Jan 1, 2025·VI All-Russian (National) Scientific Conference "Science, Technology, Society: Ecological Engineering for Sustainable Development of Territories"
A mathematical approach is proposed for evaluating the resilience of a distributed ledger of SmartDust-class sensor microsystems under conditions of cyber-physical attacks and industrial interference. A stochastic model of the trusted sensor network is developed, incorporating the probabilities of node compromise, telemetry packet loss, and data verification errors. Analytical expressions are derived for the indicators of data trustworthiness, latency, and energy reliability of the system. The simulation results demonstrate the influence of network topology parameters and attack intensity on the integral resilience index of the sensor infrastructure.
We compare the total capital efficiency of secure restaking and Proof-of-Stake (PoS) protocols. First, we consider the sufficient condition for the restaking graph to be secure. The condition implies that it is always possible to transform such a restaking graph into separate secure PoS protocols. Next, we derive two main results: upper and lower bounds on the required extra stakes to add to the validators of the secure restaking graph to be able to transform it into secure PoS protocols. In particular, we show that the restaking savings compared to PoS protocols can be very large and can asymptotically grow as a square root of the number of validators. We also study a complementary question of aggregating secure PoS protocols into a secure restaking graph and provide matching lower and upper bounds on the PoS savings.
T A Mohanaprakash, Ranganayaki V.C, M. S. Minu, D. A. · 5 authors
Many have long aimed to create a safe electronic voting system that maintains the confidentiality and integrity of traditional voting methods while using the convenience and openness of modern technology. Ballot paper or electronic voting machines are the current voting schemes in every nation, and democratic voting is a significant event in every country. Problems with these procedures abound, including lack of openness, poor voter turnout, vote manipulation, mistrust of the election body, forgery of unique identification (voter ID card), delays in disseminating results, and, most importantly, security breaches. Prioritizing the security of digital voting is of utmost importance when contemplating implementing a digital voting system. The article assesses the objective of building a blockchain-based e-voting system [BC-E-VOT] that uses digital voting technology. Electronic voting methods that leverage the distributed ledger attract much attention because they can make digital voting more transparent, secure, and honest. As shown in this research, a successful strategy for electronic voting may be achieved by using Blockchain's cryptographic underpinnings and transparency. Due to its complete transparency, the suggested approach satisfies the essential criteria for electronic voting systems. Since Blockchain employs a decentralized mechanism for data storage rather than storing all of the data in one central place, it becomes challenging to tamper with the data when utilizing this technology to build a decentralized application. By creating a decentralized system using the WSN platform, a third party is no longer needed to oversee the election's access control. This article provides a system for electronic voting that guarantees privacy, trustworthiness, and security. The suggested approach is practical and secure, according to the findings.
Continuous Group Key Agreement (CGKA) is the core of a new generation of End-to-End secure (E2E) cryptographic multi-party applications. CGKA allows the members in a dynamic group to agree on the current state for continuous communicating. The first CGKA protocol deployed in practical E2E applications is Inside-Secure TreeKEM (ITK), in which members use flood broadcasting to transition to the same new state for subsequent communications. However, flood broadcasting requires spread of a large amount of messages, while only a small part of the messages is needed for one specific member. This would incur substantial communication costs. To reduce the communication costs, Server-Aided ITK (SAIK) was proposed. SAIK employs a server to split the whole uploaded messages into multiple pieces, and deliver each piece to a specific member, thereby saving bandwidth of members. However, SAIK relies on a central server and hence is vulnerable to the single-point-of-failure problem. The problem is that if the server is unavailable, it will cause a sharp reduction in efficiency and increasing cost. In this work, we first formalize CGKA with smart contract (ScCGKA), which replaces the central server with smart contracts to solve the single-point-of-failure problem. We give a concrete construction of ScCGKA, dubbed the improved ITK with smart contract (ScITK). ScITK is constructed on ITK and can be deployed in real-world E2E applications. In ScITK, participants collaboratively negotiate and deploy a smart contract on the Ethereum blockchain to perform the splitting-delivering procedure. We give a formal security model to capture security properties that CGKA needs to achieve and a correctness property. The comparison between our ScITK and existing approaches shows that ScITK not only reduces communication cost, but also removes the server’s costs.
