John Collomosse, Tu Bui, Alan Brown, John Sheridan · 9 authors
We present ARCHANGEL; a de-centralised platform for ensuring the long-term integrity of digital documents stored within public archives. Document integrity is fundamental to public trust in archives. Yet currently that trust is built upon institutional reputation --- trust at face value in a centralised authority, like a national government archive or University. ARCHANGEL proposes a shift to a technological underscoring of that trust, using distributed ledger technology (DLT) to cryptographically guarantee the provenance, immutability and so the integrity of archived documents. We describe the ARCHANGEL architecture, and report on a prototype of that architecture build over the Ethereum infrastructure. We report early evaluation and feedback of ARCHANGEL from stakeholders in the research data archives space.
The increased deployment of Internet of Things (IoT) devices will make them targets for attacks. IoT devices can also be used as tools for committing crimes. In this regard, we propose Probe-IoT - a forensic investigation framework using a public digital ledger to find facts in criminal incidents in IoT-based systems. Probe-IoT collects interactions that take place among various IoT entities (clouds, users, and IoT devices) as evidence and stores them securely as transactions in public, distributed and decentralized blockchain network which is similar to the Bitcoin network. Probe-IoT presents a scheme that ensures integrity, confidentiality, anonymity, and non-repudiation of the evidence stored in the public ledger. Furthermore, during the investigation of a malicious incident, Probe-IoT provides a mechanism to acquire evidence from the ledger and verify the authenticity and integrity of the obtained evidence.
Traditional database with no prior security measures is becoming challenging in the era of data technology. Database storage on a central location with single point of failure and vulnerable to cyber attacks is getting exposed to big risk of being hacked with the evolution of powerful machines and modern hacking techniques. Since its commencement, the BlockChain technology has shown a promising performance for application buildup in diversed fields of life from cryptocurrency to smart contracts and decentralized applications. Although multiple studies on privacy, data confidentiality and security issues of BlockChain are performed but a systematic examination is still needs attention. In this thesis work we conduct a systematic study about the vulnerabilities of BlockChain system and review the security enhancement solutions that may point to a good future direction for further research into the area of BlockChain technology and its applications. Smart contracts are self-executable objects hosted on the 2nd generation blockchain like Ethereum, carry billions of SEK worth of cryptocoins and cannot be updated once deployed. Smart contracts are generally considered secure objects but the systematic analysis of technology and source code exposes a new class of vulnerabilities which are more likely an ethical aspect of programming than the software coding errors. Besides the literature review we empower our results with a static code analysis especially with the perspective of cyber forensics.
Collection of intelligence is one of the key elements to organize more sophisticated methods of attacks. Open Source Intelligence (OSINT) is a technique used by attackers for reconnaissance purposes to gather information about specific targets. The accessibility to critical information about emerging systems through OSINT leads exposure of vulnerabilities and exploitation of these vulnerabilities to form widespread attack. Blockchain is one of the emerging technologies that exposed the use of crypto currencies such as Bitcoin and Ethereum. This research paper explains the use of OSINT to gather critical information about cryptocurrency miners such as Bitcoin Antminer and Ethereum Claymore and expose the vulnerabilities to exploit the configuration file of the miner manager. The research outcomes expose the vulnerability of the existing crypto currencies and use of OSINT for detection and analysis of cyberthreat in crypto currency market.
Abdellah Ouaguid, Noreddine Abghour, Mohammed Ouzzif
This article presents a new framework named ANDROSCANREG (Android Permissions Scan Registry) that allows to extract and analyze the requested permissions in an Android application via a decentralized and distributed system. This framework is based on the emerging technology Blockchain whose potential is approved in the matter of transparency, reliability, security and availability without resorting to a central processing unit judged of trust. ANDROSCANREG consists of two Blockchains, the first one (PERMBC) will handle analysis, validation and preparation of the raw results so that they will persist in the second Blockchain of Bitcoin already existing (BTCBC), which will assume the role of a Registry of recovered permissions and will save the permissions history of each version of the applications being scanned via financial transactions, whose wallet source, recipient wallet and transaction value have a precise meaning. An example of a simulation will be presented to describe the different steps, actors, interactions and messages generated by the different entity of ANDROSCANREG.
