Kumar Bhaskaran, Peter Ilfrich, Dain Liffman, Christian Vecchiola · 12 authors
Blockchains are designed for trustworthy and transparent execution of transactions involving multiple parties. An important class of applications requires data to be shared selectively among mutually anonymous transacting peers while retaining the tamper-resistant evidentiary and validation features of a blockchain. KYC validations of corporate customers by banks is one example, where both banks and customers benefit from sharing process and data on a blockchain network. However, sharing of confidential KYC data must be authorized by customers, and a bank-customer relationship must be kept secret from other banks in the network. In this paper, we describe the design and implementation of a smart contract for consent-driven and double-blind data sharing on the Hyperledger Fabric blockchain platform. We show how a KYC application was built around this model to address the needs of the banks while meeting regulatory requirements.
E-government system has greatly improved the efficiency and transparency of daily operations of a government. However, most of existing e-government services are provided in a centralized manner and heavily rely on human individuals to control. The highly centralized IT infrastructure is more vulnerable to outside attacks. Also, it is relatively easy to compromise the data integrity by inside rogue users. Furthermore, relying on individuals to monitor and control some of the working flows makes the system error-prone and leaves room for corruption. To address these challenges, we propose to use the blockchain technology and decentralized autonomous organization (DAO) to improve the e-government system. The blockchain-based DAO system works in a fully decentralized way and is immune to both outside and inside attacks. At the same time, operations of such system is only controlled by pre-defined rules; thus, the uncertainty and errors caused by human processes are greatly reduced. We provide a concrete use case to demonstrate the usage of DAO e-government and evaluate its effectiveness.
Alexander Yakubov, Wazen M. Shbair, Anders Wallbom, David Sanda · 5 authors
Public-Key Infrastructure (PKI) is the cornerstone technology that facilitates secure information exchange over the Internet. However, PKI is exposed to risks due to potential failures of Certificate Authorities (CAs) that may be used to issue unauthorized certificates for end-users. Many recent breaches show that if a CA is compromised, the security of the corresponding end-users will be in risk. As an emerging solution, Blockchain technology potentially resolves the problems of traditional PKI systems - in particular, elimination of single point-of-failure and rapid reaction to CAs shortcomings. Blockchain has the ability to store and manage digital certificates within a public and immutable ledger, resulting in a fully traceable history log. In this paper we designed and developed a blockchain-based PKI management framework for issuing, validating and revoking X.509 certificates. Evaluation and experimental results confirm that the proposed framework provides more reliable and robust PKI systems with modest maintenance costs.
Paul Dunphy, Luke Garratt, Fabien A. P. Petitcolas
Distributed Ledger Technology (DLT) has been proposed as a new way to incorporate decentralization into a wide range of digital infrastructures. Applications of DLT to digital identity are increasing in prevalence, with a recent survey reporting that 55% of DLT technologies in development track digital identity. However, while proofs of concept, open source software, and new ideas are readily available, it is still unclear the extent to which DLT can play a role to underpin new forms of digital identity. In this position paper, we situate this fast-moving application domain into the broader challenges faced in digital identity, with the aim to highlight the socio-technical nature of the challenge at hand, and to propose directions for future research.
In the second decade of the 21st century, blockchain definitely became one of the most trending computational technologies. This research aims to question the feasibility and suitability of using blockchain technology within e-voting systems, regarding both technical and non-technical aspects. In today's world, although the course of this spreading is considerably slow, several countries already use means of e-voting due to many social and economic reasons, which we further investigated. Nevertheless, the number of countries offering various e-government solutions, apart from e-voting, is significantly high. E-voting systems, naturally, require much more attention and assurance regarding potential security and anonymity issues, since voting is one of the few extremely critical governmental processes. Nevertheless, e-voting is not purely a governmental service, but many companies and nonprofit organizations would benefit the cost-efficiency, scalability, remote accessibility, and ease of use that it provides. Blockchain technology is claimed to be able to address some, obviously not all, important security concerns, including anonymity, confidentiality, integrity, and non-repudiation. The analysis results presented in this article mostly confirm these claims.
