CONTENTS

Cover

IEEE Press Editorial Board

Foreword

Preface

Note

List of Contributors

Part I Introduction to Blockchain

1 Introduction
1. 1.1 Blockchain Overview
2. 1.2 Overview of the Book
3. References
2 Distributed Consensus Protocols and Algorithms
1. 2.1 Introduction
2. 2.2 Fault-tolerant Consensus in a Distributed System
3. 2.3 The Nakamoto Consensus
4. 2.4 Emerging Blockchain Consensus Algorithms
5. 2.5 Evaluation and Comparison
6. 2.6 Summary
7. Acknowledgment
8. References
9. Notes
3 Overview of Attack Surfaces in Blockchain
1. 3.1 Introduction
2. 3.2 Overview of Blockchain and its Operations
3. 3.3 Blockchain Attacks
4. 3.4 Blockchain's Peer-to-Peer System
5. 3.5 Application Oriented Attacks
6. 3.6 Related Work
7. 3.7 Conclusion and Future Work
8. References

Part II Blockchain Solutions for Distributed Systems Security

4 ProvChain: Blockchain-based Cloud Data Provenance
1. 4.1 Introduction
2. 4.2 Background and Related Work
3. 4.3 ProvChain Architecture
4. 4.4 ProvChain Implementation
5. 4.5 Evaluation
6. 4.6 Conclusions and Future Work
7. Acknowledgment
8. References
5 A Blockchain-based Solution to Automotive Security and Privacy
1. 5.1 Introduction
2. 5.2 An Introduction to Blockchain
3. 5.3 The Proposed Framework
4. 5.4 Applications
5. 5.5 Evaluation and Discussion
6. 5.6 Related Works
7. 5.7 Conclusion
8. References
6 Blockchain-based Dynamic Key Management for IoT-Transportation Security Protection
1. 6.1 Introduction
2. 6.2 Use Case
3. 6.3 Blockchain-based Dynamic Key Management Scheme
4. 6.4 Dynamic Transaction Collection Algorithm
5. 6.5 Time Composition
6. 6.6 Performance Evaluation
7. 6.7 Conclusion and Future Work
8. References
7 Blockchain-enabled Information Sharing Framework for Cybersecurity
1. 7.1 Introduction
2. 7.2 The BIS Framework
3. 7.3 Transactions on BIS
4. 7.4 Cyberattack Detection and Information Sharing
5. 7.5 Cross-group Attack Game in Blockchain-based BIS Framework: One-way Attack
6. 7.6 Cross-group Attack Game in Blockchain-based BIS Framework: Two-way Attack
7. 7.7 Stackelberg Game for Cyberattack and Defense Analysis
8. 7.8 Conclusion
9. References

Part III Blockchain Security Analysis

8 Blockcloud Security Analysis
1. 8.1 Introduction
2. 8.2 Blockchain Consensus Mechanisms
3. 8.3 Blockchain Cloud and Associated Vulnerabilities
4. 8.4 System Model
5. 8.5 Augmenting with Extra Hash Power
6. 8.6 Disruptive Attack Strategy Analysis
7. 8.7 Simulation Results and Discussion
8. 8.8 Conclusions and Future Directions
9. Acknowledgment
10. References
9 Permissioned and Permissionless Blockchains
1. 9.1 Introduction
2. 9.2 On Choosing Your Peers Wisely
3. 9.3 Committee Election Mechanisms
4. 9.4 Privacy in Permissioned and Permissionless Blockchains
5. 9.5 Conclusion
6. References
7. Note
10 Shocking Blockchain's Memory with Unconfirmed Transactions: New DDoS Attacks and Countermeasures
1. 10.1 Introduction
2. 10.2 Related Work
3. 10.3 An Overview of Blockchain and Lifecycle
4. 10.4 Threat Model
5. 10.5 Attack Procedure
6. 10.6 Countering the Mempool Attack
7. 10.7 Experiment and Results
8. 10.8 Conclusion
9. References
11 Preventing Digital Currency Miners from Launching Attacks Against Mining Pools Using a Reputation-based Paradigm
1. 11.1 Introduction
2. 11.2 Preliminaries
3. 11.3 Literature Review
4. 11.4 Reputation-based Mining Model and Setting
5. 11.5 Mining in a Reputation-based Model
6. 11.6 Evaluation of Our Model Using Game-theoretical Analyses
7. 11.7 Concluding Remarks
8. Acknowledgment
9. References

