Caleb Geren, Amanda Board, Gaby G. Dagher, Tim Andersen · 5 authors
With the growing development and deployment of large language models (LLMs) in both industrial and academic fields, their security and safety concerns have become increasingly critical. However, recent studies indicate that LLMs face numerous vulnerabilities, including data poisoning, prompt injections, and unauthorized data exposure, which conventional methods have struggled to address fully. In parallel, blockchain technology, known for its data immutability and decentralized structure, offers a promising foundation for safeguarding LLMs. In this survey, we aim to comprehensively assess how to leverage blockchain technology to enhance LLMs' security and safety. Besides, we propose a new taxonomy of blockchain for large language models (BC4LLMs) to systematically categorize related works in this emerging field. Our analysis includes novel frameworks and definitions to delineate security and safety in the context of BC4LLMs, highlighting potential research directions and challenges at this intersection. Through this study, we aim to stimulate targeted advancements in blockchain-integrated LLM security.
Decentralized Autonomous Organizations (DAOs) have emerged as pioneers of decentralized innovation, utilizing smart contracts and blockchain technology to operate autonomously. However, their progress is impeded by persistent security vulnerabilities. In response, we introduce a groundbreaking security solution: Decentralized Autonomous Verification (DAVe). DAVe integrates blockchain-based consensus mechanisms with advanced cryptographic techniques to establish a resilient security framework tailored to the specific requirements of DAOs. Through DAVe implementation, DAOs can effectively mitigate smart contract vulnerabilities, amplify transparency, and cultivate trust among participants. This solution represents a pivotal advancement in fortifying the future of decentralized governance, safeguarding the integrity of DAO operations amidst the ever-evolving landscape of cyber threats.
Hulin Yang, Mingzhe Li, Jin Zhang, Alia Asheralieva · 6 authors
The advent of Ethereum 2.0 has introduced significant changes, particularly the shift to Proof-of-Stake consensus. This change presents new opportunities and challenges for arbitrage. Amidst these changes, we introduce BriDe Arbitrager, a novel tool designed for Ethereum 2.0 that leverages Bribery-driven attacks to Delay block production and increase arbitrage gains. The main idea is to allow malicious proposers to delay block production by bribing validators/proposers, thereby gaining more time to identify arbitrage opportunities. Through analysing the bribery process, we design an adaptive bribery strategy. Additionally, we propose a Delayed Transaction Ordering Algorithm to leverage the delayed time to amplify arbitrage profits for malicious proposers. To ensure fairness and automate the bribery process, we design and implement a bribery smart contract and a bribery client. As a result, BriDe Arbitrager enables adversaries controlling a limited (< 1/4) fraction of the voting powers to delay block production via bribery and arbitrage more profit. Extensive experimental results based on Ethereum historical transactions demonstrate that BriDe Arbitrager yields an average of 8.66 ETH (16,442.23 USD) daily profits. Furthermore, our approach does not trigger any slashing mechanisms and remains effective even under Proposer Builder Separation and other potential mechanisms will be adopted by Ethereum.
Mike Graf, Ralf Küsters, Daniel Rausch, Simon Egger · 6 authors
Bulletin boards (BB) are important cryptographic building blocks that, at their core, provide a broadcast channel with memory. BBs are widely used within many security protocols, including secure multiparty computation protocols, evoting systems, and electronic auctions. Even though the security of protocols crucially depends on the underlying BB, as also highlighted by recent works, the literature on constructing secure BBs is sparse. The so-far only provably secure BBs requiretrusted components and sometimes also networks without message loss, which makes them unsuitable for applications with particularly high security needs where these assumptions might not always be met. In this work, we fill this gap by leveraging the concepts of accountability and universal composability (UC). More specifically, we propose the first ideal functionality for accountable BBs that formalizes the security requirements of such BBs in UC. We then propose Fabric*BBas a slight extension designed on top of Fabric*, which is a variant of the prominent Hyperledger Fabric distributed ledger protocol, and show that Fabric*BBUC-realizes our ideal BB functionality. This result makes Fabric*BBthe first provably accountable BB, an often desired, but so far not formally proven property for BBs, and also the first BB that has been proven to be secure based only on standard cryptographic assumptions and without requiring trusted BB components or network assumptions. Through an implementation and performance evaluation we show that Fabric*BBis practical for many applications of BBs.
