Minh-Quan Le, HaiâDuong Le, Anh Vu Dinh-Duc, Thanh-Tung Tran
Recent blockchain-based systems for managing credentials show advantages over paper-based procedures. However, issuing credentials with blockchain could conflict with current management rules and policies. One of the possible conflicts is the auditability. Most blockchain-based systems for credentials focus on security, efficiency and privacy while ignoring the auditability of the system. In this paper, we propose a new system IU-TransCert for issuing, verifying, and auditing academic credentials. The system uses a new data structure named the Auditable Merkle Tree that enables credential issuance and built-in auditing capabilities. The auditable data fields can be customized to meet regulations. Credentials are published to the blockchain in the root node of the Auditable Merkle Tree, allowing access for auditors while preserving privacy. The system provides automated and transparent auditing processes for educational authorities to independently verify credentials without involving issuers. We also present a prototype to demonstrate feasibility, and a security analysis to examine protections against threats. The analysis and discussion shows that the proposed system could enhance credential privacy, efficiency, integrity, and auditability across the university ecosystem.
Ernesto GĂłmez-MarĂn, Luis Parrilla, Jose L. Tejero LĂłpez, Diego P. Morales · 5 authors
In this work, a secure architecture to send data from an Internet of Things (IoT) device to a blockchain-based supply chain is presented. As is well known, blockchains can process critical information with high security, but the authenticity and accuracy of the stored and processed information depend primarily on the reliability of the information sources. When this information requires acquisition from uncontrolled environments, as is the normal situation in the real world, it may be, intentionally or unintentionally, erroneous. The entities that provide this external information, called Oracles, are critical to guarantee the quality and veracity of the information generated by them, thus affecting the subsequent blockchain-based applications. In the case of IoT devices, there are no effective single solutions in the literature for achieving a secure implementation of an Oracle that is capable of sending data generated by a sensor to a blockchain. In order to fill this gap, in this paper, we present a holistic solution that enables blockchains to verify a set of security requirements in order to accept information from an IoT Oracle. The proposed solution uses Hardware Security Modules (HSMs) to address the security requirements of integrity and device trustworthiness, as well as a novel Public Key Infrastructure (PKI) based on a blockchain for authenticity, traceability, and data freshness. The solution is then implemented on Ethereum and evaluated regarding the fulfillment of the security requirements and time response. The final design has some flexibility limitations that will be approached in future work.
Blockchain technology has seen rapid adoption of Proof-of-Stake consensus mechanism in lieu of Proof-of-Work due to the formerâs efficiency and speed. One notable example of Proof-of-Stake is the Tendermint protocol, which has been powering the entirety of Cosmos system - an ecosystem of multiple interlocked chains. However, Tendermintâs choice of deterministically deciding the next block proposer presents a huge window for malicious actors to prepare and coordinate attacks on upcoming validator nodes, possibly crippling the attacked chain. Furthermore, randomized number generation in this blockchain ecosystem still proves to be a challenge by reason of blockchainâs inherent deterministic nature. Aiming at the above problems, in this paper, we propose an improvement over Tendermint consensus protocol, utilizing Elliptic Curve Verifiable Random Function, a fast and secure pseudorandom generation algorithm suitable for deterministic systems like blockchain. This novel approach will solve the problem of knowing the validator ahead of time, whilst the verifiable random function module will be capable of supplying reliable random numbers to the overlaying beacon chain - a blockchain capable of distributing random numbers to users through smart contracts, and even other blockchains through Cosmosâ InterBlockchain Communication Protocol. The performed experiments with a prototype blockchain demonstrated that the new consensus protocol improves Tendermintâs resilience against network-layer attack vectors, while maintaining adequate fairness and performance.
If tokenized assets are to be a reality in the future decentralized Web3 then transaction keys need to be distributed and under the control of the asset-owners. This requires a careful design of wallet systems based on trusted hardware. A core feature needed for wallet systems is the attestation of the state of the transaction keys in the wallet without disclosure of the keys. This feature is relevant for relying parties such as insurance providers who need to perform risk assessment based on the security quality of the environment inside the wallet system that is protecting the transaction keys. In the longer term, all key-bearing devices that participate in a decentralized tokenized asset network will need to be hardened using trusted hardware, with attestation capabilities for detecting and countering cyberattacks.
