Blockchain Papers

Swee Won Lo, Yu Wang, David Kuo Chuen Lee

No abstract is available for this record.

Benjamin Breiling, Bernhard Dieber, Martin Pinzger, Stefan Raß

With the growing popularity of robots, the development of robot applications is subject to an ever increasing number of additional requirements from e.g., safety, legal and ethical sides. The certification of an application for compliance to such requirements is an essential step in the development of a robot program. However, at this point in time it must be ensured that the integrity of this program is preserved meaning that no intentional or unintentional modifications happen to the program until the robot executes it. Based on the abstraction of robot programs as workflows we present in this work a cryptography-powered distributed infrastructure for the preservation of robot workflows. A client composes a robot program and once it is accepted a separate entity provides a digital signature for the workflow and its parameters which can be verified by the robot before executing it. We demonstrate a real-world implementation of this infrastructure using a mobile manipulator and its software stack. We also provide an outlook on the integration of this work into our larger undertaking to provide a distributed ledger-based compliant robot application development environment.

Pascal Urien

This demonstration presents a new trust model for Internet of Things, based on TLS1.3 sessions authenticated by pre-shared key (PSK). According to TLS1.3, security relies on Diffie-Hellman exchanges, optionally authenticated by symmetric secret (PSK) shared by client and server. A major security issue is PSK protection against eavesdropping, in order to avoid device cloning or illegitimate use. We present two secure elements TLS-IM used on client side, and TLS-SE used on server side, which enforce PSK security. TLS-IM is a smartcard associated with TLS1.3 client running in laptop. TLS-SE is a standalone TLS1.3 server running in a secure element, which embeds an application computing signature for blockchain transaction. TLS-SE has a SIM form factor, and is plugged in a hardware module working with a Wi-Fi SoC, providing TCP/IP connectivity.

Nami Ashizawa, Naoto Yanai, Jason Paul Cruz, Shingo Okamura

Ethereum smart contracts are computer programs that are deployed and executed on the Ethereum blockchain to enforce agreements among untrusting parties. Being the most prominent platform that supports smart contracts, Ethereum has been targeted by many attacks and plagued by security incidents. Consequently, many smart contract vulnerabilities have been discovered in the past decade. To detect and prevent such vulnerabilities, different security analysis tools, including static and dynamic analysis tools, have been created, but their performance decreases drastically when codes to be analyzed are constantly being rewritten. In this paper, we propose Eth2Vec, a machine-learning-based static analysis tool that detects smart contract vulnerabilities. Eth2Vec maintains its robustness against code rewrites; i.e., it can detect vulnerabilities even in rewritten codes. Other machine-learning-based static analysis tools require features, which analysts create manually, as inputs. In contrast, Eth2Vec uses a neural network for language processing to automatically learn the features of vulnerable contracts. In doing so, Eth2Vec can detect vulnerabilities in smart contracts by comparing the similarities between the codes of a target contract and those of the learned contracts. We performed experiments with existing open databases, such as Etherscan, and Eth2Vec was able to outperform a recent model based on support vector machine in terms of well-known metrics, i.e., precision, recall, and F1-score.

Tai D. Nguyen, Long Hoang Pham, Jun Sun

Smart contracts are distributed, self-enforcing programs executing on top of blockchain networks. They have the potential to revolutionize many industries such as financial institutes and supply chains. However, smart contracts are subject to code-based vulnerabilities, which casts a shadow on its applications. As smart contracts are unpatchable (due to the immutability of blockchain), it is essential that smart contracts are guaranteed to be free of vulnerabilities. Unfortunately, smart contract languages such as Solidity are Turing-complete, which implies that verifying them statically is infeasible. Thus, alternative approaches must be developed to provide the guarantee. In this work, we develop an approach which automatically transforms smart contracts so that they are provably free of 4 common kinds of vulnerabilities. The key idea is to apply run-time verification in an efficient and provably correct manner. Experiment results with 5000 smart contracts show that our approach incurs minor run-time overhead in terms of time (i.e., 14.79%) and gas (i.e., 0.79%).

