Reputation/trust-based blockchain systems have attracted considerable research interests for better integrating Internet of Things with blockchain in terms of throughput, scalability, energy efficiency, and incentive aspects. However, most existing works only consider static adversaries. Hence, they are vulnerable to slowly adaptive attackers, who can target validators with high reputation value to severely degrade the system performance. Therefore, we introduce$\textsf{zkRep}$, a privacy-preserving scheme tailored for reputation-based blockchains. Our basic idea is to hide both the identity and reputation of the validators by periodically changing the identity and reputation commitments (i.e., aliases), which makes it much more difficult for slowly adaptive attackers to identify validators with high reputation value. To realize this idea, we utilize privacy-preserving Pedersen-commitment-based reputation updating and leader election schemes that operate on concealed reputations within an epoch. We also introduce a privacy-preserving identity update protocol that changes the identity and time-window-based cumulative reputation commitments during each epoch transition. We have implemented and evaluated$\textsf{zkRep}$on the Amazon Web Service. The experimental results and analysis show that$\textsf{zkRep}$achieves great privacy-preserving features against slowly adaptive attacks with little overhead.
The majority of hacking accidents in cryptocurrency occur when the information of a cryptocurrency wallet is stolen. Since the cryptocurrency wallet is simply used for a key storage, when connecting to a transaction network, it is vulnerable for a key theft. Blockchain is not traceable, but it should communicate to applicate data of blockchain. To communicate to applicate data of blockchain, this study proposes a key protocol design to secure cryptocurrency transactions for user privacy of cryptocurrency to resolve the drawback of decentralized exchange. The key protocol includes a session key for a blockchain data structure and the Federated Byzantine Agreement (FBA) for the key-exchange agreement among users. In F-measure model, the values of Key Cluster Mode, Test Session key Mode and Original Session key Mode resulted in True Positive Ratio greater than 0.5 and False Positive Ratio lesser than 0.5. Therefore, the key protocol model has optimal security. In addition, computation costs of the protocol improve by compared with former studies. It may be played an important role in the cryptocurrency hacking accident and supported robust cryptocurrency market The study guarantees the security of cryptocurrency users without decentralized exchange, and it is scalable to other areas by using secure distributed networks.
Lu Liu, Lili Wei, Wuqi Zhang, Ming Wen · 6 authors
Smart contracts are programs stored on blockchains to execute transactions. When input constraints or security properties are violated at runtime, the transaction being executed by a smart contract needs to be reverted to avoid undesirable consequences. On Ethereum, the most popular blockchain that supports smart contracts, developers can choose among three transaction-reverting statements (i.e., require, if…revert, and if…throw) to handle anomalous transactions. While these transaction-reverting statements are vital for preventing smart contracts from exhibiting abnormal behaviors or suffering malicious attacks, there is limited understanding of how they are used in practice. In this work, we perform the first empirical study to characterize transaction-reverting statements in Ethereum smart contracts. We measured the prevalence of these statements in 3,866 verified smart contracts from popular dapps and built a taxonomy of their purposes via manually analyzing 557 transaction-reverting statements. We also compared template contracts and their corresponding custom contracts to understand how developers customize the use of transaction-reverting statements. Finally, we analyzed the security impact of transaction-reverting statements by removing them from smart contracts and comparing the mutated contracts against the original ones. Our study led to important findings. For example, we found that transaction-reverting statements are commonly used to perform seven types of authority verifications or validity checks, and missing such statements may compromise the security of smart contracts. We also found that current smart contract security analyzers cannot effectively handle transaction-reverting statements when detecting security vulnerabilities. Our findings can shed light on further research in the broad area of smart contract quality assurance and provide practical guidance to smart contract developers on the appropriate use of transaction-reverting statements.
Fixing bugs is easiest by patching source code. However, source code is not always available: only 0.3% of the ~49M smart contracts that are currently deployed on Ethereum have their source code publicly available. Moreover, since contracts may call functions from other contracts, security flaws in closed-source contracts may affect open-source contracts as well. However, current state-of-the-art approaches that operate on closed-source contracts (i.e., EVM bytecode), such as EVMPatch and SmartShield, make use of purely hard-coded templates that leverage fix patching patterns. As a result, they cannot dynamically adapt to the bytecode that is being patched, which severely limits their flexibility and scalability. For instance, when patching integer overflows using hard-coded templates, a particular patch template needs to be employed as the bounds to be checked are different for each integer size. In this paper, we propose Elysium, a scalable approach towards automatic smart contract repair at the bytecode level. Elysium combines template-based and semantic-based patching by inferring context information from bytecode. Elysium is currently able to patch 7 different types of vulnerabilities in smart contracts automatically and can easily be extended with new templates and new bug-finding tools. We evaluate its effectiveness and correctness using 3 different datasets by replaying more than 500K transactions on patched contracts. We find that Elysium outperforms existing tools by patching at least 30% more contracts correctly. Finally, we also compare the overhead of Elysium in terms of deployment and transaction cost. In comparison to other tools, we find that generally Elysium minimizes the runtime cost (i.e., transaction cost) up to a factor of 1.7, for only a marginally higher deployment cost, where deployment cost is a one-time cost as compared to the runtime cost.
