Blockchain Papers

Weiming Tong, Luyao Yang, Wenqi Jiang, Jingbo Lin · 5 authors

No abstract is available for this record.

Ginni Garg, Arti Garg

No abstract is available for this record.

Pandi Vijayakumar, S. C. Rajkumar, S. Audithan, P. Jayarekha · 5 authors

No abstract is available for this record.

Shahrin Chowdhury, Pasika Ranaweera, Anca Delia Jurcut

No abstract is available for this record.

Yan Zhang, Chunsheng Gu, Peizhong Shi, Zhengjun Jing · 6 authors

Authentication is an important security issue for multi-access edge computing (MEC). To restrict user access from untrusted devices, Bring Your Own Device (BYOD) policy has been proposed to authenticate users and devices simultaneously. However, when integrating BYOD policy into MEC authentication to improve security, issues of efficient binding and user-device conditional anonymity have not been well supported. To address these issues, we propose Bring Your Device Group (BYDG) policy by constructing efficient and privacy-preserving user-device authentication. Our core idea is to use key sequences generated by PUFs-based key derivation functions (KDFs) to not only construct efficient binding relationships, but also achieve conditional anonymity for device groups. Specifically, a flexible and secure binding method is first developed by leveraging Chinese Remainder Theorem (CRT) to bind user with device groups. Each device’s CRT modulus is derived from the key sequence to construct many-to-many user-device binding relationships, which are managed in the form of on-chain Pedersen Commitment. Moreover, we design an identity anonymizing and tracing method for device groups. The key sequence is regarded as traceable device pseudo-identities, and then inserted into the cuckoo filter to reduce the on-chain storage overhead and mitigate malicious login attempts with low costs. Based on above two methods, the combination of Pedersen Commitment and Zero-Knowledge Proof of Knowledge is used to achieve user-device authentication with conditional anonymity. The security analysis was presented to demonstrate important security properties. A proof-of-concept prototype was implemented to conduct performance evaluation and comparative analysis.

Daniel Slamanig

With the increasing use of online services, the protection of the privacy of users becomes more and more important. This is particularly critical as authentication and authorization as realized on the Internet nowadays, typically relies on centralized identity management solutions. Although those are very convenient from a user's perspective, they are quite intrusive from a privacy perspective and are currently far from implementing the concept of data minimization. Fortunately, cryptography offers exciting primitives such as zero-knowledge proofs and advanced signature schemes to realize various forms of so-called anonymous credentials. Such primitives allow to realize online authentication and authorization with a high level of built-in privacy protection (what we call privacy-preserving authentication). Though these primitives have already been researched for various decades and are well understood in the research community, unfortunately, they lack widespread adoption. In this paper, we look at the problems, what cryptography can do, some deployment examples, and barriers to widespread adoption. Latter using the example of the EU Digital Identity Wallet (EUDIW) and the recent discussion and feedback from cryptography experts around this topic. We also briefly comment on the transition to post-quantum cryptography.

Z. Chen, Jianyong Yu, Yulong Wang

No abstract is available for this record.

Davide Ghezzi, Giacomo Vella, Luca Gastaldi, Francesco Paolo Appio

No abstract is available for this record.

Ahcène Bounceur

No abstract is available for this record.

Jun-Cheol Park

A service providing server seeks to achieve enhanced security by requesting the user for presenting an OTP value before executing a critical transaction such as money transfer. The OTP method by a separate token-type battery-powered device is not expected to always work due to the limited battery lifetime of the device, and when a problem occurs, it needs to be replaced for a fee. Other method of generating OTP by executing a mobile app is useful because no separate device is required, but it does not provide the security of the level of two-factor authentication. We propose an OTP scheme that uses the latest block of the Ethereum blockchain to generate and verify unpredictable OTPs by referring to a secret value within a mobile app and other secret stored on a separate media such as a paper. The proposed scheme achieves the high security of dual-factor authentication at no additional cost, without expiration of validity, while ensuring the currency and unpredictability of the generated OTP. Therefore, the introduction of the proposed scheme makes it possible to force the use of OTP in more diverse areas, which can add additional security to various authentication such as passwords, smart keys, and biometric recognition. As a result, it is expected that strengthened authentication can be applied without separate equipment, infrastructure, or cost, which will greatly contribute to the revitalization of Internet commerce and the creation of new business models relied on strong security for user authentication.