S. Smys, Haoxiang Wang

Cyber threat is a major issue that has been terrorizing the computing work. A typical cyber-physical system is crucial in ensuring a safe and secure architecture of a sustainable computing ecosystem. Cyber Threat Intelligence (CTI) is a new methodology that is used to address some of the existing cyber threats and ensure a more secure environment for communication. Data credibility and reliability plays a vital role in increasing the potential of a typical CTI and the data collected for this purpose is said to be highly reliable. In this paper, we have introduced a CTI system using blockchain to tackle the issues of sustainability, scalability, privacy and reliability. This novel approach is capable of measuring organizations contributions, reducing network load, creating a reliable dataset and collecting CTI data with multiple feeds. We have testing various parameters to determine the efficiency of the proposed methodology. Experimental results show that when compared to other methodologies, we can save upto 20% of storage space using the proposed methodology.

Yogita Borse, Deepti Patole, Gaurav Chawhan, Geeta Kukreja · 6 authors

No abstract is available for this record.

Fatima Zahrae Chentouf, Said Bouchkaren

No abstract is available for this record.

Xiangyan Tang, Hao Guo, Hui Li, Yuming Yuan · 6 authors

No abstract is available for this record.

Dylan Eck, Gaby G. Dagher, Adam Torek, Steve Cutchin

Crypto currencies, specifically Bitcoin, are commonly used for illegal activities. In order to aid in preventing this, and catching users who behave in illegal activities, it is useful to be able to establish links between addresses based on the publicly available transaction data stored on the blockchain. While multiple methods of doing this for bitcoin have been proposed already, none attempt to determine the flows of bitcoin through many-to-many transactions. We use publicly available blockchain data along with an existing method for untangling many-to-many transactions in order to test the effectiveness of three different address clustering heuristics in simplifying many-to-many transactions. As of the deadline to submit this abstract, we have not concluded our experiments and do not have final results.

Zheng Yang, Hang Lei

No abstract is available for this record.

Hafiz Adnan Hussain, Zulkefli Mansor, Zarina Shukur

The Internet of Things (IoT) is a widely used technology in the last decade in different applications. The Internet of things is wirelessly or wired to communicate, store, compute and track various real-time scenarios. This survey mainly discussed the core problems of Internet of things security and access control to unauthorized users and security requirements for IoT. The Internet of things is a heterogeneous device and has low memory, less processing power because of the small sizes. Nowadays, IoT systems are not sure and powerless to protect themselves against cyber attacks. It is mainly due to inadequate space in IoT gadgets, immature standards, and the lack of protected hardware and software design, development, and deployment. To meet IoT requirements, the authors discussed the limitations of traditional access control. Then the authors examined the potential to spread access control by implementing the safe architecture accommodated by the Blockchain. The authors also addressed how to use the Blockchain to work with and resolve some of the standards relevant to IoT security issues. In the end, an analysis of this survey shows future, open-ended problems, and challenges. It offers how the Blockchain potentially ensures reliable, scalable, and more efficient security solutions for IoT and further research work.

Zhaojie Wang, Jianan Guo, Yiting Zhang, Ming Liu · 8 authors

No abstract is available for this record.

Hyunyoung Oh, Kevin Nam, Seongil Jeon, Yeongpil Cho · 5 authors

Remote computing has emerged as a trendy computing model that enables users to process an immense number of computations efficiently on the remote server where the necessary data and high-performance computing power are provisioned. Unfortunately, despite such an advantage, this computing model suffers from insider threats that are committed by adversarial administrators of remote servers who attempt to steal or corrupt users' private data. These security threats are somewhat innate to remote computing in that there is no means to control administrators' unlimited data access. In this paper, we present our novel hardware-centric solution, called MeetGo, to address the intrinsic threats to remote computing. MeetGo is a field-programmable gate array (FPGA)-based trusted execution environment (TEE) that aims to operate independently of the host system architecture. To exhibit the ability and effectiveness of MeetGo as a TEE ensuring secure remote computing, we have built two concrete applications: cryptocurrency wallet and GPGPU. MeetGo provides a trust anchor for these applications that enable their users to trade cryptocurrency or to run a GPGPU program server on a remote server while staying safe from threats by insiders. Our experimental results clearly demonstrate that MeetGo incurs only a negligible performance overhead to the applications.

