Bitcoin remains the most widely used cryptocurrency. It has attracted users from tech enthusiasts to commercial investors to criminals, in no small part due to its reputation for anonymity. While not designed primarily for privacy, Bitcoin's architecture contains several provisions that can be exploited by criminals to conduct illegal activity including money laundering and collecting payments from ransomware and scams. Since Bitcoin's creation in 2008, various groups such as law enforcement, lawyers, criminals and privacy-focused Bitcoin users have been locked in a struggle between attempts to reveal hidden Bitcoin users' identities and attempts to keep those identities concealed. We present a survey of the techniques used within Bitcoin to reveal or conceal users' identities. We provide an easy to understand explanations of how these techniques work and provide a cross reference of which revealing techniques are effective for specific concealing techniques.
Smart contract is the building block of blockchain systems that enables automated peer-to-peer transactions and decentralized services. With the increasing popularity of smart contracts, blockchain systems, in particular Ethereum, have been the "paradise" of versatile fraud activities in which Ponzi, Honeypot and Phishing are the prominent ones. Formal verification and symbolic analysis have been employed to combat these destructive scams by analyzing the codes and function calls, yet the vulnerability of each \emph{individual} scam should be predefined discreetly. In this work, we present SCSGuard, a novel deep learning scam detection framework that harnesses the automatically extractable bytecodes of smart contracts as their new features. We design a GRU network with attention mechanism to learn from the \emph{N-gram bytecode} patterns, and determines whether a smart contract is fraudulent or not. Our framework is advantageous over the baseline algorithms in three aspects. Firstly, SCSGuard provides a unified solution to different scam genres, thus relieving the need of code analysis skills. Secondly, the inference of SCSGuard is faster than the code analysis by several order of magnitudes. Thirdly, experimental results manifest that SCSGuard achieves high accuracy (0.92$\sim$0.94), precision (0.94$\sim$0.96\%) and recall (0.97$\sim$0.98) for both Ponzi and Honeypot scams under similar settings, and is potentially useful to detect new Phishing smart contracts.
With the massive use of dematerialized storage, homomorphism has become one of the most widely used properties in cryptology. In this thesis we will study how to use it in concrete multi-users protocols requiring not only confidentiality but also anonymity, authentication or verifiability. Homomorphic encryption schemes, homomorphic digital signatures and homomorphic zero-knowledge proofs will be used together, but each time restricted to achieve the desired level of security.First, the confidential aspect is studied for computations on large outsourced databases. Being able to apply functions on encrypted data without having to download and decrypt it entirely may be essential and allows to take advantage of the computational power of the server. This can also be interesting when a third-party company without right-access to the database wants to obtain the result of a computation. However, some guarantees on the learned information need to be taken. To this end, we present a decentralized encryption scheme that allows controlled evaluation of quadratic functions on outsourced data thanks to a group of controllers.However, sometimes confidentiality of the data is not the most desired property for a system as it does not protect the sender. For electronic voting, each encrypted ballot must be associated with its voter to verify that he is allowed to vote. After the voting phase, anonymity is achieved by shuffling so that, during the count, which corresponds to the decryption, no link between votes and voters can be made. We propose a new construction of mix-network based on linearly homomorphic signatures which allows for the first time a verification which is cost-independent of the number of mix-servers. This scalable mix-net improves the efficiency compared to already known constructions, especially with an increasing number of shuffles.Nevertheless, with perfect anonymity comes the threat of malicious use of the system. Cryptology must consider these possible abuses and we propose the first multi-authority anonymous credential protocol with traceability property: a user asks a credential issuer for a credential and uses it to access a system while remaining anonymous. In case of abuse, an authority can revoke anonymity and trace a malicious user. The scheme is as efficient as the previously known credential schemes while achieving the multi-credential issuer functionality.
Bitcoin has emerged in 2008, and after decades of development, it has become the largest trading currency by far. The core of the blockchain is to ensure the anonymity of user transactions. As more and more analysis algorithms for blockchain transactions appear, the anonymity of the blockchain is increasingly threatened. We propose Tomen, an encryption application for the communication process in the bitcoin transaction process, combined with the encryption principle method of Tor. The goal is to achieve the application of the anonymization of bitcoin transaction communication.
