law at Stockholm University (Sweden) and Of Counsel at Bird & Bird in Milan (Italy). The present contribution is a re-publication of a study prepared at the request of the World Intellectual Property Organization and published under the same title on 1 September 2023. Over time, technological advancements have resulted in novel ways both to exploit content and to infringe rights—including intellectual property rights (IPRs)—vesting in them. Legislative instruments have consistently clarified that pre-existing rights continue to apply to new media, ie, means to disseminate intangible assets, including in digital and online contexts. In terms of rights enforcement, however, the progressive dematerialization of content and dissemination modalities has given rise to challenges, including when it comes to determining where an alleged IPR infringement has been committed. This study seeks to answer the following questions: (1) Can the same criteria and notions developed in relation to other dissemination media find application in the context of IPR infringements carried out through and within the metaverse? (2) Does the distinction between centralized and decentralized metaverses have substantial implications for the localization of IPR infringements? The first question is answered in the affirmative. In relation to the second question, it is submitted that the distinction between centralized and decentralized metaverses—while of substantial relevance to the determination of enforcement options—may not have significant implications insofar as the localization of IPR infringements is concerned. Over time, technological advancements have resulted in novel ways both to exploit content and to infringe rights—including intellectual property rights (IPRs)—vesting in them. Legislative instruments have consistently clarified that pre-existing rights continue to apply to new media, ie, means to disseminate intangible assets, including in digital and online contexts. In terms of rights enforcement, however, the progressive dematerialization of content and dissemination modalities has given rise to challenges, including when it comes to determining where an alleged IPR infringement has been committed. The importance of such an exercise cannot be overstated: it is inter alia key to determining (i) whether the right at issue (eg, a registered IPR) is enforceable at the outset, (ii) which law applies to the dispute at hand as well as—in accordance with certain jurisdictional criteria—(iii) which courts are competent to adjudicate it. For example, determining that the relevant infringement has been committed in country A serves in turn to determine (i) if the right at issue is enforceable at all, given that IPRs are territorial in nature. So, if the IPR in question is a national trade mark, the infringement needs to be localized in the territory of the country where the right is registered; (ii) whether, eg, country A’s law is applicable to the dispute at hand and (iii) if, eg, the courts in country A have jurisdiction to adjudicate the resulting dispute. This said, questions of applicable law and jurisdiction should not be conflated. Answering the former serves to ensure that a court does not have to apply more than one law, but rather on the of infringement to the law applicable to the such a to ensure that one law is applicable does not in the context of jurisdiction which for more than one The localization exercise has to be when the is committed in a digital online For infringements in courts the have developed to the the where (i) the the (ii) the content be and (iii) the is of criteria are of has in the of on a of including of relevant of an in a national is to is a substantial with a given is it is the the of to the and more of not is that such a be the rise of and for digital In the progressive of the be the of has for it has been to the of the new it is that the be and the of the and In metaverses have been developed which centralized and The distinction is on whether the at issue is and a eg, a whether it is a and decentralized eg, a decentralized as it to the of as the to has the to new to the and application of the criteria The present study is with the of such a study seeks to answer the following questions: the same criteria and notions developed in relation to other dissemination media find application in the context of IPR infringements carried out through and within the Does the distinction between centralized and decentralized metaverses have substantial implications insofar as the localization of IPR infringements is The IPRs are trade and The is to infringements committed of and an and on are and as such an it is that a is through which the questions at the of the present study be answered in terms that are as and as to of relevance to the question of of IPRs online and in the is the of the be and in the alleged IPR infringement that not but the of other than the including are to The study is as and the to the present as well as relevant and of the relevant for the localization of IPR infringements in to and as well as national This a distinction between and registered on digital and online and and on localization for the of determining applicable law where A of the criteria on and of infringement be and the of resulting is with the of and whether the of the find application in relation to new at in as the questions are the one whether the same criteria and notions developed in relation to other media find application in the context of IPR infringements carried out through and within the metaverses is answered in the affirmative. is submitted that the distinction between centralized and decentralized metaverses—while of substantial relevance to the determination of enforcement options—may not have significant implications insofar as the localization of IPR infringements is concerned. study as a as the courts in in relation to to for the localization of IPR including committed through the are the that substantial in terms of that to a with a given for the of both determining applicable law and the of and enforcement the question whether the has for a more of