Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
This publication explores global problem areas where properties offered by Blockchain provide workable solutions for the existing widely unsolved problems of Accountability, Traceability, Identification, Visibility vs. Privacy, and Connection of Non-Deterministic to Deterministic timed events. Using BlockChain-based transactions, we demonstrate that operations related to trust are reducible to five directly implementable cryptographic actions, which then create relationships to five categories of trust that we define in this document. The solution outlined will take the approach that the identified global problems will be solved by blockchain as cybersecurity of the future moves in a direction of individualized transactional-based security & privacy. Developers and organizations looking to implement new solutions or integrate blockchain into existing applications would be interested in this publication. Methods described provide workable solutions for implementing trust relationships using blockchain for positive use cases which can be related directly to cyber security industry solutions.
Voice over Long Term Evolution (VoLTE) technology defines standards to deliver real-time services such as voice and video over LTE based on IP Multimedia Subsystem (IMS) networks. The security implementation in VoLTE is End-to-Access (e2a), which means that the sessions are only encrypted between the mobile terminals and the IMS network. In this paper we propose a new approach for securing End-to-End (e2e) VoLTE media based the Ethereum Blockchain. The solution consists of creating public and private keypairs for VoLTE user equipments (UEs) and storing the public keys in the Ethereum Blockchain. The media is encrypted e2e using the Secure Real Time Protocol (SRTP) protocol with a variety of session key distribution mechanisms. Results showed that the solution implementation has minimal impact on the existing IMS network, and the secure call setup time between two terminals is negligible compared to the original VoLTE setup time.
In the past, the improvement of digital copyright protection system based on digital watermarking mainly focused on algorithms, while generation and storage of the watermark information was ignored. In this paper, a new design scheme of copyright management system based on digital watermarking and its information, such as blockchain, is proposed, which combines digital watermarking, blockchain, perceptual hash function, Quick Response(QR) code, and InterPlanetary File System(IPFS). Among them, blockchain is used to securely store watermark information and provide timestamp authentication for multiple watermarks (multiple copyrights) to confirm the creation order. Perceptual hash function is used to generate hash value based on the structure information of images, that watermark information can be confirmed without the original image. QR code is used to generate QR code images containing image hash and copyright information as watermark images to improve robustness and capacity of digital watermarking; IPFS is used to store and distribute watermarked images without a centralized server. This scheme can enhance the effectiveness of digital watermarking technology in the field of copyright protection. In this way, use P2P network to integrate and complete copyright management and distribution of copyrighted works without requiring a trusted third party. Nodes rely on cryptography to confirm the identity of each other and ensure the security of information. It can reduce information leakage, data destruction and other risks caused by collapse of the centralized system in the past. This improves the security and transparency of information, and speeds up the distribution of copyrighted works to facilitate circulation in the network. This scheme can also improve copyright protection of multiple creations. Combine blockchain and multiple digital watermarks to record copyright information of every copyright owner in the authoring process and fully prove this information. In order to protect the legitimate rights and interests of each copyright owner.
Advanced Steganography and Watermarking Techniques
Muhammad Syafiq Mohd Pozi, Gopinath Muruti, Asmidar Abu Bakar, Adam Jatowt · 5 authors
Authorship contribution is often taken for granted. Internally, the contribution rate is usually known among all the authors of a given paper. However, this rate is hard to be verified by external parties, as the measurement of the authors' contribution is still not common and the way to measure it is unclear. In this paper, we propose a new blockchain based framework to assess the contribution of all authors of any scientific paper. Our framework can be implemented by anyone who is directly or indirectly involved in the publication of the paper, such as a principal researcher, grant funder, research assistant or anyone from relevant external bodies.
This paper presents a method for a decentralised peer-to-peer software license validation system using cryptocurrency blockchain technology to ameliorate software piracy, and to provide a mechanism for software developers to protect copyrighted works. Protecting software copyright has been an issue since the late 1970's and software license validation has been a primary method employed in an attempt to minimise software piracy and protect software copyright. The method described creates an ecosystem in which the rights and privileges of participants are observed.