Open access
2 source records
cs.CR
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
The Border Gateway Protocol (BGP) is the inter-domain routing protocol that glues the Internet. BGP does not incorporate security and instead, it relies on careful configuration and manual filtering to offer some protection. As a consequence, the current inter-domain routing infrastructure is partially vulnerable to prefix and path hijacks as well as in misconfigurations that results in route leaks. There are many instances of these vulnerabilities being exploited by malicious actors on the Internet, resulting in disruption of services. To address this issue the IETF has designed RPKI, a centralised trust architecture that relies on Public Key Infrastructure. RPKI has slow adoption and its centralised nature is problematic: network administrators are required to trust CAs and do not have the ultimate control of their own critical Internet resources (e.g,. IP blocks, AS Numbers). In this context, we have built the Decentralised Internet Infrastructure (DII), a distributed ledger to securely store inter-domain routing information. The main advantages of DII are (i) it offers flexible trust models where the Internet community can define the rules of a consensus algorithm that properly reflects the power balance of its members and, (ii) offers protection against vulnerabilities (path hijack and route leaks) that goes well beyond what RPKI offers. We have deployed the prototype on the wild in a worldwide testbed including 7 ASes, we will use the testbed to demonstrate in a realistic scenario how allocation and delegation of Internet resources in DII work, and how this protects ASes against artificially produced path and prefix hijack as well as a route leak.
In Internet of Things (IoT) environments, privacy and security are among some of the significant challenges. Recently, several studies have attempted to apply blockchain technology to increase IoT network security. However, the lightweight feature of IoT devices commonly fails to meet computational intensive requirements for blockchain-based security models. In this work, we propose a mechanism to address this issue. We design an IoT blockchain architecture to store device identity information in a distributed ledger. We propose a Blockchain of Things (BCoT) Gateway to facilitate the recording of authentication transactions in a blockchain network without modifying existing device hardware or applications. Furthermore, we introduce a new device recognition model that is suitable for blockchain-based identity authentication, where we employ a novel feature selection method for device traffic flow. Finally, we develop the BCoT Sentry framework as a reference implementation of our proposed method. Experiment results verify the feasibility of our proposed framework.
Blockchain has opened up research opportunities to develop a proofreading system in many digital services. The research in this area is still in progress to merge the legal aspects with the technical process to create a self-sustained system. This paper has presented the proof of concept for implementing a remote internet-based voting system providing the physical absence of any invigilating authority thereby providing the provision for voters to cast the vote from home location. The blockchain-based system along with the implemented cryptosystem has been designed to provide reliability, security, anonymity of the votes and the voters. The system is also resistant to the prediction of the winning party until the results are announced thereby building the citizen trust as it adds transparency and security to the voting system.
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Blockchain technology (BT) Ethereum Smart Contracts allows programmable\ntransactions that involve the transfer of monetary assets among peers on a BT\nnetwork independent of a central authorizing agency. Ethereum Smart Contracts\nare programs that are deployed as decentralized applications, having the\nbuilding blocks of the blockchain consensus protocol. This technology enables\nconsumers to make agreements in a transparent and conflict-free environment.\nHowever, the security vulnerabilities within these smart contracts are a\npotential threat to the applications and their consumers and have shown in the\npast to cause huge financial losses. In this paper, we propose a framework that\ncombines static and dynamic analysis to detect Denial of Service (DoS)\nvulnerability due to an unexpected revert in Ethereum Smart Contracts. Our\nframework, SmartScan, statically scans smart contracts under test (SCUTs) to\nidentify patterns that are potentially vulnerable in these SCUTs and then uses\ndynamic analysis to precisely confirm their exploitability of the\nDoS-Unexpected Revert vulnerability, thus achieving increased performance and\nmore precise results. We evaluated SmartScan on a set of 500 smart contracts\ncollected from the Etherscan. Our approach shows an improvement in precision\nand recall when compared to available state-of-the-art techniques.\n
In this study, we overview the problems associated with the usability of cryptocurrency wallets, such as those used by ZCash, for end-users. The concept of "holistic privacy," where information leaks in one part of a system can violate the privacy expectations of different parts of the system, is introduced as a requirement. To test this requirement with real-world software, we did a 60 person task-based evaluation of the usability of a ZCash cryptocurrency wallet by having users install and try to both send and receive anonymized ZCash transactions, as well as install a VPN and Tor. While the initial wallet installation was difficult, we found even a larger amount of difficulty integrating the ZCash wallet into network-level protection like VPNs or Tor, so only a quarter of users could complete a real-world purchase using the wallet.