Part IV Blockchain Implementation

12 Private Blockchain Configurations for Improved IoT Security
1. 12.1 Introduction
2. 12.2 Blockchain-enabled Gateway
3. 12.3 Blockchain-enabled Smart End Devices
4. 12.4 Related Work
5. 12.5 Conclusion
6. References
7. Notes
13 Blockchain Evaluation Platform
1. 13.1 Introduction
2. 13.2 Hyperledger Fabric
3. 13.3 Measures of Performance
4. 13.4 Simple Blockchain Simulation
5. 13.5 Blockchain Simulation Introduction
6. 13.6 Conclusion and Future Work
7. References
14 Summary and Future Work
1. 14.1 Introduction
2. 14.2 Blockchain and Cloud Security
3. 14.3 Blockchain and IoT Security
4. 14.4 Blockchain Security and Privacy
5. 14.5 Experimental Testbed and Performance Evaluation
6. 14.6 The Future
Index

List of Illustrations

Chapter 1

Figure 1.1 Block structure.
Figure 1.2 Blockchain architecture.
Figure 1.3 Supply-chain provenance overview.

Chapter 2

Figure 2.1 Example for Theorem 1—a three-component message-passing system with one compone...
Figure 2.2 The normal operation protocol of VSR for a three-replica system.
Figure 2.3 The normal operation protocol of PBFT for a four-replica system.
Figure 2.4 One-hop block propagation between two nodes.

Chapter 3

Figure 3.1 Hard fork resulting from a set of peers following conflicting rules.
Figure 3.2 Stale vs. orphan blocks. Note that the stale block (block 2, bottom, and block ...
Figure 3.3 Illustration of selfish mining.

Chapter 4

Figure 4.1 ProvChain system interaction.
Figure 4.2 ProvChain system architecture.
Figure 4.3 Provenance data collection and storage.
Figure 4.4 Merkle tree.
Figure 4.5 Blockchain receipt.
Figure 4.6 Transaction and block information.
Figure 4.7 Average response time with different file size.
Figure 4.8 Bytes throughput over time.
Figure 4.9 Number of transactions per second.
Figure 4.10 Response time distribution.

Chapter 5

Figure 5.1 The structure of a Merkle tree.
Figure 5.2 An evaluation of the processing time for validating new blocks [6].
Figure 5.3 An overview of the proposed method.
Figure 5.4 WRSU process utilizing the BC architecture.
Figure 5.5 (a) The WVI prototype based on a BeagleBone Black and our developed communicati...
Figure 5.6 A comparison of the packet overhead of BC-based and certificate-based framework...
Figure 5.7 A comparison of the latency of BC-based and certificate-based frameworks.

Chapter 6

Figure 6.1 The relationship between ITS, VCS, and IoT.
Figure 6.2 The conventional mobile node handover process.
Figure 6.3 VCS network structure; (a) traditional structure; (b) blockchain-based structur...
Figure 6.4 Cross-domain key handover handshake procedures in traditional structure.
Figure 6.5 Same-domain key handover handshake procedures in traditional structure.
Figure 6.6 Handshake procedures of cross-domain handover in distributed ledger technology ...
Figure 6.7 Computation time of cryptographic schemes with respect to the transaction numbe...
Figure 6.8 The block preparation time with respect to the transaction number.
Figure 6.9 Key handover processing time comparison between structures and schemes; (a) tim...
Figure 6.10 Average transaction number under various traffic levels.
Figure 6.11 Key handover time under the transaction collection periods.
Figure 6.12 Key handover time results measured in one second; (a) key handover time compari...
Figure 6.13 Decreased key handover time in percentage.

Chapter 7

Figure 7.1 A typical Blockchain-based information-sharing framework among multiple organiz...
Figure 7.2 A typical structure of Blockchain for information sharing [13].
Figure 7.3 Variation of expected utility vs. the number of cross-group participants, where...
Figure 7.4 Example of expected group utilities.
Figure 7.5 Expected utility of different organizations with different security/investment ...
Figure 7.6 Expected security/investment levels caused by cyberattack impact vs. iterations...
Figure 7.7 Variation of attack impact vs. iterations.
Figure 7.8 Variation of expected attacker utility vs. iterations.

Chapter 8

Figure 8.1 Overview of block mining process.
Figure 8.2 Layout of a block in Blockchain.
Figure 8.3 Proof of Activity (PoA) in flow.
Figure 8.4 Effect on average reward in proportional pool.
Figure 8.5 Effect on average number of Shares in proportional pool.
Figure 8.6 Effect on average reward in PPLNS pool.
Figure 8.7 PPLNS reward variation vs. window length (N).