Ikechi Saviour Igboanusi, Kevin Putra Dirgantoro, Jae‐Min Lee, Dong‐Seong Kim
This article proposes an electronic payment architecture named Pure Wallet (PW), which extends the concept of Blockchain cryptocurrency for offline transactions. The process is divided into three steps. The first step requires the use of Internet connection, to convert cryptocurrency into a token at the token manager. The token manager initiates a transaction that requires the information in the token to complete. Then offline transactions step is performed between electronic devices like mobile phones through a secure Near Field Communication (NFC) using the token in senders device. The financial value in the form of a token is encrypted by the sender and sent to the receiver’s device via NFC. In the third step, the receiver converts the received token into cryptocurrency in the presence of Internet connection by sending the information required to complete the transaction to the token manager. The goal is to propose an electronic payment architecture utilizing Blockchain, which will enable financial transactions without instant connection to the Internet. The Blockchain implementation in this work utilizes smart contract in Ethereum Blockchain. The result shows a successful transfer of value without instant Internet connection. The open issues related to Blockchain in offline transactions are listed for further research works.
Lattice-based non-interactive zero-knowledge proof has been widely used in one-way communication and can be effectively applied to resist quantum attacks. However, lattice-based non-interactive zero-knowledge proof schemes have long faced and paid more attention to some efficiency issues, such as proof size and verification time. In this paper, we propose the non-interactive zero-knowledge proof schemes from RLWE-based key exchange by making use of the Hash function and public-key encryption. We then show how to apply the proposed schemes to achieve the fixed proof size and rapid public verification. Compared with previous approaches, our schemes can realize better effectiveness in proof size and verification time. In addition, the proposed schemes are secure from completeness, soundness, and zero-knowledge.
Abstract The explosive growth of big data is pushing forward the paradigm of cloud-based data store today. Among other, distributed storage systems are widely adopted due to their superior performance and continuous availability. However, due to the potentially wide attacking surfaces of the public cloud, outsourcing data store inevitably raises new concerns on user privacy exposure and unauthorized data access. Besides, directly introducing a centralized third-party authority for query authorization management does not work because it still can be compromised. In this paper, we propose a blockchain-assisted framework that can support trustworthy data sharing services. In particular, data owners allow to outsource their sensitive data to distributed systems in encrypted form. By leveraging smart contracts of blockchain, a data owner can distribute secret keys for authorized users without extra round interaction to generate the permitted search tokens. Meanwhile, such blockchain-assisted framework naturally solves the trust issues of query authorization. Besides, we devise a secure local index framework to support encrypted keyword search with forward privacy and mitigate blockchain overhead. To validate our design, we implement the prototype and deploy it at Amazon Cloud. Extensive experiments demonstrate the security, efficiency, and effectiveness of the blockchain-assisted design.
In order to have transactions executed and recorded on blockchains such as the Ethereum Mainnet, fees expressed in crypto-currency units of the blockchain must be paid. One can buy crypto-currency called Ether of the Ethereum blockchain from exchanges and pay for the transaction fees. In the case of test networks (such as Rinkeby) or scientific research blockchains (such as Bloxberg), free crypto-currency, Ether, is distributed to users via faucets. Since transaction slots on the blocks, storage and smart contract executions are consuming blockchain resources, Ethers are distributed by fixed small amounts to users. Users may have different amount of Ether requirements; some small amounts and some large amounts during different times. As a result, rather than allowing the user to get a fixed small amount of Ether, a more general distribution mechanism that allows a user to demand and claim arbitrary amounts of Ether, while satisfying fairness among users, is needed. For this end, Max-min Fairness based schemes have been used in centralized settings. Our work contributes a Max-min Fairness based algorithm and its Solidity smart contract implementation that requires low transaction costs independent of the number of users. This is important on the Ethereum blockchain, since a smart contract execution with transaction costs depending on the number of users would mean block gas limit exhaustion problem will eventually be met, making the smart contract ineffective. We report tests which confirm that the low transaction cost aims have been achieved by our algorithm.