Ya Chen, Yazhe Wang, Yu Wang, Mingxuan Li · 6 authors
Telephony networks serve as a reliable communication channel, and phone numbers are usually used to authenticate users' identities in telephony networks. However, modern telephony networks does not provide end-to-end authentication for phone numbers, making it difficult for a receiver to confirm a caller's real identity. Moreover, due to the lack of effective authentication solutions for users, phone numbers are usually exploited to commit identity theft, credit card fraud, or telecom harassment by phone number spoofing attacks. In this paper, we propose a blockchain-based identity authentication system for telephony networks, CallChain. CallChain issues verifiable digital identities to users which bound a user to his/her phone number. Based on the digital identity, CallChain provides end-to-end identity authentication between the caller and receiver in the data channel without modifying the core technologies in telephony networks. In the proposed system, users first register decentralized identities (DIDs) and store them in the blockchain distributed ledger. Then Call Center issues verifiable PhoneNumber Credentials to users. And finally users conduct end-to-end identity authentication based on these PhoneNumber Credentials before the call is established. We implement a prototype as an App for Android-based phones based on an open source blockchain platform Hyperledger Indy. Moreover, we detect that CallChain only adds a worst-case 2.1 seconds call establishment overhead and can resist DDoS attacks effectively.
Enclave applications that rely on blockchains for integrity and availability are vulnerable to eclipse attacks. In this paper, we present an approach for reliably detecting extended eclipse attacks, even when the adversary controls all network connectivity. By monitoring changes to the difficulty parameter in Proof-of-Work (PoW) protocols, our algorithm detects suppression of new blocks, as well as difficulty-lowering attacks that attempt to force an enclave client onto a malicious fork mined solely by an attacker. We present analysis that attackers have negligible probability of evading our block monitoring algorithm, and demonstrate its robustness to most historical fluctuations in difficulty on the Ethereum blockchain, resulting in a very low false-positive rate.
Christian Killer, Markus Knecht, Claude Müller, Bruno Rodrigues · 7 authors
Remote Electronic Voting (REV) systems allow voters to cast their votes in an uncontrolled, distributed environment. At the same time, the REV system must provide ballot privacy and verifiability of the final tally. Research has proposed REV schemes offering ballot privacy based on computational intractability assumptions, but only a few provide Unconditional Privacy (UP). Therefore, this work proposes Æternum, a REV system with a voting scheme providing UP. Æternum does not require trust in a central authority, nor does it assume computational intractability of an underlying mathematical problem to provide UP. To satisfy UP's minimal trust assumptions, Æternum uses a permissioned Distributed Ledger (DL), that forms a decentralized network of permissioned nodes, which serve as a transparent, tamper-proof Decentralized Public Bulletin Board (DPBB).
Because Bitcoin P2P networking is permissionless by the application requirement, it is vulnerable against networking threats based on identity/credential manipulations such as Sybil and spoofing attacks. The current Bitcoin implementation keeps track of its peer's networking misbehaviors through ban score. In this paper, we investigate the security problems of the ban-score mechanism and discover that the ban score is not only ineffective against the Bitcoin Message-based DoS attacks but also vulnerable to a Defamation attack. In the Defamation attack, the network adversary can exploit the ban-score mechanism to defame innocent peers.
Payment channel hubs (PCHs) constitute a promising solution to the inherent scalability problem of blockchain technologies, allowing for off-chain payments between sender and receiver through an intermediary, called the tumbler. While state-of-the-art PCHs provide security and privacy guarantees against a malicious tumbler, they do so by relying on the scripting-based functionality available only at few cryptocurrencies, and they thus fall short of fundamental properties such as backwards compatibility and efficiency.In this work, we present the first PCH protocol to achieve all aforementioned properties. Our PCH builds upon A2L, a novel cryptographic primitive that realizes a three-party protocol for conditional transactions, where the tumbler pays the receiver only if the latter solves a cryptographic challenge with the help of the sender, which implies the sender has paid the tumbler. We prove the security and privacy guarantees of A2L (which carry over to our PCH construction) in the Universal Composability framework and present a provably secure instantiation based on adaptor signatures and randomizable puzzles. We implemented A2L and compared it to TumbleBit, the state-of-the-art Bitcoin-compatible PCH. Asymptotically, A2L has a communication complexity that is constant, as opposed to linear in the security parameter like in TumbleBit. In practice, A2L requires ~33x less bandwidth than TumleBit, while retaining the computational cost (or providing 2x speedup with a preprocessing technique). This demonstrates that A2L (and thus our PCH construction) is ready to be deployed today.In theory, we demonstrate for the first time that it is possible to design a secure and privacy-preserving PCH while requiring only digital signatures and timelock functionality from the underlying scripting language. In practice, this result makes our PCH backwards compatible with virtually all cryptocurrencies available today, even those offering a highly restricted form of scripting language such as Ripple or Stellar. The practical appealing of our construction has resulted in a proof-of-concept implementation in the COMIT Network, a blockchain technology focused on cross-currency payments.