Xiangyang Luo, Xingxing Chen, Xiaofeng Chen, Qingfeng Cheng · 6 authors

Abstract With the continuous development of network technology, cryptographic protocols are facing diverse and complex security challenges. Blockchain technology, as a solution incorporating decentralization, traceability, programmability, and immutability, effectively enhances the security, trustworthiness, operational efficiency, and ensures the security and integrity of data storage in traditional cryptographic protocols. Consequently, it has gradually emerged as a focal point of research in cryptographic protocols. This manuscript delves into the ongoing research concerning the application of blockchain technology in cryptographic protocols. First, this manuscript introduces the background of blockchain research in cryptographic protocols and the corresponding basic knowledge. Secondly, we delve into the main concerns of traditional cryptographic protocols, with a particular focus on security and performance. Thirdly, according to the main classification of cryptographic protocols, the latest research results of blockchain in authentication protocols, authentication and key agreement protocols, and e-commerce protocols are presented. Finally, the research directions of blockchain technology in cryptographic protocols are summarized based on the existing research, and the future development trend is also prospected.

Changsong Jiang, Chunxiang Xu, Xinfeng Dong, Kefei Chen · 5 authors

Password-based authentication is widely applied in Internet of Things (IoT). It allows IoT devices to identify users with passwords to resist unauthorized access. However, choices of weak passwords, especially popular ones, might violate users’ privacy and lead to large-scale network attacks. Collection of popular passwords among IoT devices to establish blocklists via a service provider can prevent use of weak passwords. To protect unpopular passwords during collection, existing privacy-preserving schemes rely on expensive cryptographic primitives (e.g., garbled circuits and zero-knowledge proofs), which would impose heavy communication and computation burdens on constrained devices and hinder wide deployment of these schemes. In this paper, we propose EAGER+, an efficient privacy-preserving scheme for weak password collection in IoT against perpetual leakage. EAGER+ is mainly built on secret sharing and symmetric encryption, thereby enabling lightweight computation and communication on IoT devices. In EAGER+, we conceive a password-locked encryption with conditional decryption mechanism to efficiently identify popular passwords, where a password is essentially locked under itself in the encryption to guarantee its security, and the password can be revealed from the ciphertext by the service provider only if a sufficient number of devices exploit it. The mechanism is integrated with a servers-aided password-hardening mechanism to resist offline dictionary guessing attacks. Moreover, EAGER+ uses a key renewal mechanism to periodically update secrets for password hardening on key servers to thwart perpetual leakage towards the secrets. We formally analyze the security of EAGER+, and conduct experimental evaluations to show that EAGER+ is more efficient than existing schemes.

Mingwei Zeng, Jie Cui, Qingyang Zhang, Hong Zhong · 5 authors

The rapid evolution of the Industrial Internet of Things (IIoT) has necessitated increased device interactions across various management domains. This entails devices from different domains collaborating on the same production task. This poses significant challenges for the dynamics of cross-domain authentication schemes. Traditional cross-domain authentication schemes struggle to support seamless switching between domains and face difficulties when accommodating devices that join and leave the same domain. Moreover, these schemes suffer from intricate interactions and suboptimal efficiency. To address these issues, we propose a dynamic group signature scheme based on a dynamic accumulator and a non-interactive zero-knowledge proof. We integrated this scheme with blockchain technology to construct an efficient revocation cross-domain authentication scheme. The proposed scheme enables cross-domain anonymous authentication with simple interactions and provides an efficient revocation function for illegal devices. This approach ensures conditional privacy-preserving and enables efficient member joining and exiting through a dynamic accumulator. It effectively addresses the dynamic requirements of devices involved in IIoT production and manufacturing processes. We prove the security of the proposed scheme using a random Oracle model and conduct thorough analyses to verify its resistance against various attacks. Furthermore, the experimental results demonstrate that the proposed scheme achieves better performance in terms of computational and communication costs.

Chenyu Li, Xiu Zhang, Xueping Liang, Xiaorui Gong

In the network layer of the Ethereum network, the Discv5 protocol is introduced to improve the node discovery process and enhance resistance to common P2P network attacks such as Sybil Attacks, Partition Attacks, and Eclipse Attacks. However, the practical effectiveness of the new security mechanisms introduced by the Discv5 protocol has not been evaluated through engineering assessments. In this paper, we identify inconsistencies between the design and implementation of the Discv5 protocol and propose a new attack pattern: the Leveraging Service Diversity (LSD) Attack. The LSD Attack targets networks where different services are indiscriminately mixed. Through detailed measurements of the Consensus Layer (CL) discovery network, we evaluate the impact of the LSD Attack on newly joined network nodes and on the services of honest nodes within the network. Our experiments demonstrate significant deviations between the Discv5 protocol’s current implementation and its original design, which can lead to a substantial reduction in the network’s security under the influence of service diversity. This study contributes to a deeper understanding of the security implications of the Discv5 protocol and highlights the need for further evaluation and improvement of the network layer protocols in Ethereum.

