Blockchain technology has seen rapid adoption of Proof-of-Stake consensus mechanism in lieu of Proof-of-Work due to the former’s efficiency and speed. One notable example of Proof-of-Stake is the Tendermint protocol, which has been powering the entirety of Cosmos system - an ecosystem of multiple interlocked chains. However, Tendermint’s choice of deterministically deciding the next block proposer presents a huge window for malicious actors to prepare and coordinate attacks on upcoming validator nodes, possibly crippling the attacked chain. Furthermore, randomized number generation in this blockchain ecosystem still proves to be a challenge by reason of blockchain’s inherent deterministic nature. Aiming at the above problems, in this paper, we propose an improvement over Tendermint consensus protocol, utilizing Elliptic Curve Verifiable Random Function, a fast and secure pseudorandom generation algorithm suitable for deterministic systems like blockchain. This novel approach will solve the problem of knowing the validator ahead of time, whilst the verifiable random function module will be capable of supplying reliable random numbers to the overlaying beacon chain - a blockchain capable of distributing random numbers to users through smart contracts, and even other blockchains through Cosmos’ InterBlockchain Communication Protocol. The performed experiments with a prototype blockchain demonstrated that the new consensus protocol improves Tendermint’s resilience against network-layer attack vectors, while maintaining adequate fairness and performance.
Chuangming Zhou, Yang Zhou, Shaohua Yue, Bona Xuan · 5 authors
In the era of big data, facilitating efficient data flow is of paramount importance. Governments and enterprises worldwide have been investing in the big data industry, promoting data sharing and trading. However, existing data trading platforms often suffer from issues like privacy breaches, single points of failure, data tampering, and non-transparent transactions due to their reliance on centralized servers. To address these challenges, blockchain-based big data transaction models have been proposed. However, these models often lack system integrity and fail to fully meet user requirements while ensuring adequate security. To overcome these limitations, this paper presents an Ethereum-based big data trading model that establishes a comprehensive and secure trading system. The model aims to provide users with more convenient, secure, and professional services. Through the utilization of smart contracts, users can efficiently match data and negotiate prices online while ensuring secure data delivery through encryption technologies. Additionally, the model introduces a trusted third-party entity that offers professional data evaluation services and actively safeguards user data ownership in the event of disputes. The implementation of the model includes the development of smart contracts and the necessary machine learning code, followed by rigorous testing and validation. The experimental results validate the effectiveness and reliability of our proposed model, demonstrating its potential to ensure effective and secure big data trading.
Lennart Braun, Cyprien Delpech de Saint Guilhem, Robin Jadoul, Emmanuela Orsini · 6 authors
In this work, we extend the MPC-in-the-Head framework, used in recent efficient zero-knowledge protocols, to work over the ring $$\mathbb {Z}_{2^k}$$ , which is the primary operating domain for modern CPUs. The proposed schemes are compatible with any threshold linear secret sharing scheme and draw inspiration from MPC protocols adapted for ring operations. Additionally, we explore various batching methodologies, leveraging Shamir’s secret sharing schemes and Galois ring extensions, and show the applicability of our approach in RAM program verification. Finally, we analyse different options for instantiating the resulting ZK scheme over rings and compare their communication costs.
This paper delves into the crucial challenge of safeguarding data sensitivity and preventing security breaches, which can result in substantial losses, including significant financial costs and potential loss of lives. Notably, the United States faces the highest financial burden, with data breaches costing approximately USD 5.09 million. With the proliferation of Internet of Things (IoT) devices, enormous volumes of data are collected from diverse sources. However, the inherent limitations in computational power and memory of IoT devices render them susceptible targets for malicious attacks. This study focuses on fortifying the security of multimedia data, encompassing audio, video, and images, obtained from IoT devices. Cutting-edge technologies such as blockchain and quantum cryptography are explored as promising avenues to bolster multimedia security and preserve privacy. Quantum Key Distribution (QKD) emerges as an alternative to classical encryption and key distribution methods, offering heightened data security. Simultaneously, blockchain leverages hash functions to augment the overall security posture. By harnessing the principles of quantum mechanics, QKD facilitates secure key exchange between involved parties for data encryption and decryption. Additionally, the paper introduces innovative methodologies to enhance the security, privacy, and anonymity of IoT devices.