Vincenzo De Angelis, Francesco Buccafurri

The introduction of a review system in e-commerce platforms results in an effective business model. The effects of positive/negative reviews on the success of a product are well studied in the literature. Therefore, for the vendors, it is crucial to obtain positive reviews of their products. This fact opens fraudulent scenarios. Indeed, some vendors can pay an incentive to the buyers to obtain, in exchange, a fake positive review. This fake-review system (FRS) is so widespread that vendors rely on ad-hoc companies that, through intermediaries, find buyers available to release fake reviews. In this paper, we propose a game-theory-based strategy to discourage the above fraudulent business model, and an effective way to implement this strategy leveraging an Ethereum smart contract. Specifically, the contribution of the paper is two-fold. First, we formalize the current business model as a sequential game, and we identify sufficient conditions making FRS advantageous. Second, we propose to introduce in the review system a new mechanism, thanks to which, the corresponding sequential game requires conditions necessary to make advantageous FRS that are strictly less convenient than the previous ones. We implemented the solution and evaluate the cost of the smart contract execution.

Anindita Jena

No abstract is available for this record.

Jiao Jiao

The success of Bitcoin since 2009 stimulates the development of other blockchain-based applications, such as Ethereum, a second generation of cryptocurrency which supports the revolutionary idea of smart contracts. An Ethereum smart contract is a computer program written in some domain-specific high-level programming languages, such as Solidity, Vyper, Bamboo, Flint, etc., and stored on the blockchain to achieve certain functionality. Smart contracts benefit from the features of the blockchain in various aspects. For instance, it is not necessary to have an external trusted authority to achieve consensus, and transactions through smart contracts are always traceable and credible. Smart contracts must be verified for multiple reasons. Firstly, due to the decentralized nature of the blockchain, smart contracts are different from programs written in other programming languages (e.g., C/Java). For instance, the storage of each contract instance is located at a permanent address on the blockchain. In this way, each contract instance is a particular execution context and context switches are possible through external calls. Particularly, in Solidity, delegatecall is executed in the context of the caller rather than the recipient, making it possible to modify the state of the caller. Programmers must be aware of the execution context of each statement to guarantee the programming correctness. Therefore, programming smart contracts is error-prone without a proper understanding of the underlying semantic model. Secondly, a smart contract can be deployed on the blockchain by any user in the network. Vulnerabilities in deployed contracts can be exploited to launch attacks that lead to huge financial loss. Verifying smart contracts against such vulnerabilities is crucial for protecting digital assets. One famous attack on smart contracts is the DAO attack in which the attacker exploited the reentrancy vulnerability and managed to take 60 million dollars under his/her control. Finally, it is very difficult, if not impossible, to patch a smart contract once it is deployed due to the very nature of the blockchain. There is a surge of interest in analyzing and verifying smart contracts. To the best of our knowledge, most of the existing approaches either focus on EVM (Ethereum Virtual Machine) bytecode, or translate Solidity smart contracts into programs in intermediate languages that are suitable for verifying smart contracts or detecting potential issues in associated verifiers or checkers. Furthermore, none of the existing works can directly handle smart contracts written in different high-level programming languages without translating them into EVM bytecode or intermediate languages. None of the existing approaches defines security properties with the high-level semantics of smart contracts. A direct executable formal semantics of the high-level smart contract programming language concerned is a must for both understanding and verifying smart contracts. Firstly, programmers write and reason about smart contracts at the level of source code without the semantics of which they are required to understand how Solidity programs are compiled into EVM bytecode in order to understand these contracts, which is far from trivial. In addition, there may be semantic gaps between high-level smart contract programming languages and low-level bytecode which are introduced by compiler bugs. In other words, after compilation the semantics of bytecode may not be equivalent to that of the corresponding high-level programs due to the compiler bugs involved. Therefore, both high-level and low-level semantics definitions are necessary to conduct equivalence checking to guarantee that security properties are preserved at both levels and reason about compiler bugs. Secondly, even though smart contracts can be transformed into programs in intermediate languages to be analyzed and verified in existing model checkers