Currently, privacy protection in consortium blockchains can be categorized into two primary schemes based on their characteristics. The first is the ring signature scheme, which renders the user identity completely anonymous. The second is the group signature scheme, where the user identity can be fully traced by the trusted authority (OA) in the event of a transaction dispute. To address the imbalance between privacy and accountability in consortium blockchain transactions, this paper introduces an enhanced multi-Key Generation Center (multi-KGC) group signature scheme tailored for consortium chains. We validate the anonymity and unforgeability of the proposed scheme through a security game. The enhanced group signature algorithm employs the Groth-Sahai proof system for non-interactive zero-knowledge proofs (NIZK) and leverages elliptic curve cryptography combined with threshold cryptography for key generation. This scheme is implemented within the Hyperledger Fabric consortium chain environment, and both computational and communication overheads are thoroughly analyzed. Experimental results indicate that, while the signature generation efficiency of the proposed scheme is slightly reduced compared to existing group signature schemes, its verification efficiency aligns with similar schemes. Functionally, our scheme facilitates a tiered disclosure of signing user information based on transaction values during transaction audits in consortium blockchain transactions.
Verifying a secret element’s (non-)membership status to a private set is challenging yet valuable for access control and verifiable computing applications. On the other hand, blockchain technology, known for its decentralized and tamper-proof nature, allows one to commit any data publicly. This work proposes a zero-knowledge Dual Membership Set Commit (zkDMSC) scheme to bridge the two. Our scheme allows the provers to commit their private set on blockchain and prove a secret element’s membership status to the set in a zero-knowledge manner.We introduce the Perfect Hash Function(PHF) into the field of membership query and use the Merkle tree to construct an efficient zero-knowledge dual membership proof. The prover can combine our dual membership proof with other property proofs of the queried element for different verification requirements. In addition, our proposal does not require a trusted setup and only uses post-quantum cryptographic assumptions. We also implement the proposal and show the performance of our implementation that matches or surpasses the state of the art.
This research paper explores the CONIKS key management system’s security and efficiency, a system designed to ensure transparency and privacy in cryptographic operations. We conducted a comprehensive analysis of the underlying mathematical principles, focusing on cryptographic hash functions and digital signature schemes, and their implementation in the CONIKS model. Through the use of Merkle trees, we verified the integrity of the system, while zero-knowledge proofs were utilized to ensure the confidentiality of key bindings. We conducted experimental evaluations to measure the performance of cryptographic operations like key generation, signing, and verification with varying key sizes and compared the results against theoretical expectations. Our findings demonstrate that the system performs as predicted by cryptographic theory, with only minor deviations in computational time complexities. The analysis also reveals significant trade-offs between security and efficiency, particularly when larger key sizes are used. These results confirm that the CONIKS system offers a robust framework for secure and efficient key management, highlighting its potential for real-world applications in secure communication systems.
Open access
Cryptography and Data Security
Security in Wireless Sensor Networks
Advanced Steganography and Watermarking Techniques
Alexandr Kuznetsov, Emanuele Frontoni, Marco Arnesano, Kateryna Kuznetsova
Blockchain-based sensor networks offer promising solutions for secure and transparent data management in IoT ecosystems. However, efficient set membership proofs remain a critical challenge, particularly in resource-constrained environments. This paper introduces a novel OR-aggregation approach (where “OR” refers to proving that an element equals at least one member of a set without revealing which one) for zero-knowledge set membership proofs, tailored specifically for blockchain-based sensor networks. We provide a comprehensive theoretical foundation, detailed protocol specification, and rigorous security analysis. Our implementation incorporates optimization techniques for resource-constrained devices and strategies for integration with prominent blockchain platforms. Extensive experimental evaluation demonstrates the superiority of our approach over existing methods, particularly for large-scale deployments. Results show significant improvements in proof size, generation time, and verification efficiency. The proposed OR-aggregation technique offers a scalable and privacy-preserving solution for set membership verification in blockchain-based IoT applications, addressing key limitations of current approaches. Our work contributes to the advancement of efficient and secure data management in large-scale sensor networks, paving the way for wider adoption of blockchain technology in IoT ecosystems.
