Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) evidence have become an important evidentiary focus in the courtroom. This type of evidence is routinely produced as business records under U.S. Federal Rules of Evidence for use in the emerging discipline of Forensic Cell Site Analysis. The research was undertaken to determine if evidence produced by operators should be classified as digital evidence and, if so, what evidence handling methodologies are appropriate to ensure evidence integrity. This research project resulted in the creation of a method of determining if business records produced by MNO/MVNO organizations are digital evidence and whether evidentiary integrity is maintained in the conveyance of evidence between MNO/MVNO records custodians, law enforcement investigators and attorneys in criminal and civil cases. Block-chain based Distributed Ledger Technology was examined as a feasible evidence integrity maintenance solution.
In this work we investigate new computational properties that can be achieved by combining stateless trusted devices with public ledgers. We consider a hybrid paradigm in which a client-side device (such as a co-processor or trusted enclave) performs secure computation, while interacting with a public ledger via a possibly malicious host computer. We explore both the constructive and potentially destructive implications of such systems. We first show that this combination allows for the construction of stateful interactive functionalities (including general computation) even when the device has no persistent storage; this allows us to build sophisticated applications using inexpensive trusted hardware or even pure cryptographic obfuscation techniques. We further show how to use this paradigm to achieve censorship-resistant communication with a network, even when network communications are mediated by a potentially malicious host. Finally we describe a number of practical applications that can be achieved today. These include the synchronization of private smart contracts; rate limited mandatory logging; strong encrypted backups from weak passwords; enforcing fairness in multi-party computation; and destructive applications such as autonomous ransomware, which allows for payments without an online party.
Open access
Blockchain Technology Applications and Security
User Authentication and Security Systems
Advanced Steganography and Watermarking Techniques
Zero-knowledge password policy checks (ZKPPC) were introduced in Kiefer and Manulis’ report from 2014. The protocol aimed to solve the longstanding issue with servers requiring clients to provide their password in plain text to ensure its strength. Their protocol was intended to eliminate the need for users to trust the server to store and handle passwords correctly while simultaneously allowing the server to know that the registered password was strong enough. This thesis has investigated the soundness of the protocol by Kiefer and Manulis and will present three new zero-day vulnerabilities discovered in the process. The vulnerabilities allow a dishonest user to prove adherence to the policy for invalid passwords. Additionally, the thesis presents our new Proof of Inequality which prevents one of these vulnerabilities, as well as an extension for an incomplete part of the protocol. The two remaining zero-day vulnerabilities are weaknesses in the protocol left for future research.
Identity-based mutual authentication and key agreement (ID-MAKA) between a mobile user and cloud service provider is necessary for accessing any cloud services. In recent years, there are a large number of ID-MAKA schemes had been proposed on mobile cloud computing services to make authentication and accessing process more usability, security, and scalability. In this paper, we propose a new ID-MAKA scheme for mobile cloud computing, which firstly achieves remote biometric-based authentication(remote servers authenticate user's biometrics), single sign-on (a single credential and single registration for accessing multiple servers) and center-less authentication(the registration center does not participate in the access procedure) in one scheme. In order to realize this target, we design a ZK-token based on ECC and cryptographic hash function, and then artfully employ it to introduce the fuzzy extractor technology and zero-knowledge technology into our scheme. Therefore, the user can access multiple cloud computing servers by registering only once in the registration center, and cloud computing servers can complete the biometric-based remote authentication and key agreement for the user without the registration center participating. In this way, our scheme greatly improves usability, scalability, and security compared to other existing solutions. We give a formal security proof for our scheme by using Real-Or-Random(RoR) model and Burrows-Abadi-Needham (BAN) logic to show that the present scheme is secure and security analysis for other known attacks. Finally, according to the experiment result, our scheme has lower computation and communication cost compared with most existing related schemes.
