Bitcoin is a digital currency that aims to offer anonymity. However, anonymity is less secure than it is believed to be because it is based on using pseudonyms for addresses. To demonstrate this weakness, we used statistics related to transaction histories and the frequency of transactions to deanonymize a set of bitcoin addresses. In this paper, we explore the fundamental properties of Bitcoin addresses based on actual Bitcoin transaction data. We propose a new method for deanonymizing Bitcoin addresses from a set of output addresses and we demonstrate that 80.5% of addresses could be identified.
Blockchain ushers in a new era for the global financial system with the advent of digital currency (cryptocurrency), and its impact can be felt in many related industries. Because of its possible applications, cryptocurrency draws significant attention from researchers. Although there are a number of risks (e.g., speculation, 51% attack) related to cryptocurrency, billions of dollars are invested in them, because of transparency, traceability, low transaction cost, and highly profitable potential. In December 2017, the most famous cryptocurrency, Bitcoin, has reached almost $20,000.00 per coin. Such short-term, high gain potential attracts many new small investors. However, speculative movements raise many questions related to safety and privacy, just to name a few. In order to understand public opinion about cryptocurrency and to protect small investors financial interests, sentiment analysis can be done by using social media activities of individuals who are interested or investing in cryptocurrencies. One of the most important steps in the analysis is to understand the profiles of the users. Therefore, in this paper, we determine education levels of investors or users who are interested in eight cryptocurrencies by using seven readability techniques on Reddit comments as a part of profiling. Results show that the education levels of users are approximately 60% in middle school, 30% in high school, and 10% in other levels according to the average of the seven readability technique results. The results and analysis, which are provided in this paper, help new investors and developers to obtain profile information about the users who are interested or investing in cryptocurrency.
In the age of Big Data, enabling task scheduling while protecting users' privacy is critical for various decentralized applications in blockchain-based smart contract platforms. Such a privacy-preserving task scheduler requires the task input data to be secretly maintained until a prescribed task execution time and be automatically recorded into the blockchain to enabling the execution of the task at the execution time, even if the user goes offline. While straight-forward centralized approaches provide a basic solution to the problem, unfortunately they are limited to a single point of trust and involve a single point of control. This paper presents decentralized techniques for supporting privacy-preserving task scheduling using smart contracts in Ethereum blockchain networks. We design a privacy-preserving task scheduling protocol that is managed by a manager smart contract. The protocol requires a user to schedule a task by deploying a proxy smart contract maintaining the non-sensitive information of the task while creating decentralized secret trust and selecting trustees from the network to maintain the sensitive information of the task. With security techniques including secret sharing and layered encryption as well as security deposit paid by trustees as economic deterrence, the protocol can protect the sensitive information against possible attacks including some trustees destroying the sensitive information (drop attack) or secretly releasing the sensitive information before the execution time (release-ahead attack). We demonstrate the attack-resilience of the proposed protocol through rigorous analysis.Our implementation and experimental evaluation on the Ethereum official test network demonstrate the low monetary cost and the low time overhead associated with the proposed approach.
The pseudonymous nature of Bitcoin has sparked the twin rivaling researches in Bitcoin community, that is, either protecting or attacking anonymity. In spite of this intense battle, the answer to a primary question is absent – Do Bitcoin users themselves care about anonymity? This paper demystifies this doubt via analyzing the Bitcoin transaction graphs with the following three contributions: 1). We outline three representative metrics that can signify whether users concern about anonymity. 2). We examine the collective trend of anonymity concerns from a macroscope. 3). We pay particular attention on critical addresses in a microscope to unveil their anonymity concerns.This paper arrives at both expected conclusions and unexpected surprises. In particular, the expected ones are: rich addresses concern more about anonymity than poor ones. Miner addresses start caring about anonymity when exchange rate soars. Stock addresses never hide their intent of jump-and-dump. The surprises are: the majority of the users show weak concerns on anonymity. One can easily find both hot and cold wallet addresses owned by big organizations.
