Xun Deng, Sidi Mohamed Beillahi, Cyrus Minwalla, Han Du · 6 authors
This paper presents OVer, a framework designed to automatically analyze the behavior of decentralized finance (DeFi) protocols when subjected to a "skewed" oracle input. OVer firstly performs symbolic analysis on the given contract and constructs a model of constraints. Then, the framework leverages an SMT solver to identify parameters that allow its secure operation. Furthermore, guard statements may be generated for smart contracts that may use the oracle values, thus effectively preventing oracle manipulation attacks. Empirical results show that OVer can successfully analyze all 10 benchmarks collected, which encompass a diverse range of DeFi protocols. Additionally, this paper illustrates that current parameters utilized in the majority of benchmarks are inadequate to ensure safety when confronted with significant oracle deviations. It shows that existing ad-hoc control mechanisms such as introducing delays are often in-sufficient or even detrimental to protect the DeFi protocols against the oracle deviation in the real-world.
Abstract As a secure distributed ledger technology, blockchain has attracted widespread attention from academia and industry for its decentralization, immutability, and traceability characteristics. This paper proposes a cloud storage key security management scheme based on blockchain. To resist brute-force attacks launched by adversaries on ciphertexts, the scheme uses an oblivious pseudo-random function (OPRF) to generate randomized convergent keys and improve data confidentiality. Second, the scheme enhances the reliability of concurrent key management through a secret sharing mechanism, where convergent keys are split into key fragments and distributed on blockchain for storage. Even if a certain number of key fragments are lost or damaged, users can still recover complete key information through block transaction records. In addition, the scheme effectively supports file-level and block-level data security deduplication. Security analysis and experimental performance evaluation indicate that this scheme can ensure the security of keys and the confidentiality of data, and it has a low computational overhead for generating file-level encryption keys under this scheme. Even for a 100 MB file, the computational overhead required for generating encryption keys is less than 2 s, which improves computational efficiency.
The use of blockchains in the Internet of Things is extremely promising, as it gives connected things the possibility to send and receive payments or tamper-proof data. In the last years, FlyClient has emerged in the literature as a technique for allowing resource constrained devices to verify blockchain transactions. FlyClient is based on Merkle Mountain Ranges (MMRs) and probabilistic sampling, and it allows us to develop blockchain clients whose resource consumption is sublinear with the length of the chain. However, this comes at the cost of a change in the blockchain format, which leads to forks that are politically expensive, because they require 51% consensus. In this paper we explore the possibility of fork-free FlyClient verification methods that leverage smart contract programming. Smart contracts are able to add functionalities to a blockchain without needing forks. This raises several and novel technical issues that we address in the paper. We show that fork-free sublinear clients are feasible without trusting the nodes that invoke the smart contract methods, as long as the smart contract language provides a means to access the most recent block or its hash. As a proof of concept we propose SmartFly, a fork-free FlyClient verification system for the Ethereum Classic blockchain. We measure several performance metrics of SmartFly, proving that it is succinct in storage and bandwidth consumption and economically bearable (about 38 euros per day to maintain the whole system).
Blockchain technology has evolved beyond the use case of electronic cash and is increasingly used to secure, store, and distribute data for many applications. Distributed ledgers such as Bitcoin have the ability to record data of any kind alongside the transfer of monetary value. This property can be used to provide a source of immutable, tamper-evident data for a wide variety applications spanning from the supply chain to distributed social media. However, this paradigm also presents new challenges regarding the scalability of data storage protocols, such that the data can be efficiently accessed by a large number of users, in addition to maintaining privacy for data stored on the blockchain. Here, we present a new mechanism for constructing blockchain transactions using Merkle trees comprised of transaction fields. Our construction allows for transaction data to be verified field-wise using Merkle proofs. We show how the technique can be implemented either at the system level or as a second layer protocol that does not require changes to the underlying blockchain. This technique allows users to efficiently verify blockchain data by separately checking targeted individual data items stored in transactions. Furthermore, we outline how our protocol can afford users improved privacy in a blockchain context by enabling network-wide data redaction. This feature of our design can be used by blockchain nodes to facilitate easier compliance with regulations such as GDPR and the right to be forgotten.