Michael Eckel, Dominik Roy George, Björn Grohmann, Christoph Krauß
Trusted Platform Modules (TPMs) are used for remote attestation to ensure the authenticity and integrity of software running on a computer system. However, measuring software executed as containers or virtual machines can be challenging as it is measured concurrently, resulting in a jumbled measurement log that is difficult to disentangle. Moreover, disclosing the entire measurement log in traditional binary remote attestation raises privacy and intellectual property concerns. To address these issues, we propose a remote attestation method with constrained disclosure, allowing for selective disclosure of entries in the measurement log using a non-interactive zero-knowledge (NIZK) proof with Schnorr signatures. Our approach is evaluated for security and privacy and proven to be correct, sound, and satisfies the properties of a NIZK proof. Formal verification of our solution with ProVerif also supports our claims. Furthermore, the performance evaluation of our proof-of-concept implementation shows that our contribution is feasible, and the overhead introduced is negligible.
I took a close look at what a blockchain-based compliance layer might actually do for U.S. payment systems using zero-knowledge proofs (ZKPs) as the key ingredient. The study lays out a conceptual model, grounded in current research, and then walks through different architectural options so you can see the trade-offs. The big takeaway? ZKPs appear capable of meeting core U.S. AML and KYC obligations without forcing people to hand over more personal details than necessary. Frankly, that's kind of the point: keep compliance intact, but avoid needless data exposure. The analysis also suggests that a ZKP-enabled layer could smooth regulatory workflows, cut down on operational risk and costs, and perhaps most importantly drastically reduce how much sensitive information gets shared across payment networks. It's promising, if a bit early-stage, but worth paying attention to.
Umer Majeed, Sheikh Salman Hassan, Zhu Han, Choong Seon Hong
In the rapidly evolving landscape of Web3 and blockchain technologies, decentralized autonomous organizations (DAOs) have emerged as innovative structures that operate autonomously through blockchain and smart contracts, eliminating the need for centralized control. The federated learning (FL) process, akin to an information flow under structured transparency, involves local models (LMs) as inputs and the global model (GM) as the output for each global iteration. The lack of transparency and security in traditional FL systems can be attributed to the centralized validation of LMs and GM updates. In this paper, we propose DAO-FL, a smart contract-based framework that leverages the power of DAOs to address these FL challenges. DAO-FL introduces the concept of DAO Membership Tokens (DAOMTs) as a governance tool within a DAO. DAOMTs play a crucial role within the DAO, facilitating members’ enrollment and expulsion. Our framework incorporates a Validation-DAO for decentralized input verification (DIV) of the FL process, ensuring reliable and transparent validation of LMs. Additionally, DAO-FL employs a multi-signatures approach facilitated by an Orchestrator-DAO to achieve decentralized GM updates, and thus decentralized output verification (DOV) of the FL process. We present a comprehensive system architecture, detailed execution workflow, implementation specifications, and qualitative evaluation for DAO-FL. Evaluation under threat models highlights DAO-FL’s out-performance against traditional centralized-FL, effectively countering input and output attacks. DAO-FL excels in scenarios where DIV and DOV are crucial, offering enhanced transparency and trust. In conclusion, DAOFL provides a compelling solution for FL, reinforcing the integrity of the FL ecosystem through decentralized decision making and validation mechanisms.
Federated learning (FL) has been widely adopted in various fields of study and business. Traditional centralized FL systems suffer from serious issues. To address these concerns, decentralized federated learning (DFL) systems have been introduced in recent years. With the help of blockchains, they attempt to achieve more integrity and efficiency. However, privacy preservation remains an uncovered aspect of these systems. To tackle this, as well as to scale the blockchain-based computations, we propose a zero-knowledge proof (ZKP)-based aggregator (zkDFL). This allows clients to share their large-scale model parameters with a trusted centralized server without revealing their individual data to other clients. We utilize blockchain technology to manage the aggregation algorithm via smart contracts. The server performs a ZKP algorithm to prove to the clients that the aggregation is done according to the accepted algorithm. Additionally, the server can prove that all inputs from clients have been used. We evaluate our approach using a public dataset related to the wearable Internet of Things. As demonstrated by numerical evaluations, zkDFL introduces verifiability of the correctness of the aggregation process and enhances the privacy protection and scalability of DFL systems, while the gas cost has significantly declined.
