@conference {570, title = {Making Blockchain Validators Honest}, booktitle = {2022 Fourth International Conference on Blockchain Computing and Applications (BCCA)}, year = {2022}, abstract = {

The importance of honesty among blockchain validators can not be overemphasized, especially as blockchain is used by many as an underlying technology for the development of various Industry 4.0 solutions. In the blockchain consensus process, validators validate the correctness of transactions and propose new blocks for addition to the blockchain. They are rewarded for this task with the blockchain native token (e.g., ETH on the Ethereum blockchain). This reward is often distributed among validators with respect to their staked amount. An increasing number of validators joining the network leads to a decreasing chance of a validator being chosen for the validation task and thus a reduction in the validation reward. This situation results in some form of competition among the validators, leading them to carry out various malicious actions to influence the blockchain validator selection protocol in order to be chosen. In this paper, we examine the competitive interactions between validators in a blockchain consensus process and propose a model using an infinitely repeated game model that ensures that the validators are deterred from behaving maliciously while also encouraging a self-policing notion due to the extra incentive mechanism of an improved reputation score when a validator can verifiably report malicious activities by others. Further, we discuss the factors that can incentivize or disincentivize a validator to either continue to behave honestly or switch to dishonest behavior.

}, doi = {10.1109/BCCA55292.2022.9921952}, url = {https://ieeexplore.ieee.org/abstract/document/9921952}, author = {Salau, Abiola and Dantu, Ram and Morozov, Kirill and Badruddoja, Syed and Upadhyay, Kritagya} } @conference {503, title = {Towards a Threat Model and Security Analysis for Data Cooperatives}, booktitle = {19th International Conference on Security and Cryptography (SECRYPT 2022)}, year = {2022}, abstract = {

Data cooperative (called {\textquotedblleft}data coop{\textquotedblright} for short) is an emerging approach in the area of secure data management. It promises its users a better protection and control of their data, as compared to the traditional way of their handling by the data collectors (such as governments, big data companies, and others). However, for the success of data coops, existing challenges with respect to data management systems need to be adequately addressed. Especially, they concern terms of security and privacy, as well as the power imbalance between providers/owners and collectors of data. Designing a security and privacy model for a data coop requires a systematic threat modeling approach that identifies the security landscape, attack vectors, threats, and vulnerabilities, as well as the respective mitigation strategies. In this paper, we analyze the security of data cooperatives, identify potential security risks and threats, and suggest adequate countermeasures. We also discuss existing challenges that hinder the widespread adoption of data coops.\ 

}, keywords = {Cybersecurity, Data Cooperatives, Secure Data Management, Security and Privacy., Threat Model}, doi = {10.5220/0011328700003283}, author = {Salau, Abiola and Dantu, Ram and Morozov, Kirill and Upadhyay, Kritagya and Badruddoja, Syed} } @conference {397, title = {CMCAP: Ephemeral Sandboxes for Adaptive Access Control}, booktitle = {Proceedings of the 24th ACM Symposium on Access Control Models and Technologies}, year = {2019}, publisher = {ACM}, organization = {ACM}, address = {New York, NY, USA}, keywords = {adaptive access control, ephemeral sandboxes, information flow control, intrusion prevention, runtime containment}, isbn = {978-1-4503-6753-0}, doi = {10.1145/3322431.3325414}, url = {http://doi.acm.org/10.1145/3322431.3325414}, author = {Bucuti, Theogene and Dantu, Ram and Morozov, Kirill} } @conference {587, title = {Verifying OAuth Implementations Through Encrypted Network Analysis}, booktitle = {Proceedings of the 24th ACM Symposium on Access Control Models and Technologies}, year = {2019}, publisher = {Association for Computing Machinery}, organization = {Association for Computing Machinery}, address = {New York, NY, USA}, abstract = {

Verifying protocol implementations via application analysis can be cumbersome. Rapid development cycles of both the protocol and applications that use it can hinder up-to-date analysis. A better approach is to use formal models to characterize the applications platform and then verify the protocol through analysis of the network traffic tied to the models. To test this method, the popular protocol OAuth is considered. Currently, formal models of OAuth do not take into consideration the mobile environment, and implementation verification is largely based on code analysis. Our preliminary results are two fold; we sketch an extension to a formal model that incorporates the specifics of the Android platform and classify OAuth device types using machine learning on encrypted VPN traffic.

}, keywords = {Android, authorization, formal models, network analysis, oauth}, isbn = {9781450367530}, doi = {10.1145/3322431.3326449}, url = {https://doi.org/10.1145/3322431.3326449}, author = {Talkington, Josh and Dantu, Ram and Morozov, Kirill} } @conference {322, title = {A Decentralized Marketplace Application on the Ethereum Blockchain}, booktitle = {IEEE 4th International Conference on Collaboration and Internet Computing (CIC)}, year = {2018}, month = {10/2018}, publisher = {IEEE}, organization = {IEEE}, address = {Philadelphia, PA, USA}, abstract = {

Modern centralized online marketplaces such as eBay offer an alternative option for consumers to both sell and purchase goods with relative ease. However, drawbacks to these marketplaces include the platform{\textquoteright}s ability to block merchants at their own whim, the fees paid to the platform when listing a product and when selling a product, and the lack of privacy of users{\textquoteright} data. In this paper, we propose an application that remedies all three of these drawbacks through use of the Ethereum blockchain platform. The application was developed using the Truffle development framework. The application{\textquoteright}s functions were contained within an Ethereum smart contract, which was then migrated to the Ethereum network. The user{\textquoteright}s input was read through a web interface and sent to the Ethereum network via the web3.js API. Statistics about the application were gathered on the Rinkeby test network. The application was shown to have an average transaction runtime of 3.8 seconds, and an average gas consumption of 4.6 wei. Contract creation times for the application were shown to be less than a second. A cost analysis of the application was then conducted. The gas consumption of the transactions needed to both buy and sell a product was converted into US dollars, and the gas cost of the application was then compared to the cost to use an online auction marketplace such as eBay as well as an in-person auction house such as Sotheby{\textquoteright}s. The results showed that selling on the application is cheaper than existing online options as well as existing in-person options. These tests showed that our application was successful in addressing the drawbacks of current auction marketplaces.

}, keywords = {API, application program interfaces, auction marketplaces, average gas consumption, blockchain, centralized online marketplaces, Computer science, contract creation times, cost analysis, Cryptocurrency, decentralized, decentralized marketplace application, e-commerce, eBay, electronic commerce, Ethereum, Ethereum blockchain platform, Ethereum network, Ethereum smart contract, gas cost, human factors, in-person options, Internet, marketplace, Measurement, online auction marketplace, online options, peer-to-peer computing, Rinkeby test network, security of data, smart contract, Truffle development framework, user data, user interfaces, Web interface}, doi = {10.1109/CIC.2018.00023}, author = {Ranganthan, Vishnu Prasad and Ram Dantu and Paul, Aditya and Mears, Paula and Morozov, Kirill} } @article {388, title = {On the security of the Courtois-Finiasz-Sendrier signature}, year = {2018}, isbn = {23915455}, url = {https://www.degruyter.com/view/j/math.2018.16.issue-1/math-2018-0011/math-2018-0011.xml}, author = {Morozov, Kirill and Sarathi, Roy Partha and Rainer, Steinwandt and Rui, Xu} }