both at the a of the is a means of a on a to a is a is a between the and of the on the one hand and the rights and to online on the are to to the through to the territorial of the relevant that it more to online in that at the of of the in a for a on the of under law for the of The has which is the second of the that with the of and media and an more than be is to in the and not the more of have not and the application and enforcement of IPRs to inter alia the the of an IPR infringement is The importance of such a which be means of the infringement of both and registered IPRs in cannot be overstated: it is inter alia key to determining (i) whether the right at issue (eg, a registered IPR) is enforceable at the outset, (ii) which law applies to the dispute at hand as well as—in accordance with certain jurisdiction criteria—(iii) which courts are competent to adjudicate it. answer it be to a the answer to the following the the the the and the have in it has been are media in the of the are means to disseminate not in a new media have new ways to exploit content and with infringe relevant rights has not relevant and to be and the have to be not to new and have been the to both the and of In terms of and and courts have consistently IPRs applicable to the of through new as an example, the World Intellectual Property Organization and and at to and of on the other digital other the and clarified that pre-existing rights continue to apply in the digital not In courts have consistently rights enforceable in digital and online contexts. So, in which the the the has both the relevant rights to the and and applicable in and The same is for that not the rights the for example, not law to to when it the through the of the the under the right has been to be in the context of digital through of the The apply to other IPRs So, the of of a trade for the of infringement has been to courts have not the of rights to in that the to and the as a new of dissemination of content and other in infringement of the IPRs A first in the novel the has been relevant to at of for a Over the of the has been has been technological including the of and the of for digital the to and of the of which is the for and to more than has been the The is to be and the of the and have to the as to the and with and the of advancements and to with the digital the of and with the of such a however, to be For the present it is to that the of does not to a metaverses have been developed which centralized and The distinction is on whether the at issue is and a eg, a whether it is a and decentralized eg, a centralized metaverses content is and to the in accordance with the terms of in decentralized metaverses is to the in relation to such content with the relevant content the that of a as a is and of to be between the of a and that of with the that the of of a to that of a the application of IPRs to media is determining the of an issue that has given rise to when the of such rights in is the one to the localization of alleged infringements as a of In the localization of the infringement to the in which the is to as a of the law applicable to the The localization of the infringement in is relevant to the of the of within the territorial of the and to the jurisdiction of the court the of within the territorial jurisdiction of the In however, questions of applicable law and jurisdiction should not be conflated. Answering the former serves to ensure that a court does not have to apply more than one law, but rather on the of infringement to the law applicable to the such a to ensure that one law is applicable does not in the context of jurisdiction which for more than one be in in online the between centralized and decentralized has given rise to and have been time, present an in terms of In and as an example, has as a to jurisdiction in with to both registered and The localization of the alleged infringement has the of the of the court in accordance with relevant criteria under and national For example, under law, the of the rise to the the where the one of the criteria to jurisdiction under The same is under of the with to between of the both and the courts of the in which the of infringement has been committed inter alia have jurisdiction in relation to the alleged infringement an trade right that the present study seeks to answer the following questions: the same criteria and notions developed in relation to other media find application in the context of IPR infringements carried out through and within the Does the distinction between centralized and decentralized metaverses have substantial implications insofar as the localization of IPR infringements is The IPRs are trade and The is to infringements committed of and an and on be and as such an it is that a is through which the questions at the of the present study be answered in terms that are as and as to of relevance to the question of of IPRs online and in the is the of the be and in the alleged IPR infringement that not but the of other than the including as are to The study is as of in it the relevant for the localization of IPR infringements in to and as well as national a distinction between and registered on digital and online and and on localization for the of determining the territorial of where A of the criteria on the and of infringement be and the of resulting This be relevant to the of the of in the online IPR enforcement with in relation to infringements committed in the including where the and localization of is with the of and whether the of the find application in relation to new at in In for and as a as the courts in in relation to to to the localization of IPR infringements committed through the are the that substantial in terms of that to a with a given for the of both determining applicable law and the of and enforcement the question whether the has for a more of both at the A of which is the of of rights under is territorial nature. In the in given territory on the law of that with to both and This said, the rather and and (eg, in the context of trade a of have the of the between national IPR has not through the of of but in the of IPR