Balázs Bodó, Daniel J. Gervais, João Pedro Quintais
This article offers a normative analysis of key blockchain technology concepts from the perspective of copyright law. Some features of blockchain technologies—scarcity, trust, transparency, decentralized public records and smart contracts—seem to make this technology compatible with the fundamentals of copyright. Authors can publish works on blockchain creating a quasi-immutable record of initial ownership, and encode ‘smart’ contracts to license the use of works. Remuneration may happen on online distribution platforms where the smart contracts reside. In theory, such an automated setup allows for the private ordering of copyright. Blockchain technology, like Digital Rights Management 20 years ago, is thus presented as an opportunity to reduce market friction, and increase both licensing efficiency and the autonomy of creators. Yet, some of the old problems remain. The article examines the differences between new, smart-contract-based private ordering regime and the fundamental components of copyright law, such as exceptions and limitations, the doctrine of exhaustion, restrictions on formalities, the public domain and fair remuneration.
Santiago Bragagnolo, Henrique Rocha, Marcus Denker, Sté́phane Ducasse
Smart contracts are embedded procedures stored with the data they act upon.Debugging deployed Smart Contracts is a difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded.In this technical report, we present SmartInspect to address the lack of inspectability of a deployed contract.Our solution analyses the contract state by using decompilation techniques and a mirror-based architecture to represent the object responsible for interpreting the contract state.SmartInspect allows developers and also end-users of a contract to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code.
Ethereum, a cryptocurrency currently valued at 46 billion US dollars, has grown over 6,500% in the last 12 months. Despite the growth in value, we still have very limited Ethereum network visibility. In this thesis, we analyze the Ethereum network from two vantage points: the DEVp2p network and the Ethereum Mainnet. The DEVp2p peer-to- peer (P2P) network was developed specifically for and ultimately underlies the Ethereum Mainnet. We examine overall composition of the DEVp2p network. We analyze our peer connections on the Ethereum Mainnet—the main Ethereum network established on top of DEVp2p. We compare the Ethereum network’s properties to those of other well-studied P2P networks, namely BitTorrent and Gnutella. We develop novel techniques to measure the Ethereum P2P network and gain visibility into this previously opaque network.
There exist many unsolved problems in the traditional digital rights management of network media. For example, in the traditional management system it is hard to guarantee the quality of media works, to protect the copyrights, to find the effective profit model and so on. To solve these problems, we propose in this paper a network media's digital rights management scheme based on blockchain. Blockchain is a technology that makes use of cryptographic algorithm, hash chains and consensus mechanism to implement consensus, irreversibility and traceability for online data. The proposed scheme can use these functionalities of blockchain to implement the effective production management, copyright management, transaction management and users' behavior management for network media. Furthermore, our proposed scheme can predictively provide an important support for the network media platform to build a sustainable development of benign ecological environment.
Florian Kammueller, Manfred Kerber, Christian W. Probst
This paper applies machine assisted formal methods to explore insider threats for auctions. Auction systems, like eBay, are an important problem domain for formal analysis because they challenge modelling concepts as well as analysis methods. We use machine assisted formal modelling and proof in Isabelle to demonstrate how security and privacy goals of auction protocols can be formally verified. Applying the costly scrutiny of formal methods is justified for auctions since privacy and trust are prominent issues and auctions are sometimes designed for one-off occasions where high bids are at stake. For example, when radio wave frequencies are on sale, auctions are especially created for just one occasion where fair and consistent behaviour is required. Investigating the threats in auctions and insider collusions, we model and analyze auction protocols for insider threats using the interactive theorem prover Isabelle. We use the existing example of a fictitious cocaine auction protocol from the literature to develop and illustrate our approach. Combining the Isabelle Insider framework with the inductive approach to verifying security protocols in Isabelle, we formalize the cocaine auction protocol, prove that this formal definition excludes sweetheart deals, and also that collusion attacks cannot generally be excluded. The practical implication of the formalization is demonstrated by code generation. Isabelle allows generating code from constructive specifications into the programming language Scala. We provide constructive test functions for cocaine auction traces, prove within Isabelle that these functions conform to the protocol definition, and apply code generation to produce an implementation of the executable test predicate for cocaine auction traces in Scala.
