A fundamental problem for electronic commerce is the buying and selling of digital goods between individuals that may not know or trust each other. Traditionally, this problem has been addressed by the use of trusted third-parties such as credit-card companies, mediated escrows, legal adjudication, or reputation systems. Despite the rise of blockchain protocols as a way to send payments without trusted third parties, the important problem of exchanging a digital good for payment without trusted third parties has been paid much less attention. We refer to this problem as the Buyer and Seller's Dilemma and present for it a dual-deposit escrow trade protocol which uses double-sided payment deposits in conjunction with simple cryptographic primitives, and that can be implemented using a blockchain-based smart contract. We analyze our protocol as an extensive-form game and prove that the Sub-game Perfect Nash Equilibrium for this game is for both the buyer and seller to cooperate and behave honestly. We address this problem under the assumption that the digital good being traded is known and verifiable, with a fixed price known to both parties.
Jun 20, 2018·Proceedings of the IEEE International Conference on Computing, Electronics & Communications Engineering 2018 (IEEE iCCECE '18), to be held between 16-17 August 2018, at University of Essex, Southend, UK, published by IEEE
Securities exchange being digitalised and online, security of information and data has become a major concern. Blockchain (BC) technology, being distributed and immutable in nature, has proved to the "Trust Machine" eliminating the need for third-parties. Authors of this paper investigate how Blockchain can be used to secure stock exchange transactions, with an especial focus to the technological as well as legal aspects of such applications. Considering the intricate operational structure of the securities exchange, the research proposes to design, develop and implement a hybrid BC, customised according to the need of the respective stock exchange. The study suggests that the use of such BC can bring many benefits which the other technologies currently being used cannot offer. However, during the design process of any such application using BC, the relevant laws and regulations of the corresponding country need to be considered.
Bitcoin and Ethereum are novel mechanisms for decentralizing the concept of money and computation. Extending decentralization to the human identity concept, we can think of using blockchain for creating a list of verified human identities with a one-person-one-ID property. UniqueID is a Decentralized Autonomous Organization(DAO) for maintaining human identities such that every physical human entity can have no more that one account. One part of this identity is simply the user's claim on one of his unique, permanent, and measurable characteristics -biometrics. Blockchain has proved its integrity as a platform for storing and performing computations on such claims. The biggest challenge here is to ensure that the user has submitted his own valid biometric data. Human verifiers can check if there is any inconsistency in other users' data, by peer-to-peer checks. For preventing bad behavior and centralization in the verification process, UniqueID benefits from novel governance mechanisms to choose verifiers and punish unjust ones. Also, there are incentives for honest verifiers and users by newly generated tokens. We show how the users' privacy can be preserved by using state-of-the-art cryptographic techniques, and so they can use their identity without any concerns for votings, financial and banking purposes, social media accounts, reputation systems etc.
Tooba Faisal, Nicolas T. Courtois, Antoaneta Serguieva
The use of blockchains is growing every day, and their utility has greatly expanded from sending and receiving crypto-coins to smart-contracts and decentralized autonomous organizations. Modern blockchains underpin a variety of applications: from designing a global identity to improving satellite connectivity. In our research we look at the ability of blockchains to store metadata in an increasing volume of transactions and with evolving focus of utilization. We further show that basic approaches to improving blockchain privacy also rely on embedding metadata. This paper identifies and classifies real-life blockchain transactions embedding metadata of a number of major protocols running essentially over the bitcoin blockchain. The empirical analysis here presents the evolution of metadata utilization in the recent years, and the discussion suggests steps towards preventing criminal use. Metadata are relevant to any blockchain, and our analysis considers primarily bitcoin as a case study. The paper concludes that simultaneously with both expanding legitimate utilization of embedded metadata and expanding blockchain functionality, the applied research on improving anonymity and security must also attempt to protect against blockchain abuse.
Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Jun 18, 2018·Andrew Burnie, 2018. Exploring the Interconnectedness of Cryptocurrencies using Correlation Networks. In Cryptocurrency Research Conference 2018 (Anglia Ruskin University, 2018). Anglia Ruskin University, Cambridge, UK
Correlation networks were used to detect characteristics which, although fixed over time, have an important influence on the evolution of prices over time. Potentially important features were identified using the websites and whitepapers of cryptocurrencies with the largest userbases. These were assessed using two datasets to enhance robustness: one with fourteen cryptocurrencies beginning from 9 November 2017, and a subset with nine cryptocurrencies starting 9 September 2016, both ending 6 March 2018. Separately analysing the subset of cryptocurrencies raised the number of data points from 115 to 537, and improved robustness to changes in relationships over time. Excluding USD Tether, the results showed a positive association between different cryptocurrencies that was statistically significant. Robust, strong positive associations were observed for six cryptocurrencies where one was a fork of the other; Bitcoin / Bitcoin Cash was an exception. There was evidence for the existence of a group of cryptocurrencies particularly associated with Cardano, and a separate group correlated with Ethereum. The data was not consistent with a token's functionality or creation mechanism being the dominant determinants of the evolution of prices over time but did suggest that factors other than speculation contributed to the price.
Chuka Oham, Raja Jurdak, Salil S. Kanhere, Ali Dorri · 5 authors
In this paper, we propose a partitioned BlockChain based Framework for Auto-insurance Claims and Adjudication (B-FICA) for CAVs that tracks both sensor data and entity interactions with two-sided verification. B-FICA uses permissioned BC with two partitions to share information on a need to know basis. It also uses multi-signed transactions for proof of execution of instructions, for reliability and auditability and also uses a dynamic lightweight consensus and validation protocol to prevent evidence alteration. Qualitative evaluation shows that B-FICA is resilient to several security attacks from potential liable entities. Finally, simulations show that compared to the state of the art, B-FI CA reduces processing time and its delay overhead is negligible for practical scenarios and at marginal security cost.
Jianli Pan, Jianyu Wang, A. MARIA HESTER, Ismail AlQerm · 6 authors
The emerging Internet of Things (IoT) is facing significant scalability and security challenges. On the one hand, IoT devices are "weak" and need external assistance. Edge computing provides a promising direction addressing the deficiency of centralized cloud computing in scaling massive number of devices. On the other hand, IoT devices are also relatively "vulnerable" facing malicious hackers due to resource constraints. The emerging blockchain and smart contracts technologies bring a series of new security features for IoT and edge computing. In this paper, to address the challenges, we design and prototype an edge-IoT framework named "EdgeChain" based on blockchain and smart contracts. The core idea is to integrate a permissioned blockchain and the internal currency or "coin" system to link the edge cloud resource pool with each IoT device' account and resource usage, and hence behavior of the IoT devices. EdgeChain uses a credit-based resource management system to control how much resource IoT devices can obtain from edge servers, based on pre-defined rules on priority, application types and past behaviors. Smart contracts are used to enforce the rules and policies to regulate the IoT device behavior in a non-deniable and automated manner. All the IoT activities and transactions are recorded into blockchain for secure data logging and auditing. We implement an EdgeChain prototype and conduct extensive experiments to evaluate the ideas. The results show that while gaining the security benefits of blockchain and smart contracts, the cost of integrating them into EdgeChain is within a reasonable and acceptable range.
We propose definitions and implementations of "S-money" - virtual tokens designed for high value fast transactions on networks with relativistic or other trusted signalling constraints, defined by inputs that in general are made at many network points, some or all of which may be space-like separated. We argue that one significant way of characterising types of money in space-time is via the "summoning" tasks they can solve: that is, how flexibly the money can be propagated to a desired space-time point in response to relevant information received at various space-time points. We show that S-money is more flexible than standard quantum or classical money in the sense that it can solve deterministic summoning tasks that they cannot. It requires the issuer and user to have networks of agents with classical data storage and communication, but no long term quantum state storage, and is feasible with current technology. User privacy can be incorporated by secure bit commitment and zero knowledge proof protocols. The level of privacy feasible in given scenarios depends on efficiency and composable security questions that remain to be systematically addressed.