Chapter 10

Figure 10.1 Transaction life cycle in a Blockchain-based cryptocurrency.
Figure 10.2 Temporal study of mempool size and mining fee paid by the users in a popular Bl...
Figure 10.3 Analysis of fee-based design. Notice that as the mining fee increases, the memp...
Figure 10.4 Analysis of age-based design. Notice that with age-based design, the accuracy, ...
Figure 10.5 Performance of fee-based and age-based designs under mempool DDoS attack. Notic...

Chapter 11

Figure 11.1 Reputation-based mining model.

Chapter 12

Figure 12.1 The blockchain-enabled gateway strategy implemented for a smart home.
Figure 12.2 Our Ethereum gateway prototype implements a local access control solution. In t...
Figure 12.3 An edited snippet of the Solidity smart contract used to manage the building ac...
Figure 12.4 The Blockchain-enabled End Devices strategy implemented for a smart home. This ...
Figure 12.5 Our Hyperledger-fabric enabled temperature sensors host a blockchain between th...
Figure 12.6 A Hyperledger smart contract storing sensor values.
Figure 12.7 Our hardware-integrated smart contract architecture allows for device drivers i...
Figure 12.8 The contract of Org1 invokes the sensor reading function putSensor of the smart...

Chapter 13

Figure 13.1 Screenshot of artifact generation script output.
Figure 13.2 Screenshot of console outputs from the start script for the basic-network examp...
Figure 13.3 Example view of a docker-compose yml configuration file.
Figure 13.4 Example terminal results for the docker ps command of the basic network.
Figure 13.5 Terminal view of the output logs produced by the orderer node.
Figure 13.6 Terminal output for the Kafka example.
Figure 13.7 Terminal results for the docker ps command while running the Kafka system.
Figure 13.8 Terminal output from the initialize_all script that runs and tests the Kafka bl...
Figure 13.9 Terminal output from the docker ps command; notice the chaincode containers tha...
Figure 13.10 Terminal output after stopping the network.
Figure 13.11 Illustration of the process to measure a single transaction per second.
Figure 13.12 Illustration of measuring total system transactions per second.
Figure 13.13 Example output of performance in simulated proof-of-stake blockchain system.
Figure 13.14 Example output of performance in simulated proof-of-stake blockchain system wit...
Figure 13.15 Example output reporting the average number of times the highest staked holder ...
Figure 13.16 Illustration of a basic configuration of Hyperledger Fabric.
Figure 13.17 Illustration of a practical Byzantine fault tolerant consensus process.
Figure 13.18 Performance in transactions per second to process a single transaction with PBF...
Figure 13.19 Performance in transactions per second to process a single transaction with Kaf...
Figure 13.20 Illustration of linked list similarities to blockchain data structures.
Figure 13.21 Illustration of a simulated blockchain system.
Figure 13.22 Illustration of a Hyperledger Fabric system connected and interacting with a si...
Figure 13.23 Image of the type of entities that are in the simulated world.
Figure 13.24 Top down view of the simulated environment.
Figure 13.25 Game view of the simulated world with entities connected to the real blockchain...

Foreword

The success of the United States Department of Defense (DoD) in the future battlefield will hinge on the ability to protect the cyber infrastructure from loss of personal identifiable information, tampering of sensitive data, and interruption of services. Although all cyber risks are critical and need to be addressed, issues related to data integrity are most acute, as data tampering can have a huge impact on mission critical services that depend upon reliable data. The current cyber defense solutions are unable to combat data breaches effectively and are typically reactive in nature, and cannot keep up with the exponentially increasing cyber threats. Cyber defense solutions should be able to protect data despite attempts by adversaries to derail their effectiveness.

There is a pressing need for a paradigm shift in the development of next generation cyber defense strategies. Blockchain is an emerging technology that could address cyber security challenges, such as identity management and data provenance for distributed systems. Blockchain technology provides several advantages in building resilient cyber defense solutions. First, blockchains are shared, distributed, and fault-tolerant databases that every participant in the network can share, but no entity can control, and is resilient to single point of failure. Second, data integrity is ensured as tampering of blockchains is extremely challenging due to the use of a cryptographic data structure and lack of reliance on secrets. Third, blockchains assume the presence of adversaries in the network, making compromise by adversaries significantly expensive. Blockchain solutions for cyber security could represent a paradigm shift in how data manipulation will be defended by creating a trusted system in a trustless environment. Cloud, the Internet of Things (IoT), and the Internet of Battlefield Things (IoBT) are being used as distributed platforms. However, these platforms are plagued by numerous vulnerabilities that allow adversaries to gain access to sensitive information and disrupt services. A blockchain-empowered security platform will ensure the integrity of the data exchanged in these systems and reduce risks from data breach attacks.

