Santiago Bragagnolo, Henrique Rocha, Marcus Denker, Sté́phane Ducasse
Solidity is a language used for smart contracts on the Ethereum blockchain. Smart contracts are embedded procedures stored with the data they act upon. Debugging smart contracts is a really difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded. In this paper, we address the lack of inspectability of a deployed contract by analyzing contract state using decompilation techniques driven by the contract structure definition. Our solution, SmartInspect, also uses a mirror-based architecture to represent locally object responsible for the interpretation of the contract state. SmartInspect allows contract developers to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code.
Blockchain is a one of emerging technology for decentralized and sharing of transactional data across a large peer to peer network, where non-trusting members can interact with each other without an intermediary, in a verifiable manner. In this paper, we review the basics of Blockchain, its applications, types, and working of Blockchain. Behind this innovative technique, the security, privacy issues and Con-sensus mechanisms of this technology are also important and are a matter of concern. The problems associated with Blockchain technol-ogy are also discussed in this paper.
Initial Coin Offerings (ICO) are public offers of new cryptocurrencies in exchange of existing ones, aimed to finance projects in the blockchain development arena. In the last 8 months of 2017, the total amount gathered by ICOs exceeded 4 billion US$, and overcame the venture capital funnelled toward high tech initiatives in the same period. A high percentage of ICOS is managed through Smart Contracts running on Ethereum blockchain, and in particular to ERC-20 Token Standard Contract. In this work we examine 1388 ICOs, published on December 31, 2017 on icobench.com Web site, gathering information relevant to the assessment of their quality and software development management, including data on their development teams. We also study, at the same date, the financial data of 450 ICO tokens available on coinmarketcap.com Web site, among which 355 tokens are managed on Ethereum blochain. We define success criteria for the ICOs, based on the funds actually gathered, and on the behavior of the price of the related tokens, finding the factors that most likely influence the ICO success likeliness.
Blockchains have recently generated explosive interest from both academia and industry, with many proposed applications. But descriptions of many these proposals are more visionary projections than realizable proposals, and even basic definitions are often missing. We define "blockchain" and "blockchain network", and then discuss two very different, well known classes of blockchain networks: cryptocurrencies and Git repositories. We identify common primitive elements of both and use them to construct a framework for explicitly articulating what characterizes blockchain networks. The framework consists of a set of questions that every blockchain initiative should address at the very outset. It is intended to help one decide whether or not blockchain is an appropriate approach to a particular application, and if it is, to assist in its initial design stage.
With the development of marine observation technology and network technology, the volume of marine data growing rapidly. This brings new challenges for data storage and transmission. How to protect data security of marine big data has become an urgent problem. The traditional information security methods' characteristic is centralization. These technologies cannot provide whole process protection, e.g., data storage, data management and application of data. The blockchain technology is a novel technology, which can keep the data security and reliability by using decentralized methodology. It has aroused wide interest in the financial field. In this paper, we describe the concept, characteristics and key technologies of blockchain technology and introduce it into the field of marine data security.
The brave new world of blockchain potentially transforms the financial structures we have come to know and feel ambivalent about. What does a decentralized, secure system mean for our society?
The emergence of distributed ledger technology (DLT) based upon a blockchain data structure, has given rise to new approaches to identity management that aim to upend dominant approaches to providing and consuming digital identities. These new approaches to identity management (IdM) propose to enhance decentralisation, transparency and user control in transactions that involve identity information; but, given the historical challenge to design IdM, can these new DLT-based schemes deliver on their lofty goals? We introduce the emerging landscape of DLT-based IdM, and evaluate three representative proposals: uPort; ShoCard; and Sovrin; using the analytic lens of a seminal framework that characterises the nature of successful IdM schemes.
Virtual machine (VM) measurements data in IaaS cloud play a crucial role in integrity evaluation and decision making. Hence, the secure storage for these data has attracted more attention recently. This paper proposes a novel approach, named Mchain, to enhance the integrity and controllability of the secure storage. Especially, to enhance the integrity, a two-layer blockchain network is introduced. In the first layer, after the production, the data packages are first verified by leveraging a correspondence between a package and a policy, and a one-to-one relation among a VM, a user, and a node. After that, we propose a consensus achievement algorithm to construct a semi-finished block on a candidate block arranged by data packages. Meanwhile, the semi-finished block is distributed to all nodes, which can provide a certain integrity. In the second-layer, tamper-resistant metadata is generated by performing PoW tasks on the semi-finished block, resulting in strong integrity. Further, to enhance the controllability, a revisable user-defined policy-based encryption method with KP-ABE is proposed. It helps to flexibly control the scope of authorized verifiers. The experimental results on six scenarios with simulated data set show that the proposed approach is appealing in integrity and controllability, and the time overhead of data storage.