Michael Eckel, Dominik Roy George, Björn Grohmann, Christoph KrauĂ
Trusted Platform Modules (TPMs) are used for remote attestation to ensure the authenticity and integrity of software running on a computer system. However, measuring software executed as containers or virtual machines can be challenging as it is measured concurrently, resulting in a jumbled measurement log that is difficult to disentangle. Moreover, disclosing the entire measurement log in traditional binary remote attestation raises privacy and intellectual property concerns. To address these issues, we propose a remote attestation method with constrained disclosure, allowing for selective disclosure of entries in the measurement log using a non-interactive zero-knowledge (NIZK) proof with Schnorr signatures. Our approach is evaluated for security and privacy and proven to be correct, sound, and satisfies the properties of a NIZK proof. Formal verification of our solution with ProVerif also supports our claims. Furthermore, the performance evaluation of our proof-of-concept implementation shows that our contribution is feasible, and the overhead introduced is negligible.
Umer Majeed, Sheikh Salman Hassan, Zhu Han, Choong Seon Hong
In the rapidly evolving landscape of Web3 and blockchain technologies, decentralized autonomous organizations (DAOs) have emerged as innovative structures that operate autonomously through blockchain and smart contracts, eliminating the need for centralized control. The federated learning (FL) process, akin to an information flow under structured transparency, involves local models (LMs) as inputs and the global model (GM) as the output for each global iteration. The lack of transparency and security in traditional FL systems can be attributed to the centralized validation of LMs and GM updates. In this paper, we propose DAO-FL, a smart contract-based framework that leverages the power of DAOs to address these FL challenges. DAO-FL introduces the concept of DAO Membership Tokens (DAOMTs) as a governance tool within a DAO. DAOMTs play a crucial role within the DAO, facilitating membersâ enrollment and expulsion. Our framework incorporates a Validation-DAO for decentralized input verification (DIV) of the FL process, ensuring reliable and transparent validation of LMs. Additionally, DAO-FL employs a multi-signatures approach facilitated by an Orchestrator-DAO to achieve decentralized GM updates, and thus decentralized output verification (DOV) of the FL process. We present a comprehensive system architecture, detailed execution workflow, implementation specifications, and qualitative evaluation for DAO-FL. Evaluation under threat models highlights DAO-FLâs out-performance against traditional centralized-FL, effectively countering input and output attacks. DAO-FL excels in scenarios where DIV and DOV are crucial, offering enhanced transparency and trust. In conclusion, DAOFL provides a compelling solution for FL, reinforcing the integrity of the FL ecosystem through decentralized decision making and validation mechanisms.
Abstract Blockchain is a distributed ledger proposed by Satoshi Nakamoto. It has become one of the most important networks for humans in the world. With the rapid development of blockchain technology, an increasing number of criminals are engaging in fraudulent activities, extortion and other financial crimes on the blockchain. Due to the immutability of blockchain, it is difficult for users to recover their losses. Some scholars have proposed the concept of the redactable blockchain. However, most redactable blockchain schemes fail to consider the impact of modification on the contextual economic relationships of the blockchain. We propose an improved redactable blockchain considering contextual consistency. Additionally, we utilize a security deposit mechanism to guarantee financial contextual consistency for the modified blockchain. We distribute users' security deposit account private keys to random users on the blockchain using Verifiable Secret Sharing, Verifiable Random Functions and other cryptographic primitives to achieve decentralized key management and modification. Experiments show that the performance of our scheme is acceptable in realistic situations.
Today, the world is highly depended on Unified Payments Interface (UPI) system for all kind of financial transactions. Whether Banks or people, everyone relies on UPI transactions for personal or commercial purposes. Since it provides a simple interface with round the clock availability, the financial activities became easier and faster. But the security concerns are still there, for which continuous research processes are carried on all around the world. In the context of UPI system, the information security needs to be assured both during storage and transit. For providing security in information storage and data transfer, the best solution till now is Blockchain Technology enabled Smart Banking systems. The decentralized feature and use of smart contracts of Blockchain will help the transactions to be immutable, more secured and distributed. The usage of high degree cryptographic encryptions and usage of appropriate consensus algorithms can make the data purely tamper proof. This paper describes the features that should be possessed by a Blockchain technology enabled UPI system that will help to have high security for all the financial activities and transactions.
The Non-Fungible Token (NFT) industry has exploded in recent years both in the industry and also in academic research. The notion of Non-Fungible Token (NFT) is based on an Ethereum token standard that aims to distinguish each token with identifiable indications. As their unique identifiers, these tokens can be coupled with virtual/digital attributes. All marked properties can be freely sold via NFTs, with customized values based on their ages, rarity, liquidity, and so on. It has significantly boosted the growth of the decentralized application (DApp) sector. The thousand fold return on its expanding market attracts a lot of interest all across the world. However, the NFT ecosystem is still in its early stages, and NFT technologies are still in their infancy. As a result, we are working on NFT deployment as well as learning about security problems and NFT-related topics. We have to also remember that newer applications of NFTs in the Metaverse is also making NFTs state of the art.
