Chol Hyun Park, Ivanrey Mejia Barlongo, Yoohwan Kim
In the recent decade, self-consumption and local renewable energy communities are growing, especially in California, North Carolina, Arizona and Nevada. In these communities, approximately twenty percent of electricity comes from solar generation. However, what happens if a household generates more than what they consume? In most cases, the excess energy would go back to the grid with little to no compensation given by the energy utility. In today's market, there are countless homeowners who would like to profit from their own PV system. Unfortunately, there is no energy marketplace that would allow homeowners to sell or purchase energy to and from their neighbors. Luckily with blockchain, this idea becomes a reality. With the use of distributed ledger technology, it is possible to perform energy transactions in near-real time from a prosumer to consumer without the need of a central authority. Our thesis suggests ways to handle the facilitation of energy transactions using an Ethereum blockchain system in an effortless and efficient way.
Jianwei Liao, Tsung-Ta Tsai, Chia-Kang He, Chin‐Wei Tien
Blockchain has flourished in recent years. As a decentralized system architecture, smart contracts give the blockchain a user-defined logical concept. The smart contract is an executable program that can be used for automatic transactions on the Ethereum blockchain. In 2016, the DAO attack resulted in the theft of 60M USD due to unsafe smart contracts. Smart contracts are vulnerable to hacking because they are difficult to patch and there is a lack of assessment standards for ensuring their quality. Hackers can exploit the vulnerabilities in smart contracts when they have been published on Ethereum. Thus, this study presents SoliAudit (Solidity Audit), which uses machine learning and fuzz testing for smart contract vulnerability assessment. SoliAudit employs machine learning technology using Solidity machine code as learning features to verify 13 kinds of vulnerabilities, which have been listed as Top 10 threats by an open security organization. We also created a gray-box fuzz testing mechanism, which consists of a fuzzer contract and a simulated blockchain environment for on-line transaction verification. Different from previous research systems, SoliAudit can detect vulnerabilities without expert knowledge or predefined patterns. We subjected SoliAudit to real-world evaluation by using near 18k smart contracts from the Ethereum blockchain and Capture-the-Flag samples. The results show that the accuracy of SoliAudit can reach to 90% and the fuzzing can help identify potential weaknesses, including reentrancy and arithmetic overflow problems.
Mohammad El-Hajj, Ahmad Fadlallah, Maroun Chamoun, Ahmed Serhrouchni
Enterprises are no doubt interested in reaching data collected from billions of Internet of Things (IoT) devices which opens a huge potential business. The main concern remains the security challenges from the distribution of key while using public key cryptography. To ensure that IOT connected devices can be trusted to be what they are supposed to be, robust IoT device authentication is mandated. Each IoT device therefore requires a unique identity which can be verified when the device tries to link to an intermediate device. One of the early solutions used to secure data transmission among parties in public networks is the Public Key Infrastructure (PKI) which is used to distribute and manage public keys (digital certificates) among different parties and these certificates are generated upon request by Certificate Authorities (CA). Nevertheless, for billions of devices connected to IoT and mobile phones, the distribution management of certificates for each client proved to be inefficient. In this research, we propose a decentralized authentication platform based on PKI and Ethereum Blockchain. The public key certificates are stored in a decentralized fashion and the private keys are stored inside the devices themselves. It also includes a protocol for Pre-Shared Keys (PSK) distribution. PSK keys are then used by PSK-based security protocols for securing the communication channel between two devices. This platform includes a client-side module, a server-side Wallet Management Function, and a smart contract deployed on the Ethereum Blockchain network. This platform can be used by applications for end devices and/or intermediate devices authentication and a secure Machine-to-Machine (M2M) communication. The proposed platform is validated by the implementation of a Secure Session Establishment between IoT devices. Results show that the solution implementation has minimal impact on the existing networks, and the secure session setup time between two devices is negligible compared to the existing security methods. Eventually, this scheme can help removing the trust requirement placed on clients by the current PKI/CAs infrastructure.
