Credible reputation lies at the core of users and devices communicating and transacting successfully. Identity fraud is becoming increasingly difficult to manage in the face of massive-scale database breaches. In critical infrastructure and public safety applications, as well as day-to-day personal and business transactions, it is imperative to have a significant degree of confidence in whom/what one communicates with - whether to know if the recipient can be entrusted with the sender's data, or if the sender's data is to be considered reliably sourced. Even where possible, lost reputation is substantially more cumbersome, timeconsuming and expensive to replace than are compromised, stolen or defective devices and their embedded cryptographic keys. This paper focuses on two methodologies that have considerable implications relative to addressing the reputation issue: (1) blockchain-enabled anomaly detection and assessment that involves dynamically asserted identity at the network edge effected through end-user targeted release of trusted behavioral data; (2) IoT and human interaction that is securely facilitated through use of an "Inviter-Invitee" protocol to set up dedicated maintainable "communication lines." The judiciously applied combination of the cryptographic protocol suites that enable the two methodologies results in a practicably implementable system for smart city use cases.
Aug 1, 2017·2017 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computed, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/CBDCom/IOP/SCI)
Blockchain was first implemented in Bitcoin, the first decentralized digital currency, with the hash-chained blocks of data, hash-based proof-of-work, and a peer-to-peer protocol to reach consensus so as to append new blocks and secure transactions. Most importantly, it prevents double-spending after some confirmation time. However, few countries accept Bitcoin as a legal currency because, in addition to being subject to some security attacks, there are still problems in economics, politics, performance, etc. Many altcoins with different improvements have been proposed, but problems and attacks still remain. Meanwhile, blockchain, as a trust machine, has been applied to many other areas, such as smart contract, creating a new hype, called “the most significant innovation since the Internet.” However, there are still similar problems and attacks in those applications. By changing the original consensus design, instead of just providing proof of work, we propose EPoW, i.e. estimable proof-of-work, to estimate how much work is done and a corresponding protocol to reach consensus. EPoW and the protocol can serve as a new instrument such that the problems and attacks mentioned above might be relaxed or solved economically. With EPoW, we believe blockchains and digital currencies can be better customized by companies, organizations or countries for different purposes or policies and be employed by any users.
Almost all real world activities have been digitized and there are various client server architecture based systems in place to handle them. These are all based on trust on third parties. There is an active attempt to successfully implement blockchain based systems which ensures that the IT systems are immutable, double spending is avoided and cryptographic strength is provided to them. A successful implementation of blockchain as backbone of existing information technology systems is bound to eliminate various types of fraud and ensure quicker delivery of the item on trade. To adapt IT systems to blockchain architecture, an efficient consensus algorithm need to be designed. Blockchain based on proof of work first came up as the backbone of cryptocurrency. After this, several other methods with variety of interesting features have come up. In this paper, we conduct a survey on existing attempts to achieve consensus in block chain. A federated consensus method and a proof of validation method are being compared.
We’ve seen repeatedly that ideas in the research literature can be gradually forgotten or lie unappreciated, especially if they are ahead of their time, even in popular areas of research. Both practitioners and academics would do well to revisit old ideas to glean insights for present systems. Bitcoin was unusual and successful not because it was on the cutting edge of research on any of its components, but because it combined old ideas from many previously unrelated fields. This is not easy to do, as it requires bridging disparate terminology, assumptions, etc., but it is a valuable blueprint for innovation.
In the last few years, blockchain (also known as distributed ledger), the underlying technology of the permissionless or public Bitcoin network, has become very popular for use in private or permissioned environments. Computer companies like IBM and Microsoft, and many key players in different vertical industry segments have recognized the utility of blockchains for securely managing assets (physical/digital) other than cryptocurrencies. IBM did some pioneering work by architecting and implementing a private blockchain system, and then open sourcing it. That system, which has since then been named Fabric, is being enhanced via the Hyperledger Consortium set up under the auspices of the Linux Foundation. Other efforts in the industry include Enterprise Ethereum, R3 Corda and BigchainDB.