Federated learning (FL), as an effective method to solve the problem of “data island”, has become one of the hot and widespread concern topics in recent years. However, with the using of FL technology in the practical applications, an increasing number of FL tasks make the training management be more complex and the trade-off of multi-task becomes difficult. To overcome this weakness, this work proposes a privacy-preserving FL framework with multi-tasks using partitioned blockchain, which can run several different FL tasks by multiple requesters. First, a temporary committee is formed for an FL task to facilitating visualization, organization and management of security aggregation. Second, the proposed framework combines Paillier homomorphic encryption with Pearson correlation coefficient to protect users' privacy and ensure the accuracy of global model. Finally, a new blockchain-based reward method is presented to inspire participants to share their valuable data. The experimental results show that the global model accuracy of our proposed framework is able to reach 98.43%. Obviously, the proposed framework is more suitable for practical application environment, especially in industrial application field.
Mohd Najwadi Yusoff, Shams Mhmood Abd Ali, Hasan Falah Hasan
Blockchain technology has presented a promisingdecentralized paradigm to precludetrusted third parties' dominancy. It is a transparent and distributed ledger initially designed for digital cryptocurrencies while currently extended to servevarious industries. However, Blockchain immutability presents challenges, as it can be misused for storing illicit content, violating privacy regulations,and limiting data management flexibility. Policy Based Chameleon Hash Function (PBCH) has transformed blockchain rewriting contents concept via permitting modifiers to amend certain transaction since they possessed fundamental privileges satisfying certain access policy. However, PBCHFsuffers from efficiency issues due to its relianceon Chameleon Hash ephemeral Trapdoor (CHET) and Attribute-Based Encryption (ABE), significantly impacting overall efficiency. We propose the Efficient Policy-Based Chameleon (EPBCHF) construction by replacing CHET with Chameleon-Hashes by Dual Long-Term Trapdoors (CHDLTT) to address these challenges.Additionally, we introduce an enhanced encryption scheme resilient against chosen-ciphertext attacks (CCA) without compromising overall efficiency. Modelling EPBCHF proves practical instantiation accompanied by rigorous security proofs. Our construction provides a fine-grained redactable blockchain in comparison to the currently proposed solutions.The evaluated results confirm that the proposed EPBCHF is scalable and efficient due to having the ability to handle unlimited transaction volumes additionally, data is efficiently processed without further overhead meanwhile data size consistency reflects a robust memory management due to predicted memory size, network bandwidth and storage requirement for future growth thereby, EPBCHF is proven to be reliable and scalable.
Federated Learning (FL) has recently arisen as a revolutionary approach to collaborative training Machine Learning models. According to this novel framework, multiple participants train a global model collaboratively, coordinating with a central aggregator without sharing their local data. As FL gains popularity in diverse domains, security, and privacy concerns arise due to the distributed nature of this solution. Therefore, integrating this strategy with Blockchain technology has been consolidated as a preferred choice to ensure the privacy and security of participants. This paper explores the research efforts carried out by the scientific community to define privacy solutions in scenarios adopting Blockchain-Enabled FL. It comprehensively summarizes the background related to FL and Blockchain, evaluates existing architectures for their integration, and the primary attacks and possible countermeasures to guarantee privacy in this setting. Finally, it reviews the main application scenarios where Blockchain-Enabled FL approaches have been proficiently applied. This survey can help academia and industry practitioners understand which theories and techniques exist to improve the performance of FL through Blockchain to preserve privacy and which are the main challenges and future directions in this novel and still under-explored context. We believe this work provides a novel contribution respect to the previous surveys and is a valuable tool to explore the current landscape, understand perspectives, and pave the way for advancements or improvements in this amalgamation of Blockchain and Federated Learning.