and verifiers, the equivalence checking of the high-level smart contract programming language concerned and the intermediate language applied to interpret it is crucial to the validity of the verification. We develop an executable operational semantics for the Solidity programming language to formally reason about smart contracts written in Solidity. The contributions of this work lie in four aspects. Firstly, our work is the first approach, to the best of our knowledge, to a complete executable formal semantics of Solidity constructed directly on the language itself other than Solidity compilers. The proposed executable semantics completely covers the supported high-level core features specified by the official Solidity documentation and is validated with the official compiler Remix. In addition, a new and general way of semantics formalization is applied in the semantics design, making the proposed semantics robust in the language evolution of smart contracts. Secondly, the proposed semantics provides a formal specification of smart contracts which solves the specification issues in the existing verification and analysis tools. Thirdly, the proposed semantics allows us to formally define semantic-level security properties for verifying smart contracts to exclude the false positives and negatives introduced by the existing approaches. Finally, the proposed semantics defines correct and secure high-level execution behaviours of smart contracts to reason about compiler bugs and assist developers in writing secure smart contracts. Furthermore, we develop a generalized formal semantic framework for smart contracts. The contributions of this work lie in three aspects. Firstly, our work is the first approach, to the best of our knowledge, to a generalized formal semantic framework for smart contracts which can directly handle contracts written in different high-level programming languages. Secondly, a general semantic model of smart contracts is constructed with rewriting logic in the K-framework. With the general semantic model, a direct executable formal semantics of a particular high-level smart contract programming language can be constructed as long as its core features fall into the ones defined in this model. The general semantic model is validated with its interpretation in Solidity using the Solidity compiler test set and evaluation results show that it is complete and correct. Lastly, the generated semantics facilitates the formal verification of smart contracts written in a particular high-level programming language as a formal specification of the corresponding language. Together with low-level specifications, it allows us to conduct equivalence checking on high-level contracts and low-level bytecode to reason about compiler bugs and guarantee that security properties are preserved at both levels. We define some security properties based on the formal semantics of the high-level smart contract programming languages. These security properties are defined from a general point of view and can be applied to detect a variety of vulnerabilities in smart contracts, such as the reentrancy vulnerability, exception disorders, integer underflows and overflows, etc. In addition, verification algorithms for these properties are constructed with the proposed semantic framework. We compare our approaches to the security analysis of smart contracts with the existing ones and highlight the importance of precise semantic foundations for the verification of smart contracts. Lastly, we systematize the existing approaches to the security analysis of smart contracts from the perspectives of domain-specific research and applications of general ideas to study the connection between the domain-specific issues in smart contracts and general analysis techniques. To conclude, this thesis studies the formal specification and verification of smart contracts, and combines domain-specific analysis and applications of general techniques. It also motivates other research directions related to the security analysis of smart contracts, such as the equivalence checking of high-level contracts and low-level bytecode, formal reasoning of high-level smart contract programming languages, the fairness analysis of smart contracts, etc.

Alex Hoffman, Phillipe Austria, Chol Hyun Park, Yoohwan Kim

A C TBug Bounty Programs (BBPs) play an important role in providing and maintaining security in software applications.These programs allow testers to discover and resolve bugs before the general public is aware of them, preventing incidents of widespread abuse.However, they have shown problems such as organizations providing accountability of reporting bugs and nonrecognition of testers.In this paper, we discuss Bountychain, a decentralized application using Ethereum-based Smart Contracts (SCs) and the Interplanetary File System (IPFS), a distributed file storage system.Blockchain and SCs provide a safe, secure and transparent platform for a BBP.Testers can submit bug reports and organizations can accept or reject the defect via the SCs.Transactions on the blockchain serve as a persistent and transparent record of software bugs, while IPFS serves as a long-term storage system for bug details.Thus, Bountychain ensures organization accountability and allows testers to gain irrefutable recognition.