Zhijun Xu, Yichen Liu, Jun Zhang, Zhaoxiong Song · 6 authors
Nowadays the composition and structure of the manufacturing industry supply chain have become increasingly complex. The loss and not-in-time transmission of the supply chain information have aggravated the bullwhip effect. At the same time, due to the lack of reliable information storage, the difficulties of traceability and accountability have also caused supply chain management to fall into the bottleneck. The blockchain has the characteristics of supporting distributed networking, information synchronization among nodes, digital encryption, traceable information and block content that cannot be tampered, which is suitable for use in supply chain, and can provide solution for it. In this paper, a design scheme of integrated platform for information service provided by participants in supply chain and based on Ethereum blockchain is proposed. By using Ethereum smart contracts, the common business involved in the supply chain is realized using blockchain technology, and the key information of supply chain production and circulation is stored on the blockchain to ensure the information cannot be tampered. At the same time, a reputation evaluating method based on smart contracts is used to evaluate the reputation of enterprises in supply chain, which can provide reference for supplier selection among enterprises.
Bhabendu Kumar Mohanta, Anisha Sahoo, Shibasis Patel, Soumyashree S. Panda · 6 authors
Internet of Things (IoT) has lots of attention in the last decade. The connected IoT devices are more than the total world population. Due to its low cost, easy to deploy, and simple to implement, application areas are large like smart city, smart home, smart transportation, environment monitoring, agriculture and many more. There exists some security and privacy challenges in IoT system. The device identification is one of the challenges in any IoT application. Authentication is one of the processes to identify the device. Though some work has been done on this problem, most of these are using a centralized system. In this paper, we have proposed a distributed authentication system using the Blockchain technology The implementation of the proposed authentication is done on Ethereum platform for its better results in order to justify it as a superior scheme.
The term “smart contracts” has become ubiquitous to describe an enormous number of programs uploaded to the popular Ethereum blockchain system. Despite rapid growth of the smart contract ecosystem, errors and exploitations have been constantly reported from online contract systems, which has put financial stability at risk with losses totaling millions of US dollars. Most existing research focuses on pinpointing specific types of vulnerabilities using known patterns. However, due to the lack of awareness of the inherent nondeterminism in the Ethereum blockchain system and how it affects the funds transfer of smart contracts, there can be unknown vulnerabilities that may be exploited by attackers to access numerous online smart contracts. \n \nIn this paper, we introduce a methodical approach to understanding the inherent nondeterminism in the Ethereum blockchain system and its (unwanted) influence on contract payments. We show that our new focus on nondeterminism-related smart contract payment bugs captures the root causes of many common vulnerabilities without relying on any known patterns and also encompasses recently disclosed issues that are not handled by existing research. To do so, we introduce techniques to systematically model components in the contract execution context and to expose various nondeterministic factors that are not yet fully understood. We further study how these nondeterministic factors impact contract funds transfer using information flow tracking. The technical challenge of detecting nondeterministic payments lies in discovering the contract global variables subtly affected by read-write hazards because of unpredictable transaction scheduling and external callee behavior. We show how to augment and instrument a contract program into a representation that simulates the execution of a large subset of the contract behavior. The instrumented code is then analyzed to flag nondeterministic global variables using off-the-shelf model checkers. \n \nWe implement the proposed techniques as a practical tool named NPChecker (Nondeterministic Payment Checker) and evaluate it on 30K online contracts (3,075 distinct) collected from the Ethereum mainnet. NPChecker has successfully detected nondeterministic payments in 1,111 online contracts with reasonable cost. Further investigation reports high precision of NPChecker (only four false positives in a manual study of 50 contracts). We also show that NPChecker unveils contracts vulnerable to recently-disclosed attack vectors. NPChecker can identify all six new vulnerabilities or variants of common smart contract vulnerabilities that are missed by existing research relying on a “contract vulnerability checklist.”
Blockchain technology is being used in many areas, during last few years. Furthermore, different application opportunities are still been investigated. Blockchain relies on and permits to implement the concept of Decentralized Application (DApps). This makes the applications more transparent, distributed and flexible. The complexity of blockchain and its integration problems require expertise that differs from traditional application development approaches. Within this context, this paper presents our experience in building a DApp with one of the most popular blockchain based platforms called Ethereum.