Santiago Bragagnolo, Henrique Rocha, Marcus Denker, Sté́phane Ducasse
Smart contracts are embedded procedures stored with the data they act upon.Debugging deployed Smart Contracts is a difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded.In this technical report, we present SmartInspect to address the lack of inspectability of a deployed contract.Our solution analyses the contract state by using decompilation techniques and a mirror-based architecture to represent the object responsible for interpreting the contract state.SmartInspect allows developers and also end-users of a contract to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code.
Because of the distributed nature of cloud computing, the data of cloud may be stored and processed across jurisdictional borders. In such case, collecting digital evidence from cloud computing requires multiparty cooperation. However, as far as we known, there is still no available technic approach for improving the trustworthy of the interaction records of all stakeholders in cloud forensics. This work proposed a process provenance, which provides proof of existence and privacy preservation for process records by using technologies of blockchain and cryptography group signature. The process provenance enhances the trustworthy of the chain of custody for cloud forensics.
Willy Sudiarto Raharjo, Ignatia Dhian Estu Karisma Ratri, Henry Susilo
Abstract — This paper describes a login system utilizing Two Factor Authentication and Zero Knowledge Proof using Schnorr NIZK. The proposed system is designed to prevent password leak when being sent over insecure network or when used in an untrusted devices. Zero Knowledge Proof is used for maintaining the confidentiality of the password and Two Factor Authentication is used to secure login process on untrusted devices. The proposed system has been tested and initial results indicates that such system is able to secure the login process without leaking the user’s password. Keywords— Authentication, Security, Two Factor Authentication, Password, Zero Knowledge Proof
Recent efficient constructions of zero-knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs), require a setup phase in which a common-reference string (CRS) with a certain structure is generated. This CRS is sometimes referred to as the public parameters of the system, and is used for constructing and verifying proofs. A drawback of these constructions is that whomever runs the setup phase subsequently possesses trapdoor information enabling them to produce fraudulent pseudoproofs.
Ethereum is a framework for cryptocurrencies which uses blockchain technology to provide an open global computing platform, called the Ethereum Virtual Machine (EVM). EVM executes bytecode on a simple stack machine. Programmers do not usually write EVM code; instead, they can program in a JavaScript-like language, called Solidity, that compiles to bytecode. Since the main purpose of EVM is to execute smart contracts that manage and transfer digital assets (called Ether), security is of paramount importance. However, writing secure smart contracts can be extremely difficult: due to the openness of Ethereum, both programs and pseudonymous users can call into the public methods of other programs, leading to potentially dangerous compositions of trusted and untrusted code. This risk was recently illustrated by an attack on TheDAO contract that exploited subtle details of the EVM semantics to transfer roughly $50M worth of Ether into the control of an attacker.
Purpose The purpose of this paper is to explore the value of Blockchain technology as a solution to creating and preserving trustworthy digital records, presenting some of the limitations, risks and opportunities of the approach. Design/methodology/approach The methodological approach involves using the requirements embedded in records management and digital preservation standards, specifically ISO 15,489, ARMA’s Generally Accepted Recordkeeping Principles, ISO 14,721 and ISO 16,363, as a general evaluative framework for a risk-based assessment of a specific proposed implementation of Blockchain technology for a land registry system in a developing country. Findings The results of the analysis suggest that Blockchain technology can be used to address issues associated with information integrity in the present and near term, assuming proper security architecture and infrastructure management controls. It does not, however, guarantee reliability of information in the first place, and would have several limitations as a long-term solution for maintaining trustworthy digital records. Originality/value This paper contributes an original analysis of the application of Blockchain technology for recordkeeping.
