Blockchain Papers

Rupeng Yang, Man Ho Au, Zhenfei Zhang, Qiuliang Xu · 6 authors

No abstract is available for this record.

Yi Ding, Jun Jin, Jinglun Zhang, Zhongyi Wu · 5 authors

No abstract is available for this record.

Geoffrey Goodell, Tomaso Aste

Current architectures to validate, certify, and manage identity are based on centralised, top-down approaches that rely on trusted authorities and third-party operators. We approach the problem of digital identity starting from a human rights perspective, with a primary focus on identity systems in the developed world. We assert that individual persons must be allowed to manage their personal information in a multitude of different ways in different contexts and that to do so, each individual must be able to create multiple unrelated identities. Therefore, we first define a set of fundamental constraints that digital identity systems must satisfy to preserve and promote privacy as required for individual autonomy. With these constraints in mind, we then propose a decentralised, standards-based approach, using a combination of distributed ledger technology and thoughtful regulation, to facilitate many-to-many relationships among providers of key services. Our proposal for digital identity differs from others in its approach to trust in that we do not seek to bind credentials to each other or to a mutually trusted authority to achieve strong non-transferability. Because the system does not implicitly encourage its users to maintain a single aggregated identity that can potentially be constrained or reconstructed against their interests, individuals and organisations are free to embrace the system and share in its benefits.

Muhammed F. Esgin, Ron Steinfeld, Joseph K. Liu, Dongxi Liu

We devise new techniques for design and analysis of efficient lattice-based zero-knowledge proofs (ZKP). First, we introduce one-shot proof techniques for non-linear polynomial relations of degree \(k\ge 2\), where the protocol achieves a negligible soundness error in a single execution, and thus performs significantly better in both computation and communication compared to prior protocols requiring multiple repetitions. Such proofs with degree \(k\ge 2\) have been crucial ingredients for important privacy-preserving protocols in the discrete logarithm setting, such as Bulletproofs (IEEE S&P ’18) and arithmetic circuit arguments (EUROCRYPT ’16). In contrast, one-shot proofs in lattice-based cryptography have previously only been shown for the linear case (\(k=1\)) and a very specific quadratic case (\(k=2\)), which are obtained as a special case of our technique.

Francesco Buccafurri, Lorenzo Musarella, Roberto Nardone

Web of Trust offers a way to bind identities with the corresponding public keys. It relies on a distributed architecture, where each user could play the role of certificate signer. With the widespread diffusion of social networks, the trust propagation is a matter of growing interest. This paper proposes an approach enabling the propagation in Web of Trust by means of Ethereum. The usage of Ethereum eliminates the necessity of single-organization trusted services, which is, in general, not realistic. Although the information stored on Ethereum is public, the privacy of users is protected because trust chains involve only Ethereum addresses and strong measures are implemented to contrast their malicious de-anonymization. The approach relies on the usage of a smart contract for storing the status of certificate signatures and to manage revocations. When a user u wants to trust another user v, the smart contract checks the presence of trust chains originating from root nodes of u.

Federico Matteo Benčić, Alen Hrga, Ivana Podnar Žarko

Current consumer grade hardware running a full DLT node takes a long time to synchronize with the network and requires a lot of resources. Nodes that have never before synchronized with the network require significant resources to verify entire ledger history. The initial synchronization assumes inherent trust in the bootstrap nodes, which is a point of centralization. In the case when bootstrap nodes cannot be trusted, a new node might find itself in a malicious cluster of nodes that can either make the node waste resources before realizing that it has been exposed to malicious data, or subvert it into thinking that it has downloaded the longest chain. The Aurora algorithm is able to detect the existence of malicious cliques with a certain plausibility when a new node is attempting to synchronize with the network, and will try to exit cliques identified as malicious. If the node is unable to exit a malicious clique, the node will halt its operation. Furthermore, the same algorithm can be applied to verify if a specific transaction has been included into a referent block with a certain plausibility without the need to download the entire chain (or the header chain), or to trust centralized block explorers. Thus, the Aurora algorithm has the potential to significantly improve the scalability of DLT by reducing the time necessary for initial blockchain synchronization. Furthermore, it strengthens the trustless environment by incentivizing users not willing to run a full or even a light node to partly verify transaction inclusion without relying on third party entities.

Umberto Morelli, Silvio Ranise, Damiano Sartori, Giada Sciarretta · 5 authors

No abstract is available for this record.