The fake certificate is a special global problem in today's digital age. Thousands of universities and educational institutions around the world do not exist but can release hundreds of millions of fake degrees. Verifying the integrity of qualifications is a real challenge for today's employers. Applying the anti-data modifying properties of blockchain technology, this study proposes a solution issuing and verifying digital certificates called EUniCert to solve this problem. By changing the design and integrating new consensus algorithm used in Ethereum platform into the Unicoin network that was used to verify and store the information related to the issued digital certificate, the EUniCert improves the latency to validate transactions as well as the number of verified blocks in the blockchain network compared to the previous solution that we have proposed. We implement a simple blockchain system to illustrate the management operation of the digital certificates on the ethereum platform. Besides, we conduct a simulation to evaluate the performance of our proposal compared with the previous system. The result is that the average latency decreases by 3.27 times as well as the number of verified blocks increases by 11% compared with the previous system.
U radu je ukratko prikazana povijest pametnih ugovora. Kako bi njihov način rada bio jasniji, prikazani su Bitcoin blockchain te novosti koje je donio Ethereum, jedan od blockchain sustava koji se najčešće koristi kao temelj pametnih ugovora. Također, uz primjere iz prakse prikazana su neka od područja u kojima bi se pametni ugovori mogli koristiti. Potom se rad osvrnuo na moguće opasnosti i zloupotrebe koje pametni ugovori omogućuju. Kao zaključni dio rada obrađena je usporedba pametnih ugovora i ugovora u elektroničkom obliku kako bi se dao zaključak o kompatibilnosti načina rada pametnih ugovora sa zakonodavstvom Republike Hrvatske.
With the advancement of digitization, digital ecosystems are playing an increasingly important role in value creation. The mechanism by which digital ecosystems create value, however, has been generally deemed to be a mixed effect due to various factors. On the basis of signaling theory, this paper explores the effect of information transmission on the value creation capability of a digital ecosystem from two dimensions: the scale and sustainability of value creation. Taking a sample of weekly transaction data from Ethereum during August 2015–August 2018, our research proposes an integrated framework of information transmission in value creating, and discusses the diffusion process of the network effect within the digital ecosystem. As a generally accepted exchange medium, digital currency traffic acts as an observable proxy of information flow in a crypto-digital ecosystem, where the effects of heterogeneity in transaction attributes are filtered. Empirical results show that information transmission positively influences the scale and sustainability of value creation activities in a digital ecosystem by affecting user number and transaction frequency. Further research reveals that user number is the initial driving force of the network effect and a critical factor for the overall ecosystem market capitalization. This research provides a new insight into the design of sustainable value creation mechanisms under digital circumstances.
Kelven Klein Rocha, Jordano Ferrari, Rodrigo Lange
O objetivo deste trabalho e explicar as diferencas entre tres sistemas de registros distribuidos: Bitcoin , Ethereum e Iota . Para atingir o objetivos vao ser explicadas algumas caracteristicas essenciais. Estes sistemas sao espalhados pelo mundo em maquinas que possuem essa tecnologia de confirmacao para transacoes, se comunicando pela internet. Possuem varios enderecos com chave publica e privada e o saldo. Chave privada: E uma senha de acesso. Apenas o proprietario da chave privada pode usar. Ao usar a chave, o usuario desbloqueia e pode usar os fundos registrados. Chave publica: Parte da chave, pode ser visivel para os outros. A chave publica e gerada a partir da chave privada, portanto, elas sao um par. Endereco: E o contato entre os usuarios, para transacoes. O saldo e a quantidade de recursos disponiveis na conta. O Bitcoin e um sistema de pagamento. Ele fornece uma maneira simples de enviar e receber bitcoins entre os usuarios. Foi a primeira implementacao em larga escala do livro-razao distribuido usando a tecnologia blockchain , lancado em 2009. Ethereum tambem e um sistema de pagamento com a tecnologia blockchain , mas utiliza a moeda chamada Ether . Alem disso, nele voce pode gravar codigos de programas na rede para deixar registrado ( smart contract ), fazendo com que as informacoes dos programas tenham disponibilidade, pois serao dificeis de perder uma vez registrados na rede sendo lancado em 2014. Ja Iota e projetado para IOT ( Internet of Things ) por exemplo, micro pagamento entre maquinas. Como isso requer uma escalabilidade enorme e uma taxa de transacao baixa (ou zero), a IOTA adota uma abordagem diferente da tecnologia de contabilidade baseada em blockchain . O DAG ( Directed Acyclic Graph ) e a alternativa, sendo lancado em 2015. Bitcoin e Ethereum possuem a tecnologia de cadeia de blocos, ja Iota apresenta a tecnologia de grafico em cadeia. Os tres possuem a geracao de chaves feitas de forma aleatoria. com Ethereum sendo protegido por senha e Iota via embaralhamento. Bitcoin e Ethereum tem 33 bytes e 160 bits respectivamente, enquanto Iota tem sequencias de -1, 0 e 1.