Under the 2018 National Defense Authorization Act, the DoD will conduct a comprehensive study of blockchain, particularly in the context of cybersecurity. There have been DoD investments (research grants, SBIR/STTR awards, etc.) in the investigation of blockchain for secure message delivery in tactical scenarios, additive manufacturing, and the protection of supply chains. On the flip side, there is growing concern that malware or other illicit content, once introduced into a blockchain, would be very hard to remove. There is also growing concern about the threat to blockchain posed by quantum computing.

The focus of the book is on providing blockchain-based solutions to distributed systems to ensure a resilient and reliable cyberinfrastructure for operations and missions. Most current books on blockchain only focus on impacts in the financial sector. There is a need for books to understand how the blockchain's impact goes beyond cryptocurrency, and to address security and privacy issues in cloud and IoT/IoBT platforms. The topics in the book provide blockchain-empowered solutions to protect cloud and IoT/IoBT platforms. The book also presents security challenges that must be addressed for blockchain technologies to reach their full potential.

Dr. Ananthram Swami
Senior Research Scientist (ST) for Network Science,
ARL Fellow, IEEE Fellow
US Army Research Laboratory, Adelphi, MD

Preface

Cyberattacks have increasingly targeted commercial, government, and military enterprises with the goal to steal sensitive information and/or disrupt service. There is an urgent need for cyber defense solutions to ensure traceable and tamper-evident accountability and auditability of command and control, logistics, and other critical mission data as future operations will involve the convergence of multiple domains and a heavily contested cyberspace. Thus, the emphasis needs to be on cyber defense solutions that can ensure resilient operation during adversarial attempts to thwart normal operation. The existing cyber defense solutions are reactive and are not able to combat the impact of the exponential rise in cyber threats. Centralized or homogenous information assurance systems and databases must evolve to possess distributed, disintermediated, and secure capabilities.

The cyber warfare strategy will come down to the ability to conduct operations on data in a secure and trusted environment. In order to win the cyber warfare, the military needs to protect data operations by (i) preventing adversarial access to networks housing critical data, (ii) ensuring the integrity of data despite the presence of the adversary on the network, and (iii) being resilient to the adversary's efforts to manipulate data. At the same time, the emergence of cloud and the Internet of Things to support on-demand computing, dynamic provisioning, and management of autonomous systems has increased the need to improve their security. Security assurance of intracloud and intercloud data management and transfer is a key issue. Cloud auditing can only be effective if all operations on the data can be tracked reliably. Assured provenance data can help detect access violations within the cloud computing infrastructure. The Internet of Things (IoT) in the military context interconnects warfighting resources, such as sensors, munitions, weapons, vehicles, robots, and wearable devices, to perform tasks such as sensing, communicating, acting, and collaborating with human warfighters. The massive scale and distributed nature of IoT devices will create several security and privacy challenges. Firstly, the underlying IoT networking and communication infrastructure needs to be flexible and adaptive to support dynamics military missions. This dynamic change to the communication infrastructure needs to happen in an autonomous fashion without reliance on centralized maintenance services. Second, there is a need to ensure the veracity of the information made available through the IoT devices. There is a need for a trusted platform to ensure the information consumed by the human warfighters are accurate.

Blockchain and distributed ledger technologies as a whole demonstrate the potential of a truly distributed and disintermediated mechanism for accountability and auditability. Blockchains are shared, distributed, and fault-tolerant databases that every participant in the network can share, but no entity can control. Blockchains assume the presence of adversaries in the network and nullify adversarial strategies by harnessing the computational capabilities of the honest nodes, and the information exchanged is resilient to manipulation and destruction. This ability allows leaders to continue military operations despite adversarial attempts to cause disruption. Blockchain solutions for cyber security will represent a paradigm shift in how data manipulation will be defended. Blockchain has the ability to create a trusted system in a trustless environment.

Tampering of blockchains is extremely challenging due to the use of a cryptographic data structure and no reliability of secrets. Blockchain has the potential to enhance cyber defense with its ability to prevent unauthorized actions through distributed consensus mechanisms and provision of data integrity through its immutability, auditability, and operational resilience (ability to withstand a single point of failure) mechanisms. Though blockchain is not a panacea for all cyber security challenges, the technology does have the ability to help organizations tackle cyber security risk issues such as identity management, provenance, and data integrity.

