基于正常交易掩盖下的区块链隐蔽通信方案

随着计算机技术的发展,现代网络攻防形势日益严峻,秘密信息的安全传输问题亟待解决。隐蔽通信技术将秘密信息嵌入载体中通过隐蔽信道安全地传输,但传统的隐蔽信道存在数据易受损、易被攻击、易被检测等问题,无法满足更高的安全需求。区块链作为公共数据平台,能够在大量交易的掩盖下嵌入秘密信息,其具有的不易篡改、匿名性、去中心化等特点,可以很好地解决传统隐蔽信道存在的问题,实现安全的隐蔽通信,但现有的区块链隐蔽通信方案存在通信效率较低、安全性较差等问题,如何安全、高效地进行通信是区块链隐蔽通信的研究重点。提出一种基于正常交易掩盖下的区块链隐蔽通信方案,利用哈希算法构建免传输密码表在不改变任何交易数据的情况下实现秘密信息的嵌入,利用椭圆曲线特性可在海量的交易中快速筛选出带有隐藏信息的交易,从而快速提取秘密信息。所提方案提高了隐蔽通信的安全性、效率,可迁移性强,理论分析显示,攻击者无法区分普通交易和特殊交易,所提方案具有极高的抗检测性和可扩展性;比特币测试网的实验结果表明,所提方案的效率高。     

区块链的安全检测模型

区块链^[1]是去中心化交易平台比特币的底层技术.该系统由分布式数据存储、点对点传输、共识机制、加密算法等计算机技术组成,它的安全性受到广泛关注.目前的研究大多使用数学证明的方法分析每个攻击的作用,本文提出了一种新颖的根据区块链的结构来评估和检测安全性的方法.在真实环境下当一个区块连接超过6个区块后,该区块的内容基本无法改变,被认为是稳定状态,分支产生的概率逐渐降低,因此整个系统的状态是无限循环的.该方法通过分析每个结构到达稳定状态的概率来评估系统的安全性,并通过实验分析了攻击力度,攻击状态和实验循环次数之间的关系,验证了该方法的可行性和有效性.     

基于区块链技术的生物特征和口令双因子跨域认证方案

为解决传统跨域认证方式不多且方案复杂的问题,提出了基于区块链技术的生物特征和口令双因子跨域认证方案。首先,使用模糊提取技术提取生物特征的随机密钥参与认证,解决了生物特征泄露导致永久不可用的问题;其次,利用不易篡改的区块链存储生物特征公开信息,解决了模糊提取技术易受主动攻击威胁的问题;最后,基于区块链的分布式存储功能与联盟链架构,实现了用户在本地和异地环境下的双因子跨域认证。安全性分析和效率分析的结果表明,在安全性方面,所提方案具有抗中间人攻击、抗重放攻击等安全属性;在效率与可用性方面,该方案效率适中,用户无需携带智能卡,系统的可扩展性强。     

Proof of Activity Protocol for IoMT Data Security

The Internet of Medical Things (IoMT) is an online device that senses and transmits medical data from users to physicians within a time interval. In, recent years, IoMT has rapidly grown in the medical field to provide healthcare services without physical appearance. With the use of sensors, IoMT applications are used in healthcare management. In such applications, one of the most important factors is data security, given that its transmission over the network may cause obtrusion. For data security in IoMT systems, blockchain is used due to its numerous blocks for secure data storage. In this study, Blockchain-assisted secure data management framework (BSDMF) and Proof of Activity (PoA) protocol using malicious code detection algorithm is used in the proposed data security for the healthcare system. The main aim is to enhance the data security over the networks. The PoA protocol enhances high security of data from the literature review. By replacing the malicious node from the block, the PoA can provide high security for medical data in the blockchain. Comparison with existing systems shows that the proposed simulation with BSD-Malicious code detection algorithm achieves higher accuracy ratio, precision ratio, security, and efficiency and less response time for Blockchain-enabled healthcare systems.     