Outsourcing storage has emerged as an effective solution to manage the increasing volume of data. With the popularity of pay-as-you-go payment models in outsourcing storage, data auditing schemes that prioritize timeliness can be valuable evidence for elastic bill settlement. Unfortunately, existing data auditing schemes do not sufficiently consider timeliness during auditing. Furthermore, practical data auditing schemes should have the capability to check the integrity of scalable data. In this paper, we propose a blockchain-based dynamic data auditing scheme with strong timeliness to ensure that data stored in outsourcing storage systems remain intact. Our scheme encapsulates timestamps into homomorphic verifiable tags to simultaneously check data integrity and timestamp validity. To achieve dynamicity, we utilize the Merkle hash tree to store the tags, allowing for block-level dynamic operations. Additionally, by leveraging the transparency, non-repudiation, and tamper resistance of blockchain technology, we design a blockchain-based data auditing framework to prevent malicious behavior from all entities. We then formally prove the soundness and privacy of our scheme. Finally, we conduct theoretical analysis and experimental evaluation to demonstrate that the performance of our scheme is of acceptable efficiency to existing works in terms of computation cost, communication overhead, and storage overhead.
Blockchain is a distributed ledger that records transactions among users on top of a peer-to-peer network. Among all, Ethereum is the most popular general-purpose platform and its support of smart contracts led to a new form of applications called decentralized applications (DApps). A typical DApp has an off-chain frontend and on-chain backend architecture, and the frontend often needs interactions with the backend network, e.g., to acquire chain data or make transactions. Therefore, Ethereum nodes implement the official RPC specification and expose a uniform set of RPC methods to the frontend. However, the specification is not sufficient in two points: (1) lack of clarification for non-deterministic event handling, and (2) lack of specification for invalid arguments. To effectively disclose any deviations caused by the insufficiency, this paper introduces EtherDiffer that automatically performs differential testing on four major node implementations in terms of their RPC services. EtherDiffer first generates a non-deterministic chain by multi-concurrent transactions and propagation delay. Then, it applies our key techniques called property-based generation and type-preserving mutation to generate both semantically-valid and semantically-invalid-yet-executable test cases. EtherDiffer executes the test cases on target nodes and reports any deviations in error handling or return values. The evaluation showed the effectiveness of our test case generation techniques with the success ratios of 98.8% and 95.4%, respectively. Also, EtherDiffer detected 48 different classes of deviations including 11 implementation bugs such as crash and denial-of-service bugs. We reported 44 of the detected classes to the specification and node developers and received acknowledgements as well as bug patches. Lastly, it significantly outperformed the official node testing tool in every technical aspect. We believe that our research findings can contribute to more stable DApp ecosystem by reducing the inconsistencies among nodes.
Sharon Rose H, Razeenath Aafiya A, Kamachi Swetha R, G. R. Ramya
The system focuses on proposing a robust authentication framework based on these Secure Remote Password (SRP) protocol to enhance the security of data exchange in Peer-to- Peer (P2P) cloud environments. The Advanced Encryption Standard (AES) algorithm provides encryption and the SRP protocol leverages cryptographic primitives to establish mutual authentication between cloud servers and users, ensures that data, remains protected against any vulnerabilities. The system encompasses various stages, including user registration, key establishment, and secure data transmission. After user registration, the SRP protocol employs a zero-knowledge proof mechanism to maintain the security of data available on cloud servers, mitigating the risks associated with password leaks and unauthorized access. Furthermore, the protocol facilitates secure key exchange to establish a confidential communication channel between peers, enabling encrypted data transmission. The system integrates SRP protocol and AES encryption, fortifying data security in P2P cloud environments through robust authentication, ensuring a comprehensive defence against potential vulnerabilities.