The sharing of private information is a daunting, multifaceted, and expensive undertaking. Furthermore, identity management is an additional challenge that poses significant technological, operational, and legal obstacles. Present solutions and their accompanying infrastructures rely on centralized models that are susceptible to hacking and can hinder data control by the rightful owner. Consequently, blockchain technology has generated interest in the fields of identity and access control. This technology is viewed as a potential solution due to its ability to offer decentralization, transparency, provenance, security, and privacy benefits. Nevertheless, a completely decentralized and private solution that enables data owners to control their private data has yet to be presented. In this research, we introduce DeAuth, a novel decentralized, authentication and authorization scheme for secure private data transfer. DeAuth combines blockchain, smart-contracts, decentralized identity, and distributed peer-to-peer (P2P) storage to give users more control of their private data, and permissioning power to share without centralized services. For this scheme, identity is proven using decentralized identifiers and verifiable credentials, while authorization to share data is performed using the blockchain. A prototype was developed using the Ethereum Blockchain and the InterPlanetary Files System, a P2P file sharing protocol. We evaluated DeAuth through a use-case study and metrics such as security, performance, and cost. Our findings indicate DeAuth to be viable alternative to using centralized services; however, the underlying technologies are still in its infancies and require more testing before it can supplant traditional services.
Mathe. Suneela, D Srilatha, K Venkateswara Rao, M Asha Priyadarshini · 6 authors
In today’s digital era, traditional methods of academic certificate validation are plagued by inefficiencies and vulnerabilities to fraudulent activities. To combat these challenges, integrating blockchain technology presents a promising solution. Originally designed for cryptocurrencies such as Bitcoin, blockchain offers a decentralized ledger system characterized by transparency, cryptographic security, and immutability. This research endeavors to explore the utilization of blockchain for the validation of student certificates. Our proposed system aims to develop a robust platform for issuing, storing, and verifying certificates, leveraging blockchain’s distributed consensus and cryptographic features to ensure integrity and authenticity. Additionally, the system will incorporate user-friendly interfaces, seamless integration with existing educational systems, and advanced security measures to enhance user experience and trust in the validation process. This innovative approach grants individuals’ greater control over their credentials while mitigating risks of fraud and manipulation, thus revolutionizing the landscape of academic certificate validation in the digital age.
The architecture of SDN can be roughly divided into the application layer, the control plane, and the data plane. Applications at the application layer drive the controllers of the control plane through the northbound interface (NBI) to manage the network. Traditionally, there is usually only one controller to fulfill the management. However, in SD-WAN, the number of controllers in the control plane is no longer unique and may belong to different branches. For these distributed controllers to collaborate securely and effectively, an access control mechanism adapted to the distributed network environment is required. The network structure of SD-WAN is more complex and its network scale is larger than traditional SDN, which also puts forward new requirements for the design of access control mechanisms. Besides, in other scenarios such as the polymorphic network, multiple controllers are also required to achieve high availability and redundancy, which also brings in the access control issue among controllers. Attribute-based access control (ABAC) is a potential solution, which can provide higher fine-grained access control functions than traditional technologies such as role-based access control (RBAC), discretionary access control (DAC), etc. In addition, the blockchain can provide a practical environment for operating a decentralized and secure access control mechanism. Based on the combination of these two technologies, we designed and implemented a distributed access control mechanism using smart contracts, which is named DABS. Experimental results show that DABS is able to support the role of access control, whose performance and scalability are sufficient for the SD-WAN scenario.
Web 3.0 has been proposed as a new generation of the Internet, which shifts towards system decentralization, improved data security, and self-sovereign identity. With the proliferation of networked entities, the proper management and verification of their identities play a vital role in Web 3.0. Decentralized identity is a promising paradigm to enhance data security and restore sovereignty over personal data to users. However, the data security in existing centralized solutions is often severely limited. In this paper, we propose vDID, a novel blockchain-enabled verifiable decentralized identity management system for Web 3.0. First, we design a generic verifiable DID structure, which is capable of capturing and expressing the inherent relationships between different entities with high granularity. Second, we develop an identity verification scheme to support efficient integrity verification for identities and their relationships in the decentralized framework. We implement vDID and conduct experiments to evaluate the system performance. Experimental results demonstrate the effectiveness of our proposed system.
Identity management plays a critical role in Web3 applications. Decentralized Identity (DID) offers a privacy-preserving solution, giving users full control over their identity information. Existing research on DID primarily focuses on single-owner scenarios, where owners have complete privileges for owner management and credentials. However, in multi-owner cases, current coarse-grained identity management approaches lead to serious privacy and security problems, such as identity impersonation and high key recovery overhead. Little work has been done on identity management for multiple owners. In this paper, we propose MoDID, a fine-grained identity management scheme for multiple owners, which complies with the DID standard proposed by W3C. First, our solution allows multiple owners to control DID subjects flexibly and reliably through hierarchical owner management. Additionally, we design a secure key recovery scheme to reduce the risk of identity loss while introducing lower overhead. Finally, we implement MoDID on the Sepolia Ethereum Test Network to evaluate the effectiveness of our proposed scheme. The result demonstrates that our system allows multiple owners to manage a single identity with lower gas consumption and time consumption than the state-of-the-art.