Digital forensics must constantly adapt to new technological developments. The advent of Bitcoin is such a development. Bitcoin represents a new model for financial transactions. In many cash transactions between strangers, the underlying model is parties-unknown/transaction-unknown. There is no ledger record of the transaction. In contrast, PayPal illustrates the parties-known/transaction-known model. An intermediary will record both items of information. Bitcoin differs from both of these models; Bitcoin uses a parties-unknown/transaction-known model. The Bitcoin block chain records the transaction, but the user’s Bitcoin address is not expressly tied to an identity. Thus, Bitcoin users enjoy pseudo-anonymity.As the recent experience with Silk Road demonstrates, there is a downside to this pseudo-anonymity. Precisely because of that feature, Silk Road served a marketplace for vendors to sell illegal narcotics, forged identifications, and other illicit goods and services. Given that danger, law enforcement authorities have a felt need to develop techniques to penetrate the pseudo-anonymity. To do so, they have turned to digital forensics experts.This article evaluates two techniques that have been proposed for this purpose. The first is traffic analysis. This technique relies on the entry nodes that users employ to access the Internet. The second is transaction graph analysis. This technique clusters transactions to identify natural chokepoints in the Bitcoin economy, that is, service islands where, for example, the user might convert Bitcoins to fiat currency. The chokepoints becomes a target for a law enforcement subpoena to learn the user’s IP address. After describing each technique, the article assesses the research conducted to date. In particular, the article reviews Alex Biryukov’s research into traffic analysis and Sarak Meiklejohn’s work with transaction graph analysis. The article applies the standards announced in Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993) to determine whether, given the available data, expert testimony based on either technique would be admissible today. The article explains that it is doubtful whether testimony based on either technique would survive a Daubert admissibility challenge. The article concludes that further research is needed to enable law enforcement authorities to effectively penetrate the pseudo-anonymity of the new parties-unknown/transaction-known model.
The increasing demand in promoting cloud computing in either business or other areas requires more security of a cloud storage system. Traditional cloud storage systems fail to protect data integrity information (DII), when the interactive messages between the client and the data storage server are sniffed. To protect DII and support public verifiability, we propose a data integrity verification scheme by deploying a designated confirmer signature DCS as a building block. The DCS scheme strikes the balance between public verifiable signatures and zero-knowledge proofs which can address disputes between the cloud storage server and any user, whoever acting as a malicious player during the two-round verification. In addition, our verification scheme remains blockless and stateless, which is important in conducting a secure and efficient cryptosystem. We perform security analysis and performance evaluation on our scheme, and compared with the existing schemes, the results show that our scheme is more secure and efficient.
Cloud computing is the vast computing utility, where users can remotely store their data into the cloud so to have the benefit of the on-demand availability of huge and different applications and services from a shared pool of configurable computing resources.Cloud-based outsourced storage space reduces the patron load of storage management. It also reduces the maintenance load of customer by providing a comparably low-cost, scalable, locationindependent platform.This new model of data hosting service commence a new security challenges, which requires an independent auditing service which audit the data integrity of cloud. There are different existing auditing services available in cloud which audit data integrity remotely in static motion but these are not applicable whenever data is dynamically updated in cloud. Since it require efficient and secure dynamic auditing method for data owner. However in cloud, the clients no have direct physical possession of data. It shows client faces different formidable risk like missing or corruption of data. To keep away from the security and integrity risk of data, audit services are essential to ensure the integrity and availability of outsourced data and to achieve digital forensics and credibility on cloud computing.Provable data possession (PDP), which is a cryptographic technique for verifying the integrity of data without retrieving it at an untrusted server, can be used to realize audit services. In this paper, profiting from the interactive proof system, we address the construction of an interactive PDP protocol to prevent the fraudulence of prove (soundness property) and the leakage of verified data (zero-knowledge property).