Recent years have witnessed significant advancements in cross-chain technology. However, the field faces two pressing challenges when it comes to security and privacy. Hacks on cross-chain bridges have led to monetary losses of around 3 billion USD, highlighting flaws in security models governing interoperability mechanisms (IMs) and the ineffectiveness of incident response frameworks. Additionally, the exploration of privacy within cross-chain scenarios remains relatively unexplored. Hackers benefit from extensive privacy, whereas users and bridge operators experience restricted privacy, thereby broadening the potential attack surface for adversaries. In this paper, we present the most comprehensive study to date on the security and privacy of blockchain interoperability. Our study employs a rigorous systematic literature review, yielding a corpus of 178 relevant documents, including 58 academic papers and 120 gray literature documents, out of a pool of 531. We systematically categorize 56 interoperability solutions based on a newly created taxonomy focusing on security and privacy considerations. Our dataset, comprising academic research, disclosures from bug bounty programs, and audit reports, exposes 45 cross-chain vulnerabilities, 25 theoretical attacks, and 88 mitigation strategies. Leveraging this data, we analyze 14 notable bridge hacks accounting for over USD 2.9 billion in losses, mapping them to the identified vulnerabilities. Our findings reveal that a substantial portion (65.8\%) of stolen funds originates from projects secured by permissioned intermediary networks with unsecured cryptographic key operations. Regarding privacy, we demonstrate that achieving unlinkability in cross-chain transactions is contingent on the underlying ledgers providing some form of confidentiality. In conclusion, our study offers critical insights into the challenges and vulnerabilities within the realm of cross-chain interoperability. We pinpoint promising directions for future research that can guide both industry practitioners and academics toward substantial advancements in this field. Our work underscores the urgency of enhancing security and privacy measures in cross-chain technology to mitigate the substantial financial risks associated with bridge hacks and to foster user trust in the blockchain ecosystem.
Data deduplication and integrity auditing based blockchain plays an important role in guaranteeing secure and efficient cloud storage services. However, existing data deduplication schemes support auditing either with the assistance of a trust center (key server or third-party auditor) or bear the waste of computation and storage resources caused by repetitive authenticators storage and key storage. In this paper, we propose a blockchain-based shared data integrity auditing and deduplication scheme. Specifically, we propose a deduplication protocol based on ID-based broadcast encryption without key servers and achieve key deduplication on the user side. Next, we propose a data integrity auditing protocol by using the characteristic of convergent encryption to achieve authenticator deduplication on the cloud service provider side. Besides, we achieve decentralized data integrity auditing based blockchain without relying on a single trusted third-party auditor and improve the credibility of the auditing result. On this basis, we propose two bath auditing protocols for different scenarios to improve efficiency. Security and performance analysis demonstrates that the authenticators' storage cost on the cloud storage provider side can be reduced from${\mathcal {O}}({\mathcal {F}})$to${\mathcal {O}}(1)$and the key storage cost on the user side can be reduced from${\mathcal {O}}({\mathcal {F}})$to${\mathcal {O}}(1)$as well.
Anna Vacca, Michele Fredella, Andrea Di Sorbo, Corrado Aaron Visaggio · 5 authors
Abstract Blockchain is a crossâcutting technology allowing interactions among untrusted entities in a distributed manner without the need for involving a trusted third party. Smart contracts (i.e., programs running on the blockchain) enabled organizations to envision and implement solutions to realâworld problems in less cost and time. Given the immutability of blockchain and the lack of best practices for properly designing and developing smart contracts, it is crucial to assure smart contract quality before deployment. With the help of an exploratory survey involving developers and researchers, this paper identifies the practices and tools used to develop, implement, and evaluate smart contracts. The survey received 55 valid responses. Such responses indicate that (i) inefficiencies may occur during the development cycle of a smart contract, especially regarding requirements specification, design, and testing phases, and (ii) the lack of a shared standard to evaluate the functional quality of implemented smart contracts. To start coping with these issues, the adoption of functional suitability assessment measures recommended by the ISO/IEC 25000 standard, widely used in software engineering, is proposed by adapting them to the context of smart contracts. Through some examples, the manuscript also illustrates how to measure the functional completeness and correctness of smart contracts. The proposed procedure to measure smart contract functional suitability brings advantages to both developers and users of decentralized finance or nonâfungible tokens platforms, data marketplaces, or shipping and real estate services, just to mention a few. In particular, it helps (i) better outline the responsibilities of smart contracts, (ii) uncover errors and deficiencies of smart contracts in the early stages, and (iii) ensure that the established requirements are met.