enforcement have been on a the a is to the other on enforcement of The in of the are a of following the of the has been a the it and as a IPR enforcement enforcement, have been at the In the the enforcement of in the that it does not that are more to the IPRs with which the present study is and relevant on the localization of a distinction to is that between trade and and registered trade and The present the for infringements of a on the same apply to other the relevant of and national with and enforcement at the the not instruments to a enforcement are the and the in and in the is on the of national and of for of of of the and of first is not that of the a of the of to the localization of The at to and of on the other digital the which with 1 to of the and the as key to and the on and rights the and the to to in and in the both instruments clarified that rights continue to apply in the digital and new online to a certain in to rights in the digital the of on IPRs has in relation to both law for and of and of law determining jurisdiction and applicable law in infringement The former have been through both and The have been through In terms of determination of the law applicable to the infringement of IPRs in in the is in a to determine the applicable law in infringements of the of the of the under The under is relevant to law, the localization of the to The relevant for IPRs and registered national IPRs are in and The in of the is that in a be in the courts of that The in as an that in a be in in to in the courts for the where the The of law in is not to the of the but rather to determine which court has jurisdiction in and in between and to the enforcement of Over time, has a and at it is that the where the be the where the the of the rise to that the be the of the the courts for of is in the law of the and where it is not to a of the should be on the at the rather than that at the of the have in in which the is an localization be that of the country where the relevant has said, the of where to has inter alia implications for the that be the has clarified that if one in an other than the one of of the ie, the where the content is the court is competent to adjudicate on the on that A in with the be in other including law In questions of applicable law are answered in the same as in the given the in in instruments the jurisdiction in be in accordance with a jurisdiction which determining if the is to the where the court is (eg, that the resulting not be under the law of the country where the court is be them. a does not to in the jurisdiction in inter alia needs to be in a which to the of a court to in a on the of the in such a of with inter alia said, the of to jurisdiction with court on of and eg, to the of and where the and the applicable to the to infringement under the in which the alleged infringement an is courts whether to the when determining jurisdiction when the of the are whether the not within the territory to determine law and This said, courts have that it is an under the to content a and the content to the eg, such content for the for registered the to in the of law is a in with the territorial of under law, the localization of the to The relevant for IPRs and registered national IPRs are in and registered the and of the to be in accordance with the law of the country where a national trade is that trade one to to in eg, through application for national in of the concerned. A of the territorial of infringement is not of relevance to it is to that the of for the registered IPRs in the present contribution is to the relevant and and within the and as trade are the under the not eg, the In for a trade to be in relation to and it to the to of the and to with and The of the at the of has the digital in In be the one it not be that for to the other courts in and the of the for to the digital including in the context of and of law developed in that have not a on the localization of IPR infringements and the of the in relation to inter alia national trade for that infringement the of for a of of an be the courts of the in which the of infringement has been committed In the courts of the in which the of infringement is committed have jurisdiction in of of infringement committed within the territory of that with the that the of the territorial jurisdiction of the court is to the that be than if in accordance with where the is The question that is whether, the of of the to infringement the of of infringement within has the same as where the within the In the answered in the that the for jurisdiction to are than within jurisdiction to the courts in the where the to the not in the where such that the in in the such to trade law, it is that the that and of the are not and to where the in is advancements and the of content and the and of have the dissemination and of both and in has a in the in which not content is and but are to the has of in digital have a rights have to a on and the and of content to the with to a has both the between and and and and have in and at both national and In has given rise to insofar as IPR enforcement is including questions of localization of the relevant time, courts have to and and in relation to new and infringement including in the context of eg, infringement In the to of has not resulted in significant of in infringement has more in have criteria to determine (i) the court is competent if it is in a country which the content is (ii) with the courts in the territory where the the and (iii) courts in the territory at which the content is have criteria are in should be that in has as a to determine applicable law and jurisdiction in and in of it be in In relation to both registered and in the of a in to alleged infringements in for of jurisdiction and applicable law has been the of the a certain In the for example, has been the to the infringement of the right and trade is a inter alia the in to the of application of that to of that are not in the A is well under the law of the with the of courts have a in relation to but not to in determining the of the infringement as such when the of the A more of the and is with the in