This thesis illustrates forensic research work on Bitcoin, an innovative Internet based global transaction system that attracts ascending popularity during the recent few years. As an open, public and scalable distributed payment system, Bitcoin brings forward significant economic and technological impact to our world. Meanwhile, a new notion of virtual currency, "Bitcoin" comes into existence such that Bitcoin currency can be "mined" from all over world complying with specific algorithms. Mined bit "coins" has practical monetary values that turn the Bitcoin system into a digital currency circulation system. Due to Bitcoin's decentralized semantics, Bitcoin transaction and currency are not subject to control and censorship from any single authority. Therefore, Bitcoin brings out various security concerns about its application as a long-term reliable system.\nThe research in the thesis focuses on forensic study on Bitcoin. It covers experimental study on the Bitcoin network as a peer-to-peer system and a graph-based forensic approach against Bitcoin's transaction data. Major contributions include network data evaluation and transaction history analysis. In case of forensic investigation is needed against criminal incidents such as fraud, false transactions and money theft, which are commonly seen in commonly used digital payment systems, the research provides a guidance of efficient information collection and framework of evidence data processing and extraction
Are there differences between the sale of an unopened Super Mario Bros. computer game and of the digital collage of 5,000 images? Viewed from the perspective of the doctrine of exhaustion, we can easily conclude that the two transfers have significant differences. The auction of the tangible data carrier of the Super Mario’s 1986 edition (for $660,000) 1 fits well into the doctrine. The auction of the NFT (non-fungible token) representing Beeple’s “Everdays: the First 5000 Days” (for an equivalent of an astounding $69.3 million) 2 seems to be hype with a snowball effect rather than a modern encapsulation of digital exhaustion. Some commentators, 3 including the present author in collaboration with Alexandra Giannapoulou, João Pedro Quintais, and Balázs Bodó, 4 have thoroughly introduced the incompatibility of the NFT mania with the existing copyright status quo, and so – in connection with the present book’s topic – the sale of tokenized information, which is capable of representing information related to digital artworks, is practically excluded from the scope of the exhaustion of the right of distribution. At the same time, NFTs de facto offer a “code-based digital ecosystem that has practical consequences for the copyright-relevant fields of creativeness.” 5 The sale and resale of NFTs is possible; an exchange of information and title to “own” and “trade” information related to copyrightable subject matter is technologically guaranteed. In line with that, a quasi-exhaustion regime has also emerged. As such, the NFT mania can practically evidence the need for and modern technology’s capability of offering digital marketplaces for artworks as well.
The selective decommitment problem can be described as follows: assume an adversary receives a number of commitments and then may request openings of, say, half of them. Do the unopened commitments remain secure? Although this question arose more than twenty years ago, no satisfactory answer could be presented so far. We answer the question in several ways: 1. If simulation-based security is desired (i.e., if we demand that the adversary's output can be simulated by a machine that does not see the unopened commitments), then security is not achievable for non-interactive or perfectly binding commitment schemes via black-box reductions to standard cryptographic assumptions. However, we show how to achieve security in this sense with interaction and a non-black-box reduction to one-way permutations. 2. If only indistinguishability of the unopened commitments from random commitments is desired, then security is not achievable for (interactive or non-interactive) perfectly binding commitment schemes, via black-box reductions to standard cryptographic assumptions. However, any statistically hiding scheme does achieve security in this sense. Our results give an almost complete picture when and how security under selective openings can be achieved. Applications of our results include: • Essentially, an encryption scheme must be non-committing in order to achieve provable security against an adaptive adversary. • When implemented with our secure commitment scheme, the interactive proof for graph 3-coloring due to Goldreich et al. becomes zero-knowledge under parallel composition. On the technical side, we develop a technique to show very general impossibility results for black-box proofs.
In this thesis,we design a protocol based on Zero-Knowledge Proof to realize the real time secure communication.This protocol is realized through the way of intertactive communication and is also an application of the Zero-Knowledge Proof in identification.The security of this protocol is based on the factorization of large numbers and RSA problems.This protocol can complete the identification with less amount of intetactive communication.