Md Sadek Ferdous, Farida Chowdhury, Madini O. Alassafi

In recent times, with the advent of blockchain technology, there is an optimism surrounding the concept of self-sovereign identity which is regarded to have an influential effect on how we interact with each other over the Internet in future. There are a few works in the literature which examine different aspects of self-sovereign identity. Unfortunately, the existing works are not methodological and comprehensive at all. Moreover, there exist different notions of what the term self-sovereign identity means. To exploit its full potential, it is essential to ensure a common understanding in a formal way. This paper aims to achieve this goal by providing the first-ever formal and rigorous treatment of the concept of self-sovereign identity using a mathematical model. This paper examines the properties that a self-sovereign identity should have and explores the impact of self-sovereign identity over the laws of identity. It also highlights the essential life-cycles of an identity management system and inter-relates how the notion of self-sovereign identity can be applied in these life-cycles. In addition, the paper illustrates several envisioned flows involving a self-sovereign identity leveraging blockchain technology covering different aspects of an identity management system. All in all, this paper presents the first formal and comprehensive step toward an academic investigation of self-sovereign identity.

Sheng Ding, Jin Cao, Chen Li, Kai Fan · 5 authors

With the sharp increase in the number of intelligent devices, the Internet of Things (IoT) has gained more and more attention and rapid development in recent years. It effectively integrates the physical world with the Internet over existing network infrastructure to facilitate sharing data among intelligent devices. However, its complex and large-scale network structure brings new security risks and challenges to IoT systems. To ensure the security of data, traditional access control technologies are not suitable to be directly used for implementing access control in IoT systems because of their complicated access management and the lack of credibility due to centralization. In this paper, we proposed a novel attribute-based access control scheme for IoT systems, which simplifies greatly the access management. We use blockchain technology to record the distribution of attributes in order to avoid single point failure and data tampering. The access control process has also been optimized to meet the need for high efficiency and lightweight calculation for IoT devices. The security and performance analysis show that our scheme could effectively resist multiple attacks and be efficiently implemented in IoT systems.

Md Arquam, Anurag Singh, Rajesh Sharma

The online social networks facilitate naturally for the users to share information. On these platforms, each user shares information based on his or her interests. The particular information being shared by a user may be legitimate or fake. Sometimes a misinformation, propagated by users and group can create chaos or in some cases, might leads to cases of riots. Nowadays the third party like ALT news and Cobrapost check the information authenticity, but it takes too much time to validate the news. Therefore, a robust and new system is required to check the information authenticity within the network, to stop the propagation of misinformation. In this paper, we propose a blockchain based framework for sharing the information securely at the peer level. In the blockchain model, a chain is created by combining blocks of information. Each node of network propagates the information based on its credibility to its peer nodes. The credibility of a node will vary according to the respective information. Trust is calculated between sender and receiver in two ways:(i) Local trust used for sharing information at the peer level and (ii) global trust is used for a credibility check of each user in the network. We evaluate our framework using real dataset derived from Facebook. Our approach achieves an accuracy of 83% which shows the effectiveness of our proposed framework.

Yuepeng Wang, Shuvendu K. Lahiri, Shuo Chen, Rong Pan · 7 authors

Ensuring correctness of smart contracts is paramount to ensuring trust in blockchain-based systems. This paper studies the safety and security of smart contracts in the \emph{Azure Blockchain Workbench}, an enterprise Blockchain-as-a-Service offering from Microsoft. As part of this study, we formalize \emph{semantic conformance} of smart contracts against a state machine model with access-control policy and develop a highly-automated formal verifier for Solidity that can produce proofs as well as counterexamples. We have applied our verifier {\sc VeriSol} to analyze {\it all} contracts shipped with the Azure Blockchain Workbench, which includes application samples as well as a governance contract for Proof of Authority (PoA). We have found previously unknown bugs in these published smart contracts. After fixing these bugs, {\sc VeriSol} was able to successfully perform full verification for all of these contracts.

Orlenys López‐Pintado, Marlon Dumas, Luciano García‐Bañuelos, Ingo Weber

Blockchain technology enables the execution of collaborative business processes involving mutually untrusted parties. Existing platforms allow such processes to be modeled using high-level notations and compiled into smart contracts that can be deployed on blockchain platforms. However, these platforms brush aside the question of who is allowed to execute which tasks in the process, either by deferring the question altogether or by adopting a static approach where all actors are bound to roles upon process instantiation. Yet, a key advantage of blockchains is their ability to support dynamic sets of actors. This paper presents a model for dynamic binding of actors to roles in collaborative processes and an associated binding policy specification language. The proposed language is endowed with a Petri net semantics, thus enabling policy consistency verification. The paper also outlines an approach to compile policy specifications into smart contracts for enforcement. An experimental evaluation shows that the cost of policy enforcement increases linearly with the number of roles and constraints.