Bitcoin provides freshness properties by forming a blockchain where each block is associated with its timestamp and the previous block. Due to these properties, the Bitcoin protocol is being used as a decentralized, trusted, and secure timestamping service. Although Bitcoin participants which create new blocks cannot modify their order, they can manipulate timestamps almost undetected. This undermines the Bitcoin protocol as a reliable timestamping service. In particular, a newcomer that synchronizes the entire blockchain has a little guarantee about timestamps of all blocks. In this paper, we present a simple yet powerful mechanism that increases the reliability of Bitcoin timestamps. Our protocol can provide evidence that a block was created within a certain time range. The protocol is efficient, backward compatible, and surprisingly, currently deployed SSL/TLS servers can act as reference time sources. The protocol has many applications and can be used for detecting various attacks against the Bitcoin protocol.
Bitcoin provides freshness properties by forming a blockchain where each block is associated with its timestamp and the previous block. Due to these properties, the Bitcoin protocol is being used as a decentralized, trusted, and secure timestamping service. Although Bitcoin participants which create new blocks cannot modify their order, they can manipulate timestamps almost undetected. This undermines the Bitcoin protocol as a reliable timestamping service. In particular, a newcomer that synchronizes the entire blockchain has a little guarantee about timestamps of all blocks.
In this paper, we present a simple yet powerful mechanism that increases the reliability of Bitcoin timestamps. Our protocol can provide evidence that a block was created within a certain time range. The protocol is efficient, backward compatible, and surprisingly, currently deployed SSL/TLS servers can act as reference time sources. The protocol has many applications and can be used for detecting various attacks against the Bitcoin protocol.
Privacy and safety are the most needed features while accessing the data in the IoT. Due to the complicated decentralization and heterogeneous environment present in IoT, the security and privacy of the data becomes a challenging job for the developers. The current methods are not suitable for these scenarios where a decentralized and heterogeneous system exists. This paper provides a new method for access control in IoT based on the booming technology "Block Chain," which helps the user in accessing or controlling their data. The contribution consists of a description of the model used to show how a blockchain is used for creating access control methods. To implement the method, the blockchain is taken as the decentralized access manager. The proposed method is validated with respect to the previous related work. Finally, the limitations and future work of the paper are discussed. Access Control Systems are proved to provide access control to critical resources. The right to access the resources is defined by the access control policies that are executed during the access request time.
Recently, there has been a growing interest in using online technologies to design protocols for secure electronic voting. The main challenges include vote privacy and anonymity, ballot irrevocability and transparency throughout the vote counting process. The introduction of the blockchain as a basis for cryptocurrency protocols, provides for the exploitation of the immutability and transparency properties of these distributed ledgers. In this paper, we discuss possible uses of the blockchain technology to implement a secure and fair voting system. In particular, we introduce a secret share-based voting system on the blockchain, the so-called SHARVOT protocol. Our solution uses Shamir's Secret Sharing to enable on-chain, i.e. within the transactions script, votes submission and winning candidate determination. The protocol is also using a shuffling technique, Circle Shuffle, to de-link voters from their submissions.
Increasingly digital technology in the present helped many people lives. This paper describes an electoral system for Indian election on blockchain technology and Aadhar verification. The aspect of security and transparency is a threat from still widespread election with the current system. Some of the problems that can occur in the current system are with an organization that has full control over the database and system, it is possible to tamper with the database of considerable opportunities. The proposed system is mainly designed for our country based on Aadhar verification where the details of the persons who are above 18 years are extracted from Aadhar card database since it had become mandatory in the present scenario. To ensure more security, the fingerprint of a voter is used as the main authentication resource. The system will allow the voter to vote through his fingerprint. As soon as they cast their vote, blockchain technology comes into existence which is integrated inside EVM. By adopting Blockchain in the distribution of databases can reduce one of the cheating sources of database manipulation. This research discusses the recording of the voting result in blockchain algorithm from every place of election.