Kontham Vinay Kumar Reddy, Chavi Kapoor, Veeravalli Shivadeepak, Mula Sai Charan · 5 authors
Blockchain, a circulated record innovation, can possibly be conveyed in a wide scope of utilizations. Among these applications, decentralized payment frameworks (for example Bitcoin) have been perhaps the most developed blockchain applications with inescapable appropriation. While the early plans (for example Bitcoin) are regularly the cash of decision by cybercriminals, they just give pseudo-secrecy, as in anybody can de-anonymize Bitcoin exchanges by utilizing data in the blockchain. To reinforce the security insurance of decentralized payment frameworks, various arrangements, for example, Monero and Zerocash have been proposed. Notwithstanding, totally Decentralized Anonymous Payment (DAP) frameworks can be criminally misused, for instance in online coercion and illegal tax avoidance exercises. Perceiving the significance of guideline, we present a novel meaning of Decentralized Conditional Anonymous Payment (DCAP) and portray the comparing security necessities. To develop a solid DCAP framework, we first plan a Condition Anonymous Payment (CAP) conspire (in light of our proposed mark of information), whose security can be exhibited under the characterized formal semantic and security models. To exhibit utility, we contrast the presentation of our proposition and that of Zerocash under similar boundaries and testing climate.
Anonymous Zether, proposed by Bünz, Agrawal, Zamani, and Boneh (FC’20), is a private payment design whose wallets demand little bandwidth and need not remain online; this unique property makes it a compelling choice for resource-constrained devices. In this work, we describe an efficient construction of Anonymous Zether. Our protocol features proofs which grow only logarithmically in the size of the "anonymity sets" used, improving upon the linear growth attained by prior efforts. It also features competitive transaction sizes in practice (on the order of 3 kilobytes).Our central tool is a new family of extensions to Groth and Kohlweiss’s one-out-of-many proofs (Eurocrypt 2015), which efficiently prove statements about many messages among a list of commitments. These extensions prove knowledge of a secret subset of a public list, and assert that the commitments in the subset satisfy certain properties (expressed as linear equations). Remarkably, our communication remains logarithmic; our computation increases only by a logarithmic multiplicative factor. This technique is likely to be of independent interest.We present an open-source, Ethereum-based implementation of our Anonymous Zether construction.
Various e-voting systems have been provided with the goal of increasing security and reducing costs for a long time. Ethereum Blockchain is a major breakthrough in the tech industry that provides a highly secure platform. As Ethereum, a decentralized platform which runs decentralized applications (DApps), was introduced in the market, the idea of secured voting system finally seemed possible. Organizations have shifted their focus on applications that run on blockchain platforms. It is highly likely that a simple voting method will not lead to a clear majority. There can be a number of ways to deal with this issue, including other potentially voting process, thus costing time and resources which is exactly opposite of the main concern of e-voting systems. Thus, in our paper, we introduce the vote-trading concept where in the absence of a clear majority, votes can be redistributed to other candidates and also this 'majority' factor can be determined by the organization as per their requirement as different organizations can have different winning percentage. We discuss the design and implementation for the Ethereum blockchain based decentralized preferential e-voting system using Solidity programming language where we present the idea of giving preference to candidates, rather than one vote per candidate.
Access control is a fundamental keystone in security. Damgard, Haagh, and Orlandi (TCC 2016) introduced access˚ control encryption (ACE) that enforces no-read and no-write rules without revealing the senders, receivers, or the content of the encrypted traffic. Existing designs of ACE for arbitrary policy (covering all possibilities of read/write relationship) rely on indistinguishability obfuscation or lattice-based assumptions, with either exponential-size ciphertexts or circuit realization of policy. Also, their designs mandate a private sanitizer key to remain perpetually online for sanitization. The only existing scheme that can afford a public sanitizer key supports only simple policies. To summarize, state-of-the-art ACE schemes only feature at most two of the following desirable properties: arbitrarypolicy, constant-size (ciphertext), and efficient (sanitization). This paper introduces an ACE scheme for arbitrary policy without sanitizer key, which solves the open question posed by Kim and Wu (Asiacrypt 2017). We also put forth the notion of cross-domain ACE, separating the key generator into the sender-authority and receiver-authority. Our scheme requires structure-preserving signatures, non-interactive zero-knowledge proof, and sanitizable identity-based broadcast encryption as the building blocks. It can be instantiated directly from pairing-based assumptions and features constant ciphertext size. We also prototyped our scheme and demonstrated its practical efficiency.