Mohammad Saidur Rahman, Ibrahim Khalil, Nour Moustafa, Aditya Pribadi Kalapaaking · 5 authors
Advanced Industrial Internet-of-Things (IIoT), such as smart grids, 5G-enabled unmanned aerial vehicles (UAV), and supply chain 4.o, can be used to facilitate smart management. Nevertheless, IIoT systems generate huge amounts of data that need to be outsourced to the cloud for storing and providing real-time search facilities to end-users. Outsourcing IIoT data to a third-party cloud service provider (CSP) introduces several data privacy and integrity issues related to verifying the reliability of users’ queries and aggregated outcomes. In this article, we propose a blockchain-based framework for provisioning a privacy-preserving and verifiable query facility to end-users in IIoT systems. The framework uses blockchain to store IoT data as on-chain data and the cloud to store extensive data (e.g., image) as off-chain data and provisioning search services to users by executing a query in both on-chain and off-chain data and generating an aggregated result. Besides, it introduces a new privacy-preserving query mechanism for ensuring sensitive data privacy during query execution. A data owner encrypts both on-chain and off-chain data in the privacy-preserving query mechanism before sending it to the blockchain and cloud. A CSP can perform search operations on the encrypted on-chain and off-chain data to ensure sensitive data privacy. A multisignature-powered query verification model is also built for the blockchain. The query verification model allows each blockchain node to endorse the query result individually and a user to verify the endorsement of the query result before use. The experiments revealed the high efficiency and scalability of the proposed framework.
B. Sravani, Dr S Pradeep, A Damodar, K Kumar Swamy
Looking at the higher learning institutions, there is no question that the current methods for paying student fees are inefficient, inconvenient, and wasteful of time. In addition, the rise in the number of students studying in higher learning institutions has led to long frustrating queues and overcrowding in most financial institutions during payment of student fees. This paper sought to design and implement a secure block chain-based payment system for higher learning institutions in developing countries. Students are to use the proposed payment system to pay tuition fees and other student fees to their respective higher educational institution. In addition, students are to use the proposed payment to pay for goods and services provided by the institution and other merchants in the institution’s premises. In this study, object oriented software development methodology was used to implement the proposed payment system. The proposed system consists of a mobile e-wallet, RESTful API, and blockchain as the core component of the API.
Open access
Cryptography and Data Security
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Enrico Bacis, Dario Facchinetti, Marco Guarnieri, Marco Rosa · 6 authors
A Time-Lock enables the release of a secret at a future point in time. Many approaches implement Time-Locks as cryptographic puzzles, binding the recovery of the secret to the solution of the puzzle. Since the time required to find the puzzle’s solution may vary due to a multitude of factors, including the computational effort spent, these solutions may not suit all scenarios.
Delegation of cryptographic signing rights has found many application in the literature and the real world. However, despite very advanced functionalities and specific use cases, existing solutions share the natural limitation that the number of usages of these signing rights cannot be efficiently limited, but users can at most be disincentivized to abuse their rights. In this paper, we suggest a solution to this problem based on blockchains. We let a user define a smart contract defining delegated signing rights, which needs to be triggered to successfully sign a message. By leveraging the immutability of the blockchain, our construction can now guarantee that a user-defined threshold of signature invocations cannot be exceeded, thereby circumventing the need for dedicated hardware or similar assistance in existing constructions for one-time programs. We discuss different constructions supporting different features, and provide concrete implementations in the Solidity language of the Ethereum blockchain, proving the real-world efficiency and feasibility of our construction.
Verifiable delay functions have found a lot of applications in blockchain technology in recent times. Continuous verifiable delay functions are an improvement over the basic notion of VDFs with recursive capabilities. We are proposing the application of VDF for constructing more space time-efficient provers and simulators required for the iterative non-interactive zero-knowledge systems.
Blockchain technology has been gaining great interest from a variety of sectors, including healthcare, supply chain and cryptocurrencies. However, Blockchain suffers from its limited ability to scale (i.e. low throughput and high latency). Several solutions have been appeared to tackle this issue. In particular, sharding proved that it is one of the most promising solutions to Blockchain scalability. Sharding can be divided into two major categories: (1) Sharding-based Proof-of-Work (PoW) Blockchain protocols, and (2) Sharding-based Proof-of-Stake (PoS) Blockchain protocols. The two categories achieve a good performances (i.e. good throughput with a reasonable latency), but raise security issues. This article attends that analyze the security of the second category. More specifically, we compute the probability of committing a faulty block and measure the security by computing the number of years to fail. Finally, to show the effectiveness of the proposed model, we conduct a numerical analysis and evaluate the results obtained.