and the the of in which the of infringement the intellectual property right at as to the law of the country where the of at the of the committed have been committed. In the context of online that of the of the of online the for of the said, on in the including to and other the has such a and for a This has been as in relation to (i) the in and in to determine whether the committed for and through a of in a an infringement under the (ii) and the right under of in and and (iii) the right of under of the in of of the in a be eg, the of a certain the content and of the and with in a certain other law and which be it is clarified in the that of the territory be on the at that of one more be on including of a a in that the of the of a relevant an be the of an in the relevant national the of in a in that the of such as in a in that The same that of a the on that be as a substantial to the has been as a to the relevant with the jurisdiction of the court in other For example, courts in the and a that be to the In the courts have consistently the question of whether a is to a country is a which on relevant where a to the the territory of the is territory and is at that be as within the in the of and the of that the of an online be for of to the a and to to the not to in the courts have in other of including trade For example, in the of of and to the in and and and the that to as to the court an for of a trade to of the trade in the territory the registered trade and within the right that if, to the it be that the is at in that the of the the a has been in in relation to the the of of and clarified that of the territory be the to a trade mark, and of the relevant and of the that the localization of the of the alleged IPR infringement be as a jurisdiction This is with to both registered and the has an to the of where the in relation to on a of in the for the of rise to the the has to that such a cannot be as jurisdiction to courts in a in which the alleged has not In the that the rise to the is where the of the for the of the content is In a the one at issue the to such an infringement be localized at the where the that is where the and carried out the to the online on a an been with to national trade in the that the where the rise to the be the where the alleged is This is such a be the where the relevant of infringement relevant be and be a is in with the of in the same in and such an is the of on a to to that present to an enforcement of and rights the jurisdiction the of of the to an to the jurisdiction in The of jurisdiction to the courts in the of the have been both and and the in with the such an In with to online infringement determination of the not be a This is it is more to a under as the has with to jurisdiction within the of infringement for in A has been to the and jurisdiction within insofar as are concerned. that the of is the same as that of for apply with to as the clarified that jurisdiction within is than under of the courts in the where the alleged infringement has been committed have to adjudicate the relevant dispute. of the not be to the of the trade an for on an online that in to be within the of trade law, in an of the application of said, the in and does not and the question of jurisdiction to the of the rise to the it is to the more in and a In the that an for infringement be the courts of the where the the are of whether the for the of the at issue of the to which the rise to the is where the alleged and the of and for not be it jurisdiction of the courts where the is and the jurisdiction of The for of be as in the at which such is of whether a has a is the that courts in that are to whether the alleged infringement does in the clarified the to to and determine the of the court For an of to be at a certain it is not that such are and for to be to other insofar as to with the in which the court of the infringement is is for the court to the of the that of infringement have been committed on the territory of a is it in and be given to the in to of the the of the of a a other than the in the in which the is of with an of on an in to to the that of in other of a other than that of the in which the is of an of in in in as the it is not to determine the of of the at a be the that the the of the of an to A distinction that is relevant to for the of the present is that between of and be not but are to infringe as the are an distinction is The first the of of and as a of In for of in relation to a in the but not the and the that of a of certain of a in an be to not in relation to should the be but at the The second distinction the of of on a does in the be in as are relevant to the of IPRs in the including in in which are to and be the localization of the In the in in with in the context of in and is to to the of For example, if one an of and that terms of a answer insofar as is out of developed through in with the of of for is when on enforcement including are not the A of the on the and localization to and to an and more of the in the enforcement to the of IPRs and the that such a has given rise be in with to IPR localization and enforcement to the In the second of the of of and the for a of the that carried out of The as including has been including in relation to For example, in the which in and insofar as certain are are not for infringements committed of In the the at a and online means of the and of online and the in the have been the of the a example, in law for in relation to including a be that the of has certain as a of the of and relevant For example, the in to with that with the example, in the the a of the it a of law in inter alia a in on the and as the are In the of an in for the in accordance with the as the in a where the content is if it is on the out eg, if the content is on a and is to the The in in which the that such a not been the in and that it is not in application to certain (eg, In however, it should be that other law has the in the but not For example, the application of the in a the of certain as a published on the The that of the the and for a that the of an to determine not have a within the of the In the the has the of the the that the at issue does not an which is such as to it of the In where the relevant is of the be on a In the of means that it be a for to said, in the for the first that the of an that the of content be on a for The clarified that the of of a under on the of which to that the of the is both and to the of whether the (i) technological that be a in the at issue to infringements on and (ii) in content to the (iii) for the of content such which be the that the has a that of to content to the that The that a has that content be is and is the that it on a in the to a if a has a and the has to to that In the the of under trade law with to an online that for
