Original Title: Security and Privacy on Blockchain
Original Author: RUI ZHANG, RUI XUE, LING LIU
Original Address: https://doi.org/10.1145/3316481
Publication Conference: 2019 ACM Computing Surveys, Vol. 52, No. 3, Article 51
note arrangement: [email protected]
1 Introduction
Through research and analysis of thousands of blockchain papers in the past five years, the author found that there were 12 research reports on the security and privacy threats of blockchain, and found that most of the security and privacy research on blockchain were concentrated in two aspect:
- Reveal some of the current attacks against blockchain-based systems;
- Make specific proposals to use some state-of-the-art countermeasures against a subset of these attacks
The authors describe the concept of blockchains for online transactions and discuss the basic and additional security and privacy properties of blockchains. It then discusses a set of corresponding security technologies, especially encryption solutions, to achieve basic and additional security goals. The main objectives of this investigative article are the following two points:
- Provides an entry point for non-security experts to better understand the security and privacy properties of blockchain technology
- Help experts and researchers explore the cutting-edge security and privacy technology of blockchain
2. Blockchain overview
2.1 How the blockchain works
In the Bitcoin network, customer a wants to send bitcoins to customer b, which will create a bitcoin transaction by customer a. The transaction is not submitted by the Bitcoin network until it is approved by the miners. Those miner nodes will collect the transactions into a block. Validate the transactions in the block and broadcast the block and its validation using the consensus protocol for approval by the network. A block can be added to the blockchain when other nodes verify that all transactions contained in the block are valid.
The figure below gives an illustration of this process. The transfer of bitcoins from A to B is finalized and legal only when the "block" containing the transactions is approved by other nodes and added to the blockchain. 
2.2 Blockchain-level transaction models
There are two representative blockchain-level transaction models: the unconsumed transaction output (UTXO) model introduced by Bitcoin and the account-based transaction model introduced by Ethereum.
- UTXO model:
| Conditions to be met |
|---|
| Every referenced input in a transaction must be signed by its owner (sender) and has not yet been spent |
| If the transaction has multiple inputs, each input must have a signature matching the owner of the input |
| The total value of a transaction's inputs equals or exceeds the total value of its outputs |
Below is an example of a UTXO model
If both Bob and Mary send 5 BTC to Alice, and Alice doesn't spend them, then 5 BTC are signed from Bob to Alice, and 5 BTC are signed from Mary to Alice. If Alice wants to merge her two single 5BTC instances into a 10BTC instance, Alice has to perform another transaction in a manner similar to how she needs to exchange her two $5 bills for a $10 bill
Applying the UTXO model in online transactions has the following advantages:
- Potentially high level of privacy. The UTXO model defines a data structure so that each user can hold multiple BTC instances, unlike bank accounts that combine into one total amount. It is only necessary to reveal the instance of itself during the transaction, not the address of the account.
- Potentially highly scalable. The UTXO model has no concept of a user's account, which removes some of the limitations of account-based transaction models. Transactions can be parallelized without worrying about order.
- Potentially high security. The UTXO model maintains a Merkle proof of ownership for all BTC instances of each user. Can solve the double consumption problem.
Correspondingly, he will also have some disadvantages:
If Alice receives 100 BTC and wants to send 10 BTC to Carlo, Alice must consume the output of 100 BTC by creating two outputs: 10 BTC to the payee Carlo, and 90 BTC back to herself as a change.
In such a case, private information may be leaked to the observer. This also makes balance calculation a core feature of the UTXO model and an important factor leading to wallet complexity. Although payers can apply transactions in parallel, true parallelism is difficult to achieve due to the strict enforcement of total ordering constraints, such as the sum of inputs should equal or exceed the sum of outputs.
- Account-Based Trading Model
Through the transaction model based on account balance, which works similar to the bank accounts of physical banks today, the entire balance information of users is stored in Ethereum.
| Conditions to be met |
|---|
| Tokens are signed by the message writer (sender) |
| Writers' ownership of token value can be proven |
| The writer's spending account has sufficient balance for the transaction |
There are a number of clear benefits to the account-based trading model:
- Greater space savings than the UTXO model. Because each transaction requires only one reference and one signature to produce an output.
- more simple. Coins will not be separated according to origin, so there is no need to maintain coin origin information.
- Does not allow references to be changed on every transaction, but it provides easy access to account-related data.
An account nonce is associated with each account and acts as a count of transactions sent by the account. To prevent the same transaction from being executed multiple times.
Proof of work nonce: This is a random value in a block that is used to obtain proof of work through mining, which is an authorization mechanism for decentralized records.
2.3 The CAP property in the blockchain
The Bitcoin system seems to have violated the CAP theorem as it achieves consistency, availability, and partition tolerance. However, the consensus of the blockchain is achieved after a period of time. Bitcoin mining combines a consensus protocol and at least six confirmations to ensure eventual consistency by reaching a consensus.
The CAP theorem states that any distributed system can only have the following two properties.
- Consistency: Every compute node receives the most recent write.
- Availability: where some data is always available for any request.
- Partition tolerance: Even if some subset of nodes fail to operate, the distributed system is always running.