With the rapid growth in demand for mobile data fueled by the emergence of new consumer applications that require high quality of service, existing static mobile data pricing plans are no longer suitable. Although several dynamic pricing mechanisms have been proposed in the literature, they have not been widely adopted due to their associated implementation complexity, the lack of trust in the associated platforms, and the absence of automatic enforcement. To address these challenges, we propose a credible trust framework (CREDIT) that leverages well-established Ethereum smart contracts for service-level agreement (SLA) enforcement. CREDIT introduces a novel SLA verification mechanism through fair auditor selection and auditor payoff to ensure truthfulness, and hence reinforces trust between the various parties involved in CREDIT. A detailed game-theoretic analysis is provided to prove the credibility of CREDIT by using the principle of a strong Nash equilibrium. In addition, CREDIT is prototyped by leveraging the smart contracts of Ethereum Blockchain. The results achieved provide a valuable validation of the feasibility of CREDIT.
The relationship between doctors and patients is reinforced through the expanded communication channels provided by remote healthcare services, resulting in heightened patient satisfaction and loyalty. Nonetheless, the growth of these services is hampered by security and privacy challenges they confront. Additionally, patient electronic health records (EHR) information is dispersed across multiple hospitals in different formats, undermining data sovereignty. It allows any service to assert authority over their EHR, effectively controlling its usage. This paper proposes a blockchain enforced attribute-based access control in healthcare service. To enhance the privacy and data-sovereignty, the proposed system employs attribute-based access control, zero-knowledge proof (ZKP) and blockchain. The role of data within our system is pivotal in defining attributes. These attributes, in turn, form the fundamental basis for access control criteria. Blockchain is used to keep hospital information in public chain but EHR related data in private chain. Furthermore, EHR provides access control by using the attributed based cryptosystem before they are stored in the blockchain. Analysis shows that the proposed system provides data sovereignty with privacy provision based on the attributed based access control.
Rahma Mukta, Hye-Young Paik, Qinghua Lu, Salil S. Kanhere
We propose CredAct, a user activity verification designed with data minimisation to protect privacy. Many Benefits Schemes, such as discount offers, loyalty programs, and incentive systems, require verification of user activity (e.g., buying healthy food, step counts) in their business processes. These service providers can collect a large amount of users’ personal information, and often users do not have fine-grained control over the scope of data disclosure. In CredAct, we propose a Self-Sovereign Identity based framework implemented on blockchain that enables users participating in a benefits scheme to minimise data sharing during the submission and verification of data. We use a smart contract-based function along with a Zero-Knowledge Proof cryptographic commitment scheme, that forces the entities involved in the business process to collect or disclose only the required (minimum) data to fulfill the intended purpose. The evaluation shows that the system is feasible with minimal operational overheads compared to traditional cryptographic techniques. We also perform a qualitative privacy and security analysis considering relevant threats to CredAct.
Sandro Rodriguez Garzon, Dennis Natusch, Artur Philipp, Axel Küpper · 6 authors
Authentication in TLS is predominately carried out with X.509 digital certificates issued by certificate au-thorities (CA). The centralized nature of current public key infrastructures, however, comes along with severe risks, such as single points of failure and susceptibility to cyber-attacks, potentially undermining the security and trustworthiness of the entire system. With Decentralized Identifiers (DID) alongside distributed ledger technology, it becomes technically feasible to prove ownership of a unique identifier without requiring an attestation of the proof's public key by a centralized and therefore vulnerable CA. This article presents DID Link, a novel authentication scheme for TLS 1.3 that empowers entities to authenticate in a TLS-compliant way with self-issued X.509 certificates that are equipped with ledger-anchored DIDs instead of CA-issued identifiers. It facilitates the exchange of tamper-proof and 3rd-party attested claims in the form of DID-bound Verifiable Credentials after the TLS handshake to complete the authentication with a full identification of the communication partner. A prototypical implementation shows comparable TLS handshake durations of DID Link if verification material is cached and reasonable prolongations if it is obtained from a ledger. The significant speed improvement of the resulting TLS channel over a widely used, DID-based alternative transport protocol on the application layer demonstrates the potential of DID Link to become a viable solution for the establishment of secure and trustful end-to-end communication links with decentrally managed digital identities.