In recent years, there have been incidents which decreased people's trust in some organizations and authorities responsible for ratings and accreditation. For a few prominent examples, there was a security breach at Equifax (2017), misconduct was found in the Standard & Poor's Ratings Services (2015), and the Accrediting Council for Independent Colleges and Schools (2022) validated some of the low-performing schools as delivering higher standards than they actually were. A natural solution to these types of issues is to decentralize the relevant trust management processes using blockchain technologies. The research problems which are tackled in this thesis consider the issue of trust in reputation for assessment and review credibility at different angles, in the context of blockchain applications. We first explored the following questions. How can we trust courses in one college to provide students with the type and level of knowledge which is needed in a specific workplace? Micro-accreditation on a blockchain was our solution, including using a peer-review system to determine the rigor of a course (through a consensus). Rigor is the level of difficulty in regard to a student's expected level of knowledge. Currently, we make assumptions about the quality and rigor of what is learned, but this is prone to human bias and misunderstandings. We present a decentralized approach that tracks student records throughout the academic progress at a school and helps to match employers' requirements to students' knowledge. We do this by applying micro-accredited topics and Knowledge Units (KU) defined by NSA's Center of Academic Excellence to courses and assignments. We demonstrate that the system was successful in increasing accuracy of hires through simulated datasets, and that it is efficient, as well as scalable. Another problem is how can we trust that the peer reviews are honest and reflect an accurate rigor score? Assigning reputation to peers is a natural method to ensure correctness of these assessments. The reputation of the peers providing rigor scores needs to be taken into account for an overall rigor of a course, its topics, and its tasks. Specifically, those with a higher reputation should have more influence on the total score. Hence, we focused on how a peer's reputation is managed. We explored decentralized reputation management for the peers, choosing a decentralized marketplace as a sample application. We presented an approach to ensuring review credibility, which is a particular aspect of trust in reviews and reputation of the parties who provide them. We use a Proof-of-Stake based Algorand system as a base of our implementation, since this system is open-source, and it has a rich community support. Specifically, we directly map reputation to stake, which allows us to deploy Algorand at the blockchain layer. Reviews are analyzed by the proposed evaluation component using Natural Language Processing (NLP). In our system, NLP gauges the positivity of the written review, compares that value to a scaled numerical rating given, and determines adjustments to a peer's reputation from that result. We demonstrate that this architecture ensures credible and trustworthy assessments. It also efficiently manages the reputation of the peers, while keeping reasonable consensus times. We then turned our focus on ensuring that a peer's reputation is credible. This led us to introducing a new type of consensus called "Proof-of-Review". Our proposed implementation is again based on Algorand, since its modular architecture allows for easy modifications, such as adding extra components, but this time, we modified the engine. The proposed model then provides a trust in evaluations (review and assessment credibility) and in those who provide them (reputation credibility) using a blockchain. We introduce a blacklisting component, which prevents malicious nodes from participating in the protocol, and a minimum-reputation component, which limits the influence of under-performing users. Our results showed that the proposed blockchain system maintains liveliness and completeness. Specifically, blacklisting and the minimum-reputation requirement (when properly tuned) do not affect these properties. We note that the Proof-of-Review concept can be deployed in other types of applications with similar needs of trust in assessments and the players providing them, such as sensor arrays, autonomous car groups (caravans), marketplaces, and more.
With the rising use of aircrafts for operations ranging from disaster-relief to warfare, there is a growing risk of adversarial attacks. Malicious entities often only require the location of the aircraft for these attacks. Current satellite-aircraft communication and tracking protocols put aircrafts at risk if the satellite is compromised, due to computation being done in plaintext. In this work, we present \texttt{SPAM}, a private, secure, and accurate system that allows satellites to efficiently manage and maintain tracking angles for aircraft fleets without learning aircrafts' locations. \texttt{SPAM} is built upon multi-party computation and zero-knowledge proofs to guarantee privacy and high efficiency. While catered towards aircrafts, \texttt{SPAM}'s zero-knowledge fleet management can be easily extended to the IoT, with very little overhead.
We show the following unconditional results on quantum commitments in two related yet different models: 1. We revisit the notion of quantum auxiliary-input commitments introduced by Chailloux, Kerenidis, and Rosgen (Comput. Complex. 2016) where both the committer and receiver take the same quantum state, which is determined by the security parameter, as quantum auxiliary inputs. We show that computationally-hiding and statistically-binding quantum auxiliary-input commitments exist unconditionally, i.e., without relying on any unproven assumption, while Chailloux et al. assumed a complexity-theoretic assumption, ${\bf QIP}\not\subseteq{\bf QMA}$. On the other hand, we observe that achieving both statistical hiding and statistical binding at the same time is impossible even in the quantum auxiliary-input setting. To the best of our knowledge, this is the first example of unconditionally proving computational security of any form of (classical or quantum) commitments for which statistical security is impossible. As intermediate steps toward our construction, we introduce and unconditionally construct post-quantum sparse pseudorandom distributions and quantum auxiliary-input EFI pairs which may be of independent interest. 2. We introduce a new model which we call the common reference quantum state (CRQS) model where both the committer and receiver take the same quantum state that is randomly sampled by an efficient setup algorithm. We unconditionally prove that there exist statistically hiding and statistically binding commitments in the CRQS model, circumventing the impossibility in the plain model. We also discuss their applications to zero-knowledge proofs, oblivious transfers, and multi-party computations.