Elections conducted on paper consume a lot of resources and contribute to the destruction of forests, which leads to climate deterioration. Moreover, such election process can make it difficult for some people to vote and it often leads to doubts in the validity of counting, in people submitting multiple votes, in ineligible people voting. In several well-known previous examples, doubts in the validity of paper elections lead to the need of recounting and even court battles to decide the validity of the outcome. Having a way to vote online could be an easier and more reliable solution. However, secure and verifiable methods of online voting need to be developed to achieve this.<br><br>Recent online voting experiences in countries such as the United States, India and Brazil demonstrated that further research is needed to improve security guarantees for future elections, to ensure the confidentiality of votes and enable the verification of their integrity and validity. Electronic voting, to be successful, requires a more transparent and secure approach, than the approach that is offered by current electronic voting protocols. Advanced security methods are necessary to introduce effective online voting in the whole world.<br><br>Currently, most online voting systems are centralized, which means that they involve central tallying authorities to take responsibility for verifying, tallying and publishing the final outcome of the election. These previous systems always assume that their central authorities are honest. Otherwise, the published final outcome cannot be trusted. The aim of our new research is to propose and investigate a decentralized ranked choice online voting systems, which never rely on any third party (such as tallying authorities), thereby significantly increasing the confidence and trust of the voters.<br><br>The thesis presents several publicly verifiable online voting systems and indicates the processing steps and stages in the development of a publicity verifiable online voting system from centralized to semi-decentralized, to fully decentralized. By using Homomorphic cryptosystem, proof of zero knowledge and Blockchain technology, the proposed system in this thesis can achieve the following: (1) Flexible voting mechanism: voters can easily rank all candidates; (2) Publicity verifiable: the whole election procedure is transparent and verifiable by voters; (3) Self-tallying: the final outcome of the election can be computed by any individual voter; and (4) Fully decentralized: no tallying authority (or any other trusted third party) involved at all.<br><br>The proposed systems presented in this thesis include protocols developed on Blockchain technology. The technology that is used as the basis for a secure online voting system is ``smart contract over Blockchain', which offers a factor of the integrity of votes and has not been deeply studied in Blockchain technologies to date. The proposed voting protocols ensure confidentiality and preserve the voters' privacy while keeping the election procedures transparent and secure. The underlying Blockchain protocol has not been modified in any way, the voting scheme proposed merely offers an alternative use case of the protocol at hand, which could be presented as the basis for voting systems using Blockchain with further development of the underlying Blockchain protocols.<br><br>
Zijian Bao, Bin Wang, Yongxin Zhang, Qinghao Wang · 5 authors
We propose Lockcoin, a secure and privacy-preserving mix service for bitcoin anonymity. We introduce mix servers to provide mix service for user to prevent attackers linking the input address with output address by using blind signature shceme, multisignature scheme. Lockcoin provides anonymity, scalability, bitcoin compatibillity, theft impossibility and accountability. We have proposed a prototype of Lockcoin based on bitcoin test network, experimental results show that our solution is efficient. Lockcoin's source codes are released on github.com/Northeastern-University-Blockchain/Lockcoin.
Nov 1, 2018·2018 IEEE 10th International Conference on Humanoid, Nanotechnology, Information Technology,Communication and Control, Environment and Management (HNICEM)
Maria Rona L. Perez, Bobby D. Gerardo, Ruji P. Medina
This research is composed of online transaction security; the mechanism of blockchain and proposed a modified SHA256 security protocol through smart contract to secure online transaction procedure specifically based on Blockchain Mechanism. It focus on the discussion of modifying security protocol specifically designed for practical applications of blockchain with particular reference to privacy and trust. The researcher recommend a new transaction procedure involving customer and merchant, permitting entities to recognize one another enabling them to proceed with their transactions securely using Blockchain Mechanism.
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Data security, data reliability and data availability are the challenges the world has always been solving. Election and Voter data are very crucial for a democratic nation. India, in this respect, brings its own challenges. A lot of financial resources are spent to conduct elections. At times, people are unable to cast their vote because they are unable to travel back to their constituency. Either way, the regular public lifestyle is affected for days in a row. Notwithstanding the best efforts, the whole process is susceptible to unauthorized access and unauthorized deeds. In this paper use of Blockchain Technology, powered by Ethereum to overcome the challenges in existing voting system.
Alexander Yakubov, Wazen M. Shbair, Nida Khan, Radu State · 6 authors
Pretty Good Privacy (PGP) is one of the most prominent cryptographic standards offering end-to-end encryption for email messages and other sensitive information. PGP allows to verify the identity of the correspondent in information exchange as well as the information integrity. PGP implements asymmetric encryption with certificates shared through a network of PGP key servers. Many recent breaches show that certificate infrastructure can be compromised as well as exposed to operational errors. In this paper we propose a new PGP management framework with the key server infrastructure implemented using blockchain technology. Our framework resolves some problems of PGP key servers focusing in particular on fast propagation of certificate revocation among key servers and elimination of man-in-the-middle risk. We also provided user access right control where only the certificate holder can change information related to the certificate. We designed and developed a prototype for key server deployment on permissioned Ethereum blockchain. Permissioned blockchain should allow to control the costs of PGP key server infrastructure maintenance at the present level.