Ethereum platform operates with rich spectrum of data structures and hashing and coding functions. The main source describing them is the Yellow paper, complemented by a lot of informal blogs. These sources are somehow limited. In particular, the Yellow paper does not ideally balance brevity and detail, in some parts it is very detail, while too shallow elsewhere. The blogs on the other hand are often too vague and in certain cases contain incorrect information. As a solution, we provide this document, which summarises data structures used in Ethereum. The goal is to provide sufficient detail while keeping brevity. Sufficiently detailed formal view is enriched with examples to extend on clarity.
Chenhao Xu, Youyang Qu, Tom H. Luan, Peter Eklund · 6 authors
Diverse technologies, such as machine learning and big data, have been driving the prosperity of the Internet of Things (IoT) and the ubiquitous proliferation of IoT devices. Consequently, it is natural that IoT becomes the driving force to meet the increasing demand for frictionless transactions. To secure transactions in IoT, blockchain is widely deployed since it can remove the necessity of a trusted central authority. However, the mainstream blockchain-based IoT payment platforms, dominated by Proof-of-Work (PoW) and Proof-of-Stake (PoS) consensus algorithms, face several major security and scalability challenges that result in system failures and financial loss. Among the three leading attacks in this scenario, double-spend attacks and long-range attacks threaten the tokens of blockchain users, while eclipse attacks target Denial of Service. To defeat these attacks, a novel bidirectional-linked blockchain (BLB) using chameleon hash functions is proposed, where bidirectional pointers are constructed between blocks. Furthermore, a new committee members auction (CMA) consensus algorithm is designed to improve the security and attack resistance of BLB while guaranteeing high scalability. In CMA, distributed blockchain nodes elect committee members through a verifiable random function. The smart contract uses Shamir’s secret-sharing scheme to distribute the trapdoor keys to committee members. To better investigate BLB’s resistance against double-spend attacks, an improved Nakamoto’s attack analysis is presented. In addition, a modified entropy metric is devised to measure eclipse attack resistance across different consensus algorithms. Extensive evaluation results show the superior resistance against attacks and demonstrate high scalability of BLB compared with current leading paradigms based on PoS and PoW.
The amount of information generated grows as more and more sensor and IoT devices are deployed in smart cities. It is of utmost importance for us to consider the privacy data leakage and compromised identity from both outside adversaries and inside abuse of data access privilege. The security assumption of the system should not solely rely on the fact that permission and access control were being implemented correctly. Quite the contrary, a system can be designed in a way that user's identity data and usage traces are not leaked even if the system had been compromised. Based upon our previous on-street parking system utilizing Bluetooth Low Energy (BLE) beacons, we applied a cryptographic primitive called zero-knowledge proof to our authentication system. A commitment scheme and Merkle tree is combined in the setup to achieve zero-knowledge set membership proof. Doing so, the user is anonymous to the server between authentication sessions, while the server's still able to verify the legitimacy of such user. The on-street parking system is therefore immune to privacy data leakage, as for now one cannot mass-query and profile certain user's traces within the system.
In recent years, blockchain has triggered an upsurge in the application of decentralized models and has received more and more attention. For convenience and security considerations, in blockchain applications, users usually use wallets to manage digital assets. The most important data stored in the wallet is the user’s private key, which is also the only identification of the ownership of the encrypted digital assets. Once the private key is lost or stolen, it will bring irreparable losses. We proposed a consortium blockchain wallet scheme based on dual-threshold key protection secret-sharing. By splitting and storing the user’s wallet private key using a secret-sharing method, we can protect our private keys safely and effectively. Our scheme is based on the application scenario of the consortium blockchain. The peers preset by the consortium blockchain store the user’s wallet private key shadow shares, reasonably integrate storage resources, and enhance the solution’s anti-attack ability by setting double thresholds.
Afonso Falcão, Andreia Mordido, Vasco T. Vasconcelos
The popularity of smart contracts is on the rise, yet breaches in reliability and security linger. Among the many facets of smart contract reliability, we concentrate on faults rooted in out-of-order interactions with contract endpoints. We propose SmartScribble, a protocol language to describe valid patterns of interaction between users and endpoints. SmartScribble not only ensures correct interactive behaviour but also simplifies smart contract coding. From a protocol description, our compiler generates a smart contract that can then be completed by the programmer with the relevant business logic. The generated contracts rely on finite state machines to control endpoint invocations. As a proof of concept, we target Plutus, the contract programming language for the Cardano blockchain. Preliminary evaluation points to a 75% decrease in the size of the code that developers must write, coupled with an increase of reliability by enforcing the specified patterns of interaction.
