Christoph Egger, Pedro Moreno-Sánchez, Matteo Maffei
Current cryptocurrencies provide a heavily limited transaction throughput that is clearly insufficient to cater their growing adoption. Payment-channel networks (PCNs) have emerged as an interesting solution to the scalability issue and are currently deployed by popular cryptocurrencies such as Bitcoin and Ethereum. While PCNs do increase the transaction throughput by processing payments off-chain and using the blockchain only as a dispute arbitrator, they unfortunately require high collateral (i.e., they lock coins for a non-constant time along the payment path) and are restricted to payments in a path from sender to receiver. These issues have severe consequences in practice. The high collateral enables denial-of-service attacks that hamper the throughput and utility of the PCN. Moreover, the limited functionality hinders the applicability of current PCNs in many important application scenarios. Unfortunately, current proposals do not solve either of these issues, or they require Turing-complete language support, which severely limit their applicability.
In cryptocurrencies such as Bitcoin or Ethereum, users control funds via secret keys. To transfer funds from one user to another, the owner of the money signs a new transaction that transfers the funds to the new recipient. This makes secret keys a highly attractive target for attacks, and has lead to prominent examples where millions of dollars worth in cryptocurrency have been stolen. To protect against these attacks, a widely used approach are so-called hot/cold wallets. In a hot/cold wallet system, the hot wallet is permanently connected to the network, while the cold wallet stores the secret key and is kept without network connection. In this work, we propose the first comprehensive security model for hot/cold wallets and develop wallet schemes that are provable secure within these models. At the technical level our main contribution is to provide a new provably secure ECDSA-based hot/cold wallet scheme that can be integrated into legacy cryptocurrencies such as Bitcoin. Our construction and security analysis uses a modular approach, where we show how to generically build secure hot/cold wallets from signature schemes that exhibit a rerandomizing property of the keys.
Motivated by the success of Bitcoin, lots of cryptocurrencies have been created, the majority of which were implemented as smart contracts running on Ethereum and called tokens. To regulate the interaction between these tokens and users as well as third-party tools (e.g., wallets, exchange markets, etc.), several standards have been proposed for the implementation of token contracts. Although existing tokens involve lots of money, little is known whether or not their behaviors are consistent with the standards. Inconsistent behaviors can lead to user confusion and financial loss, because users/third-party tools interact with token contracts by invoking standard interfaces and listening to standard events. In this work, we take the first step to investigate such inconsistent token behaviors with regard to ERC-20, the most popular token standard. We propose a novel approach to automatically detect such inconsistency by contrasting the behaviors derived from three different sources, including the manipulations of core data structures recording the token holders and their shares, the actions indicated by standard interfaces, and the behaviors suggested by standard events. We implement our approach in a new tool named TokenScope and use it to inspect all transactions sent to the deployed tokens. We detected 3,259,001 transactions that trigger inconsistent behaviors, and these behaviors resulted from 7,472 tokens. By manually examining all (2,353) open-source tokens having inconsistent behaviors, we found that the precision of TokenScope is above 99.9%. Moreover, we revealed 11 major reasons behind the inconsistency, e.g., flawed tokens, standard methods missing, lack of standard events, etc. In particular, we discovered 50 unreported flawed tokens.
Iddo Bentov, Yan Ji, Fan Zhang, Lorenz Breidenbach · 6 authors
We propose Tesseract, a secure real-time cryptocurrency exchange service. Existing centralized exchange designs are vulnerable to theft of funds, while decentralized exchanges cannot offer real-time cross-chain trades. All currently deployed exchanges are also vulnerable to frontrunning attacks. Tesseract overcomes these flaws and achieves a best-of-both-worlds design by using a trusted execution environment. The task of committing the recent trade data to independent cryptocurrency systems presents an all-or-nothing fairness problem, to which we present ideal theoretical solutions, as well as practical solutions. Tesseract supports not only real-time cross-chain cryptocurrency trades, but also secure tokenization of assets pegged to cryptocurrencies. For instance, Tesseract-tokenized bitcoins can circulate on the Ethereum blockchain for use in smart contracts. We provide a demo implementation of Tesseract that supports Bitcoin, Ethereum, and similar cryptocurrencies.
