Bitcoin is a popular cryptocurrency that records all transactions in a distributed append-only public ledger called blockchain . The security of Bitcoin heavily relies on the incentive-compatible proof-of-work (PoW) based distributed consensus protocol, which is run by the network nodes called miners . In exchange for the incentive, the miners are expected to maintain the blockchain honestly. Since its launch in 2009, Bitcoin economy has grown at an enormous rate, and it is now worth about 150 billions of dollars. This exponential growth in the market value of bitcoins motivate adversaries to exploit weaknesses for profit, and researchers to discover new vulnerabilities in the system, propose countermeasures, and predict upcoming trends. In this paper, we present a systematic survey that covers the security and privacy aspects of Bitcoin. We start by giving an overview of the Bitcoin system and its major components along with their functionality and interactions within the system. We review the existing vulnerabilities in Bitcoin and its major underlying technologies such as blockchain and PoW-based consensus protocol. These vulnerabilities lead to the execution of various security threats to the standard functionality of Bitcoin. We then investigate the feasibility and robustness of the state-of-the-art security solutions. Additionally, we discuss the current anonymity considerations in Bitcoin and the privacy-related threats to Bitcoin users along with the analysis of the existing privacy-preserving solutions. Finally, we summarize the critical open challenges, and we suggest directions for future research towards provisioning stringent security and privacy solutions for Bitcoin.

A Survey on Security and Privacy Issues of Bitcoin

Radio access technologies for cellular mobile communications are typically characterized by multiple access schemes, e.g., frequency division multiple access (FDMA), time division multiple access (TDMA), code division multiple access (CDMA), and OFDMA. In the 4th generation (4G) mobile communication systems such as Long-Term Evolution (LTE) (Au et al., Uplink contention based SCMA for 5G radio access. Globecom Workshops (GC Wkshps), 2014. doi:10.1109/GLOCOMW.2014.7063547) and LTE-Advanced (Baracca et al., IEEE Trans. Commun., 2011. doi:10.1109/TCOMM.2011.121410.090252; Barry et al., Digital Communication, Kluwer, Dordrecht, 2004), standardized by the 3rd Generation Partnership Project (3GPP), orthogonal multiple access based on OFDMA or single carrier (SC)-FDMA is adopted. Orthogonal multiple access was a reasonable choice for achieving good system-level throughput performance with simple single-user detection. However, considering the trend in 5G, achieving significant gains in capacity and system throughput performance is a high priority requirement in view of the recent exponential increase in the volume of mobile traffic. In addition the proposed system should be able to support enhanced delay-sensitive high-volume services such as video streaming and cloud computing. Another high-level target of 5G is reduced cost, higher energy efficiency and robustness against emergencies.

Non-Orthogonal Multiple Access (NOMA) for cellular future radio access

Fuzz testing has enjoyed great success at discovering security critical bugs in real software. Recently, researchers have devoted significant effort to devising new fuzzing techniques, strategies, and algorithms. Such new ideas are primarily evaluated experimentally so an important question is: What experimental setup is needed to produce trustworthy results? We surveyed the recent research literature and assessed the experimental evaluations carried out by 32 fuzzing papers. We found problems in every evaluation we considered. We then performed our own extensive experimental evaluation using an existing fuzzer. Our results showed that the general problems we found in existing experimental evaluations can indeed translate to actual wrong or misleading assessments. We conclude with some guidelines that we hope will help improve experimental evaluations of fuzz testing algorithms, making reported results more robust.

https://dl.acm.org/doi/pdf/10.1145/3243734.3243804

Evaluating Fuzz Testing

This paper presents a comprehensive survey of the existing blockchain protocols for the Internet of Things (IoT) networks. We start by describing the blockchains and summarizing the existing surveys that deal with blockchain technologies. Then, we provide an overview of the application domains of blockchain technologies in IoT, e.g., Internet of Vehicles, Internet of Energy, Internet of Cloud, Edge computing, etc. Moreover, we provide a classification of threat models, which are considered by blockchain protocols in IoT networks, into five main categories, namely identity-based attacks, manipulation-based attacks, cryptanalytic attacks, reputation-based attacks, and service-based attacks. In addition, we provide a taxonomy and a side-by-side comparison of the state-of-the-art methods toward secure and privacy-preserving blockchain technologies with respect to the blockchain model, specific security goals, performance, limitations, computation complexity, and communication overhead. Based on the current survey, we highlight open research challenges and discuss possible future research directions in the blockchain technologies for IoT.

