Smart contracts are susceptible to various security issues, among which access control (AC) vulnerabilities are particularly critical. While existing research has proposed multiple detection tools, the automatic and appropriate repair of AC vulnerabilities in smart contracts remains a challenge. Unlike commonly supported vulnerability types by existing repair tools, such as reentrancy, which are usually fixed by template-based approaches, the main obstacle of AC lies in identifying the appropriate roles or permissions amid a long list of non-AC-related source code to generate proper patch code, a task that demands human-level intelligence. Leveraging recent advancements in large language models (LLMs), we employ the state-of-the-art GPT-4 model and enhance it with a novel approach called ACFIX. The key insight is that we can mine common AC practices for major categories of code functionality and use them to guide LLMs in fixing code with similar functionality. To this end, ACFIX involves both offline and online phases. First, during the offline phase, ACFIX mines a taxonomy of common Role-based Access Control (RBAC) practices from 344,251 on-chain contracts, categorizing 49 role-permission pairs from the top 1,000 pairs mined. Second, during the online phase, ACFIX tracks AC-related elements across the contract and uses this context information along with a Chain-of-Thought pipeline to guide LLMs in identifying the most appropriate role-permission pair for the subject contract and subsequently generating a suitable patch. This patch will then undergo a validity and effectiveness check. To evaluate ACFIX, we built the first benchmark dataset of 118 real-world AC vulnerabilities, and our evaluation revealed that ACFIX successfully repaired 94.92% of them. This represents a significant improvement compared to the baseline GPT-4, which achieved only 52.54%.
Lakshmi Rama Kiran Pasumarthy, Hisham Ali, William J. Buchanan, Jawad Ahmad · 7 authors
There is an increasing need to share threat information for the prevention of widespread cyber-attacks. While threat-related information sharing can be conducted through traditional information exchange methods, such as email communications etc., these methods are often weak in terms of their trustworthiness and privacy. Additionally, the absence of a trust infrastructure between different information-sharing domains also poses significant challenges. These challenges include redactment of information, the Right-to-be-forgotten, and access control to the information-sharing elements. These access issues could be related to time bounds, the trusted deletion of data, and the location of accesses. This paper presents an abstraction of a trusted information-sharing process which integrates Attribute-Based Encryption (ABE), Homomorphic Encryption (HE) and Zero Knowledge Proof (ZKP) integrated into a permissioned ledger, specifically Hyperledger Fabric (HLF). It then provides a protocol exchange between two threat-sharing agents that share encrypted messages through a trusted channel. This trusted channel can only be accessed by those trusted in the sharing and could be enabled for each data-sharing element or set up for long-term sharing.
Koteswara Rao Kodepogu, Mudigonda Dharmateja, J. M. S. V. Ravi Kumar, Muraboina Hari Pavan Gopi Krishna · 5 authors
In this exploration, our paper delves into the intricate implementation of robust authentication and transaction management within educational blockchain systems.Our project showcases a commitment to privacy and integrity, safeguarding interactions through advanced cryptographic techniques.The multifaceted capabilities of blockchain technology are showcased through the seamless maintenance of student records, the facilitation of secure voting processes, and the optimization of token transfers, collectively contributing to an ecosystem characterized by enhanced security, transparency, and efficiency.Our study uncovers insights into blockchain's transformative potential in education, redefining paradigms by introducing security measures and transparency to student-admin interactions.We highlight the successful implementation of blockchainbased authentication and transaction management systems, leading to enhanced educational processes.Additionally, we briefly outline our research design and methodology, emphasizing the rigorous approach to exploring blockchain applications.
With the rise of healthcare digitization, it has become a critical priority to safeguard patient privacy and ensure data security. Conventional methods of data access control mechanisms have proven to be insufficient in the dynamic management of patient data access with a fine-grained access control mechanism. In this paper, we have proposed ZeroMedChain which explores an innovative solution for enhancing the security of medical records in the field of healthcare. The proposed paper makes use of Layer 2 security measures and Zero-Knowledge Proof (ZKP) technologies. Since the basic focus of the paper is decentralized identity and access management, we have integrated Zero-knowledge Proof with a layer of privacy that permits the patients to share the necessary medical details without revealing their identity. Further, the simulation carried out of the proposed ZeroMedChain along with the conventional consensus algorithm of Proof-of-work proved that ZeroMedChain has better time complexity by 34%.