Blockchain naturally fits multiple industry sectors due its characteristics of decentralization, enhanced security, tamper-proof, improved traceability and transparency. However, there is a significant concern of blockchain’s performance, since blockchain trades off its performance for a completely distributed feature, which enhances its security. In this paper, we investigate the state-of-the-art progress of blockchain, mainly from a performance and security perspective. We extracted 42 primary papers from major scientific databases and 34 online technical articles. The objective is to understand the current research trends, challenges and future directions. We briefly introduce the key technologies of blockchain including distributed ledger, cryptography, consensus, smart contracts and benchmarks. We next summarize the performance and security concerns raised in the investigation. We discuss the architectural choices, performance metrics, database management enhancements, and hybrid blockchains, and try to identify the effort that the state-of-the-art has made to balance between the performance and security. We also make experiments on Ethereum and survey other popular blockchain platforms on the scalability feature of blockchain. We later discuss the potential applications and present the lessons learned. Finally, we attempt to identify the open issues and possible research directions.
Fuzzing and symbolic execution are two complementary techniques for discovering software vulnerabilities. Fuzzing is fast and scalable, but can be ineffective when it fails to randomly select the right inputs. Symbolic execution is thorough but slow and often does not scale to deep program paths with complex path conditions. In this work, we propose to learn an effective and fast fuzzer from symbolic execution, by phrasing the learning task in the framework of imitation learning. During learning, a symbolic execution expert generates a large number of quality inputs improving coverage on thousands of programs. Then, a fuzzing policy, represented with a suitable architecture of neural networks, is trained on the generated dataset. The learned policy can then be used to fuzz new programs. We instantiate our approach to the problem of fuzzing smart contracts, a domain where contracts often implement similar functionality (facilitating learning) and security is of utmost importance. We present an end-to-end system, ILF (for Imitation Learning based Fuzzer), and an extensive evaluation over >18K contracts. Our results show that ILF is effective: (i) it is fast, generating 148 transactions per second, (ii) it outperforms existing fuzzers (e.g., achieving 33% more coverage), and (iii) it detects more vulnerabilities than existing fuzzing and symbolic execution tools for Ethereum.
The pervasiveness of IoT devices makes the delivery mechanism of security updates a challenge. Current IoT systems rely on centralized or brokered paradigms or clouds with huge computational and storage capacities. The existing centralized IoT setups are therefore expensive as the result of factors such as the high costs associated with cloud server and network infrastructures and maintenance. Thus, the need for a fully decentralized peer to peer and secure technology to overcome these problems rises into the realm of existence. Blockchain provides a solution that fulfills the requirements of such a platform. Ideally, the update infrastructure should implement the CIA triad properties (Confidentiality, Integrity, and Availability). In this article, we study how a blockchain application can meet these requirements and propose a novel system to decentrally distribute digital content in a peer-to-peer network using the blockchain technology and smart contracts to overcome the concerns mentioned above. Additionally, in order to prevent the issues stemming from the free-riding challenge in P2P networks (peers refrain to generously share their resources to distribute updates), we exploit a Nash equilibrium micropayment mechanism to grant adequate incentive for peers to participate in distributing IoT update files.
Blockchain smart contracts are PC programs that can be adequately executed by an arrangement of ordinarily questioning center points, without the need of an external trusted in power. Since shrewd contracts handle and trade assets of huge regard, other than their correct execution it is also imperative that their use is secure against ambushes which go for taking or modifying the favorable circumstances. Ethereum, the most eminent and used structure for sharp contracts up to this point. It analyze the security vulnerabilities of Ethereum smart contracts, giving a logical order of customary programming traps which may incite vulnerabilities and exhibit a movement of attacks which misuse these vulnerabilities, empowering a foe to take money or cause other mischief
In this study, we will explain what settings the RX580 4GB AMD graphics card should be operated for in order to be able to perform Ethereum and Monero mining at high speed and with less energy consumption. Core and memory undervolting, core underclocking, memory overclocking and tightening memory timings are the techniques which are applied to the card. With the adjustments made, approximately 30 percent savings were achieved in electrical energy spent in Ethereum and Monero mining. Also, the mining speed increased by approximately 20 percent. It was measured that the temperature of the graphics card decreased by 10 degrees due to the decrease of the power drawn.