Message digest algorithms are one of the underlying building blocks of\nblockchain platforms such as Ethereum. This paper analyses situations in which\nthe message digest collision resistance property can be exploited by attackers.\nTwo mitigations for possible attacks are described: longer message digest sizes\nmake attacks more difficult; and, including timeliness properties limits the\namount of time an attacker has to determine a hash collision.\n
Recently we could see several institutions coming together to create consortium based blockchain networks such as Hyperledger. Although for applications of blockchain such as Bitcoin, Litcoin, etc. the majority-attack might not be a great threat but for consortium based blockchain networks where we could see several institutions such as public, private, government, etc. are collaborating, the majority-attack might just prove to be a prevalent threat if collusion among these institutions takes place. This paper proposes a methodology where we can use intelligent software agents to monitor the activity of stakeholders in the blockchain networks to detect anomaly such as collusion, using supervised machine learning algorithm and algorithmic game theory and stop the majority-attack from taking place.
By comparing cryptocurrencies with other existing payment methods, including banknotes and bank cards, it is clear that the use of Bitcoin and its competitors (Ethereum, \dots) is almost insignificant in world trade. We may also note that these cryptocurrencies have become tools of speculation, which is the antithesis of their primary purpose. Based essentially on the security of electronic signatures, the Ecash introduced here will put the users back to the center of the game and exclude miners and their enormous waste of power energy. Thus, the purpose of this paper is to show that even a piece of paper can be recycled into a secure Ecash, while remaining environmentally friendly. Hence, we create here a cryptocurrency that would use a slight modification of the current banknotes to set up anonymous electronic transactions. By trading with banknotes, we mechanically transfer ownership of the paper money from one owner to another, hence, in this scheme, we introduce the notion of ownership transfer. It implies that at each transaction the elements allowing to authenticate the Ecash does not change, while the ownership certificate will change since the Ecash is transfer towards someone else.
We analyze the economic incentives generated by the proof-of-stake mechanism discussed in the Ethereum Casper upgrade proposal. Compared with proof-of-work, proof-of-stake has a different cost structure for attackers. In Budish (2018), three equations characterize the limits of Bitcoin, which has a proof-of-work mechanism. We investigate their counterparts and evaluate the risk of double-spending attack and sabotage attack. We argue that PoS is safer than PoW agaisnt double-spending attack because of the tractability of attackers, which implies a large "stock" cost for the attacker. Compared to a PoW system whose mining equipments are repurposable, PoS is also safer against a sabotage attack.
Vincent Chia, Pieter Hartel, Qingze Hum, Sebastian Ma · 8 authors
Blockchain technology has become almost as famous for incidents involving security breaches as for its innovative potential. We shed light on the prevalence and nature of these incidents through a database structured using the STIX format. Apart from OPSEC-related incidents, we find that the nature of many incidents is specific to blockchain technology. Two categories stand out: smart contracts, and techno-economic protocol incentives. For smart contracts, we propose to use recent advances in software testing to find flaws before deployment. For protocols, we propose the PRESTO framework that allows us to compare different protocols within a five-dimensional framework.
Murat Yasin Kubilay, Mehmet Sabir Kiraz, Haci Ali Mantar
In conventional PKI, CAs are assumed to be fully trusted. However, in practice, CAs' absolute responsibility for providing trustworthiness caused major security and privacy issues. To prevent such issues, Google introduced the concept of Certificate Transparency (CT) in 2013. Later, several new PKI models (e.g., AKI, ARPKI, and DTKI) are proposed to reduce the level of trust to the CAs. However, all of these proposals are still vulnerable to split-world attacks if the adversary is capable of showing different views of the log to the targeted victims. In this paper, we propose a new PKI architecture with certificate transparency based on blockchain, what we called CertLedger, to eliminate the split-world attacks and to provide an ideal certificate/revocation transparency. All TLS certificates, their revocation status, entire revocation process, and trusted CA management are conducted in the CertLedger. CertLedger provides a unique, efficient, and trustworthy certificate validation process eliminating the conventional inadequate and incompatible certificate validation processes implemented by different software vendors. TLS clients in the CertLedger also do not require to make certificate validation and store the trusted CA certificates anymore. We analyze the security and performance of the CertLedger and provide a comparison with the previous proposals.