Blockchain has been recognized as a secure technology with which unique and tamper-proof certificates can be issued. Today the secure and immutable storage of vital records, such as birth certificates, is of paramount importance. Traditional systems for recording and managing such documents are complex, tedious, and inaccessible for many. At present, issuing a certificate involves three stakeholders; Parents, Hospitals, and Registrars. The Parents must visit the Registrar and report the birth after which the Registrar verifies the birth, which is a time-intensive process for the Registrar. To address these challenges, we present a web application that leverages blockchain technology to record and manage birth certificates. By utilizing a decentralized and distributed ledger, our application improves accessibility, transparency, and increased security. This paper outlines the design, implementation, and evaluation of our birth certificate recording system, highlighting its benefits for hospitals, registrars, and individuals. Furthermore, limitations and the future work of this technology are discussed.
A paradox of compliance and privacy exists among an increasing number of users of Decentralized Finance (DeFi). While the Financial Action Task Force (FATF) has established Travel Rules to improve transparency for financial institutions to prevent money laundering, data protection regulations like GDPR require financial institutions to maintain secrecy about customer information. The existing DeFi architecture currently solves this problem via two approaches; it either sacrifices user anonymity in order to meet the regulatory standards set forth by government entities, or creates non-transparent environments that do not hold users accountable for their actions. This paper introduces a novel DLT architecture that balances the user’s requirement for anonymity with the regulatory requirements of the financial services sector through the application of Zero-Knowledge Proofs in combination with a Permissioned DLT. By utilizing a cryptographic pipeline that allows for shielded transactions, yet provides evidence that the transaction was valid and met all relevant regulatory requirements, the architecture enables compliance with regulatory standards and maintains anonymity. Furthermore, this architecture includes protocols for selective disclosure that will enable authorized third-party auditors to audit a user’s regulatory compliance automatically without exposing PII. Experimental results demonstrate that this architecture can be deployed and tested using Hyperledger Fabric and will support both consistent performance and scalability. Specifically, experimental results demonstrate that this architecture can operate commercially at a throughput rate of 1,200 TPS, which represents less than a 35 percent increase in the consumption of computing resources compared to the corresponding rates of fully transparent architectures. Finally, the security analysis proves mathematically that this architecture fulfills the compliance requirements for preventing fraudulent activities and prevents unauthorized de-anonymization of users.
Yu Gao, Carlo Campajola, Nicolò Vallarano, Andreia Sofia Teixeira · 5 authors
IOTA is a distributed ledger technology that relies on a peer-to-peer (P2P) network for communications. Recently an auto-peering algorithm was proposed to build connections among IOTA peers according to their "Mana" endowment, which is an IOTA internal reputation system. This paper's goal is to detect potential vulnerabilities and evaluate the resilience of the P2P network generated using IOTA auto-peering algorithm against eclipse attacks. In order to do so, we interpret IOTA's auto-peering algorithm as a random network formation model and employ different network metrics to identify cost-efficient partitions of the network. As a result, we present a potential strategy that an attacker can use to eclipse a significant part of the network, providing estimates of costs and potential damage caused by the attack. On the side, we provide an analysis of the properties of IOTA auto-peering network ensemble, as an interesting class of homophile random networks in between 1D lattices and regular Poisson graphs.
Marco Marcozzi, Ernestas Filatovas, Linas Stripinis, Remigijus Paulavičius
The consensus protocol plays a vital role in the performance and security of a specific Distributed Ledger Technology (DLT) solution. Currently, the traditional classification of consensus algorithms relies on subjective criteria, such as protocol families (Proof of Work, Proof of Stake, etc.) or other protocol features. However, such classifications often result in representatives with strongly different characteristics belonging to the same category. To address this challenge, a quantitative data-driven classification methodology that leverages machine learning—specifically, clustering—is introduced here to achieve unbiased grouping of analyzed consensus protocols implemented in various platforms. When different clustering techniques were used on the analyzed DLT dataset, an average consistency of 78% was achieved, while some instances exhibited a match of 100%, and the lowest consistency observed was 55%.