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
With the growth of digital assets known as cryptocurrency, where there is no central authority to process a transaction, anyone in the world can participate and start sharing assets with other parties.
Today, chat applications have billions of active users [Statista, 2018a] messaging text, audio, images and video. Transacting with cryptocurrency could be as intuitive and simple as sending a simple message, where users could send and track their cryptocurrency while seamlessly chatting with other users.
Users still need to access third-party services and entrust their credentials
to these services in order to have their requests processed. This exposes the users to potentially malicious parties intercepting and manipulating their
transactions. If the users were to have control over their assets locally, security flaws would be drastically reduced and transactions simplified on the user’s device.
In order to allow users to manage their assets in a more secure way, their
data would need to be locally stored in a safer manner such that it would
only be accessible by the owner.
The solution is to provide a functional mobile chat application on the user’s
device that can be used to interact with and manage cryptocurrency using
the Ethereum platform. Users do not require any previous knowledge about
the platform or cryptocurrencies and this solution will allow them to take
advantage of the opportunities that cryptocurrencies afford.
Using the Ethereum platform, the solution application will have its own local
node connected to the network, which will allow users to manage accounts,
receive and send assets to other users and monitor the status of their assets while chatting.
The Internet of Things (IoT) represents the technical foundation to solve some of the most important societal and environmental problems. One of the key challenges in IoT systems is providing security for distributed, networked IoT components that are implemented with potentially very low-end embedded processing systems. As the value of sensor data and actuator access increases in IoT deployments, attackers may increasingly target these vulnerable systems and protocol implementations running on them. For protocols that involve economic transactions on blockchains, as we show in our work, there is a direct monetary value associated with successful attacks. To address this problem, we present a hardware monitoring system that augments processors with logic that tracks the correct execution of software on the embedded systems. Attacks on the system, such as buffer overflow attacks, are recognized and stopped by the hardware monitor. Therefore, the system can avoid economic loss due to an attack and ensure that the protocol implementation is secured. We show the effectiveness of our system on a prototype that uses Linux running on a soft-core LEON3 processor on an Intel Stratix IV FPGA and interacts with the Ethereum blockchain.
Animal shelters are known as safe places which are managed by governmental or nongovernmental organizations, however the way these establishments harboring animals is a controversial issue. Almost every country in the world have different approaches to that subject. As an example; United States of America and the Europe Union have acclaimed regulations about animal rights. However, the situation in many countries is not that bright for the stray animals. Stray animals face considerable ratios of violence, assault and death. The shelters have conspicuous problems, such as overpopulation, hunger, lack of space, forced mating, illegal euthanasia and death ratio. Those circumstances have put adopting and fostering mechanisms on a much more troublesome way. Our proposal includes a promising, trackable and transparent system solution based on blockchain technology for the animal shelters. Design of the system, requirements and possible usage scenarios have been proposed. The prototype is implemented on Ethereum. Smart contracts are implemented for autonomous work of the system.
There has been a massive growth of Internet of Things (IoT) applications recently for both personal and organization use cases. But an IoT network is vulnerable to many privacy and security concerns. While some researchers have tried to define different access control models for IoT and tried to use blockchain in some cases, the solutions presented to date lacks a flexible and robust access control model that can be used for complex organization and cross-organization resource access scenarios and lacks the scalability and performance needed for IoT. This paper introduces a novel entitlement-based access control model that provides an efficient and secure way to delegate resource access rights to any entity. The solution uses service-oriented approach and a combination of public blockchain (with smart contracts) and local off-chain data for entitlements management and control. To analyze the proposed architecture, a large-scale cross-organization IoT scenario is taken into consideration and some qualitative evaluations are presented while implementation with Ethereum blockchain and smart contracts are currently in progress.
