Security, Performance, and Applications of Smart Contracts: A Systematic Survey
---
paper_title: Hyperledger fabric: a distributed operating system for permissioned blockchains

paper_content:

Hyperledger Fabric is a modular and extensible open-source system for deploying and operating permissioned blockchains. Fabric is currently used in more than 400 prototypes and proofs-of-concept of distributed ledger technology, as well as several production systems, across different industries and use cases. Starting from the premise that there are no"one-size-fits-all"solutions, Fabric is the first truly extensible blockchain system for running distributed applications. It supports modular consensus protocols, which allows the system to be tailored to particular use cases and trust models. Fabric is also the first blockchain system that runs distributed applications written in general-purpose programming languages, without systemic dependency on a native cryptocurrency. This stands in sharp contrast to existing blockchain platforms for running smart contracts that require code to be written in domain-specific languages or rely on a cryptocurrency. Furthermore, it uses a portable notion of membership for realizing the permissioned model, which may be integrated with industry-standard identity management. To support such flexibility, Fabric takes a novel approach to the design of a permissioned blockchain and revamps the way blockchains cope with non-determinism, resource exhaustion, and performance attacks. This paper describes Fabric, its architecture, the rationale behind various design decisions, its security model and guarantees, its most prominent implementation aspects, as well as its distributed application programming model. We further evaluate Fabric by implementing and benchmarking a Bitcoin-inspired digital currency. We show that Fabric achieves end-to-end throughput of more than 3500 transactions per second in certain popular deployment configurations, with sub-second latency.
---
paper_title: Systematic mapping studies in software engineering

paper_content:

BACKGROUND: A software engineering systematic map is a defined method to build a classification scheme and structure a software engineering field of interest. The analysis of results focuses on frequencies of publications for categories within the scheme. Thereby, the coverage of the research field can be determined. Different facets of the scheme can also be combined to answer more specific research questions. ::: ::: OBJECTIVE: We describe how to conduct a systematic mapping study in software engineering and provide guidelines. We also compare systematic maps and systematic reviews to clarify how to chose between them. This comparison leads to a set of guidelines for systematic maps. ::: ::: METHOD: We have defined a systematic mapping process and applied it to complete a systematic mapping study. Furthermore, we compare systematic maps with systematic reviews by systematically analyzing existing systematic reviews. ::: ::: RESULTS: We describe a process for software engineering systematic mapping studies and compare it to systematic reviews. Based on this, guidelines for conducting systematic maps are defined. ::: ::: CONCLUSIONS: Systematic maps and reviews are different in terms of goals, breadth, validity issues and implications. Thus, they should be used complementarily and require different methods (e.g., for analysis).
---
paper_title: Decentralized Applications: The Blockchain-Empowered Software System

paper_content:

Blockchain technology has attracted tremendous attention in both academia and capital market. However, overwhelming speculations on thousands of available cryptocurrencies and numerous initial coin offering (ICO) scams have also brought notorious debates on this emerging technology. This paper traces the development of blockchain systems to reveal the importance of decentralized applications (dApps) and the future value of blockchain. We survey the state-of-the-art dApps and discuss the direction of blockchain development to fulfill the desirable characteristics of dApps. The readers will gain an overview of dApp research and get familiar with recent developments in the blockchain.
---
paper_title: A Blockchain-based Infrastructure for Reliable and Cost-effective IoT-aided Smart Grids

paper_content:

One of the main trends in the evolution of smart grids is transactive energy, where distributed energy resources, e.g. smart meters, develop towards Internet-of-Things (IoT) devices enabling prosumers to trade energy directly among each other, without the need of involving any centralised third party. The expected advantages in terms of cost-effectiveness would be significant, indeed technical solutions are being investigated and large-scale deployment are planned by major utilities companies. However, introducing transactive energy in the smart grid entails new security threats, such as forging energy transactions. This paper introduces an infrastructure to support reliable and cost-effective transactive energy, based on blockchain and smart contracts, where functionalities are implemented as fully decentralised applications. Energy transactions are stored in the blockchain, whose high replication level ensures stronger guarantees against tampering. Energy auctions are carried out according to transparent rules implemented as smart contracts, hence visible to all involved actors. Threats deriving from known vulnerabilities of smart meters are mitigated by temporarily keeping out exposed prosumers and updating their devices as soon as security patches become available.
---
paper_title: Comparing Blockchain and Cloud Services for Business Process Execution

paper_content:

Blockchain is of rising importance as a technology for engineering applications in cross-organizational settings, avoiding reliance on central trusted third-parties. The use of blockchain, instead of traditional databases or services, is an architectural choice in the development of a software system. The costs of execution and storage are important non-functional qualities, but as yet very little has been done to study them for blockchain-based systems. We investigate the cost of using blockchain using business process execution as a lens. Specifically, we compare the cost for computation and storage of business process execution on blockchain vs. a popular cloud service. First, we capture the cost models for both alternatives. Second, we implemented and measured the cost of business process execution on blockchain and cloud services for an example business process model from the literature. We observe two orders of magnitude difference in this cost.
---
paper_title: Metrics for assessing blockchain-based healthcare decentralized apps

paper_content:

Blockchain is a decentralized, trustless protocol that combines transparency, immutability, and consensus properties to enable secure, pseudo-anonymous transactions. Smart contracts are built atop a blockchain to support on-chain storage and enable Decentralized Apps (DApps) to interact with the blockchain programatically. Programmable blockchains have generated interest in the healthcare domain as a potential solution to resolve key challenges, such as gapped communications, inefficient clinical report delivery, and fragmented health records. This paper provides evaluation metrics to assess blockchain-based DApps in terms of their feasibility, intended capability, and compliance in the healthcare domain.
---
paper_title: FairAccess: a new Blockchain-based access control framework for the Internet of Things

paper_content:

Security and privacy are huge challenges in Internet of Things (IoT) environments, but unfortunately, the harmonization of the IoT-related standards and protocols is hardly and slowly widespread. In this paper, we propose a new framework for access control in IoT based on the blockchain technology. Our first contribution consists in providing a reference model for our proposed framework within the Objectives, Models, Architecture and Mechanism specification in IoT. In addition, we introduce FairAccess as a fully decentralized pseudonymous and privacy preserving authorization management framework that enables users to own and control their data. To implement our model, we use and adapt the blockchain into a decentralized access control manager. Unlike financial bitcoin transactions, FairAccess introduces new types of transactions that are used to grant, get, delegate, and revoke access. As a proof of concept, we establish an initial implementation with a Raspberry PI device and local blockchain. Finally, we discuss some limitations and propose further opportunities. Copyright © 2017 John Wiley & Sons, Ltd.
---
paper_title: A Smart Contract for Boardroom Voting with Maximum Voter Privacy

paper_content:

We present the first implementation of a decentralised and self-tallying internet voting protocol with maximum voter privacy using the Blockchain. The Open Vote Network is suitable for boardroom elections and is written as a smart contract for Ethereum. Unlike previously proposed Blockchain e-voting protocols, this is the first implementation that does not rely on any trusted authority to compute the tally or to protect the voter’s privacy. Instead, the Open Vote Network is a self-tallying protocol, and each voter is in control of the privacy of their own vote such that it can only be breached by a full collusion involving all other voters. The execution of the protocol is enforced using the consensus mechanism that also secures the Ethereum blockchain. We tested the implementation on Ethereum’s official test network to demonstrate its feasibility. Also, we provide a financial and computational breakdown of its execution cost.
---
paper_title: Systematic literature reviews in software engineering – A systematic literature review

paper_content:

Background: In 2004 the concept of evidence-based software engineering (EBSE) was introduced at the ICSE04 conference. Aims: This study assesses the impact of systematic literature reviews (SLRs) which are the recommended EBSE method for aggregating evidence. Method: We used the standard systematic literature review method employing a manual search of 10 journals and 4 conference proceedings. Results: Of 20 relevant studies, eight addressed research trends rather than technique evaluation. Seven SLRs addressed cost estimation. The quality of SLRs was fair with only three scoring less than 2 out of 4. Conclusions: Currently, the topic areas covered by SLRs are limited. European researchers, particularly those at the Simula Laboratory appear to be the leading exponents of systematic literature reviews. The series of cost estimation SLRs demonstrate the potential value of EBSE for synthesising evidence and making it available to practitioners.
---
paper_title: Blockchain and IoT Integration: A Systematic Survey

paper_content:

The Internet of Things (IoT) refers to the interconnection of smart devices to collect data and make intelligent decisions. However, a lack of intrinsic security measures makes IoT vulnerable to privacy and security threats. With its "security by design," Blockchain (BC) can help in addressing major security requirements in IoT. BC capabilities like immutability, transparency, auditability, data encryption and operational resilience can help solve most architectural shortcomings of IoT. This article presents a comprehensive survey on BC and IoT integration. The objective of this paper is to analyze the current research trends on the usage of BC-related approaches and technologies in an IoT context. This paper presents the following novelties, with respect to related work: (i) it covers different application domains, organizing the available literature according to this categorization, (ii) it introduces two usage patterns, i.e., device manipulation and data management (open marketplace solution), and (iii) it reports on the development level of some of the presented solutions. We also analyze the main challenges faced by the research community in the smooth integration of BC and IoT, and point out the main open issues and future research directions. Last but not least, we also present a survey about novel uses of BC in the machine economy.
---
paper_title: A Blockchain-Based Supply Chain Quality Management Framework

paper_content:

Recent quality scandals reveal the importance of quality management from a supply chain perspective. Although there has been many related studies focusing on supply chain quality management, the technologies used still have difficulties in resolving problems arising from the lack of trust in supply chains. The root reason lies in three challenges brought to the traditional centralized trust mechanism: self-interests of supply chain members, information asymmetry in production processes, costs and limitations of quality inspections. Blockchain is a promising technology to address these problems. In this paper, we discuss how to improve the supply chain quality management by adopting the blockchain technology, and propose a framework for blockchain-based supply chain quality management.
---
paper_title: MedRec: Using Blockchain for Medical Data Access and Permission Management

paper_content:

Years of heavy regulation and bureaucratic inefficiency have slowed innovation for electronic medical records (EMRs). We now face a critical need for such innovation, as personalization and data science prompt patients to engage in the details of their healthcare and restore agency over their medical data. In this paper, we propose MedRec: a novel, decentralized record management system to handle EMRs, using blockchain technology. Our system gives patients a comprehensive, immutable log and easy access to their medical information across providers and treatment sites. Leveraging unique blockchain properties, MedRec manages authentication, confidentiality, accountability and data sharing -- crucial considerations when handling sensitive information. A modular design integrates with providers' existing, local data storage solutions, facilitating interoperability and making our system convenient and adaptable. We incentivize medical stakeholders (researchers, public health authorities, etc.) to participate in the network as blockchain "miners". This provides them with access to aggregate, anonymized data as mining rewards, in return for sustaining and securing the network via Proof of Work. MedRec thus enables the emergence of data economics, supplying big data to empower researchers while engaging patients and providers in the choice to release metadata. The purpose of this short paper is to expose, prior to field tests, a working prototype through which we analyze and discuss our approach.
---
paper_title: Smart contracts for container based video conferencing services: Architecture and implementation

paper_content:

Today, container-based virtualization is very popular due to the lightweight nature of containers and the ability to use them flexibly in various heterogeneously composed systems. This makes it possible to collaboratively develop services by sharing various types of resources, such as infrastructures, software and digitalized content. In this work, our home made video-conferencing (VC) system is used to study resource usage optimisation in business context. An application like this, does not provide monetization possibilities to all involved stakeholders including end users, cloud providers, software engineers and similar. Blockchain related technologies, such as Smart Contracts (SC) offer a possibility to address some of these needs. We introduce a novel architecture for monetization of added-value according to preferences of the stakeholders that participate in joint software service offers. The developed architecture facilitates use case scenarios of service and resource offers according to fixed and dynamic pricing schemes, fixed usage period, prepaid quota for flexible usage, division of income, consensual decisions among collaborative service providers, and constrained based usage of resources or services. Our container-based VC service, which is based on the Jitsi Meet Open Source software is used to demonstrate the proposed architecture and the benefits of the investigated use cases.
---
paper_title: A Blockchain Implementation Prototype for the Electronic Open Source Traceability of Wood along the Whole Supply Chain

paper_content:

This is the first work to introduce the use of blockchain technology for the electronic traceability of wood from standing tree to final user. Infotracing integrates the information related to the product quality with those related to the traceability [physical and digital documents (Radio Frequency IDentification-RFID-architecture)] within an online information system whose steps (transactions) can be made safe to evidence of alteration through the blockchain. This is a decentralized and distributed ledger that keeps records of digital transactions in such a way that makes them accessible and visible to multiple participants in a network while keeping them secure without the need of a centralized certification organism. This work implements a blockchain architecture within the wood chain electronic traceability. The infotracing system is based on RFID sensors and open source technology. The entire forest wood supply chain was simulated from standing trees to the final product passing through tree cutting and sawmill process. Different kinds of Internet of Things (IoT) open source devices and tags were used, and a specific app aiming the forest operations was engineered to collect and store in a centralized database information (e.g., species, date, position, dendrometric and commercial information).
---
paper_title: Blockchain based smart contract for bidding system

paper_content:

Because of the popularity of the Internet, the integration services have gradually changed people daily life, such as e-commerce activities on transactions, transportation and so on. The E-auction, one of the popular e-commerce activities, allows bidders to directly bid the products over the Internet. As for sealed bid, the extra transaction cost is required for the intermediaries because the third-party is the important role between the buyers and the sellers help to trade both during the auction. In addition, it never guarantees whether the third-party is trust. To resolve the problems, the blockchain technology with low transaction cost is used to develop the smart contract of public bid and sealed bid. The smart contract, proposed in 1990 and implements via Ethereum platform, can ensure the bill secure, private, non-reputability and inalterability owing to all the transactions are recorded in the same but decentralized ledgers. The smart contract is composed of the address of Auctioneer, the start auction time, deadline, the address of current winner, the current highest price. In the experiments, the accounts are created through Ethereum wallet. In miner stage, the MinerGate is used in miner stage for obtaining money to pay the transaction fee. At recorder stage, the nodes of blockchain are synchronized to generate smart contract.
---
paper_title: Blockchain distributed ledger technologies for biomedical and health care applications

paper_content:

Objectives ::: To introduce blockchain technologies, including their benefits, pitfalls, and the latest applications, to the biomedical and health care domains. ::: ::: ::: Target Audience ::: Biomedical and health care informatics researchers who would like to learn about blockchain technologies and their applications in the biomedical/health care domains. ::: ::: ::: Scope ::: The covered topics include: (1) introduction to the famous Bitcoin crypto-currency and the underlying blockchain technology; (2) features of blockchain; (3) review of alternative blockchain technologies; (4) emerging nonfinancial distributed ledger technologies and applications; (5) benefits of blockchain for biomedical/health care applications when compared to traditional distributed databases; (6) overview of the latest biomedical/health care applications of blockchain technologies; and (7) discussion of the potential challenges and proposed solutions of adopting blockchain technologies in biomedical/health care domains.
---
paper_title: Blockchain-inspired Event Recording System for Autonomous Vehicles

paper_content:

Autonomous vehicles are capable of sensing their environment and navigating without any human inputs. However, when autonomous vehicles are involved in accidents between themselves or with human subjects, liability must be indubitably decided based on accident forensics. This paper proposes a blockchain-inspired event recording system for autonomous vehicles. Due to the inefficiency and limited usage of certain blockchain features designed for the traditional cryptocurrency applications, we design a new "proof of event" mechanism to achieve indisputable accident forensics by ensuring that event information is trustable and verifiable. Specifically, we propose a dynamic federation consensus scheme to verify and confirm the new block of event data in an efficient way without any central authority. The security capability of the proposed scheme is also analyzed against different threat and attack models.
---
paper_title: An Online Identity and Smart Contract Management System

paper_content:

In today's online environment, people attend various kinds of activities, exhibit different digital presence, build personal digital reputations, issuing and receiving feedbacks from online communities being involved with. These diverse information sources once aggregated can provide a valuablefuture reference for personal online digital identity and credits check. The primary objective of this paper is to propose a systematic framework for aggregating online identity and reputation information, to provide a holistic approach to personal online behavioral ratings. Major contributions include: An identity aggregation mechanism based on social dependency network is proposed, a smart contract management framework referring to personal online ratings based on the aggregated digital identity, an experiment implementation based on blockchain technology, with illustrative examples and theoretical evaluations to the proposed approach.
---
paper_title: Blockchain for AI: Review and Open Research Challenges

paper_content:

Recently, artificial intelligence (AI) and blockchain have become two of the most trending and disruptive technologies. Blockchain technology has the ability to automate payment in cryptocurrency and to provide access to a shared ledger of data, transactions, and logs in a decentralized, secure, and trusted manner. Also with smart contracts, blockchain has the ability to govern interactions among participants with no intermediary or a trusted third party. AI, on the other hand, offers intelligence and decision-making capabilities for machines similar to humans. In this paper, we present a detailed survey on blockchain applications for AI. We review the literature, tabulate, and summarize the emerging blockchain applications, platforms, and protocols specifically targeting AI area. We also identify and discuss open research challenges of utilizing blockchain technologies for AI.
---
paper_title: A systematic literature review of blockchain-based applications: Current status, classification and open issues

paper_content:

Abstract This work provides a systematic literature review of blockchain-based applications across multiple domains. The aim is to investigate the current state of blockchain technology and its applications and to highlight how specific characteristics of this disruptive technology can revolutionise “business-as-usual” practices. To this end, the theoretical underpinnings of numerous research papers published in high ranked scientific journals during the last decade, along with several reports from grey literature as a means of streamlining our assessment and capturing the continuously expanding blockchain domain, are included in this review. Based on a structured, systematic review and thematic content analysis of the discovered literature, we present a comprehensive classification of blockchain-enabled applications across diverse sectors such as supply chain, business, healthcare, IoT, privacy, and data management, and we establish key themes, trends and emerging areas for research. We also point to the shortcomings identified in the relevant literature, particularly limitations the blockchain technology presents and how these limitations spawn across different sectors and industries. Building on these findings, we identify various research gaps and future exploratory directions that are anticipated to be of significant value both for academics and practitioners.
---
paper_title: Blockchain challenges and opportunities: a survey

paper_content:

Blockchain has numerous benefits such as decentralisation, persistency, anonymity and auditability. There is a wide spectrum of blockchain applications ranging from cryptocurrency, financial services, risk management, internet of things (IoT) to public and social services. Although a number of studies focus on using the blockchain technology in various application aspects, there is no comprehensive survey on the blockchain technology in both technological and application perspectives. To fill this gap, we conduct a comprehensive survey on the blockchain technology. In particular, this paper gives the blockchain taxonomy, introduces typical blockchain consensus algorithms, reviews blockchain applications and discusses technical challenges as well as recent advances in tackling the challenges. Moreover, this paper also points out the future directions in the blockchain technology.
---
paper_title: A Novel Blockchain-based Trust Model for Cloud Identity Management

paper_content:

Secure and reliable management of identities has become one of the greatest challenges facing cloud computing today, mainly due to the huge number of new cloud-based applications generated by this model, which means more user accounts, passwords, and personal information to provision, monitor, and secure. Currently, identity federation is the most useful solution to overcome the aforementioned issues and simplify the user experience by allowing efficient authentication mechanisms and use of identity information from data distributed across multiple domains. However, this approach creates considerable complexity in managing trust relationships for both the cloud service providers and their clients. Poor management of trust in federated identity management systems brings with it many security, privacy and interoperability issues, which contributes to the reluctance of organizations to move their critical identity data to the cloud. In this paper, we aim to address these issues by introducing a novel trust and identity management model based on the Blockchain for cloud identity management with security and privacy improvements.
---
paper_title: Hyperledger fabric: a distributed operating system for permissioned blockchains

paper_content:

Hyperledger Fabric is a modular and extensible open-source system for deploying and operating permissioned blockchains. Fabric is currently used in more than 400 prototypes and proofs-of-concept of distributed ledger technology, as well as several production systems, across different industries and use cases. Starting from the premise that there are no"one-size-fits-all"solutions, Fabric is the first truly extensible blockchain system for running distributed applications. It supports modular consensus protocols, which allows the system to be tailored to particular use cases and trust models. Fabric is also the first blockchain system that runs distributed applications written in general-purpose programming languages, without systemic dependency on a native cryptocurrency. This stands in sharp contrast to existing blockchain platforms for running smart contracts that require code to be written in domain-specific languages or rely on a cryptocurrency. Furthermore, it uses a portable notion of membership for realizing the permissioned model, which may be integrated with industry-standard identity management. To support such flexibility, Fabric takes a novel approach to the design of a permissioned blockchain and revamps the way blockchains cope with non-determinism, resource exhaustion, and performance attacks. This paper describes Fabric, its architecture, the rationale behind various design decisions, its security model and guarantees, its most prominent implementation aspects, as well as its distributed application programming model. We further evaluate Fabric by implementing and benchmarking a Bitcoin-inspired digital currency. We show that Fabric achieves end-to-end throughput of more than 3500 transactions per second in certain popular deployment configurations, with sub-second latency.
---
paper_title: Practical byzantine fault tolerance and proactive recovery

paper_content:

Our growing reliance on online services accessible on the Internet demands highly available systems that provide correct service without interruptions. Software bugs, operator mistakes, and malicious attacks are a major cause of service interruptions and they can cause arbitrary behavior, that is, Byzantine faults. This article describes a new replication algorithm, BFT, that can be used to build highly available systems that tolerate Byzantine faults. BFT can be used in practice to implement real services: it performs well, it is safe in asynchronous environments such as the Internet, it incorporates mechanisms to defend against Byzantine-faulty clients, and it recovers replicas proactively. The recovery mechanism allows the algorithm to tolerate any number of faults over the lifetime of the system provided fewer than 1/3 of the replicas become faulty within a small window of vulnerability. BFT has been implemented as a generic program library with a simple interface. We used the library to implement the first Byzantine-fault-tolerant NFS file system, BFS. The BFT library and BFS perform well because the library incorporates several important optimizations, the most important of which is the use of symmetric cryptography to authenticate messages. The performance results show that BFS performs 2p faster to 24p slower than production implementations of the NFS protocol that are not replicated. This supports our claim that the BFT library can be used to build practical systems that tolerate Byzantine faults.
---
paper_title: The Bitcoin Backbone Protocol: Analysis and Applications

paper_content:

Bitcoin is the first and most popular decentralized cryptocurrency to date. In this work, we extract and analyze the core of the Bitcoin protocol, which we term the Bitcoin backbone, and prove two of its fundamental properties which we call common prefix and chain quality in the static setting where the number of players remains fixed. Our proofs hinge on appropriate and novel assumptions on the “hashing power” of the adversary relative to network synchronicity; we show our results to be tight under high synchronization.
---
paper_title: A Survey about Consensus Algorithms Used in Blockchain

paper_content:

Thanks to its potential in many applications, Blockchain has recently been nominated as one of the technologies exciting intense attention. Blockchain has solved the problem of changing the original low-trust centralized ledger held by a single third-party, to a high-trust decentralized form held by different entities, or in other words, verifying nodes. The key contribution of the work of Blockchain is the consensus algorithm, which decides how agreement is made to append a new block between all nodes in the verifying network. Blockchain algorithms can be categorized into two main groups. The first group is proof-based consensus, which requires the nodes joining the verifying network to show that they are more qualified than the others to do the appending work. The second group is voting-based consensus, which requires nodes in the network to exchange their results of verifying a new block or transaction, before making the final decision. In this paper, we present a review of the Blockchain consensus algorithms that have been researched and that are being applied in some well-known applications at this time.
---
paper_title: In search of an understandable consensus algorithm

paper_content:

Raft is a consensus algorithm for managing a replicated log. It produces a result equivalent to (multi-)Paxos, and it is as efficient as Paxos, but its structure is different from Paxos; this makes Raft more understandable than Paxos and also provides a better foundation for building practical systems. In order to enhance understandability, Raft separates the key elements of consensus, such as leader election, log replication, and safety, and it enforces a stronger degree of coherency to reduce the number of states that must be considered. Results from a user study demonstrate that Raft is easier for students to learn than Paxos. Raft also includes a new mechanism for changing the cluster membership, which uses overlapping majorities to guarantee safety.
---
paper_title: MeDShare: Trust-Less Medical Data Sharing Among Cloud Service Providers via Blockchain

paper_content:

The dissemination of patients’ medical records results in diverse risks to patients’ privacy as malicious activities on these records cause severe damage to the reputation, finances, and so on of all parties related directly or indirectly to the data. Current methods to effectively manage and protect medical records have been proved to be insufficient. In this paper, we propose MeDShare, a system that addresses the issue of medical data sharing among medical big data custodians in a trust-less environment. The system is blockchain-based and provides data provenance, auditing, and control for shared medical data in cloud repositories among big data entities. MeDShare monitors entities that access data for malicious use from a data custodian system. In MeDShare, data transitions and sharing from one entity to the other, along with all actions performed on the MeDShare system, are recorded in a tamper-proof manner. The design employs smart contracts and an access control mechanism to effectively track the behavior of the data and revoke access to offending entities on detection of violation of permissions on data. The performance of MeDShare is comparable to current cutting edge solutions to data sharing among cloud service providers. By implementing MeDShare, cloud service providers and other data guardians will be able to achieve data provenance and auditing while sharing medical data with entities such as research and medical institutions with minimal risk to data privacy.
---
paper_title: Scripting smart contracts for distributed ledger technology

paper_content:

We give an overview of the scripting languages used in existing cryptocurrencies, and in particular we review in some detail the scripting languages of Bitcoin, Nxt and Ethereum, in the context of a high-level overview of Distributed Ledger Technology and cryptocurrencies. We survey different approaches, and give an overview of critiques of existing languages. We also cover technologies that might be used to underpin extensions and innovations in scripting and contracts, including technologies for verification, such as zero knowledge proofs, proof-carrying code and static analysis, as well as approaches to making systems more efficient, e.g. Merkelized Abstract Syntax Trees.
---
paper_title: Evaluation of Logic-Based Smart Contracts for Blockchain Systems

paper_content:

While procedural languages are commonly used to program smart contracts in blockchain systems, logic-based languages may be interesting alternatives. In this paper, we inspect what are the possible legal and technical (dis)advantages of logic-based smart contracts in light of common activities featuring ordinary contracts, then we provide insights on how to use such logic-based smart contracts in combination with blockchain systems. These insights lead us to emphasize a fundamental challenge - algorithms for logic approaches have to be efficient, but they also need to be literally cheap as measured within the environment where they are deployed and according to its economic rules. We illustrate this with different algorithms from defeasible logic-based frameworks.
---
paper_title: SPESC: A Specification Language for Smart Contracts

paper_content:

The smart contract is an interdisciplinary concept that concerns business, finance, contract law and information technology. Designing and developing a smart contract may require the close cooperation of many experts coming from different fields. How to support such collaborative development is a challenging problem in blockchain-oriented software engineering. This paper proposes SPESC, a specification language for smart contracts, which can define the specification of a smart contract for the purpose of collaborative design. SPESC can specify a smart contract in a similar form to real-world contracts using a natural-language-like grammar, in which the obligations and rights of parties and the transaction rules of cryptocurrencies are clearly defined. The preliminary study results demonstrated that SPESC can be easily learned and understood by both IT and non-IT users and thus has greater potential to facilitate collaborative smart contract development.
---
paper_title: Evaluation of Logic-Based Smart Contracts for Blockchain Systems

paper_content:

While procedural languages are commonly used to program smart contracts in blockchain systems, logic-based languages may be interesting alternatives. In this paper, we inspect what are the possible legal and technical (dis)advantages of logic-based smart contracts in light of common activities featuring ordinary contracts, then we provide insights on how to use such logic-based smart contracts in combination with blockchain systems. These insights lead us to emphasize a fundamental challenge - algorithms for logic approaches have to be efficient, but they also need to be literally cheap as measured within the environment where they are deployed and according to its economic rules. We illustrate this with different algorithms from defeasible logic-based frameworks.
---
paper_title: Scilla: a Smart Contract Intermediate-Level LAnguage

paper_content:

This paper outlines key design principles of Scilla---an intermediate-level language for verified smart contracts. Scilla provides a clean separation between the communication aspect of smart contracts on a blockchain, allowing for the rich interaction patterns, and a programming component, which enjoys principled semantics and is amenable to formal verification. Scilla is not meant to be a high-level programming language, and we are going to use it as a translation target for high-level languages, such as Solidity, for performing program analysis and verification, before further compilation to an executable bytecode. We describe the automata-based model of Scilla, present its programming component and show how contract definitions in terms of automata streamline the process of mechanised verification of their safety and temporal properties.
---
paper_title: Writing safe smart contracts in Flint

paper_content:

Blockchain-based platforms such as Ethereum support the execution of versatile decentralized applications, known as smart contracts. These typically hold and transfer digital currency (e.g., Ether) to other parties on the platform. Contracts have been subject to numerous attacks, losing hundreds of millions of dollars (in Ether). We propose Flint, a new type-safe, capabilities-secure, contract-oriented programming language specifically designed for writing robust smart contracts. To help programmers reason about access control of functions, Flint programmers use caller capabilities. To prevent vulnerabilities relating to the unintentional loss of currency, transfers of assets in Flint are performed through safe atomic operations, inspired by linear type theory.
---
paper_title: BitML: A Calculus for Bitcoin Smart Contracts

paper_content:

We introduce BitML, a domain-specific language for specifying contracts that regulate transfers of bitcoins among participants, without relying on trusted intermediaries. We define a symbolic and a computational model for reasoning about BitML security. In the symbolic model, participants act according to the semantics of BitML, while in the computational model they exchange bitstrings, and read/append transactions on the Bitcoin blockchain. A compiler is provided to translate contracts into standard Bitcoin transactions. Participants can execute a contract by appending these transactions on the Bitcoin blockchain, according to their strategies. We prove the correctness of our compiler, showing that computational attacks on compiled contracts are also observable in the symbolic model.
---
paper_title: Blockchains everywhere - a use-case of blockchains in the pharma supply-chain

paper_content:

Blockchains are on the top of the Gartner Hype Cycle 2016 and many start-ups are integrating blockchains into their technology portfolio. While blockchains have emerged in the context of financial applications, non-financial application areas are of interest as well. In this paper, modum.io is presented, a start-up that uses IoT (Internet of Things) sensor devices leveraging blockchain technology to assert data immutability and public accessibility of temperature records, while reducing operational costs in the pharmaceutical supply-chain. The medical industry has many complex and strict environmental control process (e.g., temperature and humidity) to ensure quality control and regulatory compliance over the transport of medical products. The sensor devices monitor the temperature of each parcel during the shipment to fully ensure GDP regulations. All data is transferred to the blockchain where a smart contract assesses against the product attributes. As modum.io is not the only non-financial start-up working with blockchains, a list of areas and other start-ups is provided that aim to reduce bureaucracy, distribute the infrastructure, and saving costs using blockchains.
---
paper_title: EthIR: A Framework for High-Level Analysis of Ethereum Bytecode

paper_content:

Analyzing Ethereum bytecode, rather than the source code from which it was generated, is a necessity when: (1) the source code is not available (e.g., the blockchain only stores the bytecode), (2) the information to be gathered in the analysis is only visible at the level of bytecode (e.g., gas consumption is specified at the level of EVM instructions), (3) the analysis results may be affected by optimizations performed by the compiler (thus the analysis should be done ideally after compilation). This paper presents EthIR, a framework for analyzing Ethereum bytecode, which relies on (an extension of) OYENTE, a tool that generates CFGs; EthIR produces from the CFGs, a rule-based representation (RBR) of the bytecode that enables the application of (existing) high-level analyses to infer properties of EVM code.
---
paper_title: SmartInspect: solidity smart contract inspector

paper_content:

Solidity is a language used for smart contracts on the Ethereum blockchain. Smart contracts are embedded procedures stored with the data they act upon. Debugging smart contracts is a really difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded. In this paper, we address the lack of inspectability of a deployed contract by analyzing contract state using decompilation techniques driven by the contract structure definition. Our solution, SmartInspect, also uses a mirror-based architecture to represent locally object responsible for the interpretation of the contract state. SmartInspect allows contract developers to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code.
---
paper_title: Mirrors: design principles for meta-level facilities of object-oriented programming languages

paper_content:

We identify three design principles for reflection and metaprogramming facilities in object oriented programming languages. Encapsulation: meta-level facilities must encapsulate their implementation. Stratification: meta-level facilities must be separated from base-level functionality. Ontological correspondence: the ontology of meta-level facilities should correspond to the ontology of the language they manipulate. Traditional/mainstream reflective architectures do not follow these precepts. In contrast, reflective APIs built around the concept of mirrors are characterized by adherence to these three principles. Consequently, mirror-based architectures have significant advantages with respect to distribution, deployment and general purpose metaprogramming.
---
paper_title: Remote Debugging and Reflection in Resource Constrained Devices

paper_content:

Building software for devices that cannot locally support development tools can be challenging. These devices have either limited computing power to run an IDE (e.g., smart-phones), lack appropriate input/output interfaces (display, keyboard, mouse) for programming (e.g., mobile robots) or are simply unreachable for local development (e.g., cloud-servers). In these situations developers need appropriate infrastructure to remotely develop and debug applications. Yet remote debugging solutions can prove awkward to use due to their distributed nature. Empirical studies show us that on average 10.5 minutes per coding hour (over five 40-hour work weeks per year) are spend for re-deploying applications while fixing bugs or improving functionality [ZeroTurnAround 2011]. Moreover current solutions lack facilities that would otherwise be available in a local setting because its difficult to reproduce them remotely (e.g., object-centric debugging [Ressia 2012b]). This fact can impact the amount of experimentation during a remote debugging session - compared to a local setting. In this dissertation in order to overcome these issues we first identify four desirable properties that an ideal solution for remote debugging should exhibit, namely: interactiveness, instrumentation, distribution and security. Interactiveness is the ability of a remote debugging solution to incrementally update all parts of a remote application without losing the running context (i.e., without stopping the application). Instrumentation is the ability of a debugging solution to alter the semantics of a running process in order to assist debugging. Distribution is the ability of a debugging solution to adapt its framework while debugging a remote target. Finally security refers to the availability of prerequisites for authentication and access restriction. Given these properties we propose Mercury, a remote debugging model and architecture for reflective OO languages. Mercury supports interactiveness through a mirror-based remote meta-level that is causally connected to its target, instrumentation through reflective intercession by reifying the underlying execution environment, distribution through an adaptable middleware and security by decomposing and authenticating access to reflective facilities. We validate our proposal through a prototype implementation in the Pharo programming language using a diverse experimental setting of multiple constraint devices. We exemplify remote debugging techniques supported by Mercury's properties, such as remote agile debugging and remote object instrumentation and show how these can solve in practice the problems we have identified.
---
paper_title: EthIR: A Framework for High-Level Analysis of Ethereum Bytecode

paper_content:

Analyzing Ethereum bytecode, rather than the source code from which it was generated, is a necessity when: (1) the source code is not available (e.g., the blockchain only stores the bytecode), (2) the information to be gathered in the analysis is only visible at the level of bytecode (e.g., gas consumption is specified at the level of EVM instructions), (3) the analysis results may be affected by optimizations performed by the compiler (thus the analysis should be done ideally after compilation). This paper presents EthIR, a framework for analyzing Ethereum bytecode, which relies on (an extension of) OYENTE, a tool that generates CFGs; EthIR produces from the CFGs, a rule-based representation (RBR) of the bytecode that enables the application of (existing) high-level analyses to infer properties of EVM code.
---
paper_title: GASTAP: A Gas Analyzer for Smart Contracts

paper_content:

Gas is a measurement unit of the computational effort that it will take to execute every single operation that takes part in the Ethereum blockchain platform. Each instruction executed by the Ethereum Virtual Machine (EVM) has an associated gas consumption specified by Ethereum. If a transaction exceeds the amount of gas allotted by the user (known as gas limit), an out-of-gas exception is raised. There is a wide family of contract vulnerabilities due to out-of-gas behaviours. We report on the design and implementation of GASTAP, a Gas-Aware Smart contracT Analysis Platform, which takes as input a smart contract (either in EVM, disassembled EVM, or in Solidity source code) and automatically infers sound gas upper bounds for all its public functions. Our bounds ensure that if the gas limit paid by the user is higher than our inferred gas bounds, the contract is free of out-of-gas vulnerabilities.
---
paper_title: SACO: Static analyzer for concurrent objects

paper_content:

We present the main concepts, usage and implementation of SACO, a static analyzer for concurrent objects. Interestingly, SACO is able to infer both liveness (namely termination and resource boundedness) and safety properties (namely deadlock freedom) of programs based on concurrent objects. The system integrates auxiliary analyses such as points-to and may-happen-in-parallel, which are essential for increasing the accuracy of the aforementioned more complex properties. SACO provides accurate information about the dependencies which may introduce deadlocks, loops whose termination is not guaranteed, and upper bounds on the resource consumption of methods.
---
paper_title: Automatic Inference of Upper Bounds for Recurrence Relations in Cost Analysis

paper_content:

The classical approach to automatic cost analysis consists of two phases. Given a program and some measure of cost, we first produce recurrence relations(RRs) which capture the cost of our program in terms of the size of its input data. Second, we convert such RRs into closed form(i.e., without recurrences). Whereas the first phase has received considerable attention, with a number of cost analyses available for a variety of programming languages, the second phase has received comparatively little attention. In this paper we first study the features of RRs generated by automatic cost analysis and discuss why existing computer algebra systems are not appropriate for automatically obtaining closed form solutions nor upper bounds of them. Then we present, to our knowledge, the first practical framework for the fully automatic generation of reasonably accurate upper bounds of RRs originating from cost analysis of a wide range of programs. It is based on the inference of ranking functionsand loop invariantsand on partial evaluation.
---
paper_title: Securify: Practical Security Analysis of Smart Contracts

paper_content:

Permissionless blockchains allow the execution of arbitrary programs (called smart contracts), enabling mutually untrusted entities to interact without relying on trusted third parties. Despite their potential, repeated security concerns have shaken the trust in handling billions of USD by smart contracts. ::: To address this problem, we present Securify, a security analyzer for Ethereum smart contracts that is scalable, fully automated, and able to prove contract behaviors as safe/unsafe with respect to a given property. Securify's analysis consists of two steps. First, it symbolically analyzes the contract's dependency graph to extract precise semantic information from the code. Then, it checks compliance and violation patterns that capture sufficient conditions for proving if a property holds or not. To enable extensibility, all patterns are specified in a designated domain-specific language. ::: Securify is publicly released, it has analyzed >18K contracts submitted by its users, and is regularly used to conduct security audits by experts. We present an extensive evaluation of Securify over real-world Ethereum smart contracts and demonstrate that it can effectively prove the correctness of smart contracts and discover critical violations.
---
paper_title: Finding The Greedy, Prodigal, and Suicidal Contracts at Scale

paper_content:

Smart contracts---stateful executable objects hosted on blockchains like Ethereum---carry billions of dollars worth of coins and cannot be updated once deployed. We present a new systematic characterization of a class of trace vulnerabilities, which result from analyzing multiple invocations of a contract over its lifetime. We focus attention on three example properties of such trace vulnerabilities: finding contracts that either lock funds indefinitely, leak them carelessly to arbitrary users, or can be killed by anyone. We implemented Maian, the first tool for specifying and reasoning about trace properties, which employs interprocedural symbolic analysis and concrete validator for exhibiting real exploits. Our analysis of nearly one million contracts flags 34, 200 (2, 365 distinct) contracts vulnerable, in 10 seconds per contract. On a subset of 3, 759 contracts which we sampled for concrete validation and manual analysis, we reproduce real exploits at a true positive rate of 89%, yielding exploits for 3, 686 contracts. Our tool finds exploits for the infamous Parity bug that indirectly locked $200 million US worth in Ether, which previous analyses failed to capture.
---
paper_title: Vandal: A Scalable Security Analysis Framework for Smart Contracts

paper_content:

The rise of modern blockchains has facilitated the emergence of smart contracts: autonomous programs that live and run on the blockchain. Smart contracts have seen a rapid climb to prominence, with applications predicted in law, business, commerce, and governance. ::: Smart contracts are commonly written in a high-level language such as Ethereum's Solidity, and translated to compact low-level bytecode for deployment on the blockchain. Once deployed, the bytecode is autonomously executed, usually by a %Turing-complete virtual machine. As with all programs, smart contracts can be highly vulnerable to malicious attacks due to deficient programming methodologies, languages, and toolchains, including buggy compilers. At the same time, smart contracts are also high-value targets, often commanding large amounts of cryptocurrency. Hence, developers and auditors need security frameworks capable of analysing low-level bytecode to detect potential security vulnerabilities. ::: In this paper, we present Vandal: a security analysis framework for Ethereum smart contracts. Vandal consists of an analysis pipeline that converts low-level Ethereum Virtual Machine (EVM) bytecode to semantic logic relations. Users of the framework can express security analyses in a declarative fashion: a security analysis is expressed in a logic specification written in the \souffle language. We conduct a large-scale empirical study for a set of common smart contract security vulnerabilities, and show the effectiveness and efficiency of Vandal. Vandal is both fast and robust, successfully analysing over 95\% of all 141k unique contracts with an average runtime of 4.15 seconds; outperforming the current state of the art tools---Oyente, EthIR, Mythril, and Rattle---under equivalent conditions.
---
paper_title: Soufflé: On Synthesis of Program Analyzers

paper_content:

Souffle is an open source programming framework that performs static program analysis expressed in Datalog on very large code bases, including points-to analysis on OpenJDK7 (1.4M program variables, 350K objects, 160K methods) in under a minute. Souffle is being successfully used for Java security analyses at Oracle Labs due to (1) its high-performance, (2) support for rapid program analysis development, and (3) customizability. Souffle incorporates the highly flexible Datalog-based program analysis paradigm while exhibiting performance results that are on-par with manually developed state-of-the-art tools. In this tool paper, we introduce the Souffle architecture, usage and demonstrate its applicability for large-scale code analysis on the OpenJDK7 library as a use case.
---
paper_title: Under-optimized smart contracts devour your money

paper_content:

Smart contracts are full-fledged programs that run on blockchains (e.g., Ethereum, one of the most popular blockchains). In Ethereum, gas (in Ether, a cryptographic currency like Bitcoin) is the execution fee compensating the computing resources of miners for running smart contracts. However, we find that under-optimized smart contracts cost more gas than necessary, and therefore the creators or users will be overcharged. In this work, we conduct the first investigation on Solidity, the recommended compiler, and reveal that it fails to optimize gas-costly programming patterns. In particular, we identify 7 gas-costly patterns and group them to 2 categories. Then, we propose and develop GASPER, a new tool for automatically locating gas-costly patterns by analyzing smart contracts' bytecodes. The preliminary results on discovering 3 representative patterns from 4,240 real smart contracts show that 93.5%, 90.1% and 80% contracts suffer from these 3 patterns, respectively.
---
paper_title: Towards verifying ethereum smart contract bytecode in Isabelle/HOL

paper_content:

Blockchain technology has increasing attention in research and across many industries. The Ethereum blockchain offers smart contracts, which are small programs defined, executed, and recorded as transactions in the blockchain transaction history. These smart contracts run on the Ethereum Virtual Machine (EVM) and can be used to encode agreements, transfer assets, and enforce integrity conditions in relationships between parties. Smart contracts can carry financial value, and are increasingly used for safety-, security-, or mission-critical purposes. Errors in smart contracts have led and will lead to loss or harm. Formal verification can provide the highest level of confidence about the correct behaviour of smart contracts. In this paper we extend an existing EVM formalisation in Isabelle/HOL by a sound program logic at the level of bytecode. We structure bytecode sequences into blocks of straight-line code and create a program logic to reason about these. This abstraction is a step towards control of the cost and complexity of formal verification of EVM smart contracts.
---
paper_title: A formal verification tool for Ethereum VM bytecode

paper_content:

In this paper, we present a formal verification tool for the Ethereum Virtual Machine (EVM) bytecode. To precisely reason about all possible behaviors of the EVM bytecode, we adopted KEVM, a complete formal semantics of the EVM, and instantiated the K-framework's reachability logic theorem prover to generate a correct-by-construction deductive verifier for the EVM. We further optimized the verifier by introducing EVM-specific abstractions and lemmas to improve its scalability. Our EVM verifier has been used to verify various high-profile smart contracts including the ERC20 token, Ethereum Casper, and DappHub MakerDAO contracts.
---
paper_title: Semantics-based program verifiers for all languages

paper_content:

We present a language-independent verification framework that can be instantiated with an operational semantics to automatically generate a program verifier. The framework treats both the operational semantics and the program correctness specifications as reachability rules between matching logic patterns, and uses the sound and relatively complete reachability logic proof system to prove the specifications using the semantics. We instantiate the framework with the semantics of one academic language, KernelC, as well as with three recent semantics of real-world languages, C, Java, and JavaScript, developed independently of our verification infrastructure. We evaluate our approach empirically and show that the generated program verifiers can check automatically the full functional correctness of challenging heap-manipulating programs implementing operations on list and tree data structures, like AVL trees. This is the first approach that can turn the operational semantics of real-world languages into correct-by-construction automatic verifiers.
---
paper_title: Dependent types and multi-monadic effects in F*

paper_content:

We present a new, completely redesigned, version of F*, a language that works both as a proof assistant as well as a general-purpose, verification-oriented, effectful programming language. In support of these complementary roles, F* is a dependently typed, higher-order, call-by-value language with _primitive_ effects including state, exceptions, divergence and IO. Although primitive, programmers choose the granularity at which to specify effects by equipping each effect with a monadic, predicate transformer semantics. F* uses this to efficiently compute weakest preconditions and discharges the resulting proof obligations using a combination of SMT solving and manual proofs. Isolated from the effects, the core of F* is a language of pure functions used to write specifications and proof terms---its consistency is maintained by a semantic termination check based on a well-founded order. We evaluate our design on more than 55,000 lines of F* we have authored in the last year, focusing on three main case studies. Showcasing its use as a general-purpose programming language, F* is programmed (but not verified) in F*, and bootstraps in both OCaml and F#. Our experience confirms F*'s pay-as-you-go cost model: writing idiomatic ML-like code with no finer specifications imposes no user burden. As a verification-oriented language, our most significant evaluation of F* is in verifying several key modules in an implementation of the TLS-1.2 protocol standard. For the modules we considered, we are able to prove more properties, with fewer annotations using F* than in a prior verified implementation of TLS-1.2. Finally, as a proof assistant, we discuss our use of F* in mechanizing the metatheory of a range of lambda calculi, starting from the simply typed lambda calculus to System F-omega and even micro-F*, a sizeable fragment of F* itself---these proofs make essential use of F*'s flexible combination of SMT automation and constructive proofs, enabling a tactic-free style of programming and proving at a relatively large scale.
---
paper_title: Online detection of effectively callback free objects with applications to smart contracts

paper_content:

Callbacks are essential in many programming environments, but drastically complicate program understanding and reasoning because they allow to mutate object's local states by external objects in unexpected fashions, thus breaking modularity. The famous DAO bug in the cryptocurrency framework Ethereum, employed callbacks to steal $150M. We define the notion of Effectively Callback Free (ECF) objects in order to allow callbacks without preventing modular reasoning. An object is ECF in a given execution trace if there exists an equivalent execution trace without callbacks to this object. An object is ECF if it is ECF in every possible execution trace. We study the decidability of dynamically checking ECF in a given execution trace and statically checking if an object is ECF. We also show that dynamically checking ECF in Ethereum is feasible and can be done online. By running the history of all execution traces in Ethereum, we were able to verify that virtually all existing contracts, excluding the DAO or contracts with similar known vulnerabilities, are ECF. Finally, we show that ECF, whether it is verified dynamically or statically, enables modular reasoning about objects with encapsulated state.
---
paper_title: Towards an Ontology-Driven Blockchain Design for Supply Chain Provenance

paper_content:

An interesting research problem in our age of Big Data is that of determining provenance. Granular evaluation of provenance of physical goods--e.g. tracking ingredients of a pharmaceutical or demonstrating authenticity of luxury goods--has often not been possible with today's items that are produced and transported in complex, inter-organizational, often internationally-spanning supply chains. Recent adoption of Internet of Things and Blockchain technologies give promise at better supply chain provenance. We are particularly interested in the blockchain as many favoured use cases of blockchain are for provenance tracking. We are also interested in applying ontologies as there has been some work done on knowledge provenance, traceability, and food provenance using ontologies. In this paper, we make a case for why ontologies can contribute to blockchain design. To support this case, we analyze a traceability ontology and translate some of its representations to smart contracts that execute a provenance trace and enforce traceability constraints on the Ethereum blockchain platform.
---
paper_title: Blockchain contract: Securing a blockchain applied to smart contracts

paper_content:

A new mechanism is proposed for securing a blockchain applied to contracts management such as digital rights management. This mechanism includes a new consensus method using a credibility score and creates a hybrid blockchain by alternately using this new method and proof-of-stake. This makes it possible to prevent an attacker from monopolizing resources and to keep securing blockchains.
---
paper_title: SmartCast: An Incentive Compatible Consensus Protocol Using Smart Contracts

paper_content:

Motivated by the desire for high-throughput public databases (i.e., “blockchains”), we design incentive compatible protocols that run “off-chain”, but rely on an existing cryptocurrency to implement a reward and/or punishment mechanism. Our protocols are incentive compatible in the sense that behaving honestly is a weak Nash equilibrium, even in spite of potentially malicious behavior from a small fraction of the participants (i.e., the BAR model from Clement et al. [7]). To show the feasibility of our approach, we build a prototype implementation, called SmartCast, comprising an Ethereum smart contract, and an off-chain consensus protocol based on Dolev-Strong [10]. SmartCast also includes a “marketplace” smart contract that randomly assigns workers to protocol instances. We evaluate the communication costs of our system, as well as the “gas” transaction costs that are involved in running the Ethereum smart contract.
---
paper_title: BAR primer

paper_content:

Byzantine and rational behaviors are increasingly recognized as unavoidable realities in todaypsilas cooperative services. Yet, how to design BAR-tolerant protocols and rigorously prove them strategy proof remains somewhat of a mystery: existing examples tend either to focus on unrealistically simple problems or to want in rigor. The goal of this paper is to demystify the process by presenting the full algorithmic development cycle that, starting from the classic synchronous repeated terminating reliable broadcast (R-TRB) problem statement, leads to a provably BAR-tolerant solution. We show i) how to express R-TRB as a game; ii) why the strategy corresponding to the optimal Byzantine fault tolerant algorithm of Dolev and strong does not guarantee safety when non-Byzantine players behave rationally; iii) how to derive a BAR-tolerant R-TRB protocol: iv) how to prove rigorously that the protocol ensures safety in the presence of non-Byzantine rational players.
---
paper_title: Town Crier: An Authenticated Data Feed for Smart Contracts

paper_content:

Smart contracts are programs that execute autonomously on blockchains. Their key envisioned uses (e.g. financial instruments) require them to consume data from outside the blockchain (e.g. stock quotes). Trustworthy data feeds that support a broad range of data requests will thus be critical to smart contract ecosystems. We present an authenticated data feed system called Town Crier (TC). TC acts as a bridge between smart contracts and existing web sites, which are already commonly trusted for non-blockchain applications. It combines a blockchain front end with a trusted hardware back end to scrape HTTPS-enabled websites and serve source-authenticated data to relying smart contracts. TC also supports confidentiality. It enables private data requests with encrypted parameters. Additionally, in a generalization that executes smart-contract logic within TC, the system permits secure use of user credentials to scrape access-controlled online data sources. We describe TC's design principles and architecture and report on an implementation that uses Intel's recently introduced Software Guard Extensions (SGX) to furnish data to the Ethereum smart contract system. We formally model TC and define and prove its basic security properties in the Universal Composibility (UC) framework. Our results include definitions and techniques of general interest relating to resource consumption (Ethereum's "gas" fee system) and TCB minimization. We also report on experiments with three example applications. We plan to launch TC soon as an online public service.
---
paper_title: Towards an Ontology-Driven Blockchain Design for Supply Chain Provenance

paper_content:

An interesting research problem in our age of Big Data is that of determining provenance. Granular evaluation of provenance of physical goods--e.g. tracking ingredients of a pharmaceutical or demonstrating authenticity of luxury goods--has often not been possible with today's items that are produced and transported in complex, inter-organizational, often internationally-spanning supply chains. Recent adoption of Internet of Things and Blockchain technologies give promise at better supply chain provenance. We are particularly interested in the blockchain as many favoured use cases of blockchain are for provenance tracking. We are also interested in applying ontologies as there has been some work done on knowledge provenance, traceability, and food provenance using ontologies. In this paper, we make a case for why ontologies can contribute to blockchain design. To support this case, we analyze a traceability ontology and translate some of its representations to smart contracts that execute a provenance trace and enforce traceability constraints on the Ethereum blockchain platform.
---
paper_title: On and Off-Blockchain Enforcement Of Smart Contracts

paper_content:

Emerging blockchain technology is a promising platform for implementing smart contracts. But there is a large class of applications, where blockchain is inadequate due to performance, scalability, and consistency requirements, and also due to language expressiveness and cost issues that are hard to solve. In this paper we explain that in some situations a centralised approach that does not rely on blockchain is a better alternative due to its simplicity, scalability, and performance. We suggest that in applications where decentralisation and transparency are essential, developers can advantageously combine the two approaches into hybrid solutions where some operations are enforced by enforcers deployed on–blockchains and the rest by enforcers deployed on trusted third parties.
---
paper_title: Enigma: Decentralized Computation Platform with Guaranteed Privacy

paper_content:

A peer-to-peer network, enabling different parties to jointly store and run computations on data while keeping the data completely private. Enigma's computational model is based on a highly optimized version of secure multi-party computation, guaranteed by a verifiable secret-sharing scheme. For storage, we use a modified distributed hashtable for holding secret-shared data. An external blockchain is utilized as the controller of the network, manages access control, identities and serves as a tamper-proof log of events. Security deposits and fees incentivize operation, correctness and fairness of the system. Similar to Bitcoin, Enigma removes the need for a trusted third party, enabling autonomous control of personal data. For the first time, users are able to share their data with cryptographic guarantees regarding their privacy.
---
paper_title: Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts

paper_content:

Emerging smart contract systems over decentralized cryptocurrencies allow mutually distrustful parties to transact safely without trusted third parties. In the event of contractual breaches or aborts, the decentralized blockchain ensures that honest parties obtain commensurate compensation. Existing systems, however, lack transactional privacy. All transactions, including flow of money between pseudonyms and amount transacted, are exposed on the blockchain. We present Hawk, a decentralized smart contract system that does not store financial transactions in the clear on the blockchain, thus retaining transactional privacy from the public's view. A Hawk programmer can write a private smart contract in an intuitive manner without having to implement cryptography, and our compiler automatically generates an efficient cryptographic protocol where contractual parties interact with the blockchain, using cryptographic primitives such as zero-knowledge proofs. To formally define and reason about the security of our protocols, we are the first to formalize the blockchain model of cryptography. The formal modeling is of independent interest. We advocate the community to adopt such a formal model when designing applications atop decentralized blockchains.
---
paper_title: Adding concurrency to smart contracts

paper_content:

Modern cryptocurrency systems, such as the Ethereum project, permit complex financial transactions through scripts called smart contracts. These smart contracts are executed many, many times, always without real concurrency. First, all smart contracts are serially executed by miners before appending them to the blockchain. Later, those contracts are serially re-executed by validators to verify that the smart contracts were executed correctly by miners. Serial execution limits system throughput and fails to exploit today’s concurrent multicore and cluster architectures. Nevertheless, serial execution appears to be required: contracts share state, and contract programming languages have a serial semantics. This paper presents a novel way to permit miners and validators to execute smart contracts in parallel, based on techniques adapted from software transactional memory. Miners execute smart contracts speculatively in parallel, allowing non-conflicting contracts to proceed concurrently, and “discovering” a serializable concurrent schedule for a block’s transactions, This schedule is captured and encoded as a deterministic fork-join program used by validators to re-execute the miner’s parallel schedule deterministically but concurrently. We have proved that the validator’s execution is equivalent to miner’s execution. Smart contract benchmarks run on a JVM with ScalaSTM show that a speedup of 1.39 ::: $$\times $$ ::: can be obtained for miners and 1.59 ::: $$\times $$ ::: for validators with just three concurrent threads.
---
paper_title: Smart-Contract Execution with Concurrent Block Building

paper_content:

Business processes are often related to operational processes, contracts, and regulations. Modeling such processes needs to address regulation monitoring and enforcement, and maintain a reliable history of data for evidence. This paper proposes modeling business processes as smart contracts (SCs) on permissioned blockchains (BCs). The challenges with the proposed approach are state synchronizations among distributed nodes (called authnodes), and real-time requirements. This paper separates the executions of SCs from the state managements on multi-BCs, and proposes a pipeline model to verify and create blocks in parallel.
---
paper_title: Transactional boosting: a methodology for highly-concurrent transactional objects

paper_content:

We describe a methodology for transforming a large class of highly-concurrent linearizable objects into highly-concurrent transactional objects. As long as the linearizable implementation satisfies certain regularity properties (informally, that every method has an inverse), we define a simple wrapper for the linearizable implementation that guarantees that concurrent transactions without inherent conflicts can synchronize at the same granularity as the original linearizable implementation.
---
paper_title: Software transactional memory

paper_content:

As we learn from the literature, flexibility in choosing synchronization operations greatly simplifies the task of designing highly concurrent programs. Unfortunately, existing hardware is inflexible and is at best on the level of a Load–Linked/Store–Conditional operation on a single word. Building on the hardware based transactional synchronization methodology of Herlihy and Moss, we offer software transactional memory (STM), a novel software method for supporting flexible transactional programming of synchronization operations. STM is non-blocking, and can be implemented on existing machines using only a Load–Linked/Store–Conditional operation. We use STM to provide a general highly concurrent method for translating sequential object implementations to non-blocking ones based on implementing a k-word compare&swap STM-transaction. Empirical evidence collected on simulated multiprocessor architectures shows that our method always outperforms the non-blocking translation methods in the style of Barnes, and outperforms Herlihy’s translation method for sufficiently large numbers of processors. The key to the efficiency of our software-transactional approach is that unlike Barnes style methods, it is not based on a costly “recursive helping” policy.
---
paper_title: BLOCKBENCH: A Framework for Analyzing Private Blockchains

paper_content:

Blockchain technologies are taking the world by storm. Public blockchains, such as Bitcoin and Ethereum, enable secure peer-to-peer applications like crypto-currency or smart contracts. Their security and performance are well studied. This paper concerns recent private blockchain systems designed with stronger security (trust) assumption and performance requirement. These systems target and aim to disrupt applications which have so far been implemented on top of database systems, for example banking, finance and trading applications. Multiple platforms for private blockchains are being actively developed and fine tuned. However, there is a clear lack of a systematic framework with which different systems can be analyzed and compared against each other. Such a framework can be used to assess blockchains' viability as another distributed data processing platform, while helping developers to identify bottlenecks and accordingly improve their platforms. In this paper, we first describe BLOCKBENCH, the first evaluation framework for analyzing private blockchains. It serves as a fair means of comparison for different platforms and enables deeper understanding of different system design choices. Any private blockchain can be integrated to BLOCKBENCH via simple APIs and benchmarked against workloads that are based on real and synthetic smart contracts. BLOCKBENCH measures overall and component-wise performance in terms of throughput, latency, scalability and fault-tolerance. Next, we use BLOCKBENCH to conduct comprehensive evaluation of three major private blockchains: Ethereum, Parity and Hyperledger Fabric. The results demonstrate that these systems are still far from displacing current database systems in traditional data processing workloads. Furthermore, there are gaps in performance among the three systems which are attributed to the design choices at different layers of the blockchain's software stack. We have released BLOCKBENCH for public use.
---
paper_title: A detailed and real-time performance monitoring framework for blockchain systems

paper_content:

Blockchain systems, with the characteristics of decentralization, irreversibility and traceability, have attracted a lot of attentions recently. However, the current performance of blockchain is poor, which becomes a major constraint of its applications. Additionally, different blockchain systems lack standard performance monitoring approach which can automatically adapt to different systems and provide detailed and real-time performance information. To solve this problem, we propose overall performance metrics and detailed performance metrics for the users to know the exact performance in different stages of the blockchain. Then we propose a performance monitoring framework with a log-based method. It has advantages of lower overhead, more details, and better scalability than the previous performance monitoring approaches. Finally we implement the framework to monitor four well-known blockchain systems, using a set of 1,000 open-source smart contracts. The experimental results show that our framework can make detailed and real-time performance monitoring of blockchain systems. We also provide some suggestions for the future development of blockchain systems.
---
paper_title: Smart contracts for container based video conferencing services: Architecture and implementation

paper_content:

Today, container-based virtualization is very popular due to the lightweight nature of containers and the ability to use them flexibly in various heterogeneously composed systems. This makes it possible to collaboratively develop services by sharing various types of resources, such as infrastructures, software and digitalized content. In this work, our home made video-conferencing (VC) system is used to study resource usage optimisation in business context. An application like this, does not provide monetization possibilities to all involved stakeholders including end users, cloud providers, software engineers and similar. Blockchain related technologies, such as Smart Contracts (SC) offer a possibility to address some of these needs. We introduce a novel architecture for monetization of added-value according to preferences of the stakeholders that participate in joint software service offers. The developed architecture facilitates use case scenarios of service and resource offers according to fixed and dynamic pricing schemes, fixed usage period, prepaid quota for flexible usage, division of income, consensual decisions among collaborative service providers, and constrained based usage of resources or services. Our container-based VC service, which is based on the Jitsi Meet Open Source software is used to demonstrate the proposed architecture and the benefits of the investigated use cases.
---
paper_title: Physical Access Control Management System Based on Permissioned Blockchain

paper_content:

Using blockchain as a decentralized backend infrastructure has been attracting many startups entrepreneurs' and developers' attention. Blockchain records transactions permanently and protects them from undesirable tampering. It provides a reliable tamper-proof database which can be considered as a trustable resource for tracking previous system's state. In this paper, we present our access control application based on Hyperledger Fabric Blockchain and Hyperledger Composer to control access to physical places. The system components and modular architecture are illustrated, and we have extracted metadata include historian transactions' details arising from our demo test. Finally, the performance metrics and resources consumption are provided using Hyperledger Caliper, a benchmark framework for measuring Hyperledger blockchains performance.
---
paper_title: Managing IoT devices using blockchain platform

paper_content:

Since the start of Bitcoin in 2008[1], blockchain technology emerged as the next revolutionary technology. Though blockchain started off as a core technology of Bitcoin, its use cases are expanding to many other areas including finances, Internet of Things (IoT), security and such[2]. Currently, many private and public sectors are diving into the technology[3]. Aside from that, as software and hardware improve, we would see the beginning of IoT. And those IoT devices need to communicate and synchronize with each other. But in situations where more than thousands or tens of thousands of IoT devices connected, we expect that using current model of server-client may have some limitations and issues while in synchronization. So, we propose using blockchain to build IoT system. Using blockchain, we can control and configure IoT devices. We manage keys using RSA public key cryptosystems where public keys are stored in Ethereum and private keys are saved on individual devices. Specifically, we choose Ethereum as our blockchain platform because using its smart contract, we can write our own Turing-complete code to run on top of Ethereum. Thus, we can easily manage configuration of IoT devices and build key management system. Even though we can simply use account as a key management system, which most of blockchain platform supports, we decide to use Ethereum because we can manage the system in a more fine-grained way. For the proof of a concept, we use a few IoT devices instead of a full system of IoT system, which consists of thousands of IoT devices. But in our later study, we would like to build a fully scaled IoT system using blockchain.
---
paper_title: A Blockchain-based Infrastructure for Reliable and Cost-effective IoT-aided Smart Grids

paper_content:

One of the main trends in the evolution of smart grids is transactive energy, where distributed energy resources, e.g. smart meters, develop towards Internet-of-Things (IoT) devices enabling prosumers to trade energy directly among each other, without the need of involving any centralised third party. The expected advantages in terms of cost-effectiveness would be significant, indeed technical solutions are being investigated and large-scale deployment are planned by major utilities companies. However, introducing transactive energy in the smart grid entails new security threats, such as forging energy transactions. This paper introduces an infrastructure to support reliable and cost-effective transactive energy, based on blockchain and smart contracts, where functionalities are implemented as fully decentralised applications. Energy transactions are stored in the blockchain, whose high replication level ensures stronger guarantees against tampering. Energy auctions are carried out according to transparent rules implemented as smart contracts, hence visible to all involved actors. Threats deriving from known vulnerabilities of smart meters are mitigated by temporarily keeping out exposed prosumers and updating their devices as soon as security patches become available.
---
paper_title: FairAccess: a new Blockchain-based access control framework for the Internet of Things

paper_content:

Security and privacy are huge challenges in Internet of Things (IoT) environments, but unfortunately, the harmonization of the IoT-related standards and protocols is hardly and slowly widespread. In this paper, we propose a new framework for access control in IoT based on the blockchain technology. Our first contribution consists in providing a reference model for our proposed framework within the Objectives, Models, Architecture and Mechanism specification in IoT. In addition, we introduce FairAccess as a fully decentralized pseudonymous and privacy preserving authorization management framework that enables users to own and control their data. To implement our model, we use and adapt the blockchain into a decentralized access control manager. Unlike financial bitcoin transactions, FairAccess introduces new types of transactions that are used to grant, get, delegate, and revoke access. As a proof of concept, we establish an initial implementation with a Raspberry PI device and local blockchain. Finally, we discuss some limitations and propose further opportunities. Copyright © 2017 John Wiley & Sons, Ltd.
---
paper_title: Blockchain and IoT Integration: A Systematic Survey

paper_content:

The Internet of Things (IoT) refers to the interconnection of smart devices to collect data and make intelligent decisions. However, a lack of intrinsic security measures makes IoT vulnerable to privacy and security threats. With its "security by design," Blockchain (BC) can help in addressing major security requirements in IoT. BC capabilities like immutability, transparency, auditability, data encryption and operational resilience can help solve most architectural shortcomings of IoT. This article presents a comprehensive survey on BC and IoT integration. The objective of this paper is to analyze the current research trends on the usage of BC-related approaches and technologies in an IoT context. This paper presents the following novelties, with respect to related work: (i) it covers different application domains, organizing the available literature according to this categorization, (ii) it introduces two usage patterns, i.e., device manipulation and data management (open marketplace solution), and (iii) it reports on the development level of some of the presented solutions. We also analyze the main challenges faced by the research community in the smooth integration of BC and IoT, and point out the main open issues and future research directions. Last but not least, we also present a survey about novel uses of BC in the machine economy.
---
paper_title: Blockchain as a Service for IoT

paper_content:

A blockchain is a distributed and decentralized ledger that contains connected blocks of transactions. Unlike other ledger approaches, blockchain guarantees tamper proof storage of approved transactions. Due to its distributed and decentralized organization, blockchain is beeing used within IoT e.g. to manage device configuration, store sensor data and enable micro-payments. This paper presents the idea of using blockchain as a service for IoT and evaluates the performance of a cloud and edge hosted blockchain implementation.
---
paper_title: A Blockchain Connected Gateway for BLE-Based Devices in the Internet of Things

paper_content:

Recently, the popularity of the Internet of Things (IoT) has led to a rapid development and significant advancement of ubiquitous applications seamlessly integrated within our daily life. Owing to the accompanying growth of the importance of privacy, a great deal of attention has focused on the issues of secure management and robust access control of IoT devices. In this paper, we propose the design of a blockchain connected gateway which adaptively and securely maintains user privacy preferences for IoT devices in the blockchain network. Individual privacy leakage can be prevented because the gateway effectively protects users’ sensitive data from being accessed without their consent. A robust digital signature mechanism is proposed for the purposes of authentication and secure management of privacy preferences. Furthermore, we adopt the blockchain network as the underlying architecture of data processing and maintenance to resolve privacy disputes.
---
paper_title: MediChainTM: A Secure Decentralized Medical Data Asset Management System

paper_content:

The set of distributed ledger architectures known as blockchain is best known for cryptocurrency applications such as Bitcoin and Ethereum. These permissionless block chains are showing the potential to be disruptive to the financial services industry. Their broader adoption is likely to be limited by the maximum block size, the cost of the Proof of Work consensus mechanism, and the increasing size of any given chain overwhelming most of the participating nodes. These factors have led to many cryptocurrency blockchains to become centralized in the nodes with enough computing power and storage to be a dominant miner and validator. Permissioned chains operate in trusted environments and can, therefore, avoid the computationally expensive consensus mechanisms. Permissioned chains are still susceptible to asset storage demands and non-standard user interfaces that will impede their adoption. This paper describes an approach to addressing these limitations: permissioned blockchain that uses off-chain storage of the data assets and this is accessed through a standard browser and mobile app. The implementation in the Hyperledger framework is described as is an example use of patient-centered health data management.
---
paper_title: MedRec: Using Blockchain for Medical Data Access and Permission Management

paper_content:

Years of heavy regulation and bureaucratic inefficiency have slowed innovation for electronic medical records (EMRs). We now face a critical need for such innovation, as personalization and data science prompt patients to engage in the details of their healthcare and restore agency over their medical data. In this paper, we propose MedRec: a novel, decentralized record management system to handle EMRs, using blockchain technology. Our system gives patients a comprehensive, immutable log and easy access to their medical information across providers and treatment sites. Leveraging unique blockchain properties, MedRec manages authentication, confidentiality, accountability and data sharing -- crucial considerations when handling sensitive information. A modular design integrates with providers' existing, local data storage solutions, facilitating interoperability and making our system convenient and adaptable. We incentivize medical stakeholders (researchers, public health authorities, etc.) to participate in the network as blockchain "miners". This provides them with access to aggregate, anonymized data as mining rewards, in return for sustaining and securing the network via Proof of Work. MedRec thus enables the emergence of data economics, supplying big data to empower researchers while engaging patients and providers in the choice to release metadata. The purpose of this short paper is to expose, prior to field tests, a working prototype through which we analyze and discuss our approach.
---
paper_title: Improving data transparency in clinical trials using blockchain smart contracts

paper_content:

The scientific credibility of findings from clinical trials can be undermined by a range of problems including missing data, endpoint switching, data dredging, and selective publication. Together, these issues have contributed to systematically distorted perceptions regarding the benefits and risks of treatments. While these issues have been well documented and widely discussed within the profession, legislative intervention has seen limited success. Recently, a method was described for using a blockchain to prove the existence of documents describing pre-specified endpoints in clinical trials. Here, we extend the idea by using smart contracts - code, and data, that resides at a specific address in a blockchain, and whose execution is cryptographically validated by the network - to demonstrate how trust in clinical trials can be enforced and data manipulation eliminated. We show that blockchain smart contracts provide a novel technological solution to the data manipulation problem, by acting as trusted administrators and providing an immutable record of trial history.
---
paper_title: Identity and Access Management with Blockchain in Electronic Healthcare Records

paper_content:

Blockchain has proved itself to be tamper resistant and secure. It is increasingly getting attention from companies changing from centralized to decentralized systems. This paper proposes a system for identity and access management using blockchain technology to support authentication and authorization of entities in a digital system. A prototype demonstrates the application of blockchain in identity and access management using the Hyperledger Fabric framework. It provides a proof of concept based on a use case concerning Electronic Health Records from the healthcare domain where an immutable and auditable history is desired for data concerning patients. Basic authentication and authorization operations are able to execute in 2-3 seconds with an initial size of blockchain of about 3.8 MB covering physicians in Denmark.
---
paper_title: Blockchain distributed ledger technologies for biomedical and health care applications

paper_content:

Objectives ::: To introduce blockchain technologies, including their benefits, pitfalls, and the latest applications, to the biomedical and health care domains. ::: ::: ::: Target Audience ::: Biomedical and health care informatics researchers who would like to learn about blockchain technologies and their applications in the biomedical/health care domains. ::: ::: ::: Scope ::: The covered topics include: (1) introduction to the famous Bitcoin crypto-currency and the underlying blockchain technology; (2) features of blockchain; (3) review of alternative blockchain technologies; (4) emerging nonfinancial distributed ledger technologies and applications; (5) benefits of blockchain for biomedical/health care applications when compared to traditional distributed databases; (6) overview of the latest biomedical/health care applications of blockchain technologies; and (7) discussion of the potential challenges and proposed solutions of adopting blockchain technologies in biomedical/health care domains.
---
paper_title: On the Design of a Blockchain-Based System to Facilitate Healthcare Data Sharing

paper_content:

Blockchain technology though originally designed for keeping financial ledgers, recently has found applications in many different fields including healthcare. Sharing healthcare data for research purposes will boost research innovation in this area. That being said, healthcare data sharing raises many privacy and security issues for the Patients who share their data. In this work, we present the potential of Blockchain technology to facilitate (i) private and auditable healthcare data sharing and (ii) healthcare data access permission handling by proposing a blockchain-based system architecture design.
---
paper_title: FHIRChain: Applying Blockchain to Securely and Scalably Share Clinical Data

paper_content:

Secure and scalable data sharing is essential for collaborative clinical decision making. Conventional clinical data efforts are often siloed, however, which creates barriers to efficient information exchange and impedes effective treatment decision made for patients. This paper provides four contributions to the study of applying blockchain technology to clinical data sharing in the context of technical requirements defined in the "Shared Nationwide Interoperability Roadmap" from the Office of the National Coordinator for Health Information Technology (ONC). First, we analyze the ONC requirements and their implications for blockchain-based systems. Second, we present FHIRChain, which is a blockchain-based architecture designed to meet ONC requirements by encapsulating the HL7 Fast Healthcare Interoperability Resources (FHIR) standard for shared clinical data. Third, we demonstrate a FHIRChain-based decentralized app using digital health identities to authenticate participants in a case study of collaborative decision making for remote cancer care. Fourth, we highlight key lessons learned from our case study.
---
paper_title: On the Design of a Blockchain Platform for Clinical Trial and Precision Medicine

paper_content:

This paper proposes a blockchain platform architecture for clinical trial and precision medicine and discusses various design aspects and provides some insights in the technology requirements and challenges. We identify 4 new system architecture components that are required to be built on top of traditional blockchain and discuss their technology challenges in our blockchain platform: (a) a new blockchain based general distributed and parallel computing paradigm component to devise and study parallel computing methodology for big data analytics, (b) blockchain application data management component for data integrity, big data integration, and integrating disparity of medical related data, (c) verifiable anonymous identity management component for identity privacy for both person and Internet of Things (IoT) devices and secure data access to make possible of the patient centric medicine, and (d) trust data sharing management component to enable a trust medical data ecosystem for collaborative research.
---
paper_title: Using QFD for e‐business planning and analysis in a micro‐sized enterprise

paper_content:

Purpose - The purpose of this paper is to show how QFD can be used as part of a structured planning and analysis framework for micro-sized enterprises to build-up their e-business capabilities. Design/methodology/approach - This case study has been produced using a new framework which integrates the balanced scorecard, value chain and quality function deployment techniques into an integrated framework known as the E-Business Planning and Analysis Framework (E-PAF). It has been produced using an action research approach. Findings - A new framework with a supporting case study is provided. This case study has demonstrated that the framework can be applied successfully to micro-sized enterprises (those with less than ten employees) to successfully plan new strategic and technical developments. This will enhance the online service that the company is able to provide. Research limitations/implications - This paper presents a single case study. The technical recommendations are currently being implemented. Originality/value - Such analytical techniques are most commonly associated with large organisations, and are not specifically associated with e-business planning. This paper provides a new framework that will be of general applicability to other similarly sized enterprises that are looking to improve e-business capabilities. © Emerald Group Publishing Limited.
---
paper_title: Blockchains everywhere - a use-case of blockchains in the pharma supply-chain

paper_content:

Blockchains are on the top of the Gartner Hype Cycle 2016 and many start-ups are integrating blockchains into their technology portfolio. While blockchains have emerged in the context of financial applications, non-financial application areas are of interest as well. In this paper, modum.io is presented, a start-up that uses IoT (Internet of Things) sensor devices leveraging blockchain technology to assert data immutability and public accessibility of temperature records, while reducing operational costs in the pharmaceutical supply-chain. The medical industry has many complex and strict environmental control process (e.g., temperature and humidity) to ensure quality control and regulatory compliance over the transport of medical products. The sensor devices monitor the temperature of each parcel during the shipment to fully ensure GDP regulations. All data is transferred to the blockchain where a smart contract assesses against the product attributes. As modum.io is not the only non-financial start-up working with blockchains, a list of areas and other start-ups is provided that aim to reduce bureaucracy, distribute the infrastructure, and saving costs using blockchains.
---
paper_title: A Blockchain-Based Supply Chain Quality Management Framework

paper_content:

Recent quality scandals reveal the importance of quality management from a supply chain perspective. Although there has been many related studies focusing on supply chain quality management, the technologies used still have difficulties in resolving problems arising from the lack of trust in supply chains. The root reason lies in three challenges brought to the traditional centralized trust mechanism: self-interests of supply chain members, information asymmetry in production processes, costs and limitations of quality inspections. Blockchain is a promising technology to address these problems. In this paper, we discuss how to improve the supply chain quality management by adopting the blockchain technology, and propose a framework for blockchain-based supply chain quality management.
---
paper_title: A Blockchain Implementation Prototype for the Electronic Open Source Traceability of Wood along the Whole Supply Chain

paper_content:

This is the first work to introduce the use of blockchain technology for the electronic traceability of wood from standing tree to final user. Infotracing integrates the information related to the product quality with those related to the traceability [physical and digital documents (Radio Frequency IDentification-RFID-architecture)] within an online information system whose steps (transactions) can be made safe to evidence of alteration through the blockchain. This is a decentralized and distributed ledger that keeps records of digital transactions in such a way that makes them accessible and visible to multiple participants in a network while keeping them secure without the need of a centralized certification organism. This work implements a blockchain architecture within the wood chain electronic traceability. The infotracing system is based on RFID sensors and open source technology. The entire forest wood supply chain was simulated from standing trees to the final product passing through tree cutting and sawmill process. Different kinds of Internet of Things (IoT) open source devices and tags were used, and a specific app aiming the forest operations was engineered to collect and store in a centralized database information (e.g., species, date, position, dendrometric and commercial information).
---
paper_title: Towards an Ontology-Driven Blockchain Design for Supply Chain Provenance

paper_content:

An interesting research problem in our age of Big Data is that of determining provenance. Granular evaluation of provenance of physical goods--e.g. tracking ingredients of a pharmaceutical or demonstrating authenticity of luxury goods--has often not been possible with today's items that are produced and transported in complex, inter-organizational, often internationally-spanning supply chains. Recent adoption of Internet of Things and Blockchain technologies give promise at better supply chain provenance. We are particularly interested in the blockchain as many favoured use cases of blockchain are for provenance tracking. We are also interested in applying ontologies as there has been some work done on knowledge provenance, traceability, and food provenance using ontologies. In this paper, we make a case for why ontologies can contribute to blockchain design. To support this case, we analyze a traceability ontology and translate some of its representations to smart contracts that execute a provenance trace and enforce traceability constraints on the Ethereum blockchain platform.
---
paper_title: Optimized Execution of Business Processes on Blockchain

paper_content:

Blockchain technology enables the execution of collaborative business processes involving untrusted parties without requiring a central authority. Specifically, a process model comprising tasks performed by multiple parties can be coordinated via smart contracts operating on the blockchain. The consensus mechanism governing the blockchain thereby guarantees that the process model is followed by each party. However, the cost required for blockchain use is highly dependent on the volume of data recorded and the frequency of data updates by smart contracts. This paper proposes an optimized method for executing business processes on top of commodity blockchain technology. Our optimization targets three areas specifically: initialization cost for process instances, task execution cost by means of a space-optimized data structure, and improved runtime components for maximized throughput. The method is empirically compared to a previously proposed baseline by replaying execution logs and measuring resource consumption and throughput.
---
paper_title: A Case Study of Execution of Untrusted Business Process on Permissioned Blockchain

paper_content:

Many studies have been done to improve the performance of centrally controlled business processes and enhance the integration between different parties of these collaborations. However, the most serious issues of collaborative business processes remained unsolved in these studies - lack of trust and divided data on various confidential ledgers. Blockchain technology has enormous potential to become a new substantial integration method for untrusted collaborative businesses. Using the governing consensus mechanism, blockchain eliminates the necessity of the trusted third party. It provides a distributed shared ledger which facilitates the job of the process monitoring for the parties. The smart contract, as a crucial tool, is used to define the guaranteed autonomous programs. In addition, the privacy of the data can be ensured by using a permissioned blockchain that handles the access control because, in this way, only verifiable participants can have access to the state of the business process and its related information. In this study, the applicability of execution of a real-world untrusted business process on the permissioned blockchain is investigated. Moreover, we determine the advantages of using the permissioned access-controller blockchain as the infrastructure for the collaborative business processes, through implementing the process of Order Processing on the Hyperledger Fabric blockchain platform.
---
paper_title: Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols

paper_content:

Suppose we are given a proof of knowledge P in which a prover demonstrates that he knows a solution to a given problem instance. Suppose also that we have a secret sharing scheme S on n participants. Then under certain assumptions on P and S, we show how to transform P into a witness indistinguishable protocol, in which the prover demonstrates knowledge of the solution to a subset of n problem instances corresponding to a qualified set of participants. For example, using a threshold scheme, the prover can show that he knows at least d out of n solutions without revealing which d instances are involved. If the instances are independently generated, this can lead to witness hiding protocols, even if P did not have this property. Our transformation produces a protocol with the same number of rounds as P and communication complexity n times that of P. Our results use no unproven complexity assumptions.
---
paper_title: Efficient signature generation by smart cards

paper_content:

We present a new public-key signature scheme and a corresponding authentication scheme that are based on discrete logarithms in a subgroup of units in ? p where p is a sufficiently large prime, e.g., p ? 2512. A key idea is to use for the base of the discrete logarithm an integer ? in ? p such that the order of ? is a sufficiently large prime q, e.g., q ? 2140. In this way we improve the ElGamal signature scheme in the speed of the procedures for the generation and the verification of signatures and also in the bit length of signatures. We present an efficient algorithm that preprocesses the exponentiation of a random residue modulo p.
---
paper_title: A Smart Contract for Boardroom Voting with Maximum Voter Privacy

paper_content:

We present the first implementation of a decentralised and self-tallying internet voting protocol with maximum voter privacy using the Blockchain. The Open Vote Network is suitable for boardroom elections and is written as a smart contract for Ethereum. Unlike previously proposed Blockchain e-voting protocols, this is the first implementation that does not rely on any trusted authority to compute the tally or to protect the voter’s privacy. Instead, the Open Vote Network is a self-tallying protocol, and each voter is in control of the privacy of their own vote such that it can only be breached by a full collusion involving all other voters. The execution of the protocol is enforced using the consensus mechanism that also secures the Ethereum blockchain. We tested the implementation on Ethereum’s official test network to demonstrate its feasibility. Also, we provide a financial and computational breakdown of its execution cost.
---
paper_title: Blockchain based smart contract for bidding system

paper_content:

Because of the popularity of the Internet, the integration services have gradually changed people daily life, such as e-commerce activities on transactions, transportation and so on. The E-auction, one of the popular e-commerce activities, allows bidders to directly bid the products over the Internet. As for sealed bid, the extra transaction cost is required for the intermediaries because the third-party is the important role between the buyers and the sellers help to trade both during the auction. In addition, it never guarantees whether the third-party is trust. To resolve the problems, the blockchain technology with low transaction cost is used to develop the smart contract of public bid and sealed bid. The smart contract, proposed in 1990 and implements via Ethereum platform, can ensure the bill secure, private, non-reputability and inalterability owing to all the transactions are recorded in the same but decentralized ledgers. The smart contract is composed of the address of Auctioneer, the start auction time, deadline, the address of current winner, the current highest price. In the experiments, the accounts are created through Ethereum wallet. In miner stage, the MinerGate is used in miner stage for obtaining money to pay the transaction fee. At recorder stage, the nodes of blockchain are synchronized to generate smart contract.
---
paper_title: SCPKI: A Smart Contract-based PKI and Identity System

paper_content:

The Public Key Infrastructure (PKI) in use today on the Internet to secure communications has several drawbacks arising from its centralised and non-transparent design. In the past there has been instances of certificate authorities publishing rogue certificates for targeted attacks, and this has been difficult to immediately detect as certificate authorities are not transparent about the certificates they issue. Furthermore, the centralised selection of trusted certificate authorities by operating system and browser vendors means that it is not practical to untrust certificate authorities that have issued rogue certificates, as this would disrupt the TLS process for many other hosts. SCPKI is an alternative PKI system based on a decentralised and transparent design using a web-of-trust model and a smart contract on the Ethereum blockchain, to make it easily possible for rogue certificates to be detected when they are published. The web-of-trust model is designed such that an entity or authority in the system can verify (or vouch for) fine-grained attributes of another entity's identity (such as company name or domain name), as an alternative to the centralised certificate authority identity verification model.
---
paper_title: Identity-based network security for commercial blockchain services

paper_content:

While blockchain services hold great promise to improve many different industries, there are significant cybersecurity concerns which must be addressed. In this paper, we present experimental test bed results for a novel method of user identity management for cloud-based blockchain applications. Using a BlackRidge Technology endpoint on a Windows host, we insert cryptographic identity tokens on the first packet to request a new session. A corresponding gateway appliance in the cloud enforces security policy, blocking unauthorized access at or below the transport layer. Results of penetration testing a sample Hyperledger 1.0 application are discussed. We also demonstrate network segmentation and traffic separation, which allows multiple organizations to share blockchain infrastructure and facilitates compliance auditing.
---
paper_title: A Survey on Essential Components of a Self-Sovereign Identity

paper_content:

This paper provides an overview of the Self-Sovereign Identity (SSI) concept, focusing on four different components that we identified as essential to the architecture. Self-Sovereign Identity is enabled by the new development of blockchain technology. Through the trustless, decentralised database that is provided by a blockchain, classic Identity Management registration processes can be replaced. We start off by giving a simple overview of blockchain based SSI, introducing an architecture overview as well as relevant actors in such a system. We further distinguish two major approaches, namely the Identifier Registry Model and its extension the Claim Registry Model. Subsequently we discuss identifiers in such a system, presenting past research in the area and current approaches in SSI in the context of Zooko's Triangle. As the user of an SSI has to be linked with his digital identifier we also discuss authentication solutions. Most central to the concept of an SSI are the verifiable claims that are presented to relying parties. Resources in the field are only losely connected. We will provide a more coherent view of verifiable claims in regards to blockchain based SSI and clarify differences in the used terminology. Storage solutions for the verifiable claims, both on- and off-chain, are presented with their advantages and disadvantages.
---
paper_title: An Online Identity and Smart Contract Management System

paper_content:

In today's online environment, people attend various kinds of activities, exhibit different digital presence, build personal digital reputations, issuing and receiving feedbacks from online communities being involved with. These diverse information sources once aggregated can provide a valuablefuture reference for personal online digital identity and credits check. The primary objective of this paper is to propose a systematic framework for aggregating online identity and reputation information, to provide a holistic approach to personal online behavioral ratings. Major contributions include: An identity aggregation mechanism based on social dependency network is proposed, a smart contract management framework referring to personal online ratings based on the aggregated digital identity, an experiment implementation based on blockchain technology, with illustrative examples and theoretical evaluations to the proposed approach.
---
paper_title: On the Relevance of Blockchain in Identity Management

paper_content:

The ubiquitous application of emerging blockchain technology in numerous technological projects leads to a tremendous hype. The significantly high prices of digital currencies and initial coin offerings as the new funding approach has fostered the public perception of blockchain as a cure-all and driven the hype even further. In this evolution, a clear view of the reasonable application of blockchain technology is not given and therefore, the purposeful use of traditional technologies is undermined. To clarify this situation, we derive a novel decision model for evaluating the applicability of blockchain technology that considers two key factors: the remediation of central governance and the management of digital objects. Based on these key factors, we closely analyse the domain of identity management for conscious blockchain application. Finally, we examine uPort, Sovrin, and ShoCard as distinct projects in this scope with regard to the inevitable necessity to implement a blockchain by using our decision model.
---
paper_title: A Novel Blockchain-based Trust Model for Cloud Identity Management

paper_content:

Secure and reliable management of identities has become one of the greatest challenges facing cloud computing today, mainly due to the huge number of new cloud-based applications generated by this model, which means more user accounts, passwords, and personal information to provision, monitor, and secure. Currently, identity federation is the most useful solution to overcome the aforementioned issues and simplify the user experience by allowing efficient authentication mechanisms and use of identity information from data distributed across multiple domains. However, this approach creates considerable complexity in managing trust relationships for both the cloud service providers and their clients. Poor management of trust in federated identity management systems brings with it many security, privacy and interoperability issues, which contributes to the reluctance of organizations to move their critical identity data to the cloud. In this paper, we aim to address these issues by introducing a novel trust and identity management model based on the Blockchain for cloud identity management with security and privacy improvements.
---
paper_title: Software Grand Exposure: SGX Cache Attacks Are Practical

paper_content:

Intel SGX isolates the memory of security-critical applications from the untrusted OS. However, it has been speculated that SGX may be vulnerable to side-channel attacks through shared caches. We developed new cache attack techniques customized for SGX. Our attack differs from other SGX cache attacks in that it is easy to deploy and avoids known detection approaches. We demonstrate the effectiveness of our attack on two case studies: RSA decryption and genomic processing. While cache timing attacks against RSA and other cryptographic operations can be prevented by using appropriately hardened crypto libraries, the same cannot be easily done for other computations, such as genomic processing. Our second case study therefore shows that attacks on noncryptographic but privacy sensitive operations are a serious threat. We analyze countermeasures and show that none of the known defenses eliminates the attack.
---

Title: Security, Performance, and Applications of Smart Contracts: A Systematic Survey

Section 1: INTRODUCTION
Description 1: Discuss the background of blockchain and smart contracts, including their history, importance, and significance. Outline the main research questions and contributions of the paper.

Section 2: PLATFORMS OVERVIEW AND KEY CONCEPTS
Description 2: Review key concepts, blockchain platforms that support smart contracts, and programming languages used for smart contract development. 

Section 3: PUBLIC AND PERMISSIONED BLOCKCHAIN
Description 3: Describe the differences between public and permissioned blockchains, and how each type of blockchain operates.

Section 4: PLATFORMS
Description 4: Provide an overview of main blockchain platforms that support smart contracts and compare their features.

Section 5: CONSENSUS MECHANISM
Description 5: Examine various consensus mechanisms used in blockchain platforms, their characteristics, and performance.

Section 6: SMART CONTRACTS PROGRAMMING LANGUAGE
Description 6: Discuss different programming languages designed for smart contract development, their features, and challenges.

Section 7: SMART CONTRACTS SECURITY
Description 7: Investigate security issues in smart contract design, implementation, and execution. Review methods and tools for improving smart contract security.

Section 8: SMART CONTRACTS SECURITY ANALYSIS TOOLS
Description 8: Describe various tools for analyzing and improving the security of smart contracts, including their methodologies and effectiveness.

Section 9: FORMAL VERIFICATION
Description 9: Introduce formal verification methods used to ensure correctness and security of smart contracts.

Section 10: DETECTION OF EFFECTIVE CALLBACK FREE OBJECTS
Description 10: Discuss techniques for detecting and handling callback issues in smart contracts to improve security and reliability.

Section 11: CONTROL FLOW
Description 11: Review control flow analysis methods to ensure the integrity and accuracy of smart contract executions.

Section 12: SECURE CONSENSUS METHOD
Description 12: Present secure consensus methods used in blockchain to maintain integrity and security in smart contract executions.

Section 13: CONNECTING SMART CONTRACT AND OFF-CHAIN
Description 13: Explore methods and architectures for integrating on-chain and off-chain components to enhance smart contract functionality.

Section 14: PRIVACY
Description 14: Address privacy concerns related to smart contract data and introduce frameworks for creating privacy-preserving smart contracts.

Section 15: SMART CONTRACTS PERFORMANCE
Description 15: Examine methods and frameworks designed to optimize the performance of smart contract execution.

Section 16: DECENTRALIZED APPLICATIONS
Description 16: Survey various decentralized applications across different domains that leverage blockchain technology and smart contracts. 

Section 17: CONCLUSIONS, CHALLENGES AND FUTURE DIRECTIONS
Description 17: Summarize the key findings of the survey, discuss existing challenges, and outline potential future research directions in the field of smart contracts.