R P Tejushree, A.V.S.S. Prasad, C R Vedashree, Vishaka Rani Chandramule · 6 authors

Technology advancements have prompted researchers to investigate electronic voting, or "e-voting," to update and simplify the electoral process. In this research, we present a novel solution to these problems by fusing deep learning methods specifically, facial detection with blockchain technology to create an electronic voting system. To further enhance the security and integrity of the voting process, we apply deep learning techniques for facial detection. The voter's identification is then confirmed by deep learning models analyzing this data, which stops fraudulent voting and guarantees that only qualified people take part in the election process. Furthermore, our approach places a high priority on protecting voter privacy by utilizing methods like homomorphic encryption and zero-knowledge proofs, which enable vote counting without jeopardizing the voter's identity. Because blockchain technology is transparent, audits and verification are made easier, allowing interested parties to confirm the fairness of the electoral process. Our suggested electronic voting system provides a strong solution that tackles the primary issues of security, integrity, and privacy by merging deep learning combined with blockchain technologies for facial recognition.

Oqeili Saleh, Abu-alzanat Thamer, Alkaraimah Qutaibah, al smadi Takialddin

CAPTCHA, which stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart, is a commonly employed security measure to distinguish between humans and computers. The Turing Test, designed to guarantee network security, is the foundation of this security technique. Usability is a crucial concern that can prevent human users from engaging in laborious and time-consuming tasks. When designing CAPTCHA, security and usability must be addressed simultaneously. When designing CAPTCHA, it is crucial to address security and usability simultaneously. A concerted effort is required to protect online data and guarantee privacy and security. The personal information of Internet users remains susceptible to theft. This study uses an information extraction technique called CAPTCHA to investigate the hazards associated with violating user privacy. It is a highly harmful process due to hacking, theft, unauthorized reuse, and the breach of user information. This study proposes a privacy preservation system employing concurrent encryption techniques, multilateral security computing, and zero-knowledge proof. The objective is to create a system that allows for uncomplicated and secure puzzle-solving using dice gas. CAPTCHA limits access to users' information. In the overview and application of evidentiary measurable methods, we can draw significant conclusions about the more extensive client group's discernments and encounters with CAPTCHA as a privacy-preserving component.

Rasha Halim Razzaq, Mishall Al-Zubaidie, Rajaa Ghali Atiyah

Protecting patient data in the Internet of Medical Things (IoMT) is one of the major challenges facing healthcare organizations because of increasing threats to privacy and security. Although there are many existing protocols and solutions, such as Rivest–Shamir–Adleman (RSA) and El-Gamal cryptographies or centralized methods, that aim to protect data, they suffer from weaknesses such as slow performance or inability to handle large volumes of data. The issue of security in medical records has become an urgent need, and the use of centralized methods can expose them to single-point failure. In this paper, we present the efficient approach to securing patient information (EASPI), which depends on blockchain and integrates innovative techniques such as the advanced encryption algorithm (AES), reverse word frequency analysis (TF-IDF), Lemplel-Ziv-Welch (LZW), decision tree model (DTM), and naive Bayes classifier (NBC). EASPI seeks to improve the security of medical data by storing it encrypted and securely via blockchain technology, providing a high level of privacy and reliability. The experimental results indicate that the EASPI reduces the encryption execution time to 0.2 ms and the decryption execution time to 0.3 ms while improving the accuracy of medical diagnosis. The potential of the suggested methods for healthcare systems is further demonstrated by the fact that the TF-IDF algorithm attained an execution time of 0.004 ms, while the blockchain's greatest execution time was 0.014 ms. Additionally, using the formal verification Scyther tool, the security of the suggested system is examined both theoretically and practically. The suggested solution is an appropriate option for healthcare institutions since it offers a strong defense against a range of cyber threats, including targeted and espionage assaults.

Aayush Jain, Adwait Gondhalekar, Ankit Agrawal, Ashutosh Bhatia · 5 authors

Passwords remain fundamental to user authentication, including handheld devices, wearables, personal computers, and network devices. Privacy concerns have led to the development of new password guidelines and alternatives, yet these have not seen widespread adoption among users. Increasing skepticism towards the service providers has made users reluctant to share sensitive information, including passwords. While current security protocols ensure data protection in transit, assurances regarding the security and privacy of data at rest are often assumed without verification. Traditional best practices for password storage involve hashing, which still requires the original password to be shared as plaintext or as a hash. Each of these methods has its vulnerabilities. For instance, an adversary can sniff network packets to capture the original password or the hash value, potentially compromising the authentication system. To address these issues, we propose a framework for password-based authentication using graph isomorphism as a zero-knowledge proof technique. This framework aims to replace conventional authentication methods and enhance password privacy. The results demonstrate the proposed framework's effectiveness in ensuring secure and private password authentication.