The main purpose of Password-Authenticated Key Exchange (PAKE) is to allow secure authenticated communication over insecure networks between two or more parties who only share a low-entropy password. It is common practice that the secret key derived from a PAKE execution is used to authenticate and encrypt some data payload using symmetric key protocols. Unfortunately, most PAKEs of practical interest, including three protocols considered in this thesis, are studied using so-called game-based models, which -- unlike simulation models -- do not guarantee secure composition per se. However, Brzuska et al. (CCS 2011) have shown that a middle ground is possible in the case of authenticated key exchange that relies on Public-Key Infrastructure (PKI): the game-based models do provide secure composition guarantees when the class of higher-level applications is restricted to symmetric-key protocols. The question that we pose in this thesis is whether or not a similar result can be exhibited for PAKE. Our work answers this question positively. More specifically, we show that PAKE protocols secure according to the game-based Real-or-Random (RoR) definition of Abdalla et al. (PKC 2005) allow for automatic, secure composition with arbitrary, higher-level symmetric key protocols. Since there is evidence that most PAKEs secure in the Find-then-Guess (FtG) model of Bellare et al. (EUROCRYPT 2000) are in fact secure according to the RoR definition, we can conclude that nearly all provably secure PAKEs enjoy a certain degree of composition, one that at least covers the case of implementing secure channels. Although many different protocols that accomplish PAKE have been proposed over last two decades, only a few newcomers managed to find their way to real world applications - albeit lacking an intense and prolonged public scrutiny. As a step in the direction of providing one, this dissertation considers the security and efficiency of two relatively recently proposed PAKE protocols - Dragonfly and J-PAKE. In particular, we prove the security of a very close variant of Dragonfly employing the standard FtG model which incorporates forward secrecy. Thus, our work confirms that Dragonfly's main flows are sound. Furthermore, we contribute to the discussion by proposing and examining (in the RoR model of security) two variants of J-PAKE - which we call RO-J-PAKE and CRS-J-PAKE - that each makes the use of two less zero-knowledge proofs than the original protocol, at the cost of an additional security assumption. Our work reveals that CRS-J-PAKE has an edge in terms of efficiency over J-PAKE for both standard group choices: subgroups of finite fields and elliptic curves. The same is true for RO-J-PAKE, but only when instantiated with elliptic curves.
Recently, the password-authenticated key exchange protocol J-PAKE of Hao and Ryan (Workshop on Security Protocols 2008) was formally proven secure in the algebraic adversary model by Abdalla et al. (IEEE S&P 2015). In this paper, we propose and examine two variants of J-PAKE - which we call RO-J-PAKE and CRS-J-PAKE - that each makes the use of two less zero-knowledge proofs than the original protocol. We show that they are provably secure following a similar strategy to that of Abdalla et al. We also study their efficiency as compared to J-PAKE’s, also taking into account how the groups are chosen. Namely, we treat the cases of subgroups of finite fields and elliptic curves. Our work reveals that, for subgroups of finite fields, CRS-J-PAKE is indeed more efficient than J-PAKE, while RO-J-PAKE is much less efficient. On the other hand, when instantiated with elliptic curves, both RO-J-PAKE and CRS-J-PAKE are more efficient than J-PAKE, with CRS-J-PAKE being the best of the three. Regardless of implementation, we note that RO-J-PAKE enjoys a looser security reduction than both J-PAKE and CRS-J-PAKE. CRS-J-PAKE has the tightest security proof, but relies on an additional trust assumption at setup time.
The blockchain-based digital content distribution system was developed. Decentralized and pear-to-pear authentication mechanism can be considered as the ideal rights management mechanism. The blockchain has the potential to realize this ideal content distribution system. This is the successful model of the Superdistribution concept which was announced almost 30 years ago. The proposed system was demonstrated and got a lot of feedback for the future practical system.
Digital Rights Management and Security
Advanced Steganography and Watermarking Techniques
In the digital world, so many copyrighted works are made in an illegal way because it is easy to keep and copy. Digital Rights Management has proposed to prevent this theft. Contents providers often bring in one server who has charge of managing the normal user, but there are some problems that it flocks to the server. Against this problem, P2P based DRM system has considered. All users can transfer the encrypted content to other users, so the content server does not have to load so much traffic from users. As a problem with this method, it is hard to figure out usage situation of contents because P2P based system is divided into many pieces of users. In this paper, we propose a new P2P based DRM system using Bitcoin protocol, which is one of the electric commerce. Bitcoin protocol, timestamp server saves all transactions to prevent double spending. We can bring out all usage situations to apply this system.
Open access
Digital Rights Management and Security
Advanced Steganography and Watermarking Techniques
Based on ELGamal digital signature and zero-knowledge proof with the method of directed signature,a two-way identification scheme was proposed,which enabled two specific users to validate each other's identity without exposing one's own secret information.The scheme has higher security and lower computing complexity.