Recently we presented a single-party cryptographic timestamping mechanism based on proof-of-sequential-work, which we proved secure in the universal composability framework [16]. This paper describes this construction and its security claims and uses it to construct a multi-party permissioned blockchain protocol and show that it achieves an immutability notion. Finally we discuss applications of this protocol, including unpermissioned blockchains, and how these may benefit.
In recent years, there has been an upsurge of researching and learning the Amoeba management model in China. Amoeba management model is a business model created by INAMORI KAZUO in KYOCERA, and then many enterprises have achieved unprecedented success. At present, a large number of scholars have studied the amoeba management model, but the exploration of the operation mechanism of the amoeba management model has not yet appeared. As for an organization management model, it is very important to explore the mechanism for its normal operation, which provides the research question for this article, namely, the operation mechanism of amoeba organization model. Therefore, based on the characteristics of Amoeba organization, this paper explores the operation mechanism of Amoeba’s organizational model, which provides reference for other enterprises that want to implement the Amoeba organization model. The research found that the operation mechanism of Amoeba’s organizational model mainly includes Amoeba’s team relationship, team incentive mechanism, team accounting mechanism and team evaluation mechanism. The Amoeba team broke the traditional relationship between the corporate sector and the traditional relationship resulting in low efficiency of the enterprise, while the amoeba organization leads the trading relationship into the enterprise Amoeba teams, the trading between teams, and self-financing of each team resulting in the active communication between teams and the actively cooperate. The Incentive mechanism is mainly for the amoeba team decentralization, the establishment of a strict responsibility and profit mechanism for each team, the division of power and responsibility, so that each team has its own power. The accounting mechanism and the accounting of Amoeba organization model mainly introduce the independent accounting mechanism; each team is responsible for its own profit and loss, independent accounting, and uses the unit time accounting system to calculate the team. The Evaluation mechanism rigorously assesses the amoeba team. In the light of the strategy at this stage of the company, we need to build a guiding evaluation system so that the team goals and corporate goals become same, and commonly achieve the enterprise strategies.
We study distributed declarative workflow execution in an adversarial setting.In this setting, parties to an agreed-upon workflow do not trust each other to follow that workflow, or suspect the other party might misrepresent proceedings at a later time.We demonstrate how distributed declarative workflow execution can be implemented as smart contracts, guaranteeing (I) enforcement of workflow semantics, and (II) an incontrovertible record of workflow execution history.Crucially, we achieve both properties without relying on a trusted third party.The implementation is based on the Ethereum blockchain, inheriting the security properties (I) and (II) from the guarantees given by that chain.A recurring challenge for both the implementation and the analysis is the cost of operations on Ethereum: This cost must be minimised for honest parties, and an adversary must be prevented from inflicting extra cost on others.
Public key server is a simple yet effective way of key management in secure end-to-end communication. To ensure the trustworthiness of a public key server, transparent log systems such as CONIKS employ a tamper-evident data structure on the server and a gossiping protocol among clients in order to detect compromised servers. However, due to lack of incentive and vulnerability to malicious clients, a gossiping protocol is hard to implement in practice. Meanwhile, alternative solutions such as EthIKS are not scalable. This paper presents Trusternity, an auditing scheme relying on Ethereum blockchain that is easy to implement, scalable and inexpensive to operate.
Zhi Li, Layne Liu, Ali Vatankhah Barenji, Waiming Wang
This paper proposes a cloud-based manufacturing knowledge sharing system for injection mould redesign (IMR) based on blockchain technology. In our proposed system, private cloud is used to store the IMR knowledge, and blockchain provides standards and protocols for implementing the system as well as ensuring the security in a trustless environment. K-Nearest Neighbors is used for retrieving the blockchain-based document knowledge. The proposed system not only can facilitate injection mould redesign, but also provide a mechanism for knowledge owners to share their own assets securely.
Yinghui Zhang, Robert H. Deng, Jiangang Shu, Kan Yang · 5 authors
As a very attractive computing paradigm, cloud computing makes it possible for resource-constrained users to enjoy cost-effective and flexible resources of diversity. Considering the untrustworthiness of cloud servers and the data privacy of users, it is necessary to encrypt the data before outsourcing it to the cloud. However, the form of encrypted storage also poses a series of problems, such as: How can users search over the outsourced data? How to realize user-side verifiability of search results to resist malicious cloud servers? How to enable server-side verifiability of outsourced data to check malicious data owners? How to achieve payment fairness between the user and the cloud without introducing any third party? Towards addressing these challenging issues, in this paper, we introduce TKSE, a trustworthy keyword search scheme over encrypted data without any third party, trusted or not. In TKSE, the encrypted data index based on digital signature allows a user to search over the outsourced encrypted data and check whether the search result returned by the cloud fulfills the pre-specified search requirements. In particular, for the first time, TKSE realizes server-side verifiability which protects honest cloud servers from being framed by malicious data owners in the data storage phase. Furthermore, blockchain technologies and hash functions are used to enable payment fairness of search fees without introducing any third party even if the user or the cloud is malicious. Our security analysis and performance evaluation indicate that TKSE is secure and efficient and it is suitable for cloud computing.