In wireless sensor networks (WSNs), the presence of malicious nodes (MNs) poses significant challenges to data integrity, network stability, and system reliability. These issues are intensified by energy resource constraints and limitations within centralized authentication systems, necessitating an energy-efficient solution to ensure real-time responsiveness. Although artificial intelligence-driven approaches enhance detection capabilities, they overcome challenges related to data volume, coordination overhead, and latency in centralized control. This study introduces blockchain-machine learning (BC-ML), a novel hybrid model that seamlessly integrates blockchain and machine learning (ML) techniques to effectively identify MNs in WSNs. The model establishes an energy-efficient blockchain among cluster heads (CHs) for robust node authentication, incorporating a Schnorr-like zero-knowledge-proof technique to validate node data during communication initiation. Utilizing a hybrid lightweight approach with both symmetric and asymmetric ciphers enhances the security of node data transmission. A new proof-of-authority method is introduced, which leverages node digital certificates instead of conventional data transactions. This consensus mechanism reduces the processing overhead associated with larger data sizes in traditional proof-of-work methods, thereby improving both energy efficiency and scalability. To address dataset imbalances, the model employs a hybrid unsupervised ML technique, combining adaptive synthetic sampling with a convolutional neural network for efficient analysis of nodes and network features. The ML model, hosted on a robust data server, ensures ongoing oversight by updating CHs with security levels for detected MNs, thereby reducing storage and mitigating coordination challenges. Comprehensive analyses validate the effectiveness of the BC-ML model for detecting MNs, optimizing resource utilization, minimizing delays, and prolonging node and network lifetimes. Security analysis further confirms the ability of the model to mitigate diverse attacks and meet the stringent WSN security requirement.
Wireless Sensor Networks (WSNs) play a crucial role in modern distributed systems, supporting applications such as smart cities, healthcare, and industrial automation. However, their decentralized and resource-constrained nature makes them highly vulnerable to malicious node attacks, including data manipulation, packet dropping, and routing disruption. Traditional detection techniques based on rule-based or statistical methods are inadequate for handling dynamic and complex attack patterns. Recent advancements in Artificial Intelligence (AI), particularly Vision Transformers (ViTs) with cross-attention mechanisms, have significantly improved malicious node detection by capturing global dependencies and contextual relationships in network data. Simultaneously, blockchain technology has emerged as a robust solution for secure, decentralized, and tamper-proof data storage in WSNs. Blockchain-based WSN architectures enhance data integrity, transparency, and trust through distributed ledgers and smart contracts. Studies show that blockchain-integrated detection frameworks can achieve near-perfect classification accuracy while ensuring secure data transmission. Furthermore, hybrid AI-blockchain systems combine intelligent detection with secure storage, improving resilience against attacks. This survey reviews recent methods, compares architectures, identifies research gaps, and highlights future directions for developing secure and scalable WSN systems.
In the field of cloud computing, ensuring secure and efficient key agreement among multiple parties has emerged as a paramount challenge. Traditional key agreement protocols often rely on central authorities or trusted third parties, posing significant security and privacy concerns. To address these challenges, this paper introduces a novel key agreement protocol designed specifically for cloud computing platforms, emphasizing security, efficiency, and resilience without depending on a trusted third party. The proposed protocol innovatively combines Distributed Key Generation (DKG) with a Dynamic Consensus Mechanism, Zero-Knowledge Proof (ZKP) based authentication, and a Multi-Cloud Redundancy approach, offering a comprehensive solution to secure multi-party communication in distributed cloud environments. The DKG protocol facilitates the collaborative generation of a shared secret among participants, significantly enhancing security by eliminating single points of failure. The proposed Dynamic Consensus Mechanism ensures the integrity and finality of key agreement transactions on a blockchain-based ledger, adapting to network conditions and participant trust levels to optimize performance without compromising security. ZKP-based authentication allows participants to verify their identities without revealing sensitive information, preserving privacy and thwarting impersonation attacks. Lastly, the Multi-Cloud Redundancy strategy enhances the protocol's resilience to cloud-specific vulnerabilities and service outages, ensuring high availability and robustness.
