[go: up one dir, main page]

skip to main content
survey
Public Access

Security and Privacy on Blockchain

Published: 03 July 2019 Publication History
  • Get Citation Alerts
  • Abstract

    Blockchain offers an innovative approach to storing information, executing transactions, performing functions, and establishing trust in an open environment. Many consider blockchain as a technology breakthrough for cryptography and cybersecurity, with use cases ranging from globally deployed cryptocurrency systems like Bitcoin, to smart contracts, smart grids over the Internet of Things, and so forth. Although blockchain has received growing interests in both academia and industry in the recent years, the security and privacy of blockchains continue to be at the center of the debate when deploying blockchain in different applications. This article presents a comprehensive overview of the security and privacy of blockchain. To facilitate the discussion, we first introduce the notion of blockchains and its utility in the context of Bitcoin-like online transactions. Then, we describe the basic security properties that are supported as the essential requirements and building blocks for Bitcoin-like cryptocurrency systems, followed by presenting the additional security and privacy properties that are desired in many blockchain applications. Finally, we review the security and privacy techniques for achieving these security properties in blockchain-based systems, including representative consensus algorithms, hash chained storage, mixing protocols, anonymous signatures, non-interactive zero-knowledge proof, and so forth. We conjecture that this survey can help readers to gain an in-depth understanding of the security and privacy of blockchain with respect to concept, attributes, techniques, and systems.