NuLink provides privacy-preserving technology for decentralized applications via APIs. Users can securely store its valuable data, trade with others and so on. To ensure the privacy and security of service provided by NuLink, (zero-knowledge) proof systems are necessary. Zero-knowledge proof systems allow the prover to make the verifier believe that a certain conclusion is correct without providing any useful information to the verifier. In NuLink, we are going to use (zero-knowledge) proof system in the following three methods: 1. Users store their data through NuLink in a decentralized manner. To ensure that the storage clients are indeed storing the data, we employ proof of storage systems. In this system, users prepare certain challenges that can only be correctly answered by those who are actually storing the data. 2. Users have the option to outsource computations to NuLink. To verify the correctness of the computation results provided by the compute node, we require the node to provide a proof of correctness via SNARK systems. When sensitive parameters are used as inputs for computation, we utilize zk-SNARKs to prevent any potential leakage of these parameters. 3. Users may choose to trade their data through NuLink. To confirm that the buyer has sufficient digital funds and the seller possesses the desired data, both parties can provide a proof via zk-SNARKs. This builds confidence and prevents cheating during transactions. Using zero-knowledge proof systems, we can ensure that all nodes in NuLink behaves honestly and avoid cheating in the whole system.
Federated learning-based medical data privacy sharing can promote the development of medical industry intelligence, but limited by its own security and privacy deficiencies, federated learning still suffers from a single point of failure and privacy leakage of intermediate parameters. To address these problems, this paper proposes a privacy protection framework for medical data based on blockchain and cross-silo federated learning, using cross-silo federated learning to establish a collaborative training platform for multiple medical institutions to enhance the privacy of medical data, introducing blockchain and smart contracts to realize decentralized federated learning to enhance trust between distrustful medical institutions and solve the problem of a single point of failure. In addition, a secure aggregation scheme is designed using threshold homomorphic encryption to prevent the privacy leakage problem during parameter transmission. The experimental and analytical results show that the accuracy of this paper’s scheme is consistent with the original federated learning scheme, effectively deals with the problems of single-point failure and inference attacks of federated learning, improves system robustness, and is suitable for medical scenarios with more stringent requirements on security and accuracy.
Zero-knowledge proofs (zk-Proofs) are communication protocols by which a prover can demonstrate to a verifier that it possesses a solution to a given public problem without revealing the content of the solution. Arbitrary computations can be transformed into an interactive zk-Proof so anyone is convinced that it was executed correctly without knowing what was executed on, having huge implications for digital currency. Despite this, interactive proofs are not suited for blockchain applications but novel protocols such as zk-SNARKs have made zero-knowledge ledgers like Zcash possible. This project builds upon Wolfram's ZeroKnowledgeProofs paclet and implements a zk-SNARK compiler based on Pinocchio protocol.
Cross-chain dApps (decentralized applications) are enabled by smart contracts interoperability on heterogeneous blockchains. Previous work on cross-chain smart contract invocation has limitations in satisfying compatibility, atomicity, and security simultaneously. To address these limitations, this paper presents a new systemAtomCIthat enables atomic cross-chain smart contract invocations spanning heterogeneous blockchains. Our systemAtomCIis enabled by a synergy of three proposed components: (1) Smart Contract Design Patterns, (2) Cross-chain Expression Protocol, and (3) Cross-chain Service Community, which is based on smart contracts and provides honest and auditable cross-chain service. We implement a prototype ofAtomCIand analyze its security. Extensive results show thatAtomCIimposes reasonable cost and latency of end-to-end cross-chain smart contract invocations, and has less impact of locks on the contract availability. The analysis and evaluation demonstrate thatAtomCIis a promising approach to enable atomic smart contract invocations spanning heterogeneous blockchains.