A developing field of interest for the distributed systems and applied cryptography community is that of smart contracts: self-executing financial instruments that synchronize their state, often through a blockchain. One such smart contract system that has seen widespread practical adoption is Ethereum, which has grown to secure approximately 30 billion USD of currency value and in excess of 300,000 daily transactions. \n \nUnfortunately, the rise of these technologies has been marred by a repeated series of security vulnerabilities and high pro file contract failures. To address these failures, the Ethereum community has turned to formal verification and program analysis which show great promise due to the computational simplicity and bounded-time execution inherent to smart contracts. Despite this, no fully formal, rigorous, comprehensive, and executable semantics of the EVM (Ethereum Virtual Machine) currently exists, leaving a lack of rigor on which to base such tools. \n \nIn this work, we present KEVM, the first fully executable formal semantics of the EVM, the bytecode language in which smart contracts are executed. We create this semantics in a framework for executable \nsemantics, the K framework. We show that our semantics not only passes the official 40,683-test stress test suite for EVM implementations, but also reveals ambiguities and potential sources of error in the existing \non-paper formalization of EVM semantics on which our work is based. \n These properties make KEVM an ideal formal reference implementation against which other implementations can be evaluated. \n \nWe proceed to argue for a semantics-first formal verification approach for EVM contracts, and demonstrate its practicality by using KEVM to verify practically important properties over the arithmetic operation of an \nexample smart contract and the correct operation of a token transfer function in a second contract. We show that our approach is feasible and not computationally restrictive. We hope that our work serves as the base for the development of a wide range of useful formally derived tools for Ethereum, including model checkers, certified compilers, and program equivalence checkers.
Blockchain technology is growing massively where the number of blockchain platforms and decentralized applications are increasing rapidly in the last years. However, most of the existing blockchain networks are operating in a standalone environment isolated from each other, which increases scalability and connectivity issues in the current blockchain platforms as well as limiting the blockchain adoption in industry ecosystems. In the current phase, different blockchain networks don't have mutual trust where they cannot interact with each other and their capacity level has only reached a level similar to LAN. Due to the high barriers between the independent isolated blockchain platforms, researchers have started to focus on the concept of Blockchain interoperability. Blockchain interoperability is the ability of connecting multiple blockchain networks together, which significantly increases and solves scalability and connectivity issues in the blockchain platforms. Given the potential of blockchain interoperability and cross blockchain communication, many researchers are working on finding the optimal cross blockchain communication solution. As blockchain interoperability is emerging as an essential blockchain feature, the number of proposed blockchain interoperability solutions have been increasing within the last few years. In this paper, a survey of all the available cross blockchain communication solutions are discussed with a comparison of the proposed architectures.
Bitcoin, a protocol for a new permissionless decentralized digital currency hailed the arrival of a new application domain for computer science. Following Bitcoin's arrival, a series of innovations derived from the state of the art in several fields has been applied to cryptocurrencies, and has been slowly reshaping monetary and financial instruments on public distributed ledgers. It was soon clear however that Bitcoin and similar cryptocurrencies still require additional improvements. This challenging domain presents researchers in the field with new and exciting questions. I provide examples from two main research threads, related to the scalability of the protocol and to its underlying incentives.
Blockchains such as Bitcoin and Ethereum execute payment transactions securely, but their performance is limited by the need for global consensus. Payment networks overcome this limitation through off-chain transactions. Instead of writing to the blockchain for each transaction, they only settle the final payment balances with the underlying blockchain. When executing off-chain transactions in current payment networks, parties must access the blockchain within bounded time to detect misbehaving parties that deviate from the protocol. This opens a window for attacks in which a malicious party can steal funds by deliberately delaying other parties' blockchain access and prevents parties from using payment networks when disconnected from the blockchain. We present Teechain, the first layer-two payment network that executes off-chain transactions asynchronously with respect to the underlying blockchain. To prevent parties from misbehaving, Teechain uses treasuries, protected by hardware trusted execution environments (TEEs), to establish off-chain payment channels between parties. Treasuries maintain collateral funds and can exchange transactions efficiently and securely, without interacting with the underlying blockchain. To mitigate against treasury failures and to avoid having to trust all TEEs, Teechain replicates the state of treasuries using committee chains, a new variant of chain replication with threshold secret sharing. Teechain achieves at least a 33x higher transaction throughput than the state-of-the-art Lightning payment network. A 30-machine Teechain deployment can handle over 1 million Bitcoin transactions per second.