Throughout the history of mankind, trusted relationships have played a vital part in every \ntransaction humans have made. Those transactions belong to a spectrum that starts from \neveryday life decisions and acts, to a more complex, sensitive and wide area that even nations \nare involved. \nBefore the era of globalization of telecommunications that we live in, achieving trust was \nmore related to human relations. Even though that the meaning of trust is known to all, it is \nhard to find a definition that strictly describes it. \nTrust is multidimensional, multidisciplinary and multifaceted concept. Many definitions can \nbe found in literature and are related to notions as goodness, strength, reliability, integrity, \nability or character of a person or thing. A trust relationship involves two parties, a trustor \nand a trustee. The trustor is the person that holds confidence, belief on the reliability of \nanother person or thing which is the other party, the trustee. (Zheng & Valtteri Niemi, \nTowards User Driven Trust Modeling and Management, 2009) \nHow though trust is established in modern computer networks, where the notions of the \ntrustor and trustee are not represented by strictly humans, but from entities that might never \nhave had a relationship upon the trust can be build. \nIn this project we will study the achievement of trust in traditional kinds of networks such as \nad-hoc, mobile and wireless and we will examine the ability to elevate the trust level in a \ncomputer network using the under development and mostly promising blockchain network. \nThe network is going to be setup as a private blockchain network, where all the nodes that \nconsist it, will be pre-set from an administrative team. The computers that will participate will \nhave all the requirements in order to connect to the private network running as services on \nboot. \nThe application will run on each node and on starting the application the very first check will \nbe to start the node and connect to the network. Only if the network has been found and the \nnode is connected to it, the application proceeds with checking the presence of web3js and \nonly after successfully checking the communication of the web3js with the network, the user \nis prompt with the login page. \nThe authorization of the user is checked upon a smart contract on the blockchain network \nand after a successfully prompt from the smart contract, the credentials are checked, in our \ncase, on a fake backend where a JWT token is issued to the user in order to use the application \ndepending on the role that he has.
Weiqi Dai, Jun Deng, Qinyuan Wang, Changze Cui · 6 authors
Due to the increasing total value of the digital currency, the security of encryption wallet is becoming more and more important. The hardware-based wallet is safe, but it is inconvenient because users need to carry an additional physical device, the software-based wallet is convenient, but the safety cannot be guaranteed. All these wallets need to synchronize the blockchain, while most current mobile devices do not have the capability to store all blocks. To solve these problems, mobile devices can use simplified payment verification (SPV). Nevertheless, in existing methods, there is no good way to protect the verification process of the transaction. In this paper, we design a secure blockchain lightweight wallet based on Trustzone to protect SPV. It is more portable compared with the hardware wallet, and safer than the software wallet. Through the isolation, it can also protect the private key and the wallet's address from being stolen by the attackers no matter whether the Rich OS is malicious or not. Meanwhile, it can protect the verification process by verifying transactions in the secure execution environment (SEE), and keep the local block headers unreadable directly from the Rich OS through encryption. We deploy it on the RASPBERRY PI 3 MODEL B development board. The result of the experiment shows that it has little impact on the system.
Yanqi Zhao, Yannan Li, Qilin Mu, Bo Yang · 5 authors
The cyber physical system (CPS) has gained considerable success in large-scale distributed integration environment. In such systems, the sensor devices collect data which would be disseminated via reliable manner to all interested co-operant entities from the physical world. However, highly unreliable environment of CPS, for example, a number of limitations of existing network middle wares, makes secure and reliable data distribution services a challenge issue. In this paper, we propose a new architecture called secure pub-sub (SPS) without middle ware, i.e., blockchain-based fair payment with reputation. In SPS, publishers publish a topic on the blockchain and subscribers specify an interest message by making a deposit to subscribing the topic. Then, if the interest message matches the topic, the publisher transmits the encrypted content of the topic to the blockchain such that the subscribers can decrypt the ciphertext to obtain the content, and mark the publisher as its reputation. Finally, the publisher receives the payment from the subscriber. The new proposal provides confidentiality and reliability of data, anonymity of subscribers and payment fairness between the publishers and subscribers. Different from the traditional pub-sub services, no trusted third party is involved in our system due to employing blockchain technique. The security of the proposed SPS is analyzed as well. The implementation of the protocol on Ethereum of smart contract demonstrates the validity of SPS.