Blockchain technology has emerged as a cornerstone of se- cure online activities, leveraging an extensive array of cryp- tographic tools. This paper delves into an extensive survey of the current literature on post-quantum secure digital sig- natures, focusing on those with advanced, exotic features that play pivotal roles in the blockchain ecosystem. These signatures serve essential functions, including account man- agement,enhancing consensus efficiency,enabling scriptless blockchains, and fortifying user privacy. The term "exotic" in this context signifies signatures that transcend conven- tional properties such as unforgeability, introducing novel functionalities that redefine the blockchain landscape. Our exploration centers on several such exotic signatures, in- cluding multi-/aggregate, threshold, adaptor, blind, and ring signatures. These cryptographic innovations not only bolster security but also empower blockchain systems in unprece- dented ways.Within this comprehensive treatment of exotic signatures, we engage in discussions surrounding the pre- vailing challenges and chart promising avenues for future research within the post-quantum realm. As quantum threats loom ever closer, our aim is to catalyze further inquiry, facil- itating the broader accessibility of post-quantum cryptogra- phy. This, in turn, will fortify blockchain systems, preparing them to withstand the impending quantum era while fos- tering innovation and excellence in the field of blockchain security.
Lu Zhou, Abebe Diro, Akanksha Saini, Shahriar Kaisar · 5 authors
Identity sharing systems, regardless of their architectural models, share common vulnerabilities. These systems compel users to divulge personal information and furnish proof of identity for accessing services, leaving them susceptible to data breaches that can culminate in identity theft and jeopardize online data security. While blockchain technology offers a potential remedy, delivering enhanced security, immutability, and traceability, it simultaneously raises pertinent concerns surrounding privacy and transparency. The integration of zero-knowledge proof (ZKP) technology has emerged as a promising solution, particularly in enhancing privacy within the transparent blockchain ecosystem. Our paper conducts an exhaustive survey of the existing literature, with a particular focus on the assimilation of ZKP technology into blockchain for the secure sharing of user identities. We undertake a critical evaluation of the advancements achieved in this domain, pinpoint the formidable challenges that must be confronted, and uncover nascent opportunities for further exploration. Our contribution transcends the realms of mere summarization and analysis; we go a step further by offering recommendations drawn from real-world case studies and delineating future research directions.
Abstract Timed-release encryption (TRE) is a cryptographic primitive that can control the decryption time and has significant application value in time-sensitive scenarios. To solve the reliability issue of nodes in existing TRE anonymous interaction schemes, we propose a blockchain-based TRE protocol for anonymous query time trapdoors. In our protocol, the recipient divides the encrypted trapdoor request information into n ciphertext fragments using secret sharing technology near the decryption time, and employs the idea of onion routing to perform layer-by-layer encryption, creating onion-type data transmitted through middlemen selected from the smart contract. After receiving the ciphertext fragments, the time server integrates them to obtain the trapdoor request information and returns the corresponding time trapdoor to the recipient. This allows the recipient to query any time trapdoor anonymously. Our protocol provides a normative design for the smart contract and specific constraints on the participants’ behavior. Compared with the related anonymous query trapdoor schemes, our protocol improves the probability of successful queries. Security analysis shows that our protocol can resist release-ahead attack, interruption attack, eavesdropping attack, and replacement attack. Performance analysis shows that our protocol outperforms related protocols regarding anonymity, efficiency, and flexibility, achieving highly efficient anonymous interactions. Finally, we conducted an experiment in the Ethereum Rinkeby test network. For the settings of ciphertext fragment number $$n=3$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"><mml:mrow><mml:mi>n</mml:mi><mml:mo>=</mml:mo><mml:mn>3</mml:mn></mml:mrow></mml:math> and ciphertext fragment threshold $$t=2$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"><mml:mrow><mml:mi>t</mml:mi><mml:mo>=</mml:mo><mml:mn>2</mml:mn></mml:mrow></mml:math> , the gas consumption for a user to execute the contract was $5.66, which was higher than the contract cost of related schemes, but the contract execution cost was within an acceptable range.