Konstantinos Karoudis, George D. Magoulas

Learning analytics and data mining require gathering and exchanging learner data for further processing and designing of activities tailored to learner’s characteristics, context, and needs. Currently, systems that store learners’ attributes should, ideally, be operated and controlled by responsible and trustworthy authorities that guarantee the protection and sovereignty of data and use objective criteria to protect and represent all parties’ interests. This chapter introduces a peer-to-peer method for storing and exchanging learner data with minimal trust. The proposed approach, underpinned by the Experience API standard, eliminates the need of a mediator authority by using distributed ledger technology.

A. S. Konoplev, Alexey Busygin, D. P. Zegzhda

Abstract— This article presents a comparative analysis of available solutions in authenticating access subjects in computer-aided information and telecommunication systems. Centralized and decentralized public key infrastructures (PKIs) are considered, and their weaknesses are brought to light. A blockchain model of decentralized PKI for access subject authentication in computer-aided information and telecommunication systems is proposed. The current embodiments of blockchain PKIs are checked for compliance with the proposed model.

Davide Calvaresi, Valerio Mattioli, Alevtina Dubovitskaya, Aldo Franco Dragoni · 5 authors

The multi-agent framework is a well-known approach to realize distributed intelligent systems. Multi-agent systems (MAS) are increasingly employed in safety-and information-critical domains (e.g., eHealth, cyber-physical systems, financial services, and energy market). Therefore, these systems need to be equipped with mechanisms to ensure transparency and the trustworthiness of the behaviors of their components. Trust can be achieved by employing reputation-based mechanisms. Nevertheless, the existing methods are still unable to fully guarantee the desired accountability and transparency. Aligned with the recent trends, advocating the distribution of trust to avoid the risks of having a single point of failure of the system, this work extends existing efforts on combining blockchain technologies (BCT) and MAS. To attain a trusted environment, we provide the architecture and implementation of a system that allows the agents to interact with each other and enables tracking how their reputation changes after every interaction. Agents reputations are computed transparently using smart contracts. Immutable distributed ledger stores reputation values, as well as services and their evaluations to ensure trustworthy interactions between the agents. We also developed a graphical interface to test different scenarios of interactions between the agents. Finally, we summarize and discuss the experience gained and explain the strategic choices when binding MAS and BCT.

Than Myo Zaw, Min Thant, Sergey Bezzateev

In this paper, we create secure SSL protocol with zero-knowledge proof which proposed an intruder should not be able to substitute false certificates and masquerade as client or sever. We add Zero-Knowledge proof where certificate transfer directly into both parties. The new scheme was shown to be more secure against the known attacks for SSL. This protocol has characteristics which have identification and authentication of both parties when use to SSL handshake protocol.

Ji-Sun Park, Taek-Young Youn, Hye-Bin Kim, Kyung-Hyune Rhee · 5 authors

Internet of Things (IoT)-based devices, especially those used for home automation, consist of their own sensors and generate many logs during a process. Enterprises producing IoT devices convert these log data into more useful data through secondary processing; thus, they require data from the device users. Recently, a platform for data sharing has been developed because the demand for IoT data increases. Several IoT data marketplaces are based on peer-to-peer (P2P) networks, and in this type of marketplace, it is difficult for an enterprise to trust a data owner or the data they want to trade. Therefore, in this study, we propose a review system that can confirm the reputation of a data owner or the data traded in the P2P data marketplace. The traditional server-client review systems have many drawbacks, such as security vulnerability or server administrator's malicious behavior. However, the review system developed in this study is based on Ethereum smart contracts; thus, this system is running on the P2P network and is more flexible for the network problem. Moreover, the integrity and immutability of the registered reviews are assured because of the blockchain public ledger. In addition, a certain amount of gas is essential for all functions to be processed by Ethereum transactions. Accordingly, we tested and analyzed the performance of our proposed model in terms of gas required.