Wael A. Mahrous, Mahmoud Farouk, Saad M. Darwish

Due to businesses’ growing use of IoT services in their day-to-day operations and the increased use of smart devices, digital forensic investigations involving such systems will need increasingly sophisticated digital evidence collection and processing. The majority of IoT systems are composed of disparate software and hardware components, which may pose security and privacy concerns. Recently, blockchain technology was presented as one of the options for achieving IoT security via the use of an immutable ledger, a decentralized architecture, and strong cryptographic primitives. Integrating blockchain platforms with IoT-based applications, on the other hand, poses a number of difficulties owing to the trustworthiness, integrity, and real-time responsiveness of IoT data. However, certain IoT devices may be incompatible with existing blockchain-based IoT forensic methods for additional digital evidence processing owing to their usage of conventional hash. A critical feature of cryptographic hash functions is that even if just one bit of the input is altered, the output acts pseudo-randomly, making it impossible to identify identical files. However, in the field of computer forensics, it is essential to locate comparable files (e.g., various versions of a file); therefore, we need a hash function that preserves similarity. It is getting more difficult to establish how forensic investigators might utilize traces from such devices. To effectively deal with IoT digital forensics applications, this article presents an improved blockchain-based IoT digital forensics architecture that use fuzzy hash to construct the Blockchain’s Merkle tree in addition to the conventional hash for authentication. Fuzzy hashing enables the identification of potentially damning documents that might otherwise remain undiscovered using conventional hashing techniques. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, the digital forensics investigator will be able to verify their authenticity. To support the proof of concept, we simulated the suggested model.

Biser Tsvetkov, Hristo Kostadinov

No abstract is available for this record.

Aleksandr Ometov, Krystof Zeman, Pavel Mašek, Lukas Balazevic · 5 authors

With technology evolving rapidly and proliferating, it is imperative to pay attention to mobile devices’ security being currently responsible for various sensitive data processing. This phase is essential as an intermediate before the cloud or distributed ledger storage delivery and should be considered additional care due to its inevitability. This paper analyzes the security mechanisms applied for internal use in the Android OS and the communication between the Android OS and the remote server. Presented work aims to examine these mechanisms and evaluate which cryptographic methods and procedures are most advantageous in terms of energy efficiency derived from execution time. Nonetheless, the dataset with the measurements collected from 17 mobile devices and the code for reproducibility is also provided. After analyzing the collected data, specific cryptographic algorithms are recommended to implement an application that utilizes native cryptographic operations on modern Android devices. In particular, selected algorithms for symmetric encryption are AES256 / GCM / No Padding; for digital signature – SHA512 with RSA2048 / PSS, and for asymmetric encryption – RSA3072 / OAEP with SHA512 and MGF1 Padding.

Bibin Kurian, Narayanan Subramanian

No abstract is available for this record.

Lingyu Bian, Linlin Zhang, Kai Zhao, Hao Wang · 5 authors

In recent years, the rapid development of blockchain technology has attracted much attention from people around the world. Scammers take advantage of the pseudo-anonymity of blockchain to implement financial fraud. The Ponzi scheme, one of the main scam methods, has defrauded investors of large amounts of money, thereby harming their interests and hindering the application of blockchain. Unfortunately, the current detection technology typically largely relies on the source code of the contract or uses a single feature which does not fully represent the contract characteristics. In such a case, the detection of Ponzi schemes with high efficiency becomes urgent. In this paper, we propose an image-based scam detection method using an attention capsule network (SE-CapsNet) focused on Ethereum. The sequence of bytecode, the opcode frequency, and the application binary interface (ABI) call are extracted as features from the contract bytecode and ABI, further converted into grayscale images, and then mapped into three color channels to generate RGB images, which are used as the input of the model for detecting the Ponzi scheme contract. In addition, we employ fancy PCA for data augmentation to reduce the impact of imbalanced data on the detection results. Experimental results show that the image-based detection method using deep learning models can effectively detect contracts before transactions occur. Among them, our proposed SE-CapsNet obtains great detection results, with an F1 score of 98.38%.

Sarah Khadijah Taylor, M. Sharizuan M. Omar, Nooraiman Noorashid, Aswami Ariffin · 6 authors

No abstract is available for this record.