Federated Learning (FL) emerges as a viable solution to facilitate data collaboration, enabling multiple clients to collaboratively train a machine learning (ML) model under the supervision of a central server while ensuring the confidentiality of their raw data. However, existing studies have unveiled two main risks: (i) the potential for the server to infer sensitive information from the client's uploaded updates (i.e., model gradients), compromising client input privacy, and (ii) the risk of malicious clients uploading malformed updates to poison the FL model, compromising input integrity. Recent works utilize secure aggregation with zero-knowledge proofs (ZKP) to guarantee input privacy and integrity in FL. Nevertheless, they suffer from extremely low efficiency and, thus, are impractical for real deployment. In this paper, we propose a novel and highly efficient approach RiseFL for secure and verifiable data collaboration, ensuring input privacy and integrity simultaneously. Firstly, we devise a probabilistic integrity check method that transforms strict checks into a hypothesis test problem, offering great optimization opportunities. Secondly, we introduce a hybrid commitment scheme to satisfy Byzantine robustness with improved performance. Thirdly, we present an optimized ZKP generation and verification technique that significantly reduces the ZKP cost based on probabilistic integrity checks. Furthermore, we theoretically prove the security guarantee of RiseFL and provide a cost analysis compared to state-of-the-art baselines. Extensive experiments on synthetic and real-world datasets suggest that our approach is effective and highly efficient in both client computation and communication. For instance, RiseFL is up to 28x, 53x, and 164x faster than baselines ACORN, RoFL, and EIFFeL for the client computation.
Josep LluĂs Ferrer Gomila, M. Francisca Hinarejos
In this article, we present the first proposal for contract signing based on blockchain that meets the requirements of fairness, hard-timeliness, and bc-optimism. The proposal, thanks to the use of blockchain, does not require the use of trusted third parties (TTPs), thus avoiding a point of failure and the problem of signatories having to agree on a TTP that is trusted by both. The presented protocol is fair because it is designed such that no honest signatory can be placed at a disadvantage. It meets the hard-timeliness requirement because both signatories can end the execution of the protocol at any time they wish. Finally, the proposal is bc-optimistic because blockchain functions are only executed in case of exception (and not in each execution of the protocol), with consequent savings when working with public blockchains. No previous proposal simultaneously met these three requirements. In addition to the above, this article clarifies the concept of timeliness, which previously has been defined in a confusing way (starting with the authors who used the term for the first time). We conducted a security review that allowed us to verify that our proposal meets the desired requirements. Furthermore, we provide the specifications of a smart contract designed for the Ethereum blockchain family and verified the economic feasibility of the proposal, ensuring it can be aligned with the financial requirements of different scenarios.
Davide Frey, Lucie Guillou, Michel Raynal, François TaıÌani
This paper explores the territory that lies between best-effort Byzantine-Fault-Tolerant Conflict-free Replicated Data Types (BFT CRDTs) and totally ordered distributed ledgers, such as those implemented by Blockchains. It formally characterizes a novel class of distributed objects that only requires a First In First Out (FIFO) order on the object operations from each process (taken individually). The formalization leverages Mazurkiewicz traces to define legal sequences of operations and ensure both Strong Eventual Consistency (SEC) and Pipleline Consistency (PC). The paper presents a generic algorithm that implements this novel class of distributed objects both in a crash- and Byzantine setting. It also illustrates the practical interest of the proposed approach using four instances of this class of objects, namely money transfer, Petri nets, multi-sets, and concurrent work stealing dequeues.
P. Thilakavathy, S. Jayachitra, Anurag Aeron, Narendra Kumar · 6 authors
Across a wide range of sectors, blockchain technology has emerged as a game-changing option for secure data storage. This research dives into the mechanisms that enable blockchain to protect data integrity and immutability. This research investigates how blockchain technology reduces the chances of data tampering and unauthorized adjustments by examining its underlying concepts and features, such as decentralization, cryptography, consensus procedures, and immutability. Blockchain networks are decentralized, so they don't rely on any one entity to function. This eliminates one potential point of failure or manipulation. Data is protected from tampering and disclosure thanks to the use of hash functions and digital signatures, two examples of strong cryptographic algorithms. By confirming and agreeing on transactions, consensus methods like Proof of Work (PoW) and Proof of Stake (PoS) keep the blockchain ledger up-to-date and accurate. By linking blocks together and recording timestamps, blockchain makes it practically impossible to alter data after it has been recorded. The distributed ledger's availability to the public and ease of use encourage accountability and deter dishonest participants. Smart contracts eliminate the need for third parties by automating operations based on predetermined rules that cannot be altered after they have been created. This study also delves into blockchain fork resistance, incentives for truthful involvement, and other network security measures. It also covers the security implications of both permissioned and permissionless blockchains. Blockchain technology provides strong security procedures, but it has several drawbacks that must be taken into account. These include issues with scalability and the possibility of security flaws in smart contracts. Therefore, securing security and performance requires cautiously considering particular use case needs and picking the right blockchain platform and configuration. For blockchain networks to function properly in the real world, constant vigilance and updates are required