Sharon Rose H, Razeenath Aafiya A, Kamachi Swetha R, G. R. Ramya
The system focuses on proposing a robust authentication framework based on these Secure Remote Password (SRP) protocol to enhance the security of data exchange in Peer-to- Peer (P2P) cloud environments. The Advanced Encryption Standard (AES) algorithm provides encryption and the SRP protocol leverages cryptographic primitives to establish mutual authentication between cloud servers and users, ensures that data, remains protected against any vulnerabilities. The system encompasses various stages, including user registration, key establishment, and secure data transmission. After user registration, the SRP protocol employs a zero-knowledge proof mechanism to maintain the security of data available on cloud servers, mitigating the risks associated with password leaks and unauthorized access. Furthermore, the protocol facilitates secure key exchange to establish a confidential communication channel between peers, enabling encrypted data transmission. The system integrates SRP protocol and AES encryption, fortifying data security in P2P cloud environments through robust authentication, ensuring a comprehensive defence against potential vulnerabilities.
Recent years have witnessed significant advancements in cross-chain technology. However, the field faces two pressing challenges when it comes to security and privacy. Hacks on cross-chain bridges have led to monetary losses of around 3 billion USD, highlighting flaws in security models governing interoperability mechanisms (IMs) and the ineffectiveness of incident response frameworks. Additionally, the exploration of privacy within cross-chain scenarios remains relatively unexplored. Hackers benefit from extensive privacy, whereas users and bridge operators experience restricted privacy, thereby broadening the potential attack surface for adversaries. In this paper, we present the most comprehensive study to date on the security and privacy of blockchain interoperability. Our study employs a rigorous systematic literature review, yielding a corpus of 178 relevant documents, including 58 academic papers and 120 gray literature documents, out of a pool of 531. We systematically categorize 56 interoperability solutions based on a newly created taxonomy focusing on security and privacy considerations. Our dataset, comprising academic research, disclosures from bug bounty programs, and audit reports, exposes 45 cross-chain vulnerabilities, 25 theoretical attacks, and 88 mitigation strategies. Leveraging this data, we analyze 14 notable bridge hacks accounting for over USD 2.9 billion in losses, mapping them to the identified vulnerabilities. Our findings reveal that a substantial portion (65.8\%) of stolen funds originates from projects secured by permissioned intermediary networks with unsecured cryptographic key operations. Regarding privacy, we demonstrate that achieving unlinkability in cross-chain transactions is contingent on the underlying ledgers providing some form of confidentiality. In conclusion, our study offers critical insights into the challenges and vulnerabilities within the realm of cross-chain interoperability. We pinpoint promising directions for future research that can guide both industry practitioners and academics toward substantial advancements in this field. Our work underscores the urgency of enhancing security and privacy measures in cross-chain technology to mitigate the substantial financial risks associated with bridge hacks and to foster user trust in the blockchain ecosystem.
The rise of technology has brought with it a heightened awareness of the necessity to shield personal data and maintain exclusive access to specific knowledge. A notable solution that emerged from this consciousness is Zero-Knowledge Proofs (ZKPs) and, more specifically, Schnorr’s Protocol. Historically, Zero-Knowledge Proofs have a compelling lineage, tracing their roots back to the fervent discussions among cryptographers aiming to achieve a balance between information sharing and privacy. ZKPs are cryptographic methods that allow one party to prove to another that a statement is true, without revealing any specific information about the statement itself. In the midst of these developments, Schnorr’s Protocol emerged as a renowned interactive proof system. It possesses an intuitive structure that has made it pivotal in the enhancement of digital security. The typical flow of Schnorr’s Protocol begins with the prover sending a commitment to the verifier. The verifier then sends a random challenge back to the prover, who, in turn, produces a response. What’s captivating is that the verifier can ascertain the validity of the proof without gaining insight into the underlying secret. Interactive Schnorr’s Protocol involves real-time back-and-forth communication between the prover and verifier. On the other hand, the non-interactive version eliminates this need by using a cryptographic hash function, thereby streamlining the process.