Saiful Rizal, Henry Rossi Andrian, Novianto Budi Kurniawan, Suhardi Suhardi
The decentralized storage system has problems in terms of secure data and access control issues have an important role in storage security on the service computing system platform. New challenges in data storage provide an opportunity for technology blockchain to be able to solve them. At present, there are several methods in the blockchain that have been implemented. Each method used has different technical characteristics. In this paper, we discuss the implementation of blockchain technology to secure a service computing system platform. In this research, it can be used as an understanding to develop a service computing system platform to produce reliable security.. Ethereum blockchain platform is the most used choice in research.
Sarah Tahir Bokhari, Tehreem Aftab, Ibrahim Nadir, Taimur Bakhshi
Current resource consumption monitoring systems such as utility meters allow for easy manipulation to give incorrect readings and generate corrupt bills leading to huge financial losses for utility companies. In order to limit this practice, the present work proposes the use of smart meters in tandem with an Ethereum-based blockchain to secure utility (consumption) data. Electricity generation and smart metering is taken as case-study and the proposed design is benchmarked in terms of time complexity, consensus algorithms, and security to ascertain optimal blockchain parameters for practical deployments. Given the relatively nascent and un-tested existing blockchain communication protocols, a custom TCP-based protocol is also developed to address additional re-validation requirements of the metering data exchanged between the blockchain nodes. The quantitative and qualitative analysis of the proposed approach highlights a significant reduction in any human interference and errors that may lead to misappropriations in consumer metering and adds a greater degree of robustness to the billing process for the benefit of utility companies.
The global supply chain depends heavily on maritime logistics to transport a variety of goods, from raw materials, parts, to finished products. Maritime logistics has many advantages over air logistics concerning cost and cargo volume. Thus, many manufacturers choose maritime logistics to ship their parts or products to customers because it has lower transportation cost and higher cargo carrying capacity than that of air logistics. However, there are significant inefficiencies in shipping goods across countries due to the complexity of documentation and administrative procedures involved with multiple entities participating in maritime logistics. The rise of blockchain and cryptocurrencies may shed new light on improving efficiency and enhancing transparency for marine logistics processes. This paper explores the potential of applying blockchain technology and cryptocurrencies in marine logistics. A proof-of-concept blockchain (and smart contract) application based on the Ethereum platform is developed to assess the feasibility of the new blockchain-based approach and evaluate the new approach against the current marine logistics practice.
Abdullah Bin Masood, Marios Lestas, Hassaan Khaliq Qureshi, Nicolas Christofides · 6 authors
Closed-loop Cyber-Physical Systems (CPSs) are significant constituent elements for smart city applications. However, security and resiliency of closed-loop CPSs can be compromised due to the centralized control structure, network interdependency and power/computational constraints. In this paper, towards addressing this problem, we propose a blockchain based de-centralized closed-loop CPS framework. Sensed measurements are stored on the blockchain and controller implementation and actuation is realized using smart contracts. The feasibility of the proposed approach is demonstrated via its simulative implementation on a distributed frequency control system within an islanded microgrid. A co-simulation framework is developed that incorporates a microgrid simulated in Matlab interfaced with Ethereum blockchain. Actuated signals from smart contracts embedded with a distributed frequency control algorithm dictate the microgrid's operating frequency to its nominal value. The effectiveness of the proposed method is demonstrated through the convergence of the time-dependent signals to their expected nominal values. In addition, the feedback delays involved in transacting the sensed data and generating the actuation signals are characterized and found to be of the order of a few seconds, which is acceptable for the purpose of secondary frequency control and does not lead to instability. The effect of the block size and the crypto puzzle difficulty level on the delays is also investigated and while the difficulty does not affect the delay significantly, the increase in block size can lead to excessive delay values.