Blockchains such as Bitcoin and Ethereum execute payment transactions securely, but their performance is limited by the need for global consensus. Payment networks overcome this limitation through off-chain transactions. Instead of writing to the blockchain for each transaction, they only settle the final payment balances with the underlying blockchain. When executing off-chain transactions in current payment networks, parties must access the blockchain within bounded time to detect misbehaving parties that deviate from the protocol. This opens a window for attacks in which a malicious party can steal funds by deliberately delaying other parties' blockchain access and prevents parties from using payment networks when disconnected from the blockchain. We present Teechain, the first layer-two payment network that executes off-chain transactions asynchronously with respect to the underlying blockchain. To prevent parties from misbehaving, Teechain uses treasuries, protected by hardware trusted execution environments (TEEs), to establish off-chain payment channels between parties. Treasuries maintain collateral funds and can exchange transactions efficiently and securely, without interacting with the underlying blockchain. To mitigate against treasury failures and to avoid having to trust all TEEs, Teechain replicates the state of treasuries using committee chains, a new variant of chain replication with threshold secret sharing. Teechain achieves at least a 33x higher transaction throughput than the state-of-the-art Lightning payment network. A 30-machine Teechain deployment can handle over 1 million Bitcoin transactions per second.
Blockchains such as Bitcoin and Ethereum execute payment transactions securely, but their performance is limited by the need for global consensus. Payment networks overcome this limitation through off-chain transactions. Instead of writing to the blockchain for each transaction, they only settle the final payment balances with the underlying blockchain. When executing off-chain transactions in current payment networks, parties must access the blockchain within bounded time to detect misbehaving parties that deviate from the protocol. This opens a window for attacks in which a malicious party can steal funds by deliberately delaying other parties' blockchain access and prevents parties from using payment networks when disconnected from the blockchain. We present Teechain, the first layer-two payment network that executes off-chain transactions asynchronously with respect to the underlying blockchain. To prevent parties from misbehaving, Teechain uses treasuries, protected by hardware trusted execution environments (TEEs), to establish off-chain payment channels between parties. Treasuries maintain collateral funds and can exchange transactions efficiently and securely, without interacting with the underlying blockchain. To mitigate against treasury failures and to avoid having to trust all TEEs, Teechain replicates the state of treasuries using committee chains, a new variant of chain replication with threshold secret sharing. Teechain achieves at least a 33x higher transaction throughput than the state-of-the-art Lightning payment network. A 30-machine Teechain deployment can handle over 1 million Bitcoin transactions per second.
A blockchain is a decentralized ledger where all transactions are recorded. For having a reliable blockchain and double-spending prevention, we need a decentralized consensus and agreement on a blockchain. Bitcoin uses proof-of-work (PoW). It is a cryptographic puzzle that is difficult to solve but easy to verify. However, because of significant latency of proof-of-work for transactions confirmation, this consensus mechanism is vulnerable against double-spending. On the other hand, PoW consumes a significant amount of energy that by growing the network, it becomes a major problematic of this consensus mechanism. In this paper, we introduce an alternative to PoW, because of all its major problems and security issues that may lead to collapsing decentralization of the blockchain, while a full decentralized system is the main purpose of using blockchain technology. The approach we introduce is based on a distributed voting process and called "RDV: Register, Deposit, Vote". Since in RDV algorithm, there is no mining process, so it is appropriate for low-level energy devices and Internet of Things (IoT).
Joshua Lind, Christian Priebe, Divya Muthukumaran, Dan O’Keeffe · 12 authors
Trusted execution support in modern CPUs, as offered by Intel SGX enclaves , can protect applications in untrusted environments. While prior work has shown that legacy applications can run in their entirety inside enclaves, this results in a large trusted computing base (TCB). Instead, we explore an approach in which we partition an applica- tion and use an enclave to protect only security-sensitive data and functions, thus obtaining a smaller TCB. We describe Glamdring , the first source-level parti- tioning framework that secures applications written in C using Intel SGX. A developer first annotates security- sensitive application data. Glamdring then automatically partitions the application into untrusted and enclave parts: (i) to preserve data confidentiality, Glamdring uses dataflow analysis to identify functions that may be ex- posed to sensitive data; (ii) for data integrity, it uses back- ward slicing to identify functions that may affect sensitive data. Glamdring then places security-sensitive functions inside the enclave, and adds runtime checks and crypto- graphic operations at the enclave boundary to protect it from attack. Our evaluation of Glamdring with the Mem- cached store, the LibreSSL library, and the Digital Bitbox bitcoin wallet shows that it achieves small TCB sizes and has acceptable performance overheads.