一种抗合谋攻击的区块链网络分片算法

分片技术是区块链用来解决可扩展性问题的主流技术之一。通过分片技术可以有效地提升区块链的吞吐量,然而由于子链算力分布不均导致区块链安全性差。为了降低网络分片引起的子链合谋攻击风险,提出基于一种抗合谋攻击的区块链网络分片算法（anti-collusion attack network sharding algorithm for blockchain,AANS）。该算法综合考虑节点行为特征及算力特征,通过轮询区块链网络中的恶意节点,将算力均匀分配在各个子链中,避免恶意节点聚集造成合谋攻击问题。仿真实验从子链恶意节点数量、子链合谋算力、子链合谋攻击占比和危险子链占比这四个方面验证所提出AANS算法的有效性。仿真结果表明,AANS算法可以有效避免子链恶意节点聚集,降低子链合谋攻击风险,保证区块链子链的安全性。     

一种基于运行时信息的以太坊智能合约防御技术

智能合约是区块链技术最成功的应用之一,已经被广泛集成到应用程序中,成为应用去中心化的常见实现方案.然而,智能合约由于其独有的金融特性,一直以来饱受安全攻击,各种新的恶意攻击类型层出不穷.现有的研究工作提出了多种有效检测合约漏洞的方法,但在实际应用中都存在着各种局限:仅针对已知的漏洞类型,需要修改合约代码来消除漏洞,链上开销过大.由于智能合约部署到链上后的不可修改性,这些针对特定漏洞类型的检测防御手段无法对原有的合约进行修复,因此很难及时地应对新型的漏洞和攻击.为此,提出了一种基于运行时信息的智能合约可升级防御技术,通过引入运行时的各种信息,为链下对攻击和漏洞的检测提供实时的数据.同时,设计了一套部署在合约上的访问控制机制,基于动态检测的结果,对合约的访问进行限制,从而在不需要修改合约代码的情况下实现动态的防御.由于以太坊本身的机制无法对实时攻击进行识别和拦截,为了减小这一影响,利用竞争(race condition)的机制来增强防御的效果.实验结果分析表明:该防御技术可以有效地检测并防御攻击,对于后续的攻击交易,可以实现100%的拦截成功率,对于首次检测到的实时攻击,利用竞争可以达到97.5%的成功率.     

Robust and efficient detection of DDoS attacks for large-scale internet

In recent years, distributed denial of service (DDoS) attacks have become a major security threat to Internet services. How to detect and defend against DDoS attacks is currently a hot topic in both industry and academia. In this paper, we propose a novel framework to robustly and efficiently detect DDoS attacks and identify attack packets. The key idea of our framework is to exploit spatial and temporal correlation of DDoS attack traffic. In this framework, we design a perimeter-based anti-DDoS system, in which traffic is analyzed only at the edge routers of an internet service provider (ISP) network. Our framework is able to detect any source-address-spoofed DDoS attack, no matter whether it is a low-volume attack or a high-volume attack. The novelties of our framework are (1) temporal-correlation based feature extraction and (2) spatial-correlation based detection. With these techniques, our scheme can accurately detect DDoS attacks and identify attack packets without modifying existing IP forwarding mechanisms at routers. Our simulation results show that the proposed framework can detect DDoS attacks even if the volume of attack traffic on each link is extremely small. Especially, for the same false alarm probability, our scheme has a detection probability of 0.97, while the existing scheme has a detection probability of 0.17, which demonstrates the superior performance of our scheme.     

Energy trading scheme based on consortium blockchain and game theory

With the gradual opening of the electricity sales market, distributed energy trading is becoming an important research topic. However, it is not easy to design practical energy trading schemes in distributed scenario. In particular, known distributed energy trading schemes do not address the security of transaction data and the maximization of benefits among all the participants. In this paper, we propose a distributed energy trading scheme based on consortium blockchain and game theory. In our scheme, a peer-to-peer trading platform is constructed to realize direct transactions among all the participants by the property of decentralization in consortium blockchain. The direct transactions greatly reduce operating costs of energy trading, and at the same time, the security of transaction data can be obtained by the cryptographic techniques such as digital signatures and hash functions associated with the underlying blockchain. Moreover, we design an energy transaction matching mechanism by game theory in our scheme. In the matching mechanism, we construct a game model among all the participants and design an equilibrium solving algorithm, which are the key techniques to realize the maximization of benefits among all the participants in energy trading. The security analysis and experimental results show that our scheme can realize the best transaction price and quantity in the transaction matching and has high security in distributed energy transaction scenarios.     