The implementation of distributed ledger technologies and Blockchains has recently become high in various domains, from finance to governance. There are multiple Blockchain frameworks and networks for different use cases but still seems to be a gap in how different frameworks, protocols, and ledgers interact with each other. With the increase in the adoption of Blockchains, there is an increasing need for suitable interoperable solutions so that more value can be provided to the end user. This research focuses on analyzing how current Blockchain bridges are built and evaluating common security risks and countermeasures within the scope of interoperability. A threat model is proposed to analyze blockchain interoperability's various components, vulnerabilities, risks, and corresponding mitigation techniques. Common security vulnerabilities like centralization of trust and vulnerable smart contracts and others were identified and classified based on the kind of bridge component along with possible mitigations. Each solution, like Relays, HTLCs, Notary Schemes, and Smart Contracts, is explored. Thus, the study will help developers understand the risks involved by providing insights and pointing out the need for standardization on Blockchain interoperable solutions.
Maintaining accurate provenance records is paramount in digital forensics, as they underpin evidence credibility and integrity, addressing essential aspects like accountability and reproducibility. Blockchains have several properties that can address these requirements. Previous systems utilized public blockchains, i.e., treated blockchain as a black box, and benefiting from the immutability property. However, the blockchain was accessible to everyone, giving rise to security concerns and moreover, efficient extraction of provenance faces challenges due to the enormous scale and complexity of digital data. This necessitates a tailored blockchain design for digital forensics. Our solution, Forensiblock has a novel design that automates investigation steps, ensures secure data access, traces data origins, preserves records, and expedites provenance extraction. Forensiblock incorporates Role-Based Access Control with Staged Authorization (RBAC-SA) and a distributed Merkle root for case tracking. These features support authorized resource access with an efficient retrieval of provenance records. Particularly, comparing two methods for extracting provenance records - off-chain storage retrieval with Merkle root verification and a brute-force search - the off-chain method is significantly better, especially as the blockchain size and number of cases increase. We also found that our distributed Merkle root creation slightly increases smart contract processing time but significantly improves history access. Overall, we show that Forensiblock offers secure, efficient, and reliable handling of digital forensic data.
Danielle Alves Batista, Ana Mangeth, Isabella Frajhof, Paulo Henrique Alves · 8 authors
Blockchain technology, initially known for its applications in the financial industry, has emerged as a promising solution for various other domains. One prominent area for the use of blockchain-based solutions is forensics, specifically the chain of custody maintenance and control. While there have been numerous research projects exploring the use of blockchain technology in digital forensics, limited attention has been given to its application in controlling of the physical evidence chain of custody. In this research, we aim to explore the literature on the use of blockchain technology to solve problems related to the physical evidence chain of custody. Through a systematic literature review (SLR), we analyzed 26 resources discussing blockchain-based solutions for evidence chain of custody issues, based on requirements that could be applied to both physical and digital evidence. The results showed that there is a lack of studies involving the use of blockchain technology to solve problems related to the physical evidence chain of custody, and future research should focus on solving the issue.
Esa Fauzi, Sy Yuliani, Yenie Syukriyah, Azizah Zakiah
Single Sign-On (SSO) is a mechanism that allows users to access various services using a single set of login credentials. However, in SSO implementations, there are still challenges related to security and authentication management, particularly attacks targeting the Identity Provider (IDP). To address this, the use of Non-Fungible Tokens (NFTs) as proof of IDP ownership has been proposed as a solution to enhance security in the authentication mechanism. The utilization of NFTs in SSO with OpenID Connect and OAuth 2.0 has the potential to improve security and convenience in the authentication process due to the unique and non-duplicable nature of NFTs. The results of this research present a model and design of SSO with NFTs on OpenID Connect and OAuth 2.0. An SSO application with login, register, and password recovery features was also developed to provide convenience to users during the login process. The findings conclude that the utilization of NFTs in SSO with OpenID Connect and OAuth 2.0 has the potential to enhance security and convenience in the authentication mechanism. Further research is needed to explore aspects such as scalability, in-depth security analysis, testing in real-world scenarios, improvement of integration and interoperability, as well as comparative analysis with other SSO technologies.
