Context: Smart contracts and DApps are becoming increasingly important and widespread. DApps are often business-critical, and strong security guarantees must be ensured. However, developing safe and reliable smart contracts remains a challenging task. Despite growing literature, simple and actionable tools to address security issues are still lacking. Objective: This study identifies design patterns and best practices for DApp security. We categorize them into twelve critical areas based on their security goals and map them to the architecture of decentralized applications. For each item, we define concrete actions to support secure implementation. These are further structured into three security assurance checklists. Method: We analyze existing literature and manually review 224 security items, consolidating duplicates and harmonizing terminology. This process results in 84 unique items, divided into 36 design patterns and 48 best practices, further grouped into 12 categories. We also map the items into three checklists based on the development phase of DApp lifecycle. Finally, for each pattern and practice, we derive 374 actionable security tasks to guide secure development. Results: To the best of our knowledge, this is the most comprehensive and structured collection of DApp security items to date. The proposed framework and checklists help developers ensure the consistent and complete application of secure design principles. Conclusion: Focusing on Ethereum and Solidity, we present a comprehensive framework for improving DApp security. Our work supports ongoing efforts to reduce vulnerabilities in decentralized applications and provides developers with practical tools to build safer, more reliable systems.
ABSTRACT This case examines auditing implications of Bitcoin and blockchain, and is intended for either undergraduate or graduate auditing and assurance courses. Students are asked to engage in aspects of planning and risk assessment for the audit of an online retailer. The case provides an interesting setting in which to achieve the learning objectives of: (1) identifying risks of material misstatement, (2) linking risks of material misstatement to relevant financial statement assertions, (3) explaining changes in audit procedures for responding to risks, (4) understanding a financial statement auditor's use of service auditor reports, and (5) understanding management specialists and the role they play in an audit. The modular case can be used for in-class discussion or as an out-of-class assignment and requires minimal advance preparation by the instructor. The case may be assigned in part or in its entirety. Student responses indicate the case is interesting and offers a positive learning experience.
The demand for Blockchain innovation and the significance of its application has inspired ever-progressing exploration in various scientific and practical areas. Even though it is still in the initial testing stage, the blockchain is being viewed as a progressive solution to address present-day technology concerns, such as decentralization, identity, trust, character, ownership of data, and information-driven choices. Simultaneously, the world is facing an increase in the diversity and quantity of digital information produced by machines and users. While effectively looking for the ideal approach to storing and processing cloud data, the blockchain innovation provides significant inputs. This article reviews the application of blockchain technology for securing cloud storage.
In a fog computing environment, lots of devices need to be authenticated in order to keep the platform being secured. To solve this problem, we turn to blockchain techniques. Unlike the identification cryptographic scheme based on elliptic curves, the proposed 2-adic ring identity authentication scheme inherits the high verification efficiency and high key distribution of sequence ciphers of 2-adic ring theory, and this algorithm adds identity hiding function and trading node supervision function by design. The main designed application scenario of this solution is applicable to the consortium blockchain, and the master nodes are mutually trusting cooperative relations. The node transaction verification and block generation consensus algorithm designed in this solution can be implemented in a set of algorithms, which has higher verification efficiency and easier to be deployed than other solutions. This scheme can be widely used in the fog computing environment.
Open access
advanced mathematical theories
Advanced Steganography and Watermarking Techniques
Meyliana Meyliana, Cadelina Cassandra, Surjandy Surjandy, Henry Antonius Eka Widjaja · 7 authors
Contemporary, Indonesia is looking for an innovative solution to securing diploma certificate and transcript from forgery. Several cases had been reported due to the usage of a fake transcript. One modus of using fake transcript is to enter a higher level of education and job promotion. The new technology found called Blockchain believes in solving the problem. Characteristics of Blockchain Technology such as secured, immutable, distributed, transparent seem to be matched with transcript document requirement. Therefore, the research tries to create a process model of the university teaching and learning process. Several studies have been done; however, no detailed process shown especially for teaching and learning activities. The research question is, how are teaching, and learning activities can be supported by Blockchain Technology? Qualitative method used in this research, focus group discussion with 9 reputable universities discussed the academic operation process and the result show that it is possible to adopt Blockchain Technology into the teaching and learning process to avoid forgery of university transcript documents.
Aug 1, 2020·2020 7th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2020 6th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom)
Despite the increased accuracy of intrusion detection systems (IDS) in identifying cyberattacks in computer networks and devices connected to the internet, distributed or coordinated attacks can still go undetected or not detected on time. The single vantage point limits the ability of these IDSs to detect such attacks. Due to this reason, there is a need for attack characteristics’ exchange among different IDS nodes. Researchers proposed a cooperative intrusion detection system to share these attack characteristics effectively. This approach was useful; however, the security of the shared data cannot be guaranteed. More specifically, maintaining the integrity and consistency of shared data becomes a significant concern. In this paper, we propose a blockchain-based solution that ensures the integrity and consistency of attack characteristics shared in a cooperative intrusion detection system. The proposed architecture achieves this by detecting and preventing fake features injection and compromised IDS nodes. It also facilitates scalable attack features exchange among IDS nodes, ensures heterogeneous IDS nodes participation, and it is robust to public IDS nodes joining and leaving the network. We evaluate the security analysis and latency. The result shows that the proposed approach detects and prevents compromised IDS nodes, malicious features injection, manipulation, or deletion, and it is also scalable with low latency.