Cooperative Detection Method for DDoS Attacks Based on Blockchain

Distributed Denial of Service (DDoS) attacks is always one of the major problems for service providers. Using blockchain to detect DDoS attacks is one of the current popular methods. However, the problems of high time overhead and cost exist in the most of the blockchain methods for detecting DDoS attacks. This paper proposes a blockchain-based collaborative detection method for DDoS attacks. First, the trained DDoS attack detection model is encrypted by the Intel Software Guard Extensions (SGX), which provides high security for uploading the DDoS attack detection model to the blockchain. Secondly, the service provider uploads the encrypted model to Inter Planetary File System (IPFS) and then a corresponding Content-ID (CID) is generated by IPFS which greatly saves the cost of uploading encrypted models to the blockchain. In addition, due to the small amount of model data, the time cost of uploading the DDoS attack detection model is greatly reduced. Finally, through the blockchain and smart contracts, the CID is distributed to other service providers, who can use the CID to download the corresponding DDoS attack detection model from IPFS. Blockchain provides a decentralized, trusted and tamper-proof environment for service providers. Besides, smart contracts and IPFS greatly improve the distribution efficiency of the model, while the distribution of CID greatly improves the efficiency of the transmission on the blockchain. In this way, the purpose of collaborative detection can be achieved, and the time cost of transmission on blockchain and IPFS can be considerably saved. We designed a blockchain-based DDoS attack collaborative detection framework to improve the data transmission efficiency on the blockchain, and use IPFS to greatly reduce the cost of the distribution model. In the experiment, compared with most blockchain-based method for DDoS attack detection, the proposed model using blockchain distribution shows the advantages of low cost and latency. The remote authentication mechanism of Intel SGX provides high security and integrity, and ensures the availability of distributed models.     

高效抗单点失效的区块链钱包保护方案

利用区块链钱包保存的私钥对交易进行签名是区块链上交易的唯一途径,钱包中存储的私钥一旦丢失或泄露将造成无法挽回的损失.目前主流的钱包管理方案都将钱包集中存储在单个位置或者依赖可信第三方的参与,无法抵抗单点失效.针对区块链的钱包安全问题,提出一个基于无可信中心门限椭圆曲线数字签名的区块链钱包保护方案.该方案在无可信中心参与的情况下由参与者合作生成公私钥和各自的私钥碎片,超过门限阈值的参与者合作才能对交易进行有效签名,可有效抵抗单点攻击,保障钱包安全.经过安全性分析,该方案满足抗伪造性、匿名性、鲁棒性、不可追溯性和不可撤销性.通过效率分析,该方案完成签名仅需常数轮,可在增加较少签名时间的情况下保障区块链钱包安全.     

A Novel Post-Quantum Blind Signature for Log System in Blockchain

In recent decades, log system management has been widely studied for data security management. System abnormalities or illegal operations can be found in time by analyzing the log and provide evidence for intrusions. In order to ensure the integrity of the log in the current system, many researchers have designed it based on blockchain. However, the emerging blockchain is facing significant security challenges with the increment of quantum computers. An attacker equipped with a quantum computer can extract the user's private key from the public key to generate a forged signature, destroy the structure of the blockchain, and threaten the security of the log system. Thus, blind signature on the lattice in post-quantum blockchain brings new security features for log systems. In our paper, to address these, firstly, we propose a novel log system based on post-quantum blockchain that can resist quantum computing attacks. Secondly, we utilize a post-quantum blind signature on the lattice to ensure both security and blindness of log system, which makes the privacy of log information to a large extent. Lastly, we enhance the security level of lattice-based blind signature under the random oracle model, and the signature size grows slowly compared with others. We also implement our protocol and conduct an extensive analysis to prove the ideas. The results show that our scheme signature size edges up subtly compared with others with the improvement of security level.     