S. J. Patil, Lalita Admuthe, Ashwini Sandeep Patil, Saurabh R Prasad
Mobile ad hoc networks (MANETs) facilitate rapid deployment due to independence from established infrastructure, relying instead on wireless technology where each node functions as a source, destination, or intermediary router. However, existing techniques fail to adequately address security and privacy concerns inherent in MANETs, rendering them impractical for real-world deployment. To tackle these challenges, this paper proposes the Blockchain Based Trusted Distributed Routing Scheme for MANET using Latent Encoder Coupled Generative Adversarial Network Optimized with Binary Emperor Penguin Optimizer (LEGAN-BEPO-BCMANET). This scheme leverages blockchain technology to establish a fair proof-of-reputation system, ensuring trusted and decentralized routing based on authenticated blockchain token transactions. By integrating Latent Encoder Coupled Generative Adversarial Network (LEGAN) optimized with Binary Emperor Penguin optimizer (BEPO), the scheme enhances routing efficiency and security. A comprehensive security analysis is performed focusing on aspects such as double-spending prevention, transaction distinguishability, routing information integrity, and self-modification resilience. The proposed approach is implemented in NS3 software, with evaluation metrics including throughput of blockchain token transactions and average energy consumption recorded. Overall, the LEGAN-BEPO-BCMANET scheme offers a robust solution to the security and efficiency challenges faced by MANETs, paving the way for practical deployment in real-world scenarios. The performance of the proposed LEGAN-BEPO-BCMANET technique attains 29.786%, 19.25%, 22.93%, 27.21%, 31.02%, 26.91%, and 25.61% greater throughput, compared to existing methods like Blockchain-based BATMAN protocol utilizing MANET with an ensemble algorithm (BATMAN-MANET), Block chain-based trusted distributed routing scheme with optimized dropout ensemble extreme learning neural network in MANET (DEELNN-MANET), A secured trusted routing utilizing structure of a new directed acyclic graph-blockchain in MANET internet of things environment (DAG-MANET), An Optimized Link State Routing Protocol with Blockchain Framework for Efficient Video-Packet Transmission and Security over MANET (OLSRP-MANET), Auto-metric Graph Neural Network based Blockchain Technology for Protected Dynamic Optimum Routing in MANET (AGNN-MANET) and Data security-based routing in MANETs under key management process (DSR-MANET) respectively.
Against the backdrop of rapidly advancing cloud storage technology, as well as 5G and 6G communication technologies, group key management faces increasingly daunting challenges. Traditional key management encounters difficulties in key distribution, security threats, management complexity, and issues of trustworthiness. Particularly in scenarios with a large number of members or frequent member turnover within groups, this may lead to security vulnerabilities such as permission confusion, exacerbating the security risks and management complexity faced by the system. To address these issues, this paper utilizes blockchain technology to achieve distributed storage and management of group keys. This solution combines key management with the distributed characteristics of blockchain, enhancing scalability, and enabling tracking of malicious members. Simultaneously, by integrating intelligent authentication mechanisms and lightweight data update mechanisms, it effectively enhances the security, trustworthiness, and scalability of the key management system. This provides important technical support for constructing a more secure and reliable network environment.
Abstract Atomic Cross-Chain Swap (ACCS) is one important topic in cryptocurrency, where users can securely and trustlessly exchange assets between two different blockchains. However, most known ACCS schemes assume specific scripting functionalities of the underlying blockchains, such as Hash Time Locked Contracts (HTLC). In addition, these schemes are typically only applicable to certain digital signature schemes, like Schnorr or Elliptic Curve Digital Signature Algorithm (ECDSA) signatures. In this paper, we propose a generic ACCS scheme, independent from the underlying blockchains. To the best of our knowledge, this is the first solution of this kind. Our results are as follows. First, we define a formal system model of ACCS. Next, we present a generic ACCS scheme meets our model. This scheme admits atomicity in cross-chain swaps without the need for a Trusted Third Party (TTP) and protects users’ privacy. Finally, by using the Non-Interactive Zero-Knowledge (NIZK) proof protocol as a tool, we instantiate our generic scheme for Elliptic Curve Discrete Logarithm Problem-based (ECDLP-based) signatures. In addition, we implement our scheme, and the experimental results show that our protocol outperforms the existing ACCS schemes, such as the HTLC-based schemes.