Salam Khanji, Farkhund Iqbal, Zakaria Maamar, Hakim Hacid
The evolution of Internet of Things (IoT) enables addressing problems with limited human assistance. It offers communication across various modern smart city applications, for example, using communication technologies like wireless sensor networks that would generate a huge amount of data. It is imperative to maintain reliable and trustworthy interactions over things to guarantee proliferation of IoT applications. As these applications are being rolled out in many fields, sensitive data need to be safeguarded against misuse and/or leakage. Moreover, promptness and real-time responses should feature all IoT services. This paper explores, through an experimental framework, the integration of blockchain into IoT in order to investigate its impact, security enhancements, and limitations or open challenges it might bring. A private fork on Ethereum blockchain platform is developed to connect IoT devices (Raspberry pi) deployed to detect car crashes so, that, the process of insurance claims are expediated. The same scenario is also deployed on public Ethereum network in order to offer a comprehensive overview of both public and private blockchain platforms and their related security issues and challenges. The findings formulate a rigid foundation upon which a proper and efficient IoT paradigm can be provisioned to unlock blockchain technology potentials in different other domains besides IoT.
Ulfah Nadiya, Muhammad Ilham Rizqyawan, Oka Mahnedra
A smart home uses information technology to manage the devices inside the home to provide convenience for its owners. The most widely used technology for smart home systems is IoT. Nevertheless, IoT has challenges related to data security, moreover for the large scale and distributed IoT network properties. A thing that related to data security is data storage security. One of the data that needs to be secure is the door lock data access. This data must not be vulnerable to counterfeiting and hacking, because a door is directly related to the safety of the homeowner. Door lock access data can be used to find out who and when someone is in or out of the house, hence we can increase the home security if something suspicious happens. However, we must guarantee the integrity of the door lock access data. A method that can be used to ensure data integrity is making a blockchain-based system as data storage because the properties of blockchain are immutable and nonrepudiation. This study uses the Ethereum blockchain platform to store door lock access data and smart contracts to manage the policies. In addition, this study conducts a test to analyze the security level of the proposed system by using an avalanche effect method. The test results show the avalanche effect index for the proposed system is about 96% on average which means the proposed system can be categorized as a secure system.
The number of photographs taken is increasing exponentially each year. This includes the photographs captured by professional as well as non-professional personnel. The ease in accessibility of these work of art over the internet has increased unauthorized use of owner's property without handing them their deserved credit. In addition, the process to take the authorization over the use of the photograph from the respective owner takes a large amount of time as well as money. One of the solutions to this problem is the use of distributed ledger technology known as ‘Blockchain’ in order to keep the decentralized record of ownership. In addition, storing the photograph itself on the decentralized platform can make it more secure. Furthermore, designing a smart contract in which the user and owner can agree on the use of the owner's property can address the problem of unauthorized use. This paper describes the integration of blockchain, distributed storage, and peer-to-peer communication in order to solve the current problem of handling photograph ownership and authorization. Ethereum blockchain is implemented to achieve secure transaction and handling functionality regarding authorization with the help of smart contracts that runs on the blockchain. As the storage layer, the paper discusses the InterPlanetary File System (IPFS) as a distributed database with which the photographs can be stored such that decentralization can be achieved. Only after the verifying the similar image does not exist on the system the image is stored in IPFS. The existence of a duplicate image is done with the implementation of dHash algorithm and hamming distance. Whisper protocol allows the owner of the photograph and user on the Ethereum blockchain to leverage peer-to-peer communication to reach a consensus.
There have been recent, marked increases in the challenges of privacy, data interoperability and quality of Educational Professional Personal Record (EPPR). This calls into question the current model, in which different parties generate, exchange and monitor massive amounts of personal data related to EPPR. Ethereum blockchain has demonstrated that trusted, auditable transactions is visible using a decentralized network of nodes accompanied by a general ledger. Thus, the rapid development of educational and professional data generators such as online universities and distance learning, learners need to engage in detail into their EPPR as well as the educational and professional data generators. In this paper, we propose a novel decentralized approach to manage EPPR using Ethereum blockchain technology. The decentralized approach provides the owner of the EPPR a comprehensive immutable log and ease of access to their educational records across the educational record editors and consumers. Utilizing Ethereum blockchain features, can provide solutions with the main concerns of exchanging data between parties such as privacy, accountability and data interoperability. The aim of this approach is to also facilitate educational stakeholders (universities and employing agencies) to participate in the network as blockchain miners rewarded by pseudonymized data in compliance with General Data Protection Rules (GDPR) in United Arab Emirates (UAE).