    References

    [1]
    {n.d.}. Bitcoin—Open source P2P money. Retrieved from https://bitcoin.org/en.
    [2]
    {n.d.}. Ethereum Project. Retrieved from https://www.ethereum.org.
    [3]
    {n.d.}. IBM Blockchain based on Hyperledger Fabric from the Linux Foundation. Retrieved from https://www.ibm.com/blockchain/hyperledger.html.
    [4]
    {n.d.}. PlatON. Retrieved from https://www.platon.network/#/.
    [5]
    {n.d.}. Monero. Retrieved from http://www.getmonero.org.
    [6]
    {n.d.}. What is BitShares. Retrieved from http://docs.bitshares.org/bitshares/whatis.html.
    [7]
    2017. Steem: An incentivized, blockchain-based, public content platform.
    [8]
    2017. ZooKeeper: A Distributed Coordination Service for Distributed Applications.
    [9]
    Aigents. 2017. Proof of Reputation as Liquid Democracy for Blockchain.
    [10]
    Marcin Andrychowicz, Stefan Dziembowski, Daniel Malinowski, and Lukasz Mazurek. {n.d.}. Secure multiparty computations on bitcoin. In SP 2014. 443--458.
    [11]
    Kristov Atlas. {n.d.}. CoinJoin Sudoku: Weaknesses in SharedCoin.
    [12]
    Kristov Atlas. 2014. Weak Privacy Guarantees for SharedCoin Mixing Service.
    [13]
    Adam Back. 2002. Hashcash—A denial of service counter-measure. In USENIX Technical Conference.
    [14]
    Dave Bayer, Stuart Haber, and W. Scott Stornetta. 1993. Improving the Efficiency and Reliability of Digital Time-Stamping. 329--334.
    [15]
    Juan Benet. 2015. IPFS—Content Addressed, Versioned, P2P File System (DRAFT 3).
    [16]
    Nir Bitansky, Ran Canetti, Alessandro Chiesa, and Eran Tromer. {n.d.}. From extractable collision resistance to succinct non-interactive arguments of knowledge, and back again. In ITCS 2012. 326--349.
    [17]
    Nir Bitansky, Alessandro Chiesa, Yuval Ishai, Omer Paneth, and Rafail Ostrovsky. {n.d.}. Succinct non-interactive arguments via linear interactive proofs. In TCC 2013. 315--333.
    [18]
    Manuel Blum, Paul Feldman, and Silvio Micali. {n.d.}. Non-interactive Zero-knowledge and its applications. In STOC 1988. 103--112.
    [19]
    Peter Bogetoft, Dan Lund Christensen, Ivan Damgård, Martin Geisler, Thomas P. Jakobsen, Mikkel Krøigaard, Janus Dam Nielsen, Jesper Buus Nielsen, Kurt Nielsen, Jakob Pagter, Michael I. Schwartzbach, and Tomas Toft. {n.d.}. Secure multiparty computation goes live. In FC 2009. 325--343.
    [20]
    J. Bonneau, A. Miller, J. Clark, A. Narayanan, J. A. Kroll, and E. W. Felten. {n.d.}. SoK: Research perspectives and challenges for bitcoin and cryptocurrencies. In SP 2015. 104--121.
    [21]
    Joseph Bonneau, Arvind Narayanan, Andrew Miller, Jeremy Clark, Joshua A. Kroll, and Edward W. Felten. {n.d.}. Mixcoin: Anonymity for Bitcoin with Accountable Mixes. 486--504.
    [22]
    Daniel R. L. Brown. 2000. The Exact Security of ECDSA. Technical Report. Advances in Elliptic Curve Cryptography.
    [23]
    Vitalik Buterin. {n.d.}. Ethereum’s White Paper: A Next-Generation Smart Contract and Decentralized Application Platform.
    [24]
    Rebecca Campbell. 2017. Delaware Passes Groundbreaking Blockchain Regulation Bill.
    [25]
    Miguel Castro and Barbara Liskov. {n.d.}. Practical byzantine fault tolerance. In OSDI 1999. 173--186.
    [26]
    Melissa Chase. {n.d.}. Multi-authority Attribute Based Encryption. 515--534.
    [27]
    David Chaum and Eugène van Heyst. {n.d.}. Group Signatures. 257--265.
    [28]
    Lin Chen, Lei Xu, Nolan Shah, Zhimin Gao, Yang Lu, and Weidong Shi. 2017. On security analysis of proof-of-elapsed-time (PoET). In Stabilization, Safety, and Security of Distributed Systems. 282--297.
    [29]
    Raymond Cheng, Fan Zhang, Jernej Kos, Warren He, Nicholas Hynes, Noah M. Johnson, Ari Juels, Andrew Miller, and Dawn Song. 2018. Ekiden: A platform for confidentiality-preserving, trustworthy, and performant smart contract execution. CoRR abs/1804.05141 (2018).
    [30]
    Coindesk. 2017. State of Blockchian - Q4 2017.
    [31]
    Nxt community. 2014. Nxt Whitepaper.
    [32]
    Mauro Conti, Sandeep Kumar E., Chhagan Lal, and Sushmita Ruj. 2017. A survey on security and privacy issues of Bitcoin. CoRR abs/1706.00916 (2017).
    [33]
    Henry Corrigan-Gibbs and Bryan Ford. {n.d.}. Dissent: Accountable Anonymous Group Messaging. 340--350.
    [34]