We discuss key management for cryptocurrencies from the perspective of security and risk management. While we found many earlier research studies about the implementation and security of wallets, few of them provide a comprehensive analysis of real-world integration as a complex system. We particularly focus on cryptocurrency custodians, who have to tightly control the risk to meet business needs as well as regulatory requirements. Unlike individual use cases, to manage substantial amounts of various assets, they typically need more complex wallet configurations and operations, such as multiple layers of hot and cold wallets in combination with different types of implementations. Therefore, we discuss the suitability of various wallet techniques, including software, hardware, HSMs, smart contracts, or cryptographic methods. We also address several open challenges for custodians mentioned in earlier work. Furthermore, as the ultimate example, we propose Extreme-Cold, a reference cold wallet in an air-gapped environment. It is resistant to side-channel attacks studied in earlier research. The risk assessment we conduct on Extreme-Cold demonstrates the effectiveness of our systematized knowledge.
Zero-knowledge range proofs play a critical role in confidential transactions (CT) on blockchain systems. They are used to prove the non-negativity of committed transaction payments without disclosing the exact values. Logarithmicsized range proofs with transparent setups, e.g., Bulletproofs, which aim to prove a committed value lies in the range [0, 2 -1] where is the bit length of the range, have gained growing popularity for communication-critical blockchain systems as they increase scalability by allowing a block to accommodate more transactions. In this paper, we propose SwiftRange, a new type of logarithmic-sized zero-knowledge range argument with a transparent setup in the discrete logarithm setting. Our argument can be a drop-in replacement for range proofs in blockchain-based confidential transactions. Compared with Bulletproofs, our argument has higher computational efficiency and lower round complexity while incurring comparable communication overheads for CT-friendly ranges, where N ∈ {32, 64}. Specifically, a single SwiftRange achieves 1.73× and 1.37× proving efficiency with no more than 1.1× communication costs for both ranges, respectively. More importantly, our argument is doubly efficient in verification efficiency. Furthermore, our argument has a smaller size when N ≤ 16, making it competitive for many other communication-critical applications. Our argument supports the aggregation of multiple single arguments for greater efficiency in communication and verification. Finally, we benchmarked our argument against the state-of-the-art range proofs to demonstrate its practicality.
When a user wants to access certain services offered by a service provider, typically the user must first authenticate herself with the service provider, such that the service provider may grant authorization to access the services. Authentication is the process through which the user provides confirmation of her identity to the service provider (and, in parallel, the user should receive confirmation that the service provider is legitimate). Several types (or factors) of authenticators can be utilized in this process. Namely, things the user know (e.g.: passwords, PINs); things the user possesses (e.g., token authenticators in the smartphone, key fobs, cards); characteristics or physical traits of the user (e.g., fingerprint, iris pattern); and, as proposed in this dissertation, the user’s location. Each authentication factor has, in terms of security and user experience when compared to other factors, strong and weak aspects, (or pros and cons). For instance, passwords must be long and random, but then remembering them can be taxing; fingerprints are (believed to be) unique and thus form a good authenticator, but they are immutable and hardly confidential; token authenticators and out-of-band tokens (such as SMS tokens) provide an ephemeral value that is valuable for security, but the user might lose possession of the respective token device. Combining two or more of those authenticators results in a potential increased security as compared to utilizing only one authenticator, which is known as multi-factor authentication. ☐ This dissertation focuses on multi-factor authentication. I present a cryptographic method to enable location as an authentication factor, using the flexibility of Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and its access policies, together with location beacons. Such that this location authenticator can be realized, I develop a technique to request and control the presentation of multi-factor authenticators, through which scores are assigned to each authenticator type and both the user and the authentication service are aware of a minimum score needed for full authentication. To address the necessity of a secure scheme through which a user presents the authenticators, I construct a method for conveying the authentication factors in a Zero-Knowledge Password Proof (ZKPP) scheme and through an ephemeral, confidential session. The method also provides a secure joint authenticator that is the cryptographic composite (built within ZKPP) of the individual authenticators. To embody and realize these techniques, I devise a multi-factor authentication protocol named LOCATHE, through which a user device or user can authenticate herself to an authentication service using the device’s or user’s location and other authentication factors, with guarantees of forward secrecy. Moreover, I design a Location-Enhanced Multi-Factor Authentication Service (Loc-Auth), abstracting hardware (such as the location beacons) and control into a layered structure, to provide the authentication services and support for the components of this dissertation. Finally, I develop a Proof-of-Concept system, and perform an extensive security evaluation and analysis of the work herein.