The research of blockchain technology in the field of supply chain management has received extensive attention, but the research results and decision-making model of the perfect blockchain technology to solve the supervision of medical equipment supply chain have not yet been formed. This research analyzes and designs a full life cycle supply chain management method for medical equipment based on blockchain technology. A medical equipment supply chain supervision model based on blockchain technology was constructed, and a medical equipment supply chain supervision system based on blockchain technology was formed based on the full life cycle supply chain management model. Combining full life cycle theory with blockchain technology, a medical equipment management information system covering the entire process of production, supply, tendering, procurement, storage, application, export, use, destruction, and traceability of medical equipment was designed.
Network resource management relies on trusted infrastructures. However, current trusted infrastructures have centralized or hierarchical structures where root nodes often have privileges over subtrees. Hacked or malicious roots may affect subtrees by modifying IP ownership, routing and so on. Therefore, a trusted and decentralized network resource management becomes crucial. The emergence of blockchain such as Ethereum becomes a leading candidate for achieving trusted and decentralized network resource management. In this paper, based on Ethereum, we design a trusted authentication scheme that includes voting policy, endorsement, credibility model and rebinding mechanism to ensure the credibility of entities. Our scheme can allocate, delegate and transfer network resources in a trusted and decentralized style. The experimental results verify the feasibility and security of our scheme. When an entity is hacked or malicious, its endorsement authentication is revoked and the entity does not have the right to manage the network resources. In addition, the overhead increased by the trusted authentication scheme is within a reasonable range.
In general, Cloud storage is considered as a distributed model. Here, the data is usually stored on remote servers to properly maintain, back up and make it accessible to clients over a network, whenever required. Cloud storage providers keep the data and processes to oversee it on capacity servers based on secure virtualization methods. A security framework is proposed for auditing the cloud data, which makes use of the proposed blockchain technology. This ensures to efficiently maintain the data integrity. The blockchain structure inspects the mutation of operational information and thereby ensures the data security. Usually, the data auditing scheme is widely used in a Third Party Auditor (TPA), which is a centralized entity that the client is forced to trust, even if the credibility is not guaranteed. To avoid the participation of TPA, a decentralised scheme is suggested, where it uses a smart contract for auditing the cloud data. The working of smart contracts is based on blockchain. Ethereum is used to deploy a smart contract thereby eliminating the need of a foreign source in the data auditing process.
An identity management including authentication and authorization in a network environment is a critical security factor. Various models for identity management have been developed continually, from the silo model to the federated model and to the recently introduced self-sovereign identity (SSI) model. In particular, SSI makes users manage their own information by themselves independently of any organizations. SSI utilizes the newly emerged blockchain technology and many studies of it are in progress. However, SSI has not had wide public use because of its low compatibility and inconvenience. This is because it involves an unfamiliar user experience and an immature process. To solve this problem, this paper proposes a new blockchain-based SSI model that complies with the popular and mature standard of OAuth 2.0. Using blockchain, the proposed model secures users’ data sovereignty where users can use and control their own information in a decentralized manner, instead of depending on a specific monopolistic service-providers. Users and clients who are familiar with the existing OAuth can easily accept the proposed model and apply it, which makes both usability and scalability of the model excellent. This paper confirmed the feasibility of the proposed model by implementing it and a security analysis was performed. The proposed model is expected to contribute to the expansion of both blockchain technology and SSI.
T. Rama Reddy, P. V. G. D. Prasad Reddy, Rayudu Srinivas, Ch. V. Raghavendran · 6 authors
Abstract Education acts as a soul in the overall societal development, in one way or the other. Aspirants, who gain their degrees genuinely, will help society with their knowledge and skills. But, on the other side of the coin, the problem of fake certificates is alarming and worrying. It has been prevalent in different forms from paper-based dummy certificates to replicas backed with database tampering and has increased to astronomic levels in this digital era. In this regard, an overlay mechanism using blockchain technology is proposed to store the genuine certificates in digital form and verify them firmly whenever needed without delay. The proposed system makes sure that the certificates, once verified, can be present online in an immutable form for further reference and provides a tamper-proof concealment to the existing certification system. To confirm the credibility of the proposed method, a prototype of blockchain-based credential securing and verification system is developed in ethereum test network. The implementation and test results show that it is a secure and feasible solution to online credential management system.