Abstract Blockchains are distributed data structures that are used to achieve consensus in systems for cryptocurrencies (like Bitcoin) or smart contracts (like Ethereum). Although blockchains gained a lot of popularity recently, there are only few logic-based models for blockchains available. We introduce $\mathsf{BCL}$, a dynamic logic to reason about blockchain updates, and show that $\mathsf{BCL}$ is sound and complete with respect to a simple blockchain model.
A blockchain is a distributed ledger for recording transactions, maintained by many nodes without central authority through a distributed cryptographic protocol. All nodes validate the information to be appended to the blockchain, and a consensus protocol ensures that the nodes agree on a unique order in which entries are appended. Consensus protocols for tolerating Byzantine faults have received renewed attention because they also address blockchain systems. This work discusses the process of assessing and gaining confidence in the resilience of a consensus protocols exposed to faults and adversarial nodes. We advocate to follow the established practice in cryptography and computer security, relying on public reviews, detailed models, and formal proofs; the designers of several practical systems appear to be unaware of this. Moreover, we review the consensus protocols in some prominent permissioned blockchain platforms with respect to their fault models and resilience against attacks. The protocol comparison covers Hyperledger Fabric, Tendermint, Symbiont, R3~Corda, Iroha, Kadena, Chain, Quorum, MultiChain, Sawtooth Lake, Ripple, Stellar, and IOTA.
Applications requiring strict access control, such as medical record query, often require auditing of the query. The current typical design relies on server side logging. However, logging on server-side do not provide strict means of auditing, since the server can be tampered with attackers, and also anybody who has permission to write can modify the log. We propose a scheme using blockchain technology, as a request-response channel for a client-server system, to record both client request and server reply in an audi-table manner. We have implemented a proof-of-concept system on top of a publicly available blockchain testbed. By using a blockchain as a client-server request-response channel, the request-response sequence can be verified by anybody who has access to the blockchain, providing a way to implement audit log for strictly controlled resources.
In recent years, data is becoming the most valuable asset. There are more and more data exchange markets on Internet. These markets help data owners publish their datasets and data consumers find appropriate services. However, different from traditional goods like clothes and food, data is a special commodity. For current data exchange markets, it is very hard to protect copyright and privacy. Moreover, maintaining data services requires special IT techniques, which is a difficult job for many organizations who own big datasets, such as hospitals, government departments, planetariums and banks. In this paper, we propose a decentralized solution for big data exchange. This solution aims at cultivating an ecosystem, inside which all participators can cooperate to exchange data in a peer-to-peer way. The core part of this solution is to utilize blockchain technology to record transaction logs and other important documents. Unlike existing data exchange markets, our solution does not need any third-parties. It also provides an convenient way for data owners to audit the use of data, in order to protect data copyright and privacy. We will explain the ecosystem, and discuss the technical challenges and corresponding solutions.
Most blockchain systems are forkable in that they require participants to agree on a chain out of multiple possible branches of blocks. In this paper, we identify a new form of attack, called the Balance attack, against these forkable blockchain systems. The novelty of this attack consists of delaying network communications between multiple subgroups of nodes with balanced mining power. Our theoretical analysis captures the tradeoff between the network delay and the mining power of the attacker needed to double-spend in the GHOST protocol with high probability. We quantify our analysis in the settings of the Ethereum testnet of the R3 consortium where we show that a single machine needs to delay messages for 20 minutes to double spend while a coalition with a third of the mining power would simply need 4 minutes to double spend with 94% of success. We experiment the attack in our private Ethereum chain before arguing for a non-forkable blockchain design to protect against Balance attacks.