Daniel Cerecedo Hernández, Carlos Armando Franco Ruiz, Mario Iván Contreras-Valdez, Jovan Axel Franco Ruiz
El objetivo de esta investigación es analizar la presencia de burbujas financieras o un comportamiento explosivo en cuatro criptomonedas: Ethereum, Ripple, Bitcoin Cash y EOS. La selección de los activos se basó en la capitalización de mercado. La metodología implementada fue una prueba simple y generalizada (SADF y GSADF) de una variación de la prueba aumentada de Dickey-Fuller propuesta por Phillips et al. (2011, 2015). Encontramos diez, siete, seis y siete comportamientos exuberantes en los activos mencionados, respectivamente. Esta metodología ha sido en gran parte inexplorada y podría emplearse de manera estándar en el sector financiero para cualquier otro activo. Esta es la primera investigación que detecta este tipo de comportamiento para un grupo de criptomonedas con frecuencia diaria. Con el presente trabajo y el artículo de Li et al. (2018), el 68,47% del mercado ha sido analizado bajo la metodología. En consecuencia, este comportamiento podría estar disperso en todo el sector.
The importance of the Internet of Things is constantly growing, together with the proliferation of IoT devices which are changing our daily life and empowering industrial processes. However, the most IoT devices and protocols were not designed with security in mind, and economic and energyconsumption constraints make the implementation of security measures a non-trivial problem. One of the most used messaging protocol in IoT, which is MQTT (Message Queuing Telemetry Transport), leaves to developers the task to implement security, as native security services provided by the protocol are very weak. This paper focuses on MQTT authentication, which is definitely insecure in the protocol, even though the implementations can combine MQTT with other mechanisms to obtain a suitable level of security. The aim of the present work is to propose an innovative OTP-authentication scheme for MQTT which uses Ethereum to implement an independent logic channel for the second-factor authentication. The implementation of the proposed scheme relies on the trusted behavior of smart contracts and adopts suitable strategies to preserve the privacy of users.
Public blockchains like Ethereum use Merkle trees to verify transactions
received from untrusted servers before applying them to the blockchain. We
empirically show that the low throughput of such blockchains is due to the I/O
bottleneck associated with using Merkle trees for processing transactions. We
present RAINBLOCK, a new architecture for public blockchains that increases
throughput without affecting security. \sysname achieves this by tackling the
I/O bottleneck on two fronts: first, decoupling transaction processing from
I/O, and removing I/O from the critical path; second, reducing I/O
amplification by customizing storage for blockchains. RAINBLOCK uses a novel
variant of the Merkle tree, the Distributed Sharded Merkle tree (DSM-TREE) to
store system state. We evaluate RAINBLOCK using workloads based on public
Ethereum traces (including smart contracts) and show that \sysname processes
20K transactions per second in a geo-distributed setting with four regions
spread across three continents.
Public blockchains like Ethereum use Merkle trees to verify transactions received from untrusted servers before applying them to the blockchain. We empirically show that the low throughput of such blockchains is due to the I/O bottleneck associated with using Merkle trees for processing transactions. We present RAINBLOCK, a new architecture for public blockchains that increases throughput without affecting security. RAINBLOCK achieves this by tackling the I/O bottleneck on two fronts: first, decoupling transaction processing from I/O, and removing I/O from the critical path; second, reducing I/O amplification by customizing storage for blockchains. RAINBLOCK uses a novel variant of the Merkle tree, the Distributed Sharded Merkle tree (DSM-TREE) to store system state. We evaluate RAINBLOCK using workloads based on public Ethereum traces (including smart contracts) and show that RAINBLOCK processes 20K transactions per second in a geo-distributed setting with four regions spread across three continents.