Ze Wang, Zhenglin Zong, F. Li, Shimin Sun · 5 authors
Cross-domain interaction in social networks and mobile applications is rapidly expanding. The demand for accessing data across multiple domains from different applications is growing. Establishing robust authorization and access control mechanisms within trusted domains has become a critical foundation for data security. Despite advancements in the field of identity authentication and cross-domain access, challenges persist in various application domain transition scenarios, including cumbersome and inefficient processes, and the potential for authority misuse by malicious actors in decentralized environments. To mitigate these limitations, we propose a blockchain-based scheme that leverages consensus mechanisms to enable “one-time authentication, multidomain authorization.” This scheme enhances security attributes and performance in several key aspects. First, we developed a primary–secondary chain model compatible with multiple trusted domains, where the primary chain records user authentication and authorization information, and the secondary chain logs domain-specific user identity registration information. Nodes within the primary and secondary chains reach a rapid consensus on authentication outcomes through an improved consensus algorithm. Building on this model, we devised a certificateless cross-domain identity authentication method, rendering the authentication and authorization processes more secure and efficient. Additionally, to address the issue of centralized user authority, an optimized chameleon hash function was designed to facilitate identity revocation within a multicentric environment. Furthermore, security analyses and simulation validations were conducted to assess the performance of the proposed scheme. Compared to existing approaches, our scheme demonstrates reduced computational and communication overhead, substantiating its efficacy in streamlining cross-domain interactions.
Recently, distributed databases have achieved tremendous realistic performances and developed one of the most essentially utilized tools in society communication applications. However, the existing distributed databases often contain users’ sensitive information and are vulnerable to web attackers, which may cause severe privacy issues and economic loss. In this paper, we first attempt to propose a novel protocol to dispose of the potential verification risks in distributed databases. Compared with currently distributed databases, the requester can steal important data without any payment. Therefore, our model faces two primary challenges including guaranteeing the efficiency and security of the distributed databases, the data verification procedure may lead to data leakage. To address the above problems, we utilize zero-knowledge proof to dispose of the data verification issue for the requester. Moreover, a secure and effective proof protocol is established to achieve database responses the privacy data access. From our extensive experimental results, we can conclude that our developed framework can achieve an effective performance with reasonable communication costs.
Recent booming development of Generative Artificial Intelligence (GenAI) has facilitated model commercialization to reinforce the model performance, including licensing or trading Deep Neural Network (DNN) models. However, DNN model trading may violate the benefit of the model owner due to unauthorized replications or misuse of the model. Model identity auditing is a challenging issue in protecting DNN model ownership, and verifying the integrity and ownership of models is one of the critical obstacles. In this paper, we focus on the above issue and propose an \underline{A}ccumulator-enabled \underline{A}uditing for \underline{D}ecentralized \underline{Id}entity of DNN \underline{M}odel (A2-DIDM) that utilizes blockchain and zero-knowledge techniques to protect data and function privacy while ensuring the lightweight on-chain ownership verification. The proposed model presents a scheme of identity records via configuring model weight checkpoints with zero-knowledge proofs, which incorporates predicates to capture incremental state changes in model weight checkpoints. Our scheme ensures both computational integrity and programmability in DNN training process so that the uniqueness of the weight checkpoint sequence in a DNN model is preserved. %to ensure the correctness of model identity auditing, so that the uniqueness of the weight checkpoint sequence in a DNN model is preserved. A2-DIDM also addresses privacy protections in decentralized identity. We systematically analyze the security and robustness of our proposed model and further evaluate the effectiveness and usability of auditing DNN model identities. The code is available at https://github.com/xtx123456/A2-DIDM.git.
Sourav Saha, Ashok Kumar Das, Mohammad Wazid, Youngho Park · 6 authors
6G (sixth-generation wireless), the successor to 5G cellular technology, operates at higher frequencies than its predecessor and supports significantly greater capacity and markedly reduced latency. Healthcare is treated as a complex system with various stakeholders, like doctors, patients, hospitals, pharmaceutical companies as well as healthcare decision-makers. The innovations in the Internet of Things (IoT) and incorporating emerging technology in the healthcare systems provide the quality of services to the people and save millions of lives. However, patient privacy and secure interchange of medical data from various healthcare providers need to be adequately addressed. Furthermore, incorporating blockchain in the healthcare system helps to make the system more transparent and secure due to inherent properties of the blockchain. In addition, Big Data analytics helps in analyzing large datasets from hundreds of patients, and then in identifying various clusters and correlation among datasets, and also in developing predictive models. In this paper, we aim to propose a new smart contract-based access control for 6G-enabled blockchain assisted in the healthcare system (in short, we call it as SACS). SACS provides a patient to communicate with its healthcare management authority securely and helps to interchange his/her medical information across healthcare providers. A detailed security analysis, experimental results and comparative study assure that the proposed SACS is secure by preventing possible active and passive attacks, and requires less computational and communication costs as compared to those for other relevant competing schemes.