Cryptocurrency relies on the underlying P2P networking to deliver the up-to-date block and transaction information to synchronize and agree on the processed financial transactions. To maintain healthy connectivity, Bitcoin has implemented a negative reputation scheme based on ban score, which tracks the peer node behavior and results in dropping the peer connection if exceeding a threshold. Previous research in cryptocurrency security showed that such ban score can be both ineffective (easy to bypass to un-ban itself) and vulnerable (against spoofing-based defamation). We design and build a novel positive reputation scheme that addresses such deficiencies of ban score by having the peer behavior only positively impact our score and by disincentivizing switching the network ID for a new reputation score. We provide a general framework for the positive reputation scheme to enable the use of different networking sensing and measurements as well as different aggregate weights for scoring. Then, we provide a concrete instance and build of the positive reputation score scheme focusing on the peer's behavior in relaying unique/new blocks and transactions. We implement, experiment, and analyze our scheme on an active Bitcoin node connected to the Mainnet to show how our scheme provides the reputation and informs the beneficialness of each of its peer connections (delivering new block and transaction information).
In recent years, Wireless Sensor Networks (WSNs) have become integral in various applications ranging from environmental monitoring to defense. However, the security and reliability of these networks remain a paramount concern due to their susceptibility to various types of cyber-attacks and failures. This paper proposes a novel integration of blockchain technology with WSNs to address these challenges. Blockchain, with its decentralized and tamper-resistant ledger, offers a robust framework to enhance the security and reliability of sensor networks. The study begins by analyzing the current security threats and challenges faced by WSNs, emphasizing the need for a solution that can ensure data integrity, confidentiality, and network resilience. We then introduce blockchain technology and discuss its key features such as decentralization, immutability, and consensus algorithms, which are beneficial in creating a secure and reliable WSN environment. Subsequently, we present a detailed architecture of how blockchain can be integrated with WSNs. This includes the deployment of a lightweight blockchain protocol suited for the limited computational resources of sensor nodes. We also explore the use of smart contracts for automated, secure data handling and network management within WSNs. To validate the proposed integration, we conduct a simulations based on network attacks. The results demonstrate significant improvements in the security and reliability of WSNs when blockchain is implemented. This is evidenced by enhanced resistance to common attacks, such as data manipulation and node compromise and increased network uptime.
This paper introduces a novel approach to manage collections of artifacts through smart contract access control, rooted in on-chain role-based property-level access control. The proposed smart contract facilitates the lifecycle of these artifacts including allowing for the creation, modification, removal, and historical auditing of the artifacts through both direct and suggested actions. This method introduces a collection object designed to store role privileges concerning state object properties. User roles are defined within an on-chain entity that maps users' signed identities to roles across different collections, enabling a single user to assume varying roles in distinct collections. Unlike existing key-level endorsement mechanisms, this approach offers finer-grained privileges by defining them on a per-property basis, not at the key level. The outcome is a more flexible and fine-grained access control system seamlessly integrated into the smart contract itself, empowering administrators to manage access with precision and adaptability across diverse organizational contexts. This has the added benefit of allowing for the auditing of not only the history of the artifacts, but also for the permissions granted to the users.
Fernando Román-García, Juan Hernández‐Serrano, Óscar Esparza
This article introduces the Non-Repudiable Data Exchange (NoRDEx) protocol, designed to ensure non-repudiation in data exchanges. Unlike traditional non-repudiation and fair exchange protocols, NoRDEx can be considered decentralized as it eliminates the need for a centralized Trusted Third Party (TTP) by using a Distributed Ledger Technology (DLT) to store cryptographic proofs without revealing the exchanged message. NoRDEx is an optimistic non-repudiation protocol, as it only uses the DLT in case of a dispute. The protocol has been implemented and tested in real-world environments, with performance assessments covering cost, overhead, and execution time. A formal security analysis using the Syverson Van Oorschot (SVO) logical model demonstrates NoRDEx’s ability to resolve disputes securely.
This document serves as a reference for the architectural design and implementation of a secure decentralized data sharing framework. The framework leverages Distributed Ledger Technology (DLT) to ensure data integrity and immutability, while incorporating multi-party computation, fully homomorphic encryption and Trusted Execution Environments for privacy preservation. The document also explores the GAIA-X framework to further strengthen data security within the decentralized environment.