This paper introduces the Time-Aware LSTM (T-LSTM) model to identify criminal activities involving USDT on wallet addresses within the blockchain ecosystem. The model utilizes a time-aware LSTM architecture to learn the continuous variations in node address features over different transaction time intervals. Additionally, a gating mechanism filters the influence intensity of neighboring transaction node addresses on the central node. The gating mechanism accounts for the transactional correlation strength between node addresses. Finally, a self-attention mechanism is employed to integrate node address features across various transaction timestamps, producing a comprehensive feature representation for the addresses. Experimental results demonstrate that the T-LSTM model effectively captures the dynamic feature changes of node addresses over irregular transaction intervals, outperforming traditional detection models regarding precision, recall, and F1 score on the test set.
The rapid digital revolution in recent decades has resulted in an overwhelming amount of information, particularly in the realm of modern education systems and related materials. This phenomenon, often referred to as information overload, necessitates the development of educational systems that can effectively search, classify, and categorize this vast amount of available information. Of utmost importance for such educational information systems is the safeguarding of personal data, which refers to information that can identify an individual or their family. School records, for example, contain various types of personal data such as the individual’s name, address, contact details, disciplinary history, as well as their grades and progress checks. Even if individuals choose to make this data public, it remains inherently personal. Another category of data involves more sensitive topics such as student biometrics (e.g. fingerprints, photographs), religious beliefs, health information (e.g. allergies), or dietary restrictions, which may imply religious or health-related aspects. Processing data in this category can pose risks to individuals; hence, strict rules and appropriate consent are necessary to ensure their protection. To address these challenges, this research paper proposes a zero-knowledge proof intelligent recommendation system designed to protect students’ data privacy in the digital age. The proposed method incorporates an Intelligent Recommendation System (IRS) that utilizes an optimized version of the Matrix Factorization technique, calculated as an Eulerian Walk chart. Furthermore, the Schnorr Zero-Knowledge Proof format, based on the discrete logarithm problem, ensures the privacy of personal data during message exchange between educational entities.
Frederik Temmermans, Sabrina Caldwell, Symeon Papadopoulos, Fernando Pereira · 5 authors
Advances in media content manipulation and artificially generated content pose new challenges to the assessment of media authenticity. While automated detection methods can provide meaningful insights and decision support in some scenarios, they cannot provide trustworthy and comprehensive information about the origin and provenance of media assets. Therefore, a longer-term approach should rather focus on secure and interoperable annotations related to the creation and provenance of media. In October 2020, the JPEG Committee initiated a standardization exploration named "JPEG Fake Media" to address these needs. Subsequently, since many of the requirements, for example related to secure annotation and identification of media assets, are also relevant to achieve interoperability in Non-Fungible Tokens (NFTs) an additional exploration was initiated, specifically focused on standardization needs for NFTs. In April 2022 a first Call for Proposals on JPEG Fake Media was issued. Based on the responses to the call, a new standardization project named JPEG Trust was initiated to specify an interoperable framework for establishing trust in media production, distribution, and consumption. This paper presents the journey of JPEG to leverage formal methods of standardization in this context, starting from the initial JPEG Fake Media exploration, followed by the subsequent consideration of NFT use cases and requirements, through to the commencement of the new JPEG Trust international standard.