A secure routing scheme based on social network analysis in wireless mesh networks无线网状网中一种基于社会网络分析的安全路由机制

As an extension of wireless ad hoc and sensor networks, wireless mesh networks (WMNs) are employed as an emerging key solution for wireless broadband connectivity improvement. Due to the lack of physical security guarantees, WMNs are susceptible to various kinds of attack. In this paper, we focus on node social selfish attack, which decreases network performance significantly. Since this type of attack is not obvious to detect, we propose a security routing scheme based on social network and reputation evaluation to solve this attack issue. First, we present a dynamic reputation model to evaluate a node’s routing behavior, from which we can identify selfish attacks and selfish nodes. Furthermore, a social characteristic evaluation model is studied to evaluate the social relationship among nodes. Groups are built based on the similarity of node social status and we can get a secure routing based on these social groups of nodes. In addition, in our scheme, nodes are encouraged to enter into multiple groups and friend nodes are recommended to join into groups to reduce the possibility of isolated nodes. Simulation results demonstrate that our scheme is able to reflect node security status, and routings are chosen and adjusted according to security status timely and accurately so that the safety and reliability of routing are improved.     

基于随机博弈的机会网络隐私保护机制

机会网络在数据转发过程中,由于需要依靠陌生节点帮助转发信息或者接收来自陌生节点的数据,这种数据转发机制对普通用户来说具有严重的隐私安全隐患。因此,本文针对机会网络中存在恶意节点窃取用户隐私等安全问题,为机会网络中的用户设计出一种最佳防御策略来防止个人隐私泄露。首先,建立机会网络下的系统模型,使用马尔科夫链刻画普通用户的个人信息的变化过程。在系统模型的基础上,采用随机博弈理论对用户与攻击者之间的攻防关系进行建模;然后,提出一种基于极小极大学习算法的防御策略;最后,通过与传统防御算法的对比实验,证明该算法不但具有较快的收敛速度,且在满足一定用户服务质量的前提下,性能始终优于其他防御策略,是机会网络下一种高效的隐私保护安全机制。     

一种监管友好的可编辑区块链方案

现有区块链内容监管方案均采用事后治理方式,缺乏事前审计,且存在签名失效和多版本区块验证效率低的问题。针对这些问题,首先,设计了一种可动态调整可追责的数据审计方法,实现了对区块链交易数据的事前审计;其次,设计了一种编辑可控的数字签名方案RCDSS（redaction-controlled digital signature scheme）,解决了因编辑操作造成的签名失效问题;最后,设计了一种区块链数据一致性验证协议,实现了对查询结果的高效验证。安全分析和性能测试结果表明了其安全性和有效性。该方案在实现监管可控的情况下,仍然保持了较高的区块生成和验证效率,为区块链内容监管提供了一种新的解决思路。     

基于联盟区块链的V2G网络跨域认证技术研究

针对车辆到电网（Vehicle-to-Grid,V2G）网络所面临的安全威胁,分析了V2G多域网络架构,给出了一个适用于该架构的网络信任模型。基于联盟区块链提出一种V2G网络跨管理域认证方案,通过本域用户与外地域服务器以及外地域服务器与其域内用户的认证实现域间用户双向认证。该方案利用区块链所具有的不易篡改特性,在数字身份验证环节采用哈希算法减少方案中的签名与验证次数,提高了方案的效率和可扩展性。该认证方案中的签名采用基于身份的密码算法SM9,在适应性选择消息攻击下具有存在性不可伪造安全。     

区块链中攻击方式的研究

随着以数字加密货币为代表的区块链1.0技术和以以太坊为代表的区块链2.0技术的发展,区块链技术的安全性成为了研究热点问题.区块链系统的数据层、网络层、共识层、激励层、合约层与应用层均存在可被攻击者利用的漏洞.本文通过分析比特币、以太坊等平台中常见的攻击方式,提出了全新的区块链中攻击方式的分类方法.本文提出的攻击分类方法...     