    Phil Daian, Rafael Pass, and Elaine Shi. 2016. Snow White: Provably Secure Proofs of Stake. Cryptology ePrint Archive, Report 2016/919.
    [35]
    Jules DuPont and Anna Cinzia Squicciarini. {n.d.}. Toward De-Anonymizing Bitcoin by mapping users location. In CODASPY 2015. 139--141.
    [36]
    Cynthia Dwork, Moni Naor, and Amit Sahai. {n.d.}. Concurrent zero-knowledge. In STOC 1998. 409--418.
    [37]
    Taher ElGamal. {n.d.}. A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms. 10--18.
    [38]
    Fangyu Gai, Baosheng Wang, Wenping Deng, and Wei Peng. 2018. Proof of reputation: A reputation-based consensus protocol for peer-to-peer network. In Database Systems for Advanced Applications. 666--681.
    [39]
    Juan Garay, Aggelos Kiayias, and Nikos Leonardos. 2015. The Bitcoin backbone protocol: Analysis and applications. In EUROCRYPT 2015. 281--310.
    [40]
    Sanjam Garg, Craig Gentry, Shai Halevi, Amit Sahai, and Brent Waters. {n.d.}. Attribute-Based Encryption for Circuits from Multilinear Maps. 479--499.
    [41]
    Craig Gentry. {n.d.}. Fully homomorphic encryption using ideal lattices. In STOC 2009. 169--178.
    [42]
    Yossi Gilad, Rotem Hemo, Silvio Micali, Georgios Vlachos, and Nickolai Zeldovich. 2017. Algorand: Scaling Byzantine Agreements for Cryptocurrencies. Cryptology ePrint Archive, Report 2017/454.
    [43]
    Seth Gilbert and Nancy Lynch. 2002. Brewer’s conjecture and the feasibility of consistent, available, partition-tolerant web services. SIGACT News 33, 2 (June 2002), 5--59.
    [44]
    GoChain. 2018. Proof of Reputation.
    [45]
    Oded Goldreich, Silvio Micali, and Avi Wigderson. {n.d.}. How to play any mental game or A completeness theorem for protocols with honest majority. In STOC 1987. 218--229.
    [46]
    S. Goldwasser, S. Micali, and C. Rackoff. {n.d.}. The knowledge complexity of interactive proof-systems. In STOC 1985. 291--304.
    [47]
    Sergey Gorbunov, Vinod Vaikuntanathan, and Hoeteck Wee. {n.d.}. Attribute-based encryption for circuits. In Proceedings of the 45th Annual ACM Symposium on Theory of Computing (STOC 2013). 545--554.
    [48]
    Jens Groth. {n.d.}. Short Pairing-Based Non-interactive Zero-Knowledge Arguments. 321--340.
    [49]
    Stuart Haber and W. Scott Stornetta. 1991. How to time-stamp a digital document. J. Cryptology 3, 2 (1991), 99--111.
    [50]
    Intel. 2017. Sawtooth Lake. Retrieved from https://intelledger.github.io/.
    [51]
    Don Johnson, Alfred Menezes, and Scott Vanstone. 2001. The elliptic curve digital signature algorithm (ECDSA). Int. J. Inf. Secur. 1, 1 (2001), 36--63.
    [52]
    T. Jung, X. Y. Li, Z. Wan, and M. Wan. {n.d.}. Privacy preserving cloud data access with multi-authorities. In INFOCOM 2013. 2625--2633.
    [53]
    Harry Kalodner, Steven Goldfeder, Xiaoqi Chen, S. Matthew Weinberg, and Edward W. Felten. {n.d.}. Arbitrum: Scalable, private smart contracts. In USENIX Security 2018. 1353--1370.
    [54]
    Ghassan Karame. {n.d.}. On the security and scalability of Bitcoin’s Blockchain. In CCS 2016. 1861--1862.
    [55]
    Aggelos Kiayias, Alexander Russell, Bernardo David, and Roman Oliynykov. {n.d.}. Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol. 357--388.
    [56]
    Sunny King and Scott Nadal. 2012. PPCoin: Peer-to-peer crypto-currency with proof-of-stake. (2012).
    [57]
    Protocol Labs. 2017. Filecoin: A Decentralized Storage Network.
    [58]
    Leslie Lamport. 2016. Paxos made simple. ACM Sigact News 32, 4 (2016).
    [59]
    Leslie Lamport, Robert Shostak, and Marshall Pease. {n.d.}. The byzantine generals problem. ACM Trans. Program. Lang. Syst. 4, 3 ({n. d.}), 382--401.
    [60]
    Allison Lewko and Brent Waters. {n.d.}. Decentralizing attribute-based encryption. In EUROCRYPT 2011. 568--588.
    [61]
    Xiaoqi Li, Peng Jiang, Ting Chen, Xiapu Luo, and Qiaoyan Wen. 2017. A survey on the security of blockchain systems. Future Generation Computer Systems (2017).
    [62]
    Gregory Maxwell. 2013. CoinJoin: Bitcoin privacy for the real world. Retrieved from bitcointalk.org.
    [63]
    Mindi McDowell. 2013. Understanding Denial-of-Service Attacks.
    [64]
    Sarah Meiklejohn, Marjori Pomarole, Grant Jordan, Kirill Levchenko, Damon McCoy, Geoffrey M. Voelker, and Stefan Savage. {n.d.}. A fistful of Bitcoins: Characterizing payments among men with no names. In IMC 2013. 127--140.