The world is slowly but surely going digital. Information is increasingly being stored digitally, and so are our personal information. The concept of digital identity is not a new one. It has been experimented with in various forms, such as in an employee portal. The use of mobile phones to access information is also a growing trend. Thus, it seems logical to combine the two to build digital identity on mobile. \n This project aims to develop an Android application to store and verify digital identity information. It uses the Ethereum blockchain to store digital identity documents and their associated keys in order to prevent tampering by a third party. The information being sent from one party to another is verified using the keys stored in the blockchain. All documents follow the formats proposed by the W3C Credentials Working Group, and this allows the format of the documents to be standardised and easily verifiable. Verification is done via digital signatures, which prevents unauthorised modification of the information while it are being sent or received. \n While the information is being transmitted, RSA encryption is used to preserve confidentiality. Only the sender and receiver will have the keys needed to decrypt the information. The receiver can then retrieve the public key specified in the credential from the Ethereum blockchain and use it to verify the information received. With the use of a public key infrastructure via the blockchain, and the secure storage and transmission of information via end-to-end encryption, information can be exchanged and verified securely. With this system in place, digital identities can be created, verified and used easily and safely.
A noble multi-factor authentication (MFA) algorithm is developed for the security enhancement of the Cryptocurrency (CR). The main goal of MFA is to set up extra layer of safeguard while seeking access to a targets such as physical location, computing device, network or database. MFA security scheme requires more than one method for the validation from commutative family of credentials to verify the user for a transaction. MFA can reduce the risk of using single level password authentication by introducing additional factors of authentication. MFA can prevent hackers from gaining access to a particular account even if the password is compromised. The superfluous layer of security introduced by MFA offers additional security to a user. MFA is implemented by using time-based onetime password (TOTP) technique. For logging to any entity with MFA enabled, the user first needs username and password, as a second factor, the user then needs the MFA token to virtually generate a TOTP. It is found that MFA can provide a better means of secured transaction of CR.
Blockchain Technology Applications and Security
User Authentication and Security Systems
Advanced Steganography and Watermarking Techniques
Previous research studies mostly focused on enhancing the security of radio frequency identification (RFID) protocols for various RFID applications that rely on a centralized database. However, blockchain technology is quickly emerging as a novel distributed and decentralized alternative that provides higher data protection, reliability, immutability, transparency, and lower management costs compared with a conventional centralized database. These properties make it extremely suitable for integration in a supply chain management system. In order to successfully fuse RFID and blockchain technologies together, a secure method of communication is required between the RFID tagged goods and the blockchain nodes. Therefore, this paper proposes a robust ultra-lightweight mutual authentication RFID protocol that works together with a decentralized database to create a secure blockchain-enabled supply chain management system. Detailed security analysis is performed to prove that the proposed protocol is secure from key disclosure, replay, man-in-the-middle, de-synchronization, and tracking attacks. In addition to that, a formal analysis is conducted using Gong, Needham, and Yahalom logic and automated validation of internet security protocols and applications tool to verify the security of the proposed protocol. The protocol is proven to be efficient with respect to storage, computational, and communication costs. In addition to that, a further step is taken to ensure the robustness of the protocol by analyzing the probability of data collision written to the blockchain.
Stephan Zöllner, Kim‐Kwang Raymond Choo, Nhien‐An Le‐Khac
Bitcoin is popular not only with consumers, but also with cybercriminals (e.g., in ransomware and online extortion, and commercial online child exploitation). Given the potential of Bitcoin to be involved in a criminal investigation, the need to have an up-to-date and in-depth understanding on the forensic acquisition and analysis of Bitcoins is crucial. However, there has been limited forensic research of Bitcoin in the literature. The general focus of existing research is on postmortem analysis of specific locations (e.g. wallets on mobile devices), rather than a forensic approach that combines live data forensics and postmortem analysis to facilitate the identification, acquisition, and analysis of forensic traces relating to the use of Bitcoins on a system. Hence, the latter is the focus of this paper where we present an open source tool for live forensic and postmortem analysing automatically. Using this open source tool, we describe a list of target artifacts that can be obtained from a forensic investigation of popular Bitcoin clients and Web Wallets on different web browsers installed on Windows 7 and Windows 10 platforms.
Evangelos A. Deirmentzoglou, Georgios Papakyriakopoulos, Constantinos Patsakis
Despite common arguments about the prevalence of blockchain technology, in terms of security, privacy, and immutability, in reality, several attacks can be launched against them. This paper provides a systematic literature review on long-range attacks for proof of stake protocols. If successful, these attacks may take over the main chain and partially, or even completely, rewrite the history of transactions that are stored in the blockchain. To this end, we describe how proof of stake protocols work, their fundamental properties, their drawbacks, and their attack surface. After presenting long-range attacks, we discuss possible countermeasures and their applicability.