高效安全的可审计盲混币服务方案

混币服务能够为区块链隐私泄露问题提供解决方案,但仍然面临效率瓶颈和安全风险,为进一步提升混币服务的效率和安全防护能力,提出一种高效安全的可审计盲混币服务方案。该方案首先增加了审计措施,在传统的混币模型基础上,增加审计区块链,以记录用户和混币器行为,实现可追溯和可问责;然后利用椭圆曲线算法构造盲签名,替代现有研究中基于双线性对或RSA的盲签名算法;最后基于可审计的混币模型和新构造的盲签名算法,提出可审计的盲混币服务协议。仿真分析表明,所提方案在提供隐私保护的同时,具有可审计性、抗盗窃攻击等6种安全特性;在同等安全强度下,较对比方案,所提方法能够有效降低计算开销和存储开销。     

Outsourced data integrity verification based on blockchain in untrusted environment

Outsourced data, as the significant component of cloud service, has been widely used due to its convenience, low overhead, and high flexibility. To guarantee the integrity of outsourced data, data owner (DO) usually adopts a third party auditor (TPA) to execute the data integrity verification scheme. However, during the verification process, DO cannot fully confirm the reliability of the TPA, and handing over the verification of data integrity to the untrusted TPA may lead to data security threats. In this paper, we focus on the problem of integrity verification of outsourced data in untrusted environment, that is, how to improve the security and efficiency of data integrity verification without utilizing untrusted TPA. To address the problem, we design a decentralized model based on blockchain consisting of some collaborative verification peers (VPs), each of which maintains a replication of the entire blockchain to avoid maliciously tampering with. Based on the model, we present an advanced data integrity verification algorithm which allows DO to store and check the verification information by writing and retrieving the blockchain. In addition, in order to improve the concurrent performance, we extend the algorithm by introducing the verification group (VG) constituting by some VPs organized by Inner-Group and Inter-Group consensus protocols. We conduct a completed security analysis as well as extensive experiments of our proposed approach, and the evaluation results demonstrate that our proposed approaches achieve superior performance.

     

高效不含双线性对的基于证书签名方案

目前大多数基于证书密码体制的数字签名方案都使用双线性对构造, 计算开销较大、计算效率低, 因此有必要研究更安全、更高效的基于证书签名方案。基于离散对数难题和分叉引理, 提出了一个不含双线性对运算的基于证书数字签名方案, 并在随机预言模型下证明了方案的安全性, 分析了方案的效率。分析表明, 方案可以抵抗用户伪造攻击和CA伪造攻击, 抵抗公钥替换攻击, 并且计算效率较高, 适合应用于移动通信等计算能力和带宽受限的领域。     

区块链资产窃取攻击与防御技术综述

自中本聪提出比特币以来,区块链技术得到了跨越式发展,特别是在数字资产转移及电子货币支付方面。以太坊引入智能合约代码,使其具备了同步及保存智能合约程序执行状态,自动执行交易条件并消除对中介机构需求,Web3.0 开发者可利用以太坊提供的通用可编程区块链平台构建更加强大的去中心化应用。公链系统具备的特点,如无须中央节点控制、通过智能合约保障交互数据公开透明、用户数据由用户个人控制等,使得它在区块链技术发展的过程中吸引了更多的用户关注。然而,随着区块链技术的普及和应用,越来越多的用户将自己的数字资产存储在区块链上。由于缺少权威机构的监管及治理,以太坊等公链系统正逐步成为黑客窃取数字资产的媒介。黑客利用区块链实施诈骗及钓鱼攻击,盗取用户所持有的数字资产来获取利益。帮助读者建立区块链资产安全的概念,从源头防范利用区块链实施的资产窃取攻击。通过整理总结黑客利用区块链环境实施的资产窃取攻击方案,抽象并归纳威胁模型的研究方法,有效研究了各类攻击的特征及实施场景。通过深入分析典型攻击方法,比较不同攻击的优缺点,回答了攻击能够成功实施的根本原因。在防御技术方面,针对性结合攻击案例及攻击实施场景介绍了钓鱼检测、代币授权检测、代币锁定、去中心化代币所属权仲裁、智能合约漏洞检测、资产隔离、供应链攻击检测、签名数据合法性检测等防御方案。对于每一类防御方案,给出其实施的基本流程及方案,明确了各防护方案能够在哪类攻击场景下为用户资产安全提供防护。