Blockchain Technologies for the Internet of Things: Research Issues and Challenges

This paper presents a comprehensive survey of the existing blockchain protocols for the Internet of Things (IoT) networks. We start by describing the blockchains and summarizing the existing surveys that deal with blockchain technologies. Then, we provide an overview of the application domains of blockchain technologies in IoT, e.g, Internet of Vehicles, Internet of Energy, Internet of Cloud, Fog computing, etc. Moreover, we provide a classification of threat models, which are considered by blockchain protocols in IoT networks, into five main categories, namely, identity-based attacks, manipulation-based attacks, cryptanalytic attacks, reputation-based attacks, and service-based attacks. In addition, we provide a taxonomy and a side-by-side comparison of the state-of-the-art methods towards secure and privacy-preserving blockchain technologies with respect to the blockchain model, specific security goals, performance, limitations, computation complexity, and communication overhead. Based on the current survey, we highlight open research challenges and discuss possible future research directions in the blockchain technologies for IoT.

Bitcoin combines a peer-to-peer network and cryptographic algorithm to implement a distributed digital currency system, which keeps all transaction history on a public blockchain. Since all transactions recorded on the blockchain are public to everyone, Bitcoin users face a threat of leaking financial privacy. Many analysis and deanonymization approaches have been proposed to link transaction records to real identities. To eliminate this threat, we present an unlinkable coin mixing scheme that allows users to mix their bitcoins without trusting a third party. This mixing scheme employs a primitive known as ring signature with elliptic curve digital signature algorithm (ECDSA) to conceal the transfer of coins between addresses. The mixing server is only able to check whether the output addresses belong to its customers, but it cannot tell which address owned by which customer. Customers do not have to rely on the reputation of a third party to ensure his money will be returned, and his privacy will not be leaked. This scheme needs no modifications on current Bitcoin system and is convenient to deploy by any communities. We implemented a prototype of our scheme and tested it under the Bitcoin core’s regtest mode. Security and privacy of our mixing scheme are ensured through the standard ring signature and ECDSA unforgeability.

Unlinkable Coin Mixing Scheme for Transaction Privacy Enhancement of Bitcoin

Recently, Lin et al. proposed a novel quantum private comparison protocol without a third party (Quantum Inf. Process. 13:239---247, 2014). This paper points out two security loopholes in Lin et al.'s protocol, in which one dishonest party can disclose the other's private information without being detected and the comparison result can be manipulated completely by either party. In addition, improvements are proposed to avoid these loopholes.

Cryptanalysis and improvement of quantum private comparison of equality protocol without a third party

Recently Zhu (Int. J. Theor. Phys. 53, 4095, 2014) had shown that using GHZ-like states as quantum channel, it is possible to teleport an arbitrary unknown two-qubit state. We investigate this channel for the teleportation of an arbitrary N-qubit state. The strict proof through mathematical induction is presented and the rule for the receiver to reconstruct the desired state is explicitly derived in the most general case. We also discuss that if a system of quantum secret sharing of classical message is established, our protocol can be transformed to a N-qubit perfect controlled teleportation scheme from the controller’s point of view.

Quantum Teleportation of an Arbitrary N -qubit State via GHZ-like States

Network protocol vulnerability detection plays an important role in many domains, including protocol security analysis, application security, and network intrusion detection. In this study, by analyzing the general fuzzing method of network protocols, we propose a novel approach that combines network traffic analysis with the binary reverse engineering method. For network traffic analysis, the block-based protocol description language is introduced to construct test scripts, while the binary reverse engineering method employs the genetic algorithm with a fitness function designed to focus on code coverage. This combination leads to a substantial improvement in fuzz testing for network protocols. We build a prototype system and use it to test several real-world network protocol implementations. The experimental results show that the proposed approach detects vulnerabilities more efficiently and effectively than general fuzzing methods such as SPIKE.

/pdf/protocol-vulnerability-detection-based-on-network-traffic-2ygils36is.pdf

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

With widely adoption of Bitcoin, Many malicious software trying to steal bitcoins through network has emerged in a large scale Bitcoin makes heavy use of elliptic curve digital signature algorithm to guarantee transactions security Each user can have lots of addresses hashed from his public keys to receive coins, and need private keys associated with these addresses to authorize spending those coins A Bitcoin wallet give a good assistance to manage and preserve all private keys belong to its owner However, saving complete private keys on local storage meets a big challenge in case of theft For the purpose of securing user's private keys, we propose an efficient method to enhance Bitcoin wallet security We combine random seeds and a passphrase for user easy to keep in mind to generate private keys whenever needed It is only need to reserve a list of random seeds on local storage instead of complete private keys Nobody could generate the whole private keys just relying on random seeds without the passphrase Therefore, our method increases the difficulty for attackers to steal bitcoins We also introduce a key recovery approach in case of the passphrase being forgotten Our method does not incur any additional operations and is convenient to use by a common customer without professional knowledge

Chaojing Tang

Papers

Unlinkable Coin Mixing Scheme for Transaction Privacy Enhancement of Bitcoin

Cryptanalysis and improvement of quantum private comparison of equality protocol without a third party

Quantum Teleportation of an Arbitrary N -qubit State via GHZ-like States

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

An efficient method to enhance Bitcoin wallet security