Public key infrastructure (PKI) is the foundation and core of network security construction. Blockchain (BC) has many technical characteristics, such as decentralization, impossibility of being tampered with and forged, which makes it have incomparable advantages in ensuring information credibility, security, traceability and other aspects of traditional technology. In this paper, a method of constructing PKI certificate system based on permissioned BC is proposed. The problems of multi-CA mutual trust, poor certificate configuration efficiency and single point failure in digital certificate system are solved by using the characteristics of BC distribution and non-tampering. At the same time, in order to solve the problem of identity privacy on BC, this paper proposes a privacy-aware PKI system based on permissioned BCs. This system is an anonymous digital certificate publishing scheme., which achieves the separation of user registration and authorization, and has the characteristics of anonymity and conditional traceability, so as to realize to protect user's identity privacy. The system meets the requirements of certificate security and anonymity, reduces the cost of CA construction, operation and maintenance in traditional PKI technology, and improves the efficiency of certificate application and configuration.
Deva Surya Vivek Madala, Mahabir Prasad Jhanwar, Anupam Chattopadhyay
The security of web communication via the SSL/TLS protocols relies on safe distributions of public keys associated with web domains in the form of X.509 certificates. Certificate authorities (CAs) are trusted third parties that issue these certificates. However, the CA ecosystem is fragile and prone to compromises. Starting with Google's Certificate Transparency project, a number of research works have recently looked at adding transparency for better CA accountability, effectively through public logs of all certificates issued by certification authorities, to augment the current X.509 certificate validation process into SSL/TLS. In this paper, leveraging recent progress in blockchain technology, we propose a novel system, called CTB, that makes it impossible for a CA to issue a certificate for a domain without obtaining consent from the domain owner. We further make progress to equip CTB with certificate revocation mechanism. We implement CTB using IBM's Hyperledger Fabric blockchain platform. CTB's smart contract, written in Go, is provided for complete reference.
M. Magdalena Payeras–Capellà, Macià Mut–Puigserver, Miquel À. Cabot-Nadal
Blockchain can be the base for an evolution in several digital services. Fair Certified Notification is one of these and requires a fair exchange of values: a message and a non-repudiation of origin proof in exchange for a non-repudiation of reception evidence. The main contribution of this paper is the introduction of a blockchain-based Multiparty Fair Certified Notification system allowing the simultaneous fair notification to a set of receivers. We present and evaluate a smart contract for an optimistic multiparty protocol that achieves the properties of confidentiality, fairness and timeliness with a stateless TTP.
Puneet Puneet, Aman Chaudhary, Nitin Singh Chauhan, Abhishek Kumar
In centralized environments, the results of voting events have always been questionable and perceived differently by voters. Most existing E-Voting systems are based on centralized servers where the voters must trust the organizing authority for the integrity of the results. In this paper we propose a novel approach for a decentralized trustless voting platform that relies on Blockchain technology to solve the trust issues. The main features of this system include ensuring data integrity and transparency, and enforcing one vote per mobile phone number for every poll with ensured privacy. To accomplish this, the Ethereum Virtual Machine (EVM) is used as the Blockchain runtime environment, on which transparent, consistent and deterministic smart contracts will be deployed by organizers for each voting event to run the voting rules. Users are authenticated through their mobile phone numbers without the need of a third party server. Results showed that the system is feasible and may offer a step towards ideal environments for such experience.
3 source records
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Ankush Pathak, Abdul Wasay, C Bhavana Singh, Ritvik Bhavan · 5 authors
In recent times, numerous accusations have been raised on the integrity of the EVMs used in the Indian elections. These accusations demand the need for a newer system that is in line with the present modern era and addresses these accusations. This new system must be an amalgamation of technology and trust, of modernity and tradition. It must be secure, auditable, transparent and should reinforce the confidence of the voters in the democratic election process. Blockchain technology allows for the development of a decentralized distributed open ledger. It offers features like immutability of data, the integrity of data and resistance of data to modifications. We aim to use these features of Blockchain to build a voting machine that will solve existing issues with EVMs and will be sufficiently automated.
Marc Jourdan, Sébastien Blandin, Laura Wynter, Pralhad Deshpande
Bitcoin has created a new exchange paradigm within which financial transactions can be trusted without an intermediary. This premise of a free decentralized transactional network however requires, in its current implementation, unrestricted access to the ledger for peer-based transaction verification. A number of studies have shown that, in this pseudonymous context, identities can be leaked based on transaction features or off-network information. In this work, we analyze the information revealed by the pattern of transactions in the neighborhood of a given entity transaction. By definition, these features which pertain to an extended network are not directly controllable by the entity, but might enable leakage of information about transacting entities. We define a number of new features relevant to entity characterization on the Bitcoin Blockchain and study their efficacy in practice. We show that even a weak attacker with shallow data mining knowledge is able to leverage these features to characterize the entity properties.