Jan 1, 2024·Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences
With the rise of decentralized systems and applications that run over multiple blockchains, there is a growing need for architectures and bridges that ensure the trusted transfer of data and assets between the chains. zkBridge (ACM CCS'22) is a cross-chain bridge protocol that was proposed for non-permissioned blockchain and uses a network of relays, each working (for example as a light node) on a blockchain. A relay communicates with a corresponding smart contract on another chain to transfer data from the first chain to the second, and the smart contract on the second chain is used to verify the correctness of the received data from the first chain. zkBridge designs and implements optimized zero-knowledge proofs, that minimize the work of the smart contract on the second chain to verify the correctness of the received data. In this paper, we consider applications that work across two or more permissioned blockchains. We propose sigBridge that uses the framework of zkBridge but replaces the costly zero-knowledge proof computation with a pair of algorithms based on the consensus algorithm of the first chain. The algorithms will be run by a relay node on the first chain and a smart contract on the second chain and provide verifiability of data and asset transfer from the first chain to the second. The pair of algorithms are significantly more efficient compared to generating zero-knowledge proofs, verifying them, or running the full consensus algorithm of the first blockchain. We then show how a decentralized user-centric resource-sharing application will work over this architecture. We give a proof-of-concept implementation of an attribute-based access control system for a resource-sharing application that runs over two private Ethereum blockchains, and report the computation costs of the protocol.
Recently, smart contracts have been widely applied in security-sensitive fields yet are fragile to various vulnerabilities and attacks. Regarding this, existing research efforts either statically scrutinize smart contracts’ code or detect suspicious transaction execution flows. However, they either fail to timely protect contracts or only handle a small subset of well-known vulnerabilities. In the paper, we propose$\mathtt {EVM}$-$\mathtt {Shield}$that secures vulnerable smart contracts in real-time via fine-grained access control over sensitive states. The behind rationale is most of attacks aim to manipulate money-related states (e.g., tokens) for profits. Specifically, transaction-level state access control policies are first defined by developers and then translated into EVM-level policies with contract-aware function-level state access permissions. In policy enforcement,$\mathtt {EVM}$-$\mathtt {Shield}$introduces a hybrid storage analyzer to accurately identify (dynamic-allocated) storage locations for policy-involved states and a multi-stage cache based filter to fast revert bad transactions with unexpected state access behaviors. Finally, we conduct thorough experiments using 12 types of real-world contract vulnerabilities and all open-source smart contracts on the first$8M$blocks of Ethereum. The results demonstrate that$\mathtt {EVM}$-$\mathtt {Shield}$outperforms two state-of-the-art runtime analysis tools in terms of attack detection. Extensive performance evaluations with$185M$real-world transactions show that$\mathtt {EVM}$-$\mathtt {Shield}$can block 100% unexpected state accesses at the cost of 8% throughput degradation (compared with the native EVM).
Digital credentials represent crucial elements of digital identity on the Internet. Credentials should have specific properties that allow them to achieve privacy-preserving capabilities. One of these properties is selective disclosure, which allows users to disclose only the claims or attributes they must. This paper presents a novel approach to selective disclosure BLS-MT-ZKP that combines existing cryptographic primitives: Boneh-Lynn-Shacham (BLS) signatures, Merkle hash trees (MT) and zero-knowledge proof (ZKP) method called Bulletproofs. Combining these methods, we achieve selective disclosure of claims while conforming to selective disclosure requirements. New requirements are defined based on the definition of selective disclosure and privacy spectrum. Besides selective disclosure, specific use cases for equating digital credentials with paper credentials are achieved. The proposed approach was compared to the existing solutions, and its security, threat, performance and limitation analysis was done. For validation, a proof-of-concept was implemented, and the execution time was measured to demonstrate the practicality and efficiency of the approach.
The increasing complexity of cloud computing has prompted a greater emphasis on protecting the privacy, integrity, and security of data stored and processed in the cloud. Data privacy is safeguarded through access control, but existing models such as Role Based Access Control (RBAC) and Attribute Based Access Control (ABAC) rely on a centralized server. If this server is compromised, it poses significant risks to data security. To address this issue, there is a need for Distributed ABAC (DABAC) system for OpenStack services based on blockchain. The unique features of blockchain enables access control systems which ensures data integrity and privacy. Additionally, blockchain offers a level of transparency for both the resource owner and a user. In this work, we propose a smart contract based ABAC system. We implemented the proposed work using an Ethereum blockchain and OpenStack cloud. Furthermore, we evaluated two consensus algorithms for scalability analysis of DABC mechanism. The results demonstrate that DABAC performs better than ABAC in ensuring fine-grade access control with proof of stake consensus algorithm providing better scalability.