Voice over Internet Protocol (VoIP) networks are vulnerable to caller-ID (caller-identification) spoofing attacks due to the open nature of Session Initiation Protocol (SIP) signaling. Caller-ID spoofing is a critical security threat in modern telecommunication systems, allowing attackers to impersonate legitimate callers and gain access to sensitive information. While these attacks pose a significant threat to the telecom and financial industries, the existing solutions are limited to only closed-circuit options for subscribers of the same service provider. In this paper, we present a novel blockchain-based solution to effectively prevent caller-ID spoofing attacks in real time. Our approach employs a low-latency consensus algorithm to manage and verify end-to-end the caller-ID information of Internet Service Providers (ISPs) and institutions. We propose a two-step verification process, in which the accuracy and integrity of Automatic Number Identification (ANI) information is verified at different stages of the call. The proposed solution initiates a renewal of the ISP registration on every caller-ID change, making it unaffected by unusual situations such as roaming, the use of an IP-PBX (Internet Protocol Private Branch Exchange), or the use of a VPN (Virtual Private Network). We also discuss the proposed solution’s feasibility and potential deployment issues, including its integration into existing RFC (Request for Comments) efforts and the necessary regulations for service providers to demonstrate compliance. Furthermore, we address future research directions, such as handling complex call scenarios such as call forwarding and teleconference calls. Our approach not only improves the security of telecommunication systems but also provides an efficient and scalable solution to prevent caller-ID spoofing attacks.
Email serves as the primary mode of communication in today’s interconnected digital world, encompassing business, education, and interpersonal relationships. However, email’s reliance on shared media makes it susceptible to interception and misuse of confidential data. Pretty Good Privacy (PGP) protects the privacy of email contents to address this problem. While PGP offers encryption, its key sharing has weaknesses. Blockchain technology is characterized by its immutability feature. Once information is stored in the blockchain, altering it becomes extremely difficult. This characteristic serves as a valuable defense against weaknesses in the PGP key sharing system. Furthermore, the implementation of smart contracts eliminates the need for a Man-in-the-Middle when sharing keys, thereby improving the security of key sharing and fostering trust among individuals. Blockchain and smart contracts improve security, but privacy remains a concern. To further bolster privacy protection, in this paper we propose the integration of Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARKs) and blockchain into PGP key sharing mechanism. zk-SNARKs enable efficient verification of encrypted data without revealing sensitive information, thus preventing exposure of user privacy. Additionally, we employ Elliptic Curve Cryptography (ECC) in order to guarantee the confidentiality of the PGP key. Through this holistic integration, the security of the PGP key is enhanced, ensuring both confidentiality and integrity while safeguarding user privacy. Furthermore, gas consumption and transaction costs were evaluated with and without zk-SNARKs. The results demonstrate that the proposed mechanism minimizes gas consumption and transaction costs.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Distributed machine learning, and Decentralized Federated Learning in particular, is emerging as an effective solution to cope with the ever-increasing amount of data and the need to process it faster and more reliably. It enables machine learning models to be trained without centralizing user data, which improves data confidentiality and optimizes performance compared with centralized approaches. However, scaling up such systems can have limitations in terms of data and model traceability and security. To address this limitation, the integration of Blockchain has been proposed, forming a global system leveraging Blockchain, called Blockchain Based Decentralized Federated Learning (BDFL), and taking advantage of the benefits of this technology, namely transparency, immutability and decentralization. For the time being, few studies have sought to characterize these BDFL systems, although it seems that they can be broken down into a set of layers (blockchain, interconnection of DFL nodes, client selection, data transmission, consensus management) that could have a major impact on the operation of the BDFL as a whole. The aim of this article is therefore to respond to this limitation by highlighting the different layers existing in the architecture of a BDFL system and the solutions proposed in the literature that can be integrated to optimise both the performance and the security of the system. This could ultimately lead to the design of more secure and efficient architectures with greater resilience to attacks and architectural changes.