Open access
2 source records
Digital Media Forensic Detection
Advanced Steganography and Watermarking Techniques
Artificial Intelligence Generated Content (AIGC) is one of the latest achievements in AI development. The content generated by related applications, such as text, images and audio, has sparked a heated discussion. Various derived AIGC applications are also gradually entering all walks of life, bringing unimaginable impact to people's daily lives. However, the rapid development of such generative tools has also raised concerns about privacy and security issues, and even copyright issues in AIGC. We note that advanced technologies such as blockchain and privacy computing can be combined with AIGC tools, but no work has yet been done to investigate their relevance and prospect in a systematic and detailed way. Therefore it is necessary to investigate how they can be used to protect the privacy and security of data in AIGC by fully exploring the aforementioned technologies. In this paper, we first systematically review the concept, classification and underlying technologies of AIGC. Then, we discuss the privacy and security challenges faced by AIGC from multiple perspectives and purposefully list the countermeasures that currently exist. We hope our survey will help researchers and industry to build a more secure and robust AIGC system.
Abstract: Electronic First Information Report (e-FIR) is a document filed to the police stations by a victim or accuser when offense is committed. In traditional e-FIR databases, offense’s records can be tampered because of its centralized nature. Also intentional false e-FIR can be registered. Thus, data transparency and integrity is big concern. To overcome this problem e-FIR with decentralized blockchain system can be integrated with e-FIR portal. The main characteristics of the blockchain technology are advanced security and decentralized system. This technology uses the encrypted blocks to make FIR data secured. Proof of Stake (PoS) protocol is used in this system. Users have to submit e-FIR through portal which will be stored in blocks in blockchain. Due to advanced security feature of system, data tampering will be prevented. Integrating such FIR registration system will ensure transparency and enhance data integrity.
Cryptocurrency adalah teknologi sistem kriptografi yang bertujuan untuk mengamankan dan mengatur otoritas dengan menggunakan sistem desentralisasi untuk mengelola pengeluaran unit baru, mencatat transaksi, dan memberikan jaminan keamanan yang tidak dapat diduplikasi atau ditiru. Oleh karena itu, tidak diragukan lagi bahwa penjahat juga telah menggunakan Bitcoin dalam aktivitas ilegal seperti menerima pembayaran dalam kasus pemerasan online, membayar obat-obatan terlarang, insiden ransomware, mendanai terorisme, transaksi di pasar darknet, dan pencucian uang. Kejahatan yang dilakukan dengan menggunakan dompet crypto sebagai wadah berperan dalam tantangan untuk membuktikan dan menganalisis objek digital yang tersimpan di smartphone. Penelitian ini berfokus pada penemuan artefak digital dari perangkat smartphone berdasarkan fakta atau informasi yang diperoleh dari instruksi smartphone. Untuk menemukan bukti digital dari aplikasi dompet cryptocurrency smartphone menggunakan metode DFRWS dan alat oksigen forensik. Berdasarkan hasil penelitian, diperoleh beberapa aktivitas transaksi dompet cryptocurrency tokocrypto. Informasi yang terdapat pada transaksi deposit fiat, penarikan fiat, penarikan crypto, dan penjualan crypto serta beberapa label tidak terdapat pada beberapa transaksi yaitu jenis transaksi, Order Id, Txid, dan alamat wallet.Cryptocurrency adalah teknologi sistem kriptografi yang bertujuan untuk mengamankan dan mengatur otoritas dengan menggunakan sistem desentralisasi untuk mengelola pengeluaran unit baru, mencatat transaksi, dan memberikan jaminan keamanan yang tidak dapat diduplikasi atau ditiru. Oleh karena itu, tidak diragukan lagi bahwa penjahat juga telah menggunakan Bitcoin dalam aktivitas ilegal seperti menerima pembayaran dalam kasus pemerasan online, membayar obat-obatan terlarang, insiden ransomware, mendanai terorisme, transaksi di pasar darknet, dan pencucian uang. Kejahatan yang dilakukan dengan menggunakan dompet crypto sebagai wadah berperan dalam tantangan untuk membuktikan dan menganalisis objek digital yang tersimpan di smartphone. Penelitian ini berfokus pada penemuan artefak digital dari perangkat smartphone berdasarkan fakta atau informasi yang diperoleh dari instruksi smartphone. Untuk menemukan bukti digital dari aplikasi dompet cryptocurrency smartphone menggunakan metode DFRWS dan alat oksigen forensik. Berdasarkan hasil penelitian, diperoleh beberapa aktivitas transaksi dompet cryptocurrency tokocrypto. Informasi yang terdapat pada transaksi deposit fiat, penarikan fiat, penarikan crypto, dan penjualan crypto serta beberapa label tidak terdapat pada beberapa transaksi yaitu jenis transaksi, Order Id, Txid, dan alamat wallet.