Cem Bicer, Ilir Murturi, Praveen Kumar Donta, Schahram Dustdar
Internet of Things (IoT) devices pose significant security challenges due to their heterogeneity (i.e., hardware and software) and vulnerability to extensive attack surfaces. Today's conventional perimeter-based systems use credential- based authentication (e.g., username/password, certificates, etc.) to decide whether an actor can access a network. However, the verification process occurs only at the system's perimeter because most IoT devices lack robust security measures due to their limited hardware and software capabilities, making them highly vulnerable. Therefore, this paper proposes a novel approach based on Zero Trust Architecture (ZTA) extended with blockchain to further enhance security. The blockchain component serves as an immutable database for storing users' requests and is used to verify trustworthiness by analyzing and identifying potentially malicious user activities. We discuss the framework, processes of the approach, and the experiments carried out on a testbed to validate its feasibility and applicability in the smart city context. Lastly, the evaluation focuses on non-functional properties such as performance, scalability, and complexity.
Leon Witt, Usama Zafar, KuoYeh Shen, Felix Sattler · 7 authors
Federated Learning (FL) has emerged as a powerful paradigm in Artificial Intelligence, facilitating the parallel training of Artificial Neural Networks on edge devices while safeguarding data privacy. Nonetheless, to encourage widespread adoption, Federated Learning Frameworks (FLFs) must tackle (i) the power imbalance between a central authority and its participants, and (ii) the challenge of equitably measuring and incentivizing contributions. Existing approaches to decentralize and incentivize FL processes are hindered by (i) computational overhead and (ii) uncertainty in contribution assessment [1]), limiting FL's scalability beyond use cases where trust between participants and the server is established. This work introduces a cutting-edge, blockchain-enabled federated learning framework that incorporates Federated Knowledge Distillation (FD) with compressed 1-bit soft-labels, aggregated through a smart contract. Furthermore, we present the Peer Truth Serum for Federated Distillation (PTSFD), which cultivates an incentive-compatible ecosystem by rewarding honest participation based on an implicit yet effective comparison of worker contributions. The primary innovation stems from its lightweight architecture that simultaneously promotes decentralization and incentivization, addressing critical challenges in contemporary FL approaches.
The exchange of patient medical records between healthcare providers is essential for quality care but faces challenges related to privacy, security, and centralized control. This article presents the development of a decentralized medical data exchange system using Distributed Ledger Technology based on the IOTA Tangle. The system architecture and core components for immutable storage and transmission of medical records are described. The system uses masking and encryption techniques to maintain patient privacy while allowing healthcare providers to access full records with patient consent. The IOTA Tangle enables fee-less transactions and data integrity verification via its Directed Acyclic Graph structure. System validation through simulation experiments demonstrates the ability to securely share medical data at scale with lower resource costs compared to traditional blockchain designs. The system proves the viability of a decentralized, self-sovereign approach for efficient and confidential medical data sharing using Distributed Ledger Technology. The secure data exchange platform can enable new models of care and research while maintaining patient privacy and healthcare ethics.
A system of zero-knowledge proofs on graph signatures has been proposed, where a graph can be signed, and the owner of the graph signature can prove a graph relation such as the connectivity and isolation of any two vertexes on the graph without disclosing all information about the graph. The correctness of the graph information is guaranteed by the signature. One of the applications is a virtualized infrastructure, where an infrastructure provider manages a distributed system, and each tenant is allocated a specific portion of this infrastructure for use. Tenants need to check with the provider that their resources are properly connected (connectivity) and that their resources are properly separated from the resources of other tenants (isolation). On the other hand, the provider cannot simply disclose the entire infrastructure topology to each tenant. Using the zero-knowledge proof system on graph signatures, both requirements can be addressed. Previously, an efficient zero-knowledge proof system on graph signatures using a bilinear-map accumulator has been proposed, where the verification time and the size of the proof data do not depend on the number of graph vertexes and edges. However, this system has two problems. First, since the proof does not include labels, it is not possible to prove the connectivity considering network bandwidth and cost. Second, since it assumes undirected graphs, it cannot handle applications on directed graphs such as network flows. In this paper, we extend the previous system and propose a zero-knowledge proof system of the connectivity for directed graphs where each edge has labels. We implemented our system on a PC using a pairing library and evaluate it by measuring the processing times. Compared to the conference version of this paper, we show the formal definitions and the security proofs of our proposed system, and add implementation-based evaluations reflecting the application to the virtualized infrastructure.