We design and implement the first private and anonymous decentralized crowdsourcing system ZebraLancer, and overcome two fundamental challenges of decentralizing crowdsourcing, i.e., data leakage and identity breach. First, our outsource-then-prove methodology resolves the tension between the blockchain transparency and the data confidentiality to guarantee the basic utilities/fairness requirements of data crowdsourcing, thus ensuring: (i) a requester will not pay more than what data deserve, according to a policy announced when her task is published via the blockchain; (ii) each worker indeed gets a payment based on the policy, if he submits data to the blockchain; (iii) the above properties are realized not only without a central arbiter, but also without leaking the data to the open blockchain. Second, the transparency of blockchain allows one to infer private information about workers and requesters through their participation history. Simply enabling anonymity is seemingly attempting but will allow malicious workers to submit multiple times to reap rewards. ZebraLancer also overcomes this problem by allowing anonymous requests/submissions without sacrificing accountability. The idea behind is a subtle linkability: if a worker submits twice to a task, anyone can link the submissions, or else he stays anonymous and unlinkable across tasks. To realize this delicate linkability, we put forward a novel cryptographic concept, i.e., the common-prefix-linkable anonymous authentication. We remark the new anonymous authentication scheme might be of independent interest. Finally, we implement our protocol for a common image annotation task and deploy it in a test net of Ethereum. The experiment results show the applicability of our protocol atop the existing real-world blockchain.
The radical growth of Bitcoin revolutionized the field of digital currencies by offering a secure replacement for online electronic payments like card payments and Internet banking. Notably, Bitcoin has become popular since it maintains the anonymity of the users and enables peer-to-peer instant payments across the world. It is a decentralized money transfer protocol that does transactions without exposing user credentials and does verifications without any third-party intervention. Though it maintains anonymity, decentralization concept introduced vulnerabilities leading to severe security issues like double spending, block withholding and 51% attacks. These issues necessitate security specific enhancements in Bitcoin protocol. Therefore, this paper proposes a method of incorporating criteria check for miners to participate in mining process and a verification process to join the mining pool. The proposed idea mitigates double spending, block withholding, and 51% attacks. Further, a new approach is proposed namely, refining block creation and verification strategy for improving transaction rate without compromising security.
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Emre Yavuz, Ali Kaan Koc, Umut Can Çabuk, Gökhan Dalkılıç
There is no doubt that the revolutionary concept of the blockchain, which is the underlying technology behind the famous cryptocurrency Bitcoin and its successors, is triggering the start of a new era in the Internet and the online services. While most people focus only at cryptocurrencies; in fact, many administrative operations, fintech procedures, and everyday services that can only be done offline and/or in person, can now safely be moved to the Internet as online services. What makes it a powerful tool for digitalizing everyday services is the introduction of smart contracts, as in the Ethereum platform. Smart contracts are meaningful pieces of codes, to be integrated in the blockchain and executed as scheduled in every step of blockchain updates. E-voting on the other hand, is another trending, yet critical, topic related to the online services. The blockchain with the smart contracts, emerges as a good candidate to use in developments of safer, cheaper, more secure, more transparent, and easier-to-use e-voting systems. Ethereum and its network is one of the most suitable ones, due to its consistency, widespread use, and provision of smart contracts logic. An e-voting system must be secure, as it should not allow duplicated votes and be fully transparent, while protecting the privacy of the attendees. In this work, we have implemented and tested a sample e-voting application as a smart contract for the Ethereum network using the Ethereum wallets and the Solidity language. Android platform is also considered to allow voting for people who do not have an Ethereum wallet. After an election is held, eventually, the Ethereum blockchain will hold the records of ballots and votes. Users can submit their votes via an Android device or directly from their Ethereum wallets, and these transaction requests are handled with the consensus of every single Ethereum node. This consensus creates a transparent environment for e-voting. In addition to a broad discussion about reliability and efficiency of the blockchain-based e-voting systems, our application and its test results are presented in this paper, too.
In this work, we propose a novel approach, called Conflicts Check Protocol (CCP), which enables preventing potential attacks on bitcoin system. Based on the observation and discovery of a common symptom that many attacks may generate, an arbitration mechanism is proposed to determine the approval or abandon of certain transactions involved in confliction. Experimental results verified our statistical assumption and proved that the CCP is robust in handling many transactions in confliction scenarios and can significantly enhance the security of the current bitcoin systems. Unlike many of the existing efforts, this work examines the security issue of bitcoin from a new perspective, which can be extended further to a much larger scope of attack analysis and prevention.