For decentralised P2P networks, it is very important to have a mechanism in place that allows the nodes to control resource usage and prevent flooding and denial-of-service attacks with spam. In this paper, we discuss and compare the different approaches to fully decentralised resource control that are used by projects in the cryptocurrency space. The introduced methods are then applied to design a decentralised exchange for Namecoin names (or more generally, crypto assets) as an example.
The chapter “The Evolution of Virtual Currencies: Analyzing the Case of Bitcoin” by Manrique and Manrique was recently published in the book Information and Communication Technologies in Public Administration. It was written at the height of the bitcoin controversy when its value skyrocketed and waned. More than a year has passed since research on that was undertaken, and it seems that the issues with regards to bitcoin as a virtual acceptable currency has calmed down. It is the purpose of this chapter to give an update on the status of bitcoin as a currency and to determine its stability and ability to become a real currency.
Bitcoin's enormous success has inspired the development of alternative blockchains, such as consortium chains. Several cross-chain protocols have been proposed as ways of connecting these universes of individual blockchains in a distributed and secure manner. In this paper, we present Niji, a new cross-chain protocol that allows parties to perform virtual Bitcoin payment securely on a consortium chain, without any trusted third-party or mediators. Our work focuses on the issue that it is difficult for a consortium chain's token to hold a stable market value, and Niji makes it possible for smart contract services to acquire means of payment in the consortium chain. With the Bitcoin payment channel built on the consortium chain, the process from payment to service provision runs autonomously without any interaction between parties. Niji introduces the concept of a transaction template to validate Bitcoin payments efficiently on different blockchains, and it allows a service provider to delegate all of its tasks for verifying state updates to a smart contract on the consortium chain. We also propose a novel bi-directional payment channel adapted for design of the Niji protocol, which can update payments non-interactively between parties. We implemented a prototype of the Niji protocol and conducted an experiment measuring the computational cost and latency that demonstrates the protocol's feasibility on practical platforms.
Geng Hong, Zhemin Yang, Sen Yang, Lei Zhang · 10 authors
As a new mechanism to monetize web content, cryptocurrency mining is becoming increasingly popular. The idea is simple: a webpage delivers extra workload (JavaScript) that consumes computational resources on the client machine to solve cryptographic puzzles, typically without notifying users or having explicit user consent. This new mechanism, often heavily abused and thus considered a threat termed "cryptojacking", is estimated to affect over 10 million web users every month; however, only a few anecdotal reports exist so far and little is known about its severeness, infrastructure, and technical characteristics behind the scene. This is likely due to the lack of effective approaches to detect cryptojacking at a large-scale (e.g., VirusTotal). In this paper, we take a first step towards an in-depth study over cryptojacking. By leveraging a set of inherent characteristics of cryptojacking scripts, we build CMTracker, a behavior-based detector with two runtime profilers for automatically tracking Cryptocurrency Mining scripts and their related domains. Surprisingly, our approach successfully discovered 2,770 unique cryptojacking samples from 853,936 popular web pages, including 868 among top 100K in Alexa list. Leveraging these samples, we gain a more comprehensive picture of the cryptojacking attacks, including their impact, distribution mechanisms, obfuscation, and attempts to evade detection. For instance, a diverse set of organizations benefit from cryptojacking based on the unique wallet ids. In addition, to stay under the radar, they frequently update their attack domains (fastflux) on the order of days. Many attackers also apply evasion techniques, including limiting the CPU usage, obfuscating the code, etc.
A wave of alternative coins that can be effectively mined without specialized hardware, and a surge in cryptocurrencies' market value has led to the development of cryptocurrency mining ( cryptomining ) services, such as Coinhive, which can be easily integrated into websites to monetize the computational power of their visitors. While legitimate website operators are exploring these services as an alternative to advertisements, they have also drawn the attention of cybercriminals: drive-by mining (also known as cryptojacking ) is a new web-based attack, in which an infected website secretly executes JavaScript code and/or a WebAssembly module in the user's browser to mine cryptocurrencies without her consent. In this paper, we perform a comprehensive analysis on Alexa's Top 1 Million websites to shed light on the prevalence and profitability of this attack. We study the websites affected by drive-by mining to understand the techniques being used to evade detection, and the latest web technologies being exploited to efficiently mine cryptocurrency. As a result of our study, which covers 28 Coinhive-like services that are widely being used by drive-by mining websites, we identified 20 active cryptomining campaigns. Motivated by our findings, we investigate possible countermeasures against this type of attack. We discuss how current blacklisting approaches and heuristics based on CPU usage are insufficient, and present MineSweeper, a novel detection technique that is based on the intrinsic characteristics of cryptomining code, and, thus, is resilient to obfuscation. Our approach could be integrated into browsers to warn users about silent cryptomining when visiting websites that do not ask for their consent.