Krešimir Ostović

Rad uspoređuje dvije po konceptu veoma različite blockchain platforme, te na kraju donosi zaključak o uspješnosti platformi na temelju aplikacije za kontrolu ulaza. Platforma Ethereum je primjer prve platforme koja je osmišljena da podržava pametne ugovore, a u mrežu se može ući bez dozvole i čitati sve podatke na blockchainu. Hyperledger Fabric je platforma koja također podržava pametne ugovore, međutim u mrežu se ne može ući bez dozvole i ne mogu se čitati svi podatci već oni za koje čvor ima pristup. U platformi Ethereum se ne mora nikome vjerovati te je osmišljena kao javna mreža, a u Hyperledgeru se mora vjerovati određenim čvorovima i mreža je zamišljena za tvrtke. Krajnja usporedba donosi i zaključke o potrebi blockchaina za kontrolu ulaza naspram konvencionalnih baza podataka.

Miguel Tavares, André Guerreiro, Carlos Coutinho, Filipe Veiga · 5 authors

Businesses and organizations have for long been trying to tackle the most prominent issues regarding identity management and systems. Traditionally, the proof of trust concerning the identification of a citizen, a customer or a participant in any business or transaction consisted always in a physical evidence (e.g., a signature, fingerprint, photo or other) whose value would rely on a trusted third-party such as a notary or attorney that confirmed the veracity of that physical evidence. More recent approaches include novel types of evidence such as digital certificates, but still these have no value unless they are issued and signed by a trusted centralized third-party that confirms the authenticity of the certificate. These are then often used by businesses to identify and trace their parties and stakeholders, in a process known as "Know Your Customer" (KYC). This process is often slow and requires costly human intervention. This paper presents WalliD, a decentralized approach of a secure protocol to handle customer identification using Blockchain. The paper then shows a proof of concept workflow implementation of this protocol developed using an Ethereum Wallet.

Yurong Guo, Zongcheng Qi, Xiangbin Xian, Hongwen Wu · 7 authors

An insurance system based on blockchain is proposed for web identity security, which provides two insurance service models for personal web identity security of end users and data security of commercial websites, respectively. Claim evidences are uploaded automatically to the blockchain to keep their authenticity. Smart contracts are automatically applied between insurers and policyholders to build trust between them.

Hailong Yao, Caifen Wang, Bo Hai, Shiqiang Zhu

Modern communication technologies and cryptographic technologies have pushed social networks into the virtual world, but they have also ensured the real existence of social proximity. In the evaluation of social proximity, some decentralized scenarios require the participants bootstrapping tust, and the existing authentication key exchange scheme can hardly satisfy the above requirements. In this study, we have designed a homomorphic hash and Blockchain based authenticated key exchange protocol with privacy protection, and prove its security under the standard model based on hash one-way, discrete logarithm and Blockchain transaction-level security assumption, and discussed the attack that the proposed scheme can resist. Compared with the existing scheme, the proposed scheme does not need the default Unit of Trust, is safer and more flexible, suitable for the scenarios that require strangers to bootstrap trust.

Aisong Zhang, Xinxin Ma

Current digital certification revocation systems are insufficient in the application scenario of multiple certification authorities (CAs), and it leads to a lack of mutual trust, access stability, and timeliness of data synchronization between CAs. We propose a decentralized digital certificate revocation system based on consortium blockchain technology with a secret sharing scheme. It can invalidate the digital certificate in special cases to protect the user's information and property security. Based on the characteristics of the decentralized consensus mechanism, consortium blockchain technology is the core technology of the system. The scheme achieves collaborative management of digital certificate revocation lists (CRLs) by multiple CAs, and introduces secret sharing scheme, further safeguarding the reliability of the maintenance process, and then the online certificate status protocol (OCSP) can be developed based on this system. This system is security, effective, and cannot be tampered. Compared with the traditional revocation scheme, it achieves trusted and reliable CRL system above multiple CAs, which can provide new ideas for the way of digital certificate revocation and expand the application range of blockchain technology.

Νικόλαος Αλεξόπουλος, Sheikh Mahbub Habib, Max Mühlhäuser

Authorization, and more generally Trust Management (TM), is an indispensable part of the correct operation of most IT systems. The advent of the Internet of Things (IoT), with its cyber-physical and distributed nature, creates new challenges, that existing TM systems cannot adequately address, such as for example the need for non-interactive exclusive access enforcement. In the meantime, a line of thought in the research community is that Distributed Ledgers (DLs), like the one implemented by the Ethereum blockchain, can provide strong security guarantees for distributed access control. However, this approach has not yet been examined in a scientific, systematic manner, and has many pitfalls, with arguably the most important one being scalability.

R. Bala, R. Manoharan

The Distributed nature of Bitcoin introduces security issues that necessitate security-specific enhancements in Bitcoin protocol. Therefore, proposing a method of incorporating criteria check and verification process for miners to participate in the mining process and join the mining pool respective