Since 2004, different research was handling the challenges in the centralized voting systems, e-voting protocols and recently the decentralized voting. So electronic voting puts forward some difficulties regarding the voter anonymity, the secure casting of the votes and to prevent the voting process from frauding. The Decentralized property of the technology called "blockchain" could have the solution for many of the challenges in voting research area and brings a new secure mechanism of safe and transparent voting. In this paper, a broad comparison between ongoing voting systems has studied by analyzing their structure and the drawbacks that should consider in future to improve the whole election process from keeping the privacy of the voter, casting a vote with the possibility to check if it was counted correctly to publishing the results. The result of the paper will give a new approach to extend the target of the election from small scale to large scale despite the fact of Ethereum limitation which can cast on the blockchain just five votes per minute. The primary challenge is to find an answer for this question: "How to balance between voter privacy and transparency without breaking the important rule where the voter can proof for a specific candidate that he voted for him in a bribe situation?".
Alberto Sonnino, Mustafa Al-Bassam, Shehar Bano, Sarah Meiklejohn · 5 authors
Coconut is a novel selective disclosure credential scheme supporting distributed threshold issuance, public and private attributes, re-randomization, and multiple unlinkable selective attribute revelations. Coconut integrates with blockchains to ensure confidentiality, authenticity and availability even when a subset of credential issuing authorities are malicious or offline. We implement and evaluate a generic Coconut smart contract library for Chainspace and Ethereum; and present three applications related to anonymous payments, electronic petitions, and distribution of proxies for censorship resistance. Coconut uses short and computationally efficient credentials, and our evaluation shows that most Coconut cryptographic primitives take just a few milliseconds on average, with verification taking the longest time (10 milliseconds).
This paper investigates a critical access control issue in the Internet of Things (IoT). In particular, we propose a smart contract-based framework, which consists of multiple access control contracts (ACCs), one judge contract (JC), and one register contract (RC), to achieve distributed and trustworthy access control for IoT systems. Each ACC provides one access control method for a subject-object pair, and implements both static access right validation based on predefined policies and dynamic access right validation by checking the behavior of the subject. The JC implements a misbehavior-judging method to facilitate the dynamic validation of the ACCs by receiving misbehavior reports from the ACCs, judging the misbehavior and returning the corresponding penalty. The RC registers the information of the access control and misbehavior-judging methods as well as their smart contracts, and also provides functions (e.g., register, update, and delete) to manage these methods. To demonstrate the application of the framework, we provide a case study in an IoT system with one desktop computer, one laptop and two Raspberry Pi single-board computers, where the ACCs, JC, and RC are implemented based on the Ethereum smart contract platform to achieve the access control.
A blockchain system is different from the hitherto used featuring robustness and disintermediation. A blockchain consists of records (blocks) recorded in a digital ledger, thoroughly decentralized where transactions are recorded in contrast to the tables in the relational database. A transaction once recorded in the system is resistant to alteration. The paper proposed several applications of blockchain system integrating it with the national identity of an individual. The national identification records of an individual must contain the fundamental details regarding the individual along with the biometrics. The available attributes of the national identification records can be used efficaciously in applications such as banking, digitizing healthcare, digital voting, etc. An example for such a national identity is the Aadhar in India which is currently utilized in centralized applications. Integrating Aadhar with blockchain yields illimitable applications in a decentralized, secure and transparent manner.
In the era of digitalization, crypto-currency has become the talk of the town and Bitcoin is one of it. Bitcoin System is not controlled by any central authority or governed by any management division. Bitcoin is the first digital decentralized currency and its economic growth has encompassed to billions of dollars within a few years. In this paper we present detailed Introduction to the digital currency including the crypto-currency, then we present Bitcoin system in depth with the process of transactions, mining, miners' pooling. As we know that the popularity of Bitcoin is increasing day by day so are the attacks. We present an analysis of major attacks in the Bitcoin system such as eclipse attack, Sybil attack, >51% attack, selfish mining. More importantly, we present how these attacks play an important role for the attackers in order to receive unfair incentives or fraud the honest users. The current researchers are focusing on creating new protocols as defensive measures for the attacks; we also analyze the security of these protocols.