The focus of the book is on providing blockchain-based solutions to distributed systems to ensure a resilient and reliable cyberinfrastructure for operations and missions. There is a need to understand how blockchain's impact goes beyond cryptocurrency and can address distributed security and privacy issues in cloud and IoT platforms. The topics in the book describe the properties underlying formal foundations of blockchain technologies and practical issues for deployment in cloud and IoT platforms. In addition, the book also presents security and privacy issues that must be solved for blockchain technologies to reach full potential. Three book chapters (Chapters 4,5, and 8) are based on research articles that were voted as Top Blockchain papers at the 2019 Blockchain Connect Conference.¹

This material is based on research sponsored by the Air Force Research Laboratory (AFRL) under agreement number FA8750-16-0301, and we would like to thank AFRL for their financial support, collaboration, and guidance. The US Government is authorized to reproduce and distribute reprints for governmental purposes notwithstanding any copyright notation thereon. The work described in this book was also partially supported by other sources acknowledged in individual chapters.

The editors would like to acknowledge the contributions of the following individuals (in alphabetical order): Abdulhamid Adebayo, Philip Asuquom, Shihan Bao, Yue Cao, Haitham Cruickshank, Ali Dorri, Peter Foytik, Arash Golchubian, Y. Thomas Hou, Raja Jurdak, Salil S. Kanhere, Kevin Kwiat, Adriaan Larmuseau, Ao Lei, Jin Li, Xueping Liang, Wenjing Lou, Andrew Miller, Aziz Mohaisen, Mehrdad Nojoumian, DaeHun Nyang, Danda B. Rawat, Muhammad Saad, Devu Manikantan Shila, Jeffrey Spaulding, Marco Steger, Zhili Sun, Deepak Tosh, Yang Xiao, and Ning Zhang. We would like to extend our thanks to Misty Blowers, Jerry Clarke, Jim Perretta, and Val Red for their valuable support and guidance. We would like to thank Paul Ratazzi, Robert Reschly, and Michael Weisman for technical review support. Last, we would like to extend thanks and acknowledgment to Jovina E. Allen, Walter J. Bailey, Sandra B. Fletcher, Lisa M. Lacey, Sandra H. Montoya, Lorri E. Roth, and Jessica D. Schultheis, who helped edit and collect the text into its final form, and to Mary Hatcher and Vishnu Narayanan of Wiley for their kind assistance in guiding this book through the publication process.

Disclaimer: The views and content expressed in this book are those of the authors and do not reflect the official policy or position of the Department of Defense, or the US Government.

Note

List of Contributors

Abdulhamid Adebayo

Howard University

Philip Asuquom

University of Surrey

Shihan Bao

University of Surrey

Yue Cao

Northumbria University

Haitham Cruickshank

University of Surrey

Ali Dorri

University of New South Wales

Peter Foytik

Old Dominion University

Arash Golchubian

Florida Atlantic University

Y. Thomas Hou

Virginia Tech

Raja Jurdak

University of New South Wales

Salil S. Kanhere

University of New South Wales

Kevin Kwiat

CAESAR Group

Adriaan Larmuseau

United Technologies Research Center China

Ao Lei

University of Surrey

Jin Li

Guangzhou University, Guangzhou, China

Xueping Liang

Old Dominion University

Wenjing Lou

Virginia Tech

Andrew Miller

University of Illinois at Urbana-Champaign

Aziz Mohaisen

University of Central Florida

Mehrdad Nojoumian

Florida Atlantic University

DaeHun Nyang

Inha University

Danda B. Rawat

Howard University

Muhammad Saad

University of Central Florida

Devu Manikantan Shila

United Technologies Research Center

Jeffrey Spaulding

University of Central Florida

Marco Steger

Virtual Vehicle Research Center, Graz, Styria, Austria

Zhili Sun

University of Surrey

Deepak Tosh

University of Texas at El Paso

Yang Xiao

Virginia Tech

Ning Zhang

Washington University in St. Louis

Giancarlo Fortino	Andreas Molisch	Linda Shafer
David Alan Grier	Saeid Nahavandi	Mohammad Shahidehpour
Donald Heirman	Ray Perez	Sarah Spurgeon
Xiaoou Li	Jeffrey Reed	Ahmet Murat Tekalp