    [65]
    Andrew Miller, Yu Xia, Kyle Croman, Elaine Shi, and Dawn Song. {n.d.}. The honey badger of BFT protocols. In CCS 2016. 31--42.
    [66]
    H. Moniz, N. F. Neves, M. Correia, and P. Verissimo. {n.d.}. Experimental comparison of local and shared coin randomized consensus protocols. In SRDS 2006. 235--244.
    [67]
    Satoshi Nakamoto. 2008. Bitcoin: A peer-to-peer electronic cash system. Retrieved from www.bitcoin.org, 9. (2008).
    [68]
    Arvind Narayanan, Joseph Bonneau, Edward Felten, Andrew Miller, and Steven Goldfeder. 2016. Bitcoin and Cryptocurrency Technologies: A Comprehensive Introduction.
    [69]
    SAFE Network. 2018. A SAFE Network Primer—An Introductory guide to the world’s first fully autonomous data network.
    [70]
    Diego Ongaro and John Ousterhout. {n.d.}. In search of an understandable consensus algorithm. In USENIX ATC 2014. 305--320.
    [71]
    Pascal Paillier. {n.d.}. Public-key cryptosystems based on composite degree residuosity classes. In EUROCRYPT 1999. 223--238.
    [72]
    Rafael Pass, Lior Seeman, and Abhi Shelat. {n.d.}. Analysis of the Blockchain Protocol in Asynchronous Networks. 643--673.
    [73]
    Rafael Pass and Elaine Shi. {n.d.}. FruitChains: A fair Blockchain. In PODC 2017. 315--324.
    [74]
    Rafael Pass and Elaine Shi. 2016. The Sleepy Model of Consensus. Cryptology ePrint Archive, Report 2016/918.
    [75]
    M. Pease, R. Shostak, and L. Lamport. {n.d.}. Reaching agreement in the presence of faults. J. ACM 27, 2 ({n. d.}), 228--234.
    [76]
    Andrea Pinna and Wiebe Ruttenberg. 2016. Distributed ledger technologies in securities post-trading.
    [77]
    R. L. Rivest, A. Shamir, and L. Adleman. {n.d.}. A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21, 2 ({n. d.}), 120--126.
    [78]
    Ronald L. Rivest, Adi Shamir, and Yael Tauman. {n.d.}. How to Leak a Secret. 552--565.
    [79]
    Tim Ruffing, Pedro Moreno-Sanchez, and Aniket Kate. {n.d.}. CoinShuffle: Practical Decentralized Coin Mixing for Bitcoin. 345--364.
    [80]
    Nicolas van Saberhagen, Johannes Meier, Antonio M. Juarez, and Max Jameson. 2012. CryptoNote Signatures.
    [81]
    Amit Sahai and Brent Waters. {n.d.}. Fuzzy Identity-Based Encryption. 457--473.
    [82]
    Eli Ben Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer, and Madars Virza. {n.d.}. Zerocash: Decentralized anonymous payments from Bitcoin. In SP 2014. 459--474.
    [83]
    Emin Gün Sirer. {n.d.}. Hacking, Distributed.
    [84]
    Emin Gün Sirer. 2016. Bitcoin Guarantees Strong, Not Eventual, Consistency.
    [85]
    China Blockchain Technology and Industry Development Forum. 2016. China Blockchain Technology and Application Development White Paper.
    [86]
    Jason Teutsch and Christian Reitwießner. 2017. TrueBit: A scalable verification solution for blockchains.
    [87]
    Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan. {n.d.}. Fully homomorphic encryption over the integers. In EUROCRYPT 2010. 24--43.
    [88]
    Pavel Vasin. 2018. BlackCoin’s Proof-of-Stake Protocol v2.
    [89]
    Werner Vogels. {n.d.}. Eventually consistent. Commun. ACM 52, 1 ({n. d.}), 40--44.
    [90]
    Mark Walport. 2016. Distributed ledger technology: Beyond block chain.
    [91]
    Roger Wattenhofer. 2016. The Science of the Blockchain (1st ed.). CreateSpace Independent Publishing Platform.
    [92]
    Wikipedia. {n.d.}. Proof-of-authority. Retrieved from https://en.wikipedia.org/wiki/Proof-of-authority.
    [93]
    Shawn Wilkinson, Tome Boshevski, Josh Brandof, James Prestwich, Gordon Hall, Patrick Gerbes, Philip Hutchins, and Chris Pollard. {n.d.}. Storj: A Peer-to-Peer Cloud Storage Network.
    [94]
    A. C. Yao. {n.d.}. Protocols for secure computations. In SFCS 1982. 160--164.
    [95]
    Andrew Chi-Chih Yao. {n.d.}. How to generate and exchange secrets. In SFCS 1986. 162--167.
    [96]
    Guy Zyskind, Oz Nathan, and Alex Pentland. 2015. Enigma: Decentralized computation platform with guaranteed privacy. Comput. Sci. (2015).
    [97]
    Christian Decker, Jochen Seidel, and Roger Wattenhofer. 2016. Bitcoin meets strong consistency. In Proceedings of the 17th International Conference on Distributed Computing and Networking (ICDCN’16). ACM, New York, NY, USA, Article 13, 10 pages.