Jeyamohan Neera, Xiaomin Chen, Nauman Aslam, Biju Issac

Current mobile payment schemes gather detailed information about purchases customers make. This data can then be used to infer a customer’s spending behaviour, potentially violating their privacy. To tackle this problem, we propose an untraceable mobile payment scheme that strikes a better balance, preserving user privacy while allowing the Third-Party Service Provider (TPSP) to collect necessary information such as card details and transaction amount for regulatory compliance. Our scheme offers untraceability for legitimate users from malicious adversaries and curious TPSPs using cryptographic primitives such as partially blind signatures, zero-knowledge proofs, and identity-based signatures. It also guarantees that only authorised TPSPs can issue valid payment tokens, and even with limited data, the TPSP can still prevent dishonest customers/merchants from double-spending a payment token. We also propose a comprehensive evaluation framework to assess the untraceable payment schemes against seven key criteria such as untraceability, exculpability—merchant double-spending, exculpability—customer double-spending, unforgeability, confidentiality, message authenticity, efficiency, and regulatory compliance. We rigorously benchmark the security and privacy of our proposed payment scheme against this framework and other established schemes. Furthermore, we formally verify these properties using complexity-based analysis and Proverif modelling.

Shubham Kumar, K. Rohit Kumar, Abhishek Anand, Awaneesh Kumar Yadav · 6 authors

No abstract is available for this record.

Fengqun Wang, Jie Cui, Qingyang Zhang, Debiao He · 5 authors

In Industrial Internet of Things (IIoT) systems, data sharing between industrial departments is often utilized to optimize management models and improve decision-making efficiency. To enable secure data sharing, authentication between smart devices is critical. However, existing authentication schemes do not comprehensively consider data anonymity, data traceability, pseudonym management, and flexible revocation of devices, which cannot meet the needs of IIoT systems for security, real-time, and dynamicity. Therefore, we propose a blockchain-assisted lightweight authentication scheme. First, we design a lightweight authentication method based on Okamoto's protocol and elliptic curve cryptography, which achieves fast authentication of smart devices while ensuring data anonymity and traceability. Second, we design a two-level key derivation algorithm and combine it with blockchain technology to address the issue of pseudonym management. Smart devices can generate pseudonyms without requesting them from the key generation center and can be revoked flexibly. Third, security proof and analysis demonstrate that the proposed scheme achieves the security objectives and is resistant to various common attacks. Finally, the performance evaluation results show that our proposed scheme performs better than the other related schemes regarding computational and communication overheads.

Ahmad AA Alkhatib, Layla Albdor, Seraj Fayyad, Hussain Ali

The rapid expansion of Internet of Things (IoT) devices underscores the critical importance of robust security protocols, particularly in the realm of children's toys. This study introduces an innovative multi-factor authentication strategy integrating Quick Response (QR) codes with Blockchain technology to fortify the security of IoT toys designed for children. The primary objective is to safeguard young users against potential threats stemming from unauthorized access, thereby ensuring a secure interaction with IoT-enabled toys. By amalgamating authentication factors, including QR codes, the proposed approach establishes a multilayered security framework. Leveraging the inherent immutability and transparency of Blockchain, the system verifies the authenticity of IoT toys by scanning a unique QR code, thus mitigating risks associated with malwares and unauthorized access. The decentralization of Blockchain ensures no single point of failure, enhancing resilience against cyber threats. Extensive usability studies underscore the efficacy and practicality of the advanced multi-factor authentication solution, poised to elevate the safety standards of IoT toys in the digital age. This innovative approach not only bolsters security but also fosters trust among users, enabling seamless and worry-free interaction with IoT-enabled toys for children worldwide.

Patrick Kipkorir Laboso, Ali Martin, P. Thiyagarajan

No abstract is available for this record.

Thiwhat Vilaidaraga, Anucha Aribag, Chetneti Srisa-An

Authentication usually involves a combination of a username and password for the identity information process. Historically, users have had to find ways to manage them, typically by memorizing or noting them down separately. Blockchain-based Auxiliary System for Password Management (BAS-PM), which evolved from Distributed Ledger Technology (DLT) Frameworks, is designed to help users store their passwords securely and permanently. Passwords have been a simple yet effective means to protect systems from unauthorized access for years. They are also sensitive personal data that need to be protected by data privacy laws such as the GDPR. For cybersecurity and data privacy purposes, this research aims to propose a Blockchain-based Auxiliary System for Password Management (BAS-PM). The cost-effectiveness and robustness of blockchain technology make it an attractive solution for global password management. This article explores the use of blockchain in password management applications without relying on a centralized server. Experimental results indicate that blockchain-based methods have outperformed traditional methods.