Slavica Tomović, Bogdan Krivokapić, Đula Nađ, Igor Radusinović
This paper introduces a new blockchain-assisted key management protocol specifically designed for clustered Underwater Acoustic Sensor Networks (UASNs). The protocol focuses on simplifying cross-cluster reauthentication for mobile underwater devices and reducing the risks of internal attacks caused by compromised nodes. To address the resource limitations of UASN devices, the protocol utilizes Elliptic Curve Qu Vanstone (ECQV) certificates, which considerably reduces Public Key Infrastructure (PKI) overhead. Moreover, it integrates the Hashed One-pass Menezes-QuVanstone (HOMQV) protocol with blockchain technology to enhance key exchange security against active attacks. The blockchain is hosted on resource-intensive surface nodes that serve as cluster heads and decentralized authorities for certificate management. Smart contracts embedded within the blockchain facilitate certificate-related operations and node trust scoring mechanism. We compared the proposed solution against a state-of-the-art benchmark and demonstrated that it imposes lower computational and communication overheads while exhibiting robustness against various attacks, as confirmed by the AVISPA tool. The solution is implemented on actual underwater/surface devices and validated experimentally. By leveraging the immutable, traceable, and fault-tolerant properties of blockchain, it establishes a secure, scalable, and efficient communication framework for mission-critical UASN applications.
Quantum cryptography has the potential to secure the infrastructures that are vulnerable to various attacks, like classical attacks, including quantum-related attacks. Therefore, quantum cryptography seems to be a promising technology for the future secure online infrastructures and applications, like blockchain-based frameworks. In this paper, we propose a generic quantum blockchain-envisioned security framework for an Internet of Things (IoT) environment. We then discuss some potential applications of the proposed framework. We also highlight the security advantages of quantum cryptography-based systems. We explain the working of blockchain, applications of blockchain, types of blockchain, the structure of blockchain, the structure of blockchain in a classical blockchain, and the structure of a block in a quantum blockchain context. Next, the adverse effects of quantum computing on the security of blockchain-based frameworks are highlighted. Furthermore, the comparisons of quantum cryptography-based security schemes, like quantum key distribution, quantum digital signature, and quantum hashing schemes, are provided. Finally, some future research directions related to the designed generic quantum blockchain-envisioned security framework for IoT are provided.
Cloud computing has emerged as a viable alternative to traditional computing infrastructures, offering various benefits. However, the adoption of cloud storage poses significant risks to data secrecy and integrity. This article presents an effective mechanism to preserve the secrecy and integrity of data stored on the public cloud by leveraging blockchain technology, smart contracts, and cryptographic primitives. The proposed approach utilizes a Solidity-based smart contract as an auditor for maintaining and verifying the integrity of outsourced data. To preserve data secrecy, symmetric encryption systems are employed to encrypt user data before outsourcing it. An extensive performance analysis is conducted to illustrate the efficiency of the proposed mechanism. Additionally, a rigorous assessment is conducted to ensure that the developed smart contract is free from vulnerabilities and to measure its associated running costs. The security analysis of the proposed system confirms that our approach can securely maintain the confidentiality and integrity of cloud storage, even in the presence of malicious entities. The proposed mechanism contributes to enhancing data security in cloud computing environments and can be used as a foundation for developing more secure cloud storage systems.
Fernando Román-García, Juan Hernández‐Serrano, Óscar Esparza
This article introduces the Non-Repudiable Data Exchange (NoRDEx) protocol, designed to ensure non-repudiation in data exchanges. Unlike traditional non-repudiation and fair exchange protocols, NoRDEx can be considered decentralized as it eliminates the need for a centralized Trusted Third Party (TTP) by using a Distributed Ledger Technology (DLT) to store cryptographic proofs without revealing the exchanged message. NoRDEx is an optimistic non-repudiation protocol, as it only uses the DLT in case of a dispute. The protocol has been implemented and tested in real-world environments, with performance assessments covering cost, overhead, and execution time. A formal security analysis using the Syverson Van Oorschot (SVO) logical model demonstrates NoRDEx’s ability to resolve disputes securely.