Many Internet of Things (IoT) applications are considering multi-tenancy to support for multiple entities sharing access to the same IoT devices. The challenge of ensuring IoT security and privacy is exacerbated in multi-tenant environments accommodating “guest” users, i.e., opportunistic users that the system has not encountered. Thus, there is a need for novel access control mechanisms capable of addressing the complexities introduced by the opportunistic nature of the users who create complex trust relationships within the IoT ecosystem. In this study, we proposed a solution that leverages Verifiable Credentials (VCs) to implement Attribute-Based Access Control (ABA C) for multi-tenant IoT environments and we integrate it with W3C's Web of Things (WoT) standards, enhancing interoperability. Through the utilization of VCs, the solution provides secure verification and efficient revocation of user attributes, enabling access control decisions based on the enclosed attributes. Additionally, the proposed system ensures privacy, since users can selectively disclose the necessary attributes to gain access to resources through the utilization of Zero Knowledge Proofs (ZKPs). Finally, the solution does not require users to have any “pre-existing” trust relationships with the protected system.
With the increasingly widespread application of machine learning, how to strike a balance between protecting the privacy of data and algorithm parameters and ensuring the verifiability of machine learning has always been a challenge. This study explores the intersection of reinforcement learning and data privacy, specifically addressing the Multi-Armed Bandit (MAB) problem with the Upper Confidence Bound (UCB) algorithm. We introduce zkUCB, an innovative algorithm that employs the Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARKs) to enhance UCB. zkUCB is carefully designed to safeguard the confidentiality of training data and algorithmic parameters, ensuring transparent UCB decision-making. Experiments highlight zkUCB's superior performance, attributing its enhanced reward to judicious quantization bit usage that reduces information entropy in the decision-making process. zkUCB's proof size and verification time scale linearly with the execution steps of zkUCB. This showcases zkUCB's adept balance between data security and operational efficiency. This approach contributes significantly to the ongoing discourse on reinforcing data privacy in complex decision-making processes, offering a promising solution for privacy-sensitive applications.
Pseudonyms are widely used in Cooperative Intelligent Transport Systems (C-ITS) to protect the location privacy of vehicles. However, the unlinkability nature of pseudonyms also enables Sybil attacks, where a malicious vehicle can pretend to be multiple vehicles at the same time. In this paper, we propose a novel protocol called zero-knowledge Proof of Distinct Identity (zk-PoDI,) which allows a vehicle to prove that it is not the owner of another pseudonym in the local area, without revealing its actual identity. Zk-PoDI is based on the Diophantine equation and zk-SNARK, and does not rely on any specific pseudonym design or infrastructure assistance. We show that zk-PoDI satisfies all the requirements for a practical Sybil-resistance pseudonym system, and it has low latency, adjustable difficulty, moderate computation overhead, and negligible communication cost. We also discuss the future work of implementing and evaluating zk-PoDI in a realistic city-scale simulation environment.
Stuart Harshbarger, Rosa Heckle, Michael P. Collins
International Test & Evaluation Association (ITEA) For 45 years, we’ve been the catalyst for excellence in T&E – empowering professionals through education, fostering collaboration, and driving innovation that matters. Advance Your T&E Career What We Do Uniting global T&E leaders and experts to address technological challenges collaboratively.[2024
José Álvaro Fernández Carrasco, Lucía Muñoz-Solanas, Lander Segurola Gil, Daniel Paredes-García
The Self-Sovereign Identity (SSI) concept is the latest solution to emerge as an Identity Management model. Unlike other traditional models, an SSI-based system places the user at the center of the system, so that the user is the sole owner and manager of his or her identity information. This idea is very much in line with the recommendations and regulations that are emerging in the European Union, which is trying to promote the creation of a secure Digital Identity ecosystem, in which users manage their credentials through a personal wallet. This paper presents CredSSI, a tool that implements an SSI model for Identity Management in an agri-food application platform in a European project (DIVINE) and that allows performing user authentication and authorization functions. In the proposed system, user roles and permissions are managed using Verifiable Credentials, which are signed by the owners of the services. In addition, the implementation of the SSI model has been done by developing 3 Smart Contracts (one for each actor of the SSI model: holder, issuer, and verifier) in a private Ethereum network, which acts as a Verifiable Data Registry.