2.4 Evolution of Blockchain Blockchain
can be divided into three categories:
- public blockchain
- Consortium Blockchain
- private blockchain
Digital currency (Blockchain 1.0), progress to smart contracts (Blockchain 2.0), and many other forms of decentralized cooperation with a high degree of accountability and a high degree of security and trust (Blockchain 3.0) below Shows the architecture of the blockchain, where the content of the red dotted line is developed by blockchain 2.0
3. Security and privacy attributes of blockchain
The security and privacy requirements for online transactions are roughly divided into the following categories:
- Consistency of ledgers across institutions
- transaction integrity
- System and Data Availability
- prevent double waste
- confidentiality of transactions
- Anonymity of User Identity
- non-relationship of transactions
The following figure summarizes the security and privacy requirements, attributes and technologies
4. Consensus algorithm
Byzantine Generals Problem (BGP): A bad actor may secretly create conflicting information so that members of the group cannot behave uniformly, which destroys the efficiency with which the team cooperates in their actions.
- PoW
1. It should be difficult and time-consuming for any witness to produce a proof that meets certainty requirements.
2. It should be simple and fast for others to verify that it is correct.
Use BGP to explain the working process of PoW:
1.Append a nonce (usually starting from 0) to the original information, which is a random hexadecimal value.
2. Apply hash to the nonce enhanced message, and check whether the hash result is less than or equal to the preset value (such as starting with 5 0s) 3.
If the hash condition is met, the army on the city side will send a message messenger with hash information and nonce to The army on the other side of the city. If the hash condition is not met, then the nonce value is +1, and the process is iterated until a satisfactory result is obtained. Finding the correct nonce value is time consuming and computationally expensive.
4. Due to the anti-collision feature of hash, it is still difficult to tamper with the hash value of the message when the messenger of the instant message is caught, because the hash value of the tampered message will be completely different from the hash value of the original message. Start with 5 zeros, if not, this message will be ignored.
5. Repeat the iterative process above, so that a large number of message messengers are sent from the army in the east of the city to the army in the west of the city through the city.
PoW can effectively solve the BGP problem, but it also has three limitations:
- Because of the high computational complexity and low probability of successful proof-of-work generation, the protocol is an extremely inefficient process
- The security of PoW mainly comes from the return of mining, which requires a strong incentive mechanism to attract miners.
- Participants have various abilities, so PoW has different abilities to succeed.
In short, the PoW consensus algorithm is more inclined to rely on decentralized incentives and economic incentives to ensure security.
Every validator of PoS can participate in proposing to create and verify new blocks through the consensus algorithm, which requires a group of validators to place bets on the next block and vote in turn . The decision of who will be the validator for the next block is made based on vote weights calculated from each validator's stake size. The probability of being selected is proportional to their stake.
There are mainly BFT-based and chain-based PoS
chain-based PoS, the algorithm pseudo-randomly selects a validator every time period (for example, every 10 seconds), and gives the validator permission to create a block and compare the block with some previous blocks (usually the block at the end of the previous longest chain). Thus, over time, the majority of blocks converge into a single growing chain
BFT is defined as a system's fault tolerance to BGP [75]. Consider an agreement scenario between a group of players: each player holds a potentially different initial value, and all players need to agree on a single value by following the consensus protocol. We consider a system to be Byzantine Fault Tolerant in a system where the majority of players are honest players who strictly abide by the protocol, even if a minority of players are malicious and may deviate from the protocol arbitrarily.
Other consensus algorithms include
- Sleepy Consensus
- Proof of Elapsed Time (PoET)
- Proof of Authority (PoA)
- Proof of Reputation (PoR)
The figure below shows the comparison of consensus algorithms
5. Privacy and Security Technologies Used in Blockchain
The authors summarize some techniques that can be leveraged to enhance the security and privacy of existing and future blockchain systems, along with their advantages and disadvantages.
- Mixing
- anonymous signature
- Homomorphic Encryption (HE)
- Attribute Based Encryption (ABE)
- Secure Multi-Party Computation
- Non-interactive zero-knowledge (NIZK) proofs
- Smart contracts based on Trusted Execution Environment (TEE)
- Game-based smart contracts
The author has some comments on these techniques:
- No one technology is a panacea for blockchain security and privacy, and the appropriate technology should be selected according to the specific situation. Generally speaking, the combination of multiple technologies is more effective than using a single technology
- No technology is without flaws or perfect in all respects, so we pay careful attention to the pitfalls and potential harms that come with incorporating some security and privacy technologies into the blockchain
- There is always a trade-off between security, privacy, and efficiency. It is necessary to advocate technologies that improve security and privacy, but it is also necessary to ensure that the performance can be actually deployed and used.
6 Conclusion
This paper describes security and privacy technologies that achieve these security and privacy properties, and shows that technologies such as mixing, anonymous signatures, encryption, secure multi-party computation, non-interactive zero-knowledge proofs, and smart contracts can be applied in the blockchain. Blockchain is attracting more and more attention in the industry. In practice, a balance between security and efficiency should be ensured. Therefore, the development of lightweight encryption algorithms in the future will be a key enabling technology.