In this paper, we present a novel Secure Clustering Routing Method based on Blockchain and Swarm Intelligence (BS-SCRM) for Wireless Sensor Networks (WSNs), which serves as a cornerstone in the Internet of Things (IoT) infrastructure. Recognizing the limitations of existing clustering routing methods in addressing security threats, our approach integrates blockchain technology to fortify WSNs against vulnerabilities such as man-in-the-middle attacks. The proposed BS-SCRM method is structured in two phases: (1) an enhanced cluster head (CH) election utilizing an elite strategy-enhanced Whale Optimization Algorithm (WOA) that considers node energy and proximity to the base station, and (2) a secure data on-chain phase where blockchain comes into play, encrypting and validating cluster data to safeguard integrity and prevent tampering. We further tackle the challenge of implementing blockchain in resource-constrained WSNs by assigning distinct roles to devices, i.e., ordinary nodes with data viewing permissions and accounting nodes entrusted with both data viewing and consensus algorithm execution. Extensive simulations confirm that BS-SCRM not only improves clustering quality but also provides a more secure and energy-efficient routing solution compared to contemporary methods. More specifically, simulation results in different scenarios demonstrate that BS-SCRM enhances network lifetime by 24-73% compared to other clustering methods when facing attacks.
We introduce Zero-Knowledge Location Privacy (ZKLP), enabling users to prove to third parties that they are within a specified geographical region while not disclosing their exact location. ZKLP supports varying levels of granularity, allowing for customization depending on the use case. To realize ZKLP, we introduce the first set of Zero-Knowledge Proof (ZKP) circuits that are fully compliant to the IEEE 754 standard for floating-point arithmetic. Our results demonstrate that our floating point circuits amortize efficiently, requiring only $64$ constraints per multiplication for $2^{15}$ single-precision floating-point multiplications. We utilize our floating point implementation to realize the ZKLP paradigm. In comparison to a baseline, we find that our optimized implementation has $15.9 \times$ less constraints utilizing single precision floating-point values, and $12.2 \times$ less constraints when utilizing double precision floating-point values. We demonstrate the practicability of ZKLP by building a protocol for privacy preserving peer-to-peer proximity testing - Alice can test if she is close to Bob by receiving a single message, without either party revealing any other information about their location. In such a configuration, Bob can create a proof of (non-)proximity in $0.26 s$, whereas Alice can verify her distance to about $470$ peers per second
Abstract As an important manifestation of the current development and transformation of the world’s power and energy industries, the virtual power plant is an important foundation for optimizing the layout of energy resources. However, since there are many open channels in the virtual power plant, adversaries can implement eavesdropping, replay, impersonation, forgery, and other attacks to access the virtual power plant, and even publish false data in the virtual power plant to disrupt the operation of the virtual power plant. In addition, it is easy for an adversary to deduce key information such as the layout of virtual power plant equipment through the identity of the device. In this context, to ensure the security and privacy of devices when accessing the platform, in this paper, we propose an efficient authentication protocol based on the elliptic curve cryptography and zero-knowledge proof, which requires only two information exchanges. Security analysis shows that the proposed protocol can meet security features such as mutual authentication, key agreement, perfect forward secrecy, and device anonymity. Performance analysis indicates that the proposed protocol achieves a reasonable balance between computational and signaling overhead, and it is more suitable for achieving efficient device authentication and privacy protection in virtual power plants.