As we observe a trend towards the recentralisation of the Internet, this paper raises the question of guaranteeing an everlasting decentralisation. We introduce the properties of strong and soft uncentralisability in order to describe systems in which all authorities can be untrusted at any time without affecting the system. We link the soft uncentralisability to another property called perfect forkability. Using that knowledge, we introduce a new cryptographic primitive called uncentralisable ledger and study its properties. We use those properties to analyse what an uncentralisable ledger may offer to classic electronic voting systems and how it opens up the realm of possibilities for completely new voting mechanisms. We review a list of selected projects that implement voting systems using blockchain technol- ogy. We then conclude that the true revolutionary feature enabled by uncentralisable ledgers is a self-sovereign and distributed identity provider.
Husam Al Jawaheri, Mashael Al Sabah, Yazan Boshmaf, Aiman Erbad
With the rapid increase of threats on the Internet, people are continuously seeking privacy and anonymity. Services such as Bitcoin and Tor were introduced to provide anonymity for online transactions and Web browsing. Due to its pseudonymity model, Bitcoin lacks retroactive operational security, which means historical pieces of information could be used to identify a certain user. We investigate the feasibility of deanonymizing users of Tor hidden services who rely on Bitcoin as a payment method by exploiting public information leaked from online social networks, the Blockchain, and onion websites. This, for example, allows an adversary to link a user with @alice Twitter address to a Tor hidden service with private.onion address by finding at least one past transaction in the Blockchain that involves their publicly declared Bitcoin addresses.
To demonstrate the feasibility of this deanonymization attack, we carried out a real-world experiment simulating a passive, limited adversary. We crawled 1.5K hidden services and collected 88 unique Bitcoin addresses. We then crawled 5B tweets and 1M BitcoinTalk forum pages and collected 4.2K and 41K unique Bitcoin addresses, respectively. Each user address was associated with an online identity along with its public profile information. By analyzing the transactions in the Blockchain, we were able to link 125 unique users to 20 Tor hidden services, including sensitive ones, such as The Pirate Bay and Silk Road. We also analyzed two case studies in detail to demonstrate the implications of the resulting information leakage on user anonymity. In particular, we confirm that Bitcoin addresses should always be considered exploitable, as they can be used to deanonymize users retroactively. This is especially important for Tor hidden service users who actively seek and expect privacy and anonymity.
Husam Al Jawaheri, Mashael Al Sabah, Yazan Boshmaf, Aiman Erbad
With the rapid increase of threats on the Internet, people are continuously seeking privacy and anonymity. Services such as Bitcoin and Tor were introduced to provide anonymity for online transactions and Web browsing. Due to its pseudonymity model, Bitcoin lacks retroactive operational security, which means historical pieces of information could be used to identify a certain user. We investigate the feasibility of deanonymizing users of Tor hidden services who rely on Bitcoin as a payment method by exploiting public information leaked from online social networks, the Blockchain, and onion websites. This, for example, allows an adversary to link a user with @alice Twitter address to a Tor hidden service with private.onion address by finding at least one past transaction in the Blockchain that involves their publicly declared Bitcoin addresses. To demonstrate the feasibility of this deanonymization attack, we carried out a real-world experiment simulating a passive, limited adversary. We crawled 1.5K hidden services and collected 88 unique Bitcoin addresses. We then crawled 5B tweets and 1M BitcoinTalk forum pages and collected 4.2K and 41K unique Bitcoin addresses, respectively. Each user address was associated with an online identity along with its public profile information. By analyzing the transactions in the Blockchain, we were able to link 125 unique users to 20 Tor hidden services, including sensitive ones, such as The Pirate Bay and Silk Road. We also analyzed two case studies in detail to demonstrate the implications of the resulting information leakage on user anonymity. In particular, we confirm that Bitcoin addresses should always be considered exploitable, as they can be used to deanonymize users retroactively. This is especially important for Tor hidden service users who actively seek and expect privacy and anonymity.