Blockchain technology has recently gained widespread attention by media, businesses, public sector agencies, and various international organizations, and it is being regarded as potentially even more disruptive than the Internet. Despite significant interest, there is a dearth of academic literature that describes key components of blockchains and discusses potential applications. This paper aims to address this gap. This paper presents an overview of blockchain technology, identifies the blockchain's key functional characteristics, builds a formal definition, and offers a discussion and classification of current and emerging blockchain applications.
Krishnendu Chatterjee, Amir Kafshdar Goharshady, Rasmus Ibsen-Jensen, Yaron Velner
Crypto-currencies are digital assets designed to work as a medium of exchange, e.g., Bitcoin, but they are susceptible to attacks (dishonest behavior of participants). A framework for the analysis of attacks in crypto-currencies requires (a) modeling of game-theoretic aspects to analyze incentives for deviation from honest behavior; (b) concurrent interactions between participants; and (c) analysis of long-term monetary gains. Traditional game-theoretic approaches for the analysis of security protocols consider either qualitative temporal properties such as safety and termination, or the very special class of one-shot (stateless) games. However, to analyze general attacks on protocols for crypto-currencies, both stateful analysis and quantitative objectives are necessary. In this work our main contributions are as follows: (a) we show how a class of concurrent mean-payoff games, namely ergodic games, can model various attacks that arise naturally in crypto-currencies; (b) we present the first practical implementation of algorithms for ergodic games that scales to model realistic problems for crypto-currencies; and (c) we present experimental results showing that our framework can handle games with thousands of states and millions of transitions.
Zijian Bao, Wenbo Shi, Debiao He, Kim‐Kwang Raymond Choo
There has been increasing interest in the potential of blockchain in enhancing the security of devices and systems, such as Internet of Things (IoT). In this paper, we present a blockchain-based IoT security architecture, IoTchain. The three-tier architecture comprises an authentication layer, a blockchain layer and an application layer, and is designed to achieve identity authentication, access control, privacy protection, lightweight feature, regional node fault tolerance, denial-of-service resilience, and storage integrity. We also evaluate the performance of IoTchain to demonstrate its utility in an IoT deployment.
Digital identity is unsolved: after many years of research there is still no trusted communication over the Internet. To provide identity within the context of mutual distrust, this paper presents a blockchain-based digital identity solution. Without depending upon a single trusted third party, the proposed solution achieves passport-level legally valid identity. This solution for making identities Self-Sovereign, builds on a generic provable claim model for which attestations of truth from third parties need to be collected. The claim model is then shown to be both blockchain structure and proof method agnostic. Four different implementations in support of these two claim model properties are shown to offer sub-second performance for claim creation and claim verification. Through the properties of Self-Sovereign Identity, legally valid status and acceptable performance, our solution is considered to be fit for adoption by the general public.
Open access
3 source records
Blockchain Technology Applications and Security
Cryptography and Data Security
Advanced Steganography and Watermarking Techniques
Intelligence is one of the most important aspects in the development of our future communities. Ranging from smart home to smart building to smart city, all these smart infrastructures must be supported by intelligent power supply. Smart grid is proposed to solve all challenges of future electricity supply. In smart grid, in order to realize optimal scheduling, an SM is installed at each home to collect the near-real-time electricity consumption data, which can be used by the utilities to offer better smart home services. However, the near-real-time data may disclose a user's private information. An adversary may track the application usage patterns by analyzing the user's electricity consumption profile. In this article, we propose a privacy-preserving and efficient data aggregation scheme. We divide users into different groups, and each group has a private blockchain to record its members' data. To preserve the inner privacy within a group, we use pseudonyms to hide users' identities, and each user may create multiple pseudonyms and associate his/ her data with different pseudonyms. In addition, the bloom filter is adopted for fast authentication. The analysis shows that the proposed scheme can meet the security requirements and achieve better performance than other popular methods.