Matteo Franceschi, Davide Morelli, David Plans, Alan Brown · 7 authors
The problem of protecting sensitive data like medical records, and enabling the access only to authorized entities is currently a challenge. Current solutions often require trusting some centralized entity which is in charge of managing the data. The disruptive technology of blockchains may offer the possibility to change the current scenario and give to the users the control on their personal data. In this paper we propose ComeHere, a system able to store medical records and to exploit the blockchain technology to control and track the access right transfer on the blockchain. The paper shows the current status of the project, presents a preliminary proof-of-concept implementation and discusses the future improvements of the system, and some critical issues which are still open.
This article introduces the concept of proof of authentication (PoAh) for the lightweight implementation of blockchains in the Internet of Things (IoT). The PoAh can replace existing consensus algorithms, such as proof of work (PoW), proof of stake (PoS), and proof of activity (PoA), for resource- and energy-constrained infrastructures, such as the IoT.
With the recent rise of cryptocurrencies' popularity, the security and management of crypto-tokens have become critical. We have witnessed many attacks on users and providers, which have resulted in significant financial losses. To remedy these issues, several wallet solutions have been proposed. However, these solutions often lack either essential security features, usability, or do not allow users to customize their spending rules. In this paper, we propose SmartOTPs, a smart-contract wallet framework that gives a flexible, usable, and secure way of managing crypto-tokens in a self-sovereign fashion. The proposed framework consists of four components (i.e., an authenticator, a client, a hardware wallet, and a smart contract), and it provides 2-factor authentication (2FA) performed in two stages of interaction with the blockchain. To the best of our knowledge, our framework is the first one that utilizes one-time passwords (OTPs) in the setting of the public blockchain. In SmartOTPs, the OTPs are aggregated by a Merkle tree and hash chains whereby for each authentication only a short OTP (e.g., 16B-long) is transferred from the authenticator to the client. Such a novel setting enables us to make a fully air-gapped authenticator by utilizing small QR codes or a few mnemonic words, while additionally offering resilience against quantum cryptanalysis. We have made a proof-of-concept based on the Ethereum platform. Our cost analysis shows that the average cost of a transfer operation is comparable to existing 2FA solutions using smart contracts with multi-signatures.
The synergy between artificial intelligence and blockchain is increasing in the computing environment. To realize this blockchain technology making its way into applications such as healthcare, financial services, Internet of Things and much more., that use artificial intelligence making it more defendable to attacks. The current blockchain technology uses different encryption algorithms such as SHA256, MD5 etc. The blockchain attacks such as collision attack, primage attack and attacks on wallet motivated us to experiment on partial homomorphic encryption to enhance the strength of blockchain technology. This article considers i) Goldwasser- Micali and ii) Paillier encryption schemes for the comparative evaluation study with a focus on data privacy techniques. We believed and proved that the above two encryption schemes that were considered have less processing time and provide more strength to the possible attacks. While we present our preliminary results in this study, we discuss the pros and cons of the Goldwasser-Micali, Paillier and non-homomorphic encryption schemes that are expected to add value to blockchain technology to be used in Artificial Intelligence (AI) applications.
Data manipulation is often named as a serious threat to data integrity. Data can be tampered with, and malicious actors could use this to their advantage. Data users in various application domains want to be ensured that the data they are consuming are accurate and have not been tampered with. To validate the integrity of these data, we describe a blockchain-based hash validation method. The method assumes that the actual data is stored separately from the blockchain, and then allows a data identifier and a hash of these data to be submitted to the blockchain. The actual data can be validated against the hash on the blockchain at any time. Several use cases are described for blockchain-based hash validation, and to validate the method it is implemented inside an application audit trail to validate the audit trail data. This implementation shows that blockchain-based hash validation is able to detect malicious and accidental changes that were made to the data.
IoT networks are designed to connect as many devices as possible. Since any device can be connected to an IoT network, it faces an authentication issue, which may be exploited by attackers to break into the IoT network. A solution discussed in this paper is to make use of blockchain technology to authenticate IoT devices before it joins an IoT network. Based on the characteristics of blockchain, it can be used to create the digital identification of IoT devices and authenticate them. Authenticated Devices Configuration Protocol (ADCP) is proposed to achieve this authentication process. All results of the solution have been demonstrated by a fully working implementation, and do not solely rely on theoretical considerations or simulations.