With the widespread of E-commerce, the need of a trusted system to ensure the delivery of traded items is crucial. Current proof of delivery (PoD) systems lacks transparency, traceability, and credibility. These systems are mostly centralized and rely on trusted third parties (TTPs) to complete the delivery between sellers and buyers. TTPs can be costly, a single point of failure, and subject to hacking, privacy evasion, and compromise. The blockchain is an immutable, trusted, and decentralized ledger with logs and events that can be used for transparency, traceability, and tracking. In this paper, we present a solution and a general framework using the popular permissionless Ethereum blockchain to create a trusted, decentralized PoD system that ensures accountability, auditability, and integrity. The solution uses Ethereum smart contracts to prove the delivery of a shipped item between a seller and a buyer irrespective of the number of intermediate transporters needed. In our proposed solution, all participating entities are incentivized to act honestly by using a double deposit collateral. Automated payment in ether is an integral part of a solution to ensure that every entity gets its intended share of ether upon successful delivery. An arbitration mechanism is also incorporated if a dispute arises during the shipping process. In this paper, we show how we implemented, verified, and tested the proper functionality of our PoD solution. We also provide security analysis and give estimates of the cost consumption in ether gas. We made the full code of the Ethereum smart contracts publicly available at Github.
A treasury system is a community-controlled and decentralized collaborative decision-making mechanism for sustainable funding of blockchain development and maintenance. During each treasury period, project proposals are submitted, discussed, and voted for; top-ranked projects are funded from the treasury. The Dash governance system is a real-world example of such kind of systems. In this work, we, for the first time, provide a rigorous study of the treasury system. We modelled, designed, and implemented a provably secure treasury system that is compatible with most existing blockchain infrastructures, such as Bitcoin, Ethereum, etc. More specifically, the proposed treasury system supports liquid democracy/delegative voting for better collaborative intelligence. Namely, the stake holders can either vote directly on the proposed projects or delegate their votes to experts. Its core component is a distributed universally composable secure end-to-end verifiable voting protocol. The integrity of the treasury voting decisions is guaranteed even when all the voting committee members are corrupted. To further improve efficiency, we proposed the world's first honest verifier zero-knowledge proof for unit vector encryption with logarithmic size communication. This partial result may be of independent interest to other cryptographic protocols. A pilot system is implemented in Scala over the Scorex 2.0 framework, and its benchmark results indicate that the proposed system can support tens of thousands of treasury participants with high efficiency.
Kuo‐Hui Yeh, Chunhua Su, Jia-Li Hou, Wayne Chiu · 5 authors
Recently, the popularity and universality of smart-devices has led to rapid advancement in the development of applications for mobile commerce around the world. Novel mobile payment schemes, such as Apple pay, Android pay, and Samsung pay are becoming an increasingly popular ways to conduct online transactions, no matter what type of smart devices are used. Due to the attendant growth in the importance of security, significant attention has been devoted to the challenge of designing and implementing a robust mobile payment scheme for securing online transactions. In this paper, we demonstrate a robust mobile payment scheme based on sturdy certificateless signatures with bilinear pairing. We elegantly refine the proposed mobile payment scheme to make it suitable for computation-constrained mobile devices. The practicability of the proposed mobile payment scheme is then certified via a rigorous security analysis and thorough performance evaluation using the Raspberry PI as the implementation platform for our proposed scheme. Furthermore, we implement a transaction repository with the aid of smart contract technology. The simulation results, based on Ethereum, demonstrate the feasibility of employing the smart contract technology to secure mobile payments.
Blockchain is a new distributed and decentralized technology, and gradually attracts worldwide attention, but it is vulnerable to quantum attacks that would solve elliptic curve digital logarithm problem, which is mainly used for transaction authentication in blockchain. The key needed for authentication comes from the wallet. To ensure that the size of the wallet is fixed and easy to manage, deterministic wallets are required to be used. But if existing anti-quantum signature schemes, such as lattice-based signature are used directly in blockchain to solve the problem, it would have made the wallet bloat. In this paper, we present a novel anti-quantum transaction authentication scheme in the blockchain. In order to construct lightweight nondeterministic wallets, the key point is that public and private keys are generated from a set of master public and private key(Seed Key). We leverage on Bonsai Trees technology and propose a new authentication method which can extend a lattice space to multiple lattice spaces accompanied by the corresponding key. Every signature of a transaction uses a lattice space so as to ensure the randomness and the security of the master private key. And we give the complete security proof and analysis. This paper provides the theoretical support for the application of blockchain in the post quantum age.