Petar Tsankov, Andrei Dan, Dana Drachsler Cohen, Arthur Gervais · 6 authors
Permissionless blockchains allow the execution of arbitrary programs (called smart contracts), enabling mutually untrusted entities to interact without relying on trusted third parties. Despite their potential, repeated security concerns have shaken the trust in handling billions of USD by smart contracts. To address this problem, we present Securify, a security analyzer for Ethereum smart contracts that is scalable, fully automated, and able to prove contract behaviors as safe/unsafe with respect to a given property. Securify's analysis consists of two steps. First, it symbolically analyzes the contract's dependency graph to extract precise semantic information from the code. Then, it checks compliance and violation patterns that capture sufficient conditions for proving if a property holds or not. To enable extensibility, all patterns are specified in a designated domain-specific language. Securify is publicly released, it has analyzed >18K contracts submitted by its users, and is regularly used to conduct security audits by experts. We present an extensive evaluation of Securify over real-world Ethereum smart contracts and demonstrate that it can effectively prove the correctness of smart contracts and discover critical violations.
Kazım Rıfat Özyılmaz, Mehmet Ug̃ur Dog̃an, Arda Yurdakul
Today, Internet of Things (IoT) devices are the powerhouse of data generation with their ever-increasing numbers and widespread penetration. Similarly, artificial intelligence (AI) and machine learning (ML) solutions are getting integrated to all kinds of services, making products significantly more "smarter". The centerpiece of these technologies is "data". IoT device vendors should be able keep up with the increased throughput and come up with new business models. On the other hand, AI/ML solutions will produce better results if training data is diverse and plentiful. In this paper, we propose a blockchain-based, decentralized and trustless data marketplace where IoT device vendors and AI/ML solution providers may interact and collaborate. By facilitating a transparent data exchange platform, access to consented data will be democratized and the variety of services targeting end-users will increase. Proposed data marketplace is implemented as a smart contract on Ethereum blockchain and Swarm is used as the distributed storage platform.
With the Internet of Things (IoT), Things are expected to live in different “domains” and “contexts” during their lifetime. Information generated by and associated with Things should be manageable by multiple, diverse stakeholders accordingly. Moreover, the scope of the information related to Things can range from private and confidential to public and auditable. Identification, security, and interoperability in this vivid environment are expected to be challenging. In this paper we discuss how smart contracts and blockchain technologies create the potential for a viable solution. To this end, we present smart contract-based solutions that improve security and information management, we identify new opportunities and challenges, and we provide security recommendations and guidelines.
Joaõ Pedro Dias, Hugo Sereno Ferreira, Ângelo Martins
Access control is a crucial part of a system's security, restricting what actions users can perform on resources. Therefore, access control is a core component when dealing with e-Health data and resources, discriminating which is available for a certain party. We consider that current systems that attempt to assure the share of policies between facilities are prone to system's and network's faults and do not assure the integrity of policies lifecycle. By approaching this problem with the use of a distributed ledger, namely a consortium blockchain, where the operations are stored as transactions, we ensure that the different facilities have knowledge about all the parties that can act over the e-Health resources while maintaining integrity, auditability, authenticity, and scalability.
Blockchain technology, which has been known by mostly small technological circles up until recently, is bursting throughout the globe, with a potential economic and social impact that could fundamentally alter traditional financial and social structures. Issuing cryptocurrencies on top of the Blockchain system by startups and private sector companies is becoming a ubiquitous phenomenon, inducing the trading of these crypto-coins among their holders using dedicated exchanges. Apart from being a trading ledger for tokens, Blockchain can also be observed as a social network. Analyzing and modeling the dynamics of the "social signals" of this network can contribute to our understanding of this ecosystem and the forces acting within in. This work is the first analysis of the network properties of the ERC20 protocol compliant crypto-coins' trading data. Considering all trading wallets as a network's nodes, and constructing its edges using buy--sell trades, we can analyze the network properties of the ERC20 network. Examining several periods of time, and several data aggregation variants, we demonstrate that the network displays strong power-law properties. These results coincide with current network theory expectations, however nonetheless, are the first scientific validation of it, for the ERC20 trading data. The data we examined is composed of over 30 million ERC20 tokens trades, performed by over 6.8 million unique wallets, lapsing over a two years period between February 2016 and February 2018.