Recent years have witnessed explosive growth in blockchain smart contract applications. As smart contracts become increasingly popular and carry trillion dollars worth of digital assets, they become more of an appealing target for attackers, who have exploited vulnerabilities in smart contracts to cause catastrophic economic losses. Notwithstanding a proliferation of work that has been developed to detect an impressive list of vulnerabilities, the bad randomness vulnerability is overlooked by many existing tools. In this paper, we make the first attempt to provide a systematic analysis of random numbers in Ethereum smart contracts, by investigating the principles behind pseudo-random number generation and organizing them into a taxonomy. We also lucubrate various attacks against bad random numbers and group them into four categories. Furthermore, we present RNVulDet - a tool that incorporates taint analysis techniques to automatically identify bad randomness vulnerabilities and detect corresponding attack transactions. To extensively verify the effectiveness of RNVulDet, we construct three new datasets: i) 34 well-known contracts that are reported to possess bad randomness vulnerabilities, ii) 214 popular contracts that have been rigorously audited before launch and are regarded as free of bad randomness vulnerabilities, and iii) a dataset consisting of 47,668 smart contracts and 49,951 suspicious transactions. We compare RNVulDet with three state-of-the-art smart contract vulnerability detectors, and our tool significantly outperforms them. Meanwhile, RNVulDet spends 2.98s per contract on average, in most cases orders-of-magnitude faster than other tools. RNVulDet successfully reveals 44,264 attack transactions. Our implementation and datasets are released, hoping to inspire others.
Cryptocurrency represented by Bitcoin is a very popular topic in recent years. However, the prosperity of cryptocurrency drives an increasing number of applications published. Some malicious or vulnerable programs are also detected and reported these years. To do a deeper study into security of cryptocurrency application, this paper learns common vulnerabilities, threat models inside normal applications, and taint analysis, a useful vulnerability-detecting tool, concludes a common and useful methodology for threat detection in application programs, especially Android apps. This approach uses static taint analysis to detect vulnerabilities inside a given Android application, classify them into common vulnerability categories and then make conclusions. This paper does research in analyzing statistics of threats in common cryptocurrency apps in Google play store and draw conclusions on the status of cryptocurrency software as well. Finally, some suggestions are provided at the end of this paper. These recommendations apply to application programmers, app store administrators, scholars and experts in related area, government officer and users. This set of analysis process can be applied to analyze any type of application programs.
Abstract The South African Local Government (SALG) uses the tendering system to procure goods and services. Some of these tendering projects are aimed at promoting socio-economic and industrial policies. Hence, the tendering system used by SALG should be fair, transparent, competitive, cost-effective, equitable, and free from corruption. However, the mismanagement of the tendering system might lead to interruption of operations, late service delivery, rising costs, and most importantly, fraud and corruption. The use of paperwork to share project information might lead to the mismanagement of the tendering project because it might contribute towards illicit altering of project information during the process. The purpose of this study is to develop a Blockchain prototype that might be used to securely share project information with all the parties interested in the tendering project. It is recommended that the adoption of the proposed solution will enable various organisations to have access to real-time data, allowing them to have access to the entire project history regardless of their geographical location. Access to real-time data would promote real-time auditing and digital forensic investigations because both auditors and investigators will have access to credible digital evidence or project information of their interest in real-time.
Digital evidence plays an essential role in meeting the forensic need to uncover cybercrime and search for trace information of perpetrators. Digital evidence is vulnerable to system changes, human error, theft, deletion, and data manipulation, requiring security efforts to maintain authenticity. This study offers optimization of the chain of custody systems to maintain digital evidence integrity using authentication applications connected to the website server database. The design of the chain of custody system uses blockchain technology and K-means clustering algorithm. This research process consists of two stages. The first stage is the prototype of blockchain-based user access authentication applications. The second stage is the implementation of K-means clustering to determine the place of data storage according to its classification. The results of this study are the maximum security for blockchain-based chain of custody with the efficiency value of this application of 94.73% and the system load value of 0.223%. The total cost of deploying the application is 0.026702786 ETH. Based on this research can help to secure digital evidence information.