N. Suganthi, Gokul Sridharan, E Shravanth, K. Veena
Abstract: Democratic rule is based on safe and open electoral systems that can preserve their authenticity. The conventional voting processes are hampered significantly by electoral fraud and security breaches as well as centralized management and inefficiencies in auditability and accessibility. The issues of electoral systems reduce public trust along with lowering the credibility of election results. This paper introduces a new three-tier blockchain-based e-voting system designed to enhance voter privacy alongside system scalability and end-to-end verifiability to restore trust in electoral processes. Voter verification at Layer 1 (Identity Verification) combines Decentralized Identity (DID) with Zero-Knowledge Proofs (ZKP) and multimodal biometric techniques involving fingerprint scanning, facial recognition technology, and voice analysis. The system enables only the participation of valid voters while also protecting their private data and fulfilling different user needs. The system's Layer 2 (Vote Casting & Secure Storage) employs a hybrid consensus algorithm combining Byzantine Fault Tolerance (BFT) and Delegated Proof-of-Stake (dPoS) to store votes securely while reducing energy consumption. The system leverages Triple-Blind Signatures to provide complete voter anonymity by decoupling voter identities from their votes as well as any accompanying metadata. Lattice-based post-quantum cryptography is employed to encrypt votes which are distributed across sharded blockchain subnets for enhanced performance without sacrificing fault tolerance. The system accumulates votes via Merkle roots and verifies them via zk-SNARKs in Layer 3 (Result Processing & Transparency) that allows public observation without compromising voter privacy. A Live Audit Dashboard provides voters with the capability to check their vote in real time which facilitates transparent and accountable voting processes. The suggested system attains a secure and open electronic voting process using sophisticated cryptographic protocols in a decentralized setup compliant with international requirements while enabling digital democratic participation.
The vehicular networks constructed by interconnected vehicles and transportation infrastructure are vulnerable to cyber-intrusions due to the expanded use of software and the introduction of wireless interfaces. Intrusion detection systems (IDSs) can be customized efficiently in response to this increased attack surface. There has been significant progress in detecting malicious attack traffic using machine learning approaches. However, existing IDSs require network devices with powerful computing capabilities to continuously train and update complex network models, which reduces the efficiency and defense capability of intrusion detection systems due to limited resources and untimely model updates. This work proposes a cooperative intrusion detection mechanism that offloads the training model to distributed edge devices (e.g., connected vehicles and roadside units (RSUs). Distributed federated-based approach reduces resource utilization of the central server while assuring security and privacy. To ensure the security of the aggregation model, blockchain is used for the storage and sharing of the training models. This work analyzes common attacks and shows that the proposed scheme achieves cooperative privacy-preservation for vehicles while reducing communication overhead and computation cost.
Security and trust are seen as the most important issues in electronic voting systems. Therefore, it is necessary to use cryptographic procedures to ensure anonymity, security, privacy, and reliability in these systems. In recent years, blockchain has become one of the most commonly used methods for securing data storage and transmission through decentralized applications. E-voting is one of these application areas. However, data manipulation is still seen as a major potential problem in e-voting systems. In theproposed model, administrators or miners are prevented from previewing election results which are normally accessible data due to the blockchain structure. A double-layer encryption model is proposed and tested to prevent manipulations that may occur with the election results. It is ensured that the election results can be counted after the participation of all stakeholders at the end. In this way, potential manipulations may be prevented during the election period. As a result of the model, the privacy of voters is ensured, no central authority is needed, and the recorded votes are kept in a distributed structure.
The advancement of internet technology, cybersecurity, and the distributed system has enabled the development and establishment of electronic voting systems. This study focuses on the design and architecture of a secure and auditable electronic voting system that consists of a website, database system, and blockchain. The Ethereum blockchain is chosen due to its smart contract that is suitable for applications such as e-voting. The implementation is done using the Go language, and the Ethereum blockchain is accessible through the e-voting website. Initial testing and evaluation results show that the proposed design and architecture of the e-voting system allows a secure transaction to take place and auditable at the same time. Several configurations on the blockchain, such as block size, gas limit, and the number of sealers, could be modified to boost the performances further.