Open access
2 source records
Blockchain Technology Applications and Security
Retinal Imaging and Analysis
Advanced Steganography and Watermarking Techniques
Raza Nowrozy, A. S. M. Kayes, Paul Watters, Mamoun Alazab · 7 authors
In the healthcare setting, electronic databases are extensively used, specifically for storing and recalling data for improved medical interventions. However, the currently employed systems in healthcare organizations, such as hospitals and laboratories, have major security issues such as data breaches, unauthorized access, and loss of personal information. Blockchain has been regarded as an effective alternative for providing a secure data sharing for healthcare and other institutions. This is due to the cryptographic features associated with the blockchain technology that can make data breaching difficult and improve data access and sharing. However, it requires a robust and secure framework for effective operations. In order to understand the needs and requirements for a blockchain-based framework for data sharing in the healthcare, an extensive overview of the literature has been carried out, and a proposal is drafted to understand the concepts behind the data sharing framework. This is performed to delineate the requirements of an effective framework for data sharing based on blockchain. This will serve as a cornerstone for the actual research, where the associated requirements would be further researched and utilized in proposing a general data sharing framework. Through a survey of the literature, it has been identified that blockchain-based data sharing can provide better security on access control. Open research issues are also discussed, along with the existing literature.
With an increasing penetration of ubiquitous connectivity, the amount of data describing the actions of end-users has been increasing dramatically, both within the domain of the Internet of Things (IoT) and other smart devices. This has led to more awareness of users in terms of protecting personal data. Within the IoT, there is a growing number of peer-to-peer (P2P) transactions, increasing the exposure to security vulnerabilities, and the risk of cyberattacks. Blockchain technology has been explored as middleware in P2P transactions, but existing solutions have mainly focused on providing a safe environment for data trade without considering potential changes in interaction topologies. we present EdgeBoT, a proof-of-concept smart contracts based platform for the IoT built on top of the ethereum blockchain. With the Blockchain of Things (BoT) at the edge of the network, EdgeBoT enables a wider variety of interaction topologies between nodes in the network and external services while guaranteeing ownership of data and end users' privacy. in EdgeBoT, edge devices trade their data directly with third parties and without the need of intermediaries. This opens the door to new interaction modalities, in which data producers at the edge grant access to batches of their data to different third parties. Leveraging the immutability properties of blockchains, together with the distributed nature of smart contracts, data owners can audit and are aware of all transactions that have occurred with their data. we report initial results demonstrating the potential of EdgeBoT within the IoT. we show that integrating our solutions on top of existing IoT systems has a relatively small footprint in terms of computational resource usage, but a significant impact on the protection of data ownership and management of data trade.
Abstract Cloud computing based on OpenStack is widely used as a distributed computing platform. OpenStack has progressed at a rapid pace, incorporating a variety of service modules; it is supported by many companies, has a community of active developers, and a diverse user base. OpenStack uses message queue to coordinate and exchange operation and status information between services. OpenStack supports various message queue services including RabbitMQ, Qpid, and ZeroMQ, whereas its distribution architecture uses RabbitMQ. As an OpenStack’s message queue service, RabbitMQ runs on a controller node as a centralized service. In case of the centralized service, increased usage may cause slowed response times and security vulnerability. This paper proposes a Hybrid decentralized Practical byzantine fault tolerance Blockchain Framework with two-step verification for OpenStack message queue service. When compared to existing OpenStack message queue service, OpenStack with the proposed framework demonstrates identical reliability a faster response time by approximately 46.75% with a two-step verification process and decentralization approach. Additionally, a reduction in the security vulnerability in the OpenStack message queue information with saving the message queue information into each node by blockchain-based decentralized data duplication approach.
In recent years, centralized storage systems have been extensively adopted by many companies, organizations, and individuals for storing and sharing data. These systems, however, make concerns for users of a single point of failure and the involvement of a centralized entity or third party. Therefore, there is a need for developing decentralized storage systems to overcome the drawbacks of traditional approach. In order to enhance secure and transparent characteristics of decentralized storage systems, in this paper, we present a combination of IPFS (InterPlanetary File System), ABE (Attribute-based Encryption), Multi-Authority ABE (MA-ABE), and Ethereum blockchain. In particular, we facilitate the advantages of IPFS network to store user's data in a distributed manner. Furthermore, we make the use of MA-ABE to encrypt a document, which an user needs to share it among multiple organizations. The hash returned by the IPFS network will be stored in the Ethereum blockchain network to provide trustworthy for all users participating in our system. To the best of our knowledge, it is the first storage system using IPFS, ABE, MA-ABE, and blockchain technologies together to ensure decentralized, secure, and transparent characteristics for storing and sharing data.
The need for data trading promotes the emergence of data market. However, in conventional data markets, both data buyers and data sellers have to use a centralized trading platform which might be dishonest. A dishonest centralized trading platform may steal and resell the data seller's data, or may refuse to send data after receiving payment from the data buyer. It seriously affects the fair data transaction and harm the interests of both parties to the transaction. To address this issue, we propose a novel blockchain-based data trading framework with Trusted Execution Environment (TEE) to provide a trusted decentralized platform for fair data trading. In our design, a blockchain network is proposed to realize the payments from data buyers to data sellers, and a trusted exchange is built by using a TEE for the first time to achieve fair data transmission. With these help, data buyers and data sellers can conduct transactions directly. We implement our proposed framework on Ethereum and Intel SGX, security analysis and experimental results have demonstrated that the framework proposed can effectively guarantee the fair completion of data tradings.