The issue of secure data exchange and performing external transactions between robust distributed ledgers has recently been among the most significant in the sphere of designing and implementing decentralized technologies. Several approaches have been proposed to speed up the process of verifying transactions on adjacent blockchains. The problem of search has not been under research yet. The paper contains security evaluation of data exchange between independent robust distributed ledgers inside multidimensional blockchain. Main principles, basic steps of the protocol and major requirements for it are observed: centralized approach, subset principle and robust SVP. An equivalence of centralized approach and ideal search and verification functionality is proven. The probability of successful verification in case of using fully connected network graph or equivalent approach with fully connected graph between parent and child blockchain is shown. The insecurity of approach with one-to-one links between child and parent ledgers or with a subset principle is proven. A robust search and verification protocol for blocks and transactions based on the features of robust distributed ledgers is presented. The probability of attack on this protocol is mostly defined by the probability of attack on verification and not on search. An approach to protection against an attacker with 50% of nodes in the network is given. It is based on combination of various search and verification techniques.
Abstract Blockchain has decentralization characteristics and requires more targeted security schemes to protect user privacy. In contrast, existing signature schemes have many high‐complexity operations and impose an enormous computational burden on wireless nodes. This article proposes a light‐weighted identity privacy scheme for blockchain‐based on edge computing. We construct linkable identity privacy and non‐linkable identity privacy, which can resist collusion attacks while virtually guaranteeing blockchain nodes' identity privacy. Since edge computing offloads heavily, the proposed scheme has lower computational complexity than the existing techniques.
Qiliang Yang, Mingrui Zhang, Yanwei Zhou, Tao Wang · 6 authors
As an important method of protecting data confidentiality in the Internet of Things (IoT), access control has been widely concerned. Because attribute-based access control mechanisms are dynamic, it is not only suitable to solve the dynamic access problem in IoT, but also to deal with the dynamic caused by node movement and access data change. The traditional centralized attribute-based access control mechanism has some problems: due to the large number of devices in IoT, the central trusted entity may become the bottleneck of the whole system. Moreover, when a central trusted entity is under distributed denial-of-service (DDoS) attack, the entire system may crash. Blockchain is a good way to solve the above problems. Therefore, we developed a non-interactive, attribute-based access control scheme that applies blockchain technology in IoT scenarios by using PSI technology. In addition, the attributes of data user and data holder are hidden, which protects the privacy of both parties’ attributes and access policy. Furthermore, the experimental results indicate that our scheme has high efficiency.
Abstract Health records of any type should be confidential, but simultaneously they should be accessible to an authorized user. In the current conventional health care system, health records are processed in the local database. Only authorized hospital staff can have access to the patient health records kept in health centers. The flow of information in this kind of system is center-restricted. One technology that can potentially overcome this problem is Blockchain. Blockchain technology allows sharing of data in a distributed way with benefits like privacy-preserving and secure access control. To achieve secure access control and privacy of electronic healthcare data (EHD), a secure framework for distributed sharing of the health record is proposed. The use of blockchain will remove the requirement of a trusted 3 rd party for data storage. The framework uses searchable key attribute-based encryption (ABE) for achieving fine-grain access control. The simulation results indicate that our scheme is quite effective and secure.
Abstract The biggest obstacle to electronic migrations of many systems is the need to protect the details and to check the identity of users. Currently, the use of dual-factor authentication is based occasionally on a password. The problem with these approaches is that passwords are extremely insecure and authentication by two factors usually involves the sending of code via SMS or a third-party provider. The blockchain might be a solution to this problem. A 50 billion dollar currency is managed by blockchain. But authentication could be subject to the same cryptographic principles. Thus, blockchain authentication eliminates someone from maliciously modifying the ledger when they distribute a ledger to all network members. A majority of the network shall check its validity any time a block of data is attached to a chain. That guarantees the completeness of the ledger. You can then make sure to send passwords safely using public-key encryption, such as highly protected RSA encryption. The receiver could then search for an entry in the unchanged blockchain, which would result in a remarkably safe and reliable way of handling identity verification. These rules apply for the transformation into a stable, fast, reliable, and readily available service from the election process, state identifiers to dual-factor authentication.