In the Bitcoin system, a peer-to-peer electronic currency system, the delay overhead in transaction verification prevents the Bitcoin from gaining increasing popularity nowadays as it makes the system vulnerable to double spend attacks. This paper introduces a proximity-aware extension to the current Bitcoin protocol, named Bitcoin Clustering Based Ping Time protocol (BCBPT). The ultimate purpose of the proposed protocol, that is based on how the clusters are formulated and the nodes define their membership, is to improve the transaction propagation delay in the Bitcoin network. In BCBPT, the proximity of connectivity in the Bitcoin network is increased by grouping Bitcoin nodes based on ping latencies between nodes. We show, through simulations, that the proximity base ping latency defines better clustering structures that optimize the performance of the transaction propagation delay. The reduction of the communication link cost measured by the information propagation time between nodes is mainly considered as a key reason for this improvement. Bitcoin Clustering Based Ping Time protocol is more effective at reducing the transaction propagation delay compared to the existing clustering protocol (LBC) that we proposed in our previous work.
Zhijie Ren, Kelong Cong, Johan Pouwelse, Zekeriya Erkin
Recently, the blockchain technique was put in the spotlight as it introduced a systematic approach for multiple parties to reach consensus without needing trust. However, the application of this technique in practice is severely restricted due to its limitations in throughput. In this paper, we propose a novel consensus model, namely the implicit consensus, with a distinctive blockchain-based distributed ledger in which each node holds its individual blockchain. In our system, the consensus is not on the transactions, but on a special type of blocks called Check Points that are used to validate individual transactions. Our system exploits the ideas of self-interest and spontaneous sharding and achieves unbounded throughput with the transaction reliability that equivalent to traditional Byzantine fault tolerance schemes.
Artem Barger, Yacov Manevich, Benjamin Mandler, Vita Bortnikov · 6 authors
Distributed Ledger Technology (DLT) is rapidly emerging as a new paradigm for automating complex business processes in secure and decentralised fashion. Currently, however, its wider adoption is hampered by scalability problems [3] rooted in an inherent tension between stringent consistency, security, and robustness requirements on one hand, and growing application demand coupled with high performance expectations on the other. For example, popular peer-to-peer DLTs based on proof-of-work consensus [4] can only improve the transaction throughput by degrading their security and consistency guarantees, which is unacceptable in the enterprise and mission-critical settings.
In theory, database transactions protect application data from corruption and integrity violations. In practice, database transactions frequently execute under weak isolation that exposes programs to a range of concurrency anomalies, and programmers may fail to correctly employ transactions. While low transaction volumes mask many potential concurrency-related errors under normal operation, determined adversaries can exploit them programmatically for fun and profit. In this paper, we formalize a new kind of attack on database-backed applications called an ACIDRain attack, in which an adversary systematically exploits concurrency-related vulnerabilities via programmatically accessible APIs. These attacks are not theoretical: ACIDRain attacks have already occurred in a handful of applications in the wild, including one attack which bankrupted a popular Bitcoin exchange. To proactively detect the potential for ACIDRain attacks, we extend the theory of weak isolation to analyze latent potential for non-serializable behavior under concurrent web API calls. We introduce a language-agnostic method for detecting potential isolation anomalies in web applications, called Abstract Anomaly Detection (2AD), that uses dynamic traces of database accesses to efficiently reason about the space of possible concurrent interleavings. We apply a prototype 2AD analysis tool to 12 popular self-hosted eCommerce applications written in four languages and deployed on over 2M websites. We identify and verify 22 critical ACIDRain attacks that allow attackers to corrupt store inventory, over-spend gift cards, and steal inventory.
Tien Tuan Anh Dinh, Ji Wang, Gang Chen, Rui Liu · 6 authors
Blockchain technologies are taking the world by storm. Public blockchains, such as Bitcoin and Ethereum, enable secure peer-to-peer applications like crypto-currency or smart contracts. Their security and performance are well studied. This paper concerns recent private blockchain systems designed with stronger security (trust) assumption and performance requirement. These systems target and aim to disrupt applications which have so far been implemented on top of database systems, for example banking, finance and trading applications. Multiple platforms for private blockchains are being actively developed and fine tuned. However, there is a clear lack of a systematic framework with which different systems can be analyzed and compared against each other. Such a framework can be used to assess blockchains' viability as another distributed data processing platform, while helping developers to identify bottlenecks and accordingly improve their platforms.