Ethereum is a blockchain platform that hosts and executes general-purpose computer programs known as smart contracts. Users execute smart contracts by sending transactions to one of the functions of the contract. The execution of smart contracts in Ethereum has a cost that is measured in Gas unit. Executing a function of a smart contract burns a certain amount of gas units (a.k.a., gas usage). The total gas usage depends on how much computing power is necessary to carry out the execution of the function. Ethereum follows a free-market policy for deciding the transaction fee for executing a transaction. More specifically, users choose how much they are willing to pay in cryptocurrency for each unit of gas (a.k.a., gas price). Miners process transactions to gain mining rewards, which come directly from the paid transaction fees by users. However, neither the user nor the miner know, beforehand, the gas usage of a transaction. In this thesis, we analyze the Ethereum transaction data spanning between Oct. 2017 and Feb. 2019 (the Byzantium period) to conduct two studies that examine how gas usage and price impact the transaction processing dynamics of the Ethereum blockchain platform. \n \nIn our first study, we examine the strategies that are adopted by miners to prioritize transactions, the stability of the gas usage of contract functions, and whether the gas usage of a contract transaction can be predicted within a reasonable margin. We observe that most miners follow the default strategy for prioritizing transactions (which solely relies on gas price), a significant amount of contract functions have a very stable gas usage history, and it is possible to provide a real-time estimation of the gas usage of a transaction for these contracts with a median Adjusted RSquared of 0.86. \n \nIn the second study, we focus on understanding gas prices. We analyze how users commonly set gas prices and whether the contracts that are involved in user-to-contract transactions influence gas prices. Subsequently, we build a regression model to discover the factors that are strongly associated with the gas price of transactions. We observe that the gas prices set by users assume a wide range of values, vary considerably over time, and change based on the user. We also observe that the gas price of user-to-contract transactions differ significantly across contracts and functions. Lastly, we observe that different factors are more strongly associated with gas prices at different times. \n \nOur findings can help researchers to focus on the vulnerabilities of the current gas mechanism in their future work, provide developers insights on how to improve their decentralized applications (DApps) regarding transactions, motivate users to make an informed decision when issuing a transaction, and help miners to adopt optimized mining strategy.
Distributed Ledger Technology (DLT) is a shared, synchronized and replicated data spread spatially and temporally with no centralized administration and/or storage. Each node has a complete and identical set of records. All participants contribute to building and maintaining the distributed ledger. Current DLT technologies fall into two broad categories. Those that use block-chains such as in Bitcoin or Ethereum, and newer approaches which reduce computational loads for verification. All current approaches though difficult to crack can be vulnerable to quantum algorithms using Quantum Information Technologies (QIT). This effort joins the 2 technologies, constructing a Quantum Distributed Ledger (QDL) which provides a higher level of security using QIT and a decentralized data depository using DLT. This enhanced security prevents middleman attacks with quantum computers yet retains the advantages of a decentralized ledger of data.
RBAC is a traditional approach of controlling who wants to access resources in a computer system through a permission to a role. Blockchain is an open, distributed ledger that can permanently record transactions. Smart Contract facilitates negotiations for a trustless transaction by enabling automatic payment. It is currently being applied to various kinds of business applications. In a smart contract that requires payment with cryptocurrency, if access control is performed only without individual authentication, progress for applications to various fields will be restricted. In this paper, we propose a blockchain-based RBAC with an authentication mechanism that can provides role-based access control while also providing individual account-based authentication. We have defined three interfaces based on blockchain to realize it. The proposed mechanism provides anonymity-based authentication by using a hash function with a pass that is indistinguishable from the owner. This was simulated on an Ethereum-based test network and compared with existing methods. The proposed mechanism not only added authentication methods, but also was more efficient in gas use and performance time than the existing RBAC model.
This article investigates how choosing a different hash function might affect the overall performance of a blockchain. We focus on the selection of hash function for Ethereum and carry out extensive experiments to evaluate the performance change after the replacement of hash function. Our findings indicate that some performance metrics of a blockchain might be significantly affected by the hash function used. This suggests that selection of a specific hash function may not be a trivial decision for designing a blockchain.