    Cited By

    View all
    • (2025)Distributed and trustworthy digital twin platform based on blockchain and Web3 technologiesCyber Security and Applications10.1016/j.csa.2024.1000643(100064)Online publication date: Dec-2025
    • (2024)Effects of Cryptocurrency Vulnerabilities on the International Trading ArenaEuropean Modern Studies Journal10.59573/emsj.8(1).2024.248:1(269-281)Online publication date: 19-Mar-2024
    • (2024)AI Applications in Analysing and Predicting Cryptocurrency MarketRecent trends in Management and Commerce10.46632/rmc/5/2/85:2(42-46)Online publication date: 13-Jul-2024
    • Show More Cited By

    Recommendations

    Reviews

    Phoram Mehta

    While still controversial in terms of mainstream use, the study, research, and development of all things blockchain has been moving ahead full steam. Interestingly, while distributed ledger technology (DLT) is intrinsically perceived to be more secure than traditional client-server and n -tiered architectures, the desire to study these aspects in detail have been rising as commercial use cases rise beyond cryptocurrency. This paper, a survey of existing blockchain security and privacy attributes and attacks, while focused on Bitcoin-like systems, is a good reference for other DLT applications. The authors also propose additional security and privacy properties that developers of new DLT applications may desire. Primarily, due to a lack of non-cryptocurrency blockchain-based applications, the authors stick to comparing Bitcoin-like systems to explain the threats, techniques, and procedures for the security and privacy attributes identified. However, they do add a high-level analysis of proposed attributes for current DLT applications based on cryptographic components like "consensus algorithms, hash chained storage, mixing protocols, anonymous signatures, [and] non-interactive zero-knowledge proof[s]." What sets this paper apart from many other security and privacy analyses of blockchain systems is its focus on individual properties rather than the application as a whole. In assuming familiarity with cryptocurrency applications based on DLT, the authors succeed in furthering the discussion and research on advanced security and privacy aspirations for semi-private distributed systems. As a supplementary reference, the paper also includes basic descriptions of blockchain concepts, inherent security attributes in blockchain systems, and consensus algorithms.

    Access critical reviews of Computing literature here

    Become a reviewer for Computing Reviews.

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Computing Surveys
    ACM Computing Surveys  Volume 52, Issue 3
    May 2020
    734 pages
    ISSN:0360-0300
    EISSN:1557-7341
    DOI:10.1145/3341324
    • Editor:
    • Sartaj Sahni
    Issue’s Table of Contents
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 03 July 2019
    Accepted: 01 February 2019
    Revised: 01 January 2019
    Received: 01 May 2018
    Published in CSUR Volume 52, Issue 3

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. Blockchain
    2. privacy
    3. security

    Qualifiers

    • Survey
    • Research
    • Refereed

    Funding Sources

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)8,694
    • Downloads (Last 6 weeks)644
    Reflects downloads up to 09 Aug 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2025)Distributed and trustworthy digital twin platform based on blockchain and Web3 technologiesCyber Security and Applications10.1016/j.csa.2024.1000643(100064)Online publication date: Dec-2025
    • (2024)Effects of Cryptocurrency Vulnerabilities on the International Trading ArenaEuropean Modern Studies Journal10.59573/emsj.8(1).2024.248:1(269-281)Online publication date: 19-Mar-2024
    • (2024)AI Applications in Analysing and Predicting Cryptocurrency MarketRecent trends in Management and Commerce10.46632/rmc/5/2/85:2(42-46)Online publication date: 13-Jul-2024
    • (2024)Evaluating Barriers to Blockchain Adoption in the Insurance Sector using Interval-Valued Intuitionistic Fuzzy TOPSISWSEAS TRANSACTIONS ON BUSINESS AND ECONOMICS10.37394/23207.2024.21.12921(1584-1597)Online publication date: 12-Jul-2024
    • (2024)Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A SurveyAlgorithms10.3390/a1705020117:5(201)Online publication date: 9-May-2024
    • (2024)Blockchain based intrusion detection in agent-driven flight operationsMultiagent and Grid Systems10.3233/MGS-24001720:2(161-183)Online publication date: 12-Aug-2024
    • (2024)Tokenization of real assets: classification, platforms, applications, opportunities and challenges of developmentRussian Journal of Economics and Law10.21202/2782-2923.2024.1.88-10418:1(88-104)Online publication date: 18-Mar-2024
    • (2024)Using blockchain technology for sustainable public procurement of road worksRevista de Administração Pública10.1590/0034-761220230073x58:3Online publication date: 2024
    • (2024)Uso da tecnologia blockchain nas contratações públicas sustentáveis de obras rodoviáriasRevista de Administração Pública10.1590/0034-76122023007358:3Online publication date: 2024
    • (2024)Architectural framework for a United Blockchain Interaction LibraryPROBLEMS IN PROGRAMMING10.15407/pp2024.01.086(86-95)Online publication date: Jan-2024
    • Show More Cited By

    View Options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    HTML Format

    View this article in HTML Format.

    HTML Format

    Get Access

    Login options

    Full Access

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media