[论文解读] Security and Privacy on Blockchain

Rui Zhang, Rui Xue+1 more|arXiv (Cornell University)|Mar 18, 2019

Blockchain Technology Applications and Security参考文献 64被引用 227

一句话总结

本综述提供对区块链安全与隐私的全面概览，详细描述实现安全、私有区块链系统所使用的核心属性、共识技术和密码学技巧。

ABSTRACT

Blockchain offers an innovative approach to storing information, executing transactions, performing functions, and establishing trust in an open environment. Many consider blockchain as a technology breakthrough for cryptography and cybersecurity, with use cases ranging from globally deployed cryptocurrency systems like Bitcoin, to smart contracts, smart grids over the Internet of Things, and so forth. Although blockchain has received growing interests in both academia and industry in the recent years, the security and privacy of blockchains continue to be at the center of the debate when deploying blockchain in different applications. This paper presents a comprehensive overview of the security and privacy of blockchain. To facilitate the discussion, we first introduce the notion of blockchains and its utility in the context of Bitcoin like online transactions. Then we describe the basic security properties that are supported as the essential requirements and building blocks for Bitcoin like cryptocurrency systems, followed by presenting the additional security and privacy properties that are desired in many blockchain applications. Finally, we review the security and privacy techniques for achieving these security properties in blockchain-based systems, including representative consensus algorithms, hash chained storage, mixing protocols, anonymous signatures, non-interactive zero-knowledge proof, and so forth. We conjecture that this survey can help readers to gain an in-depth understanding of the security and privacy of blockchain with respect to concept, attributes, techniques and systems.

研究动机与目标

• 解释区块链是什么以及它们如何实现安全、去中心化的交易。
• 确定区块链应用中所需的基本和附加安全/隐私属性。
• 综述用于实现这些属性的代表性技术（密码学、共识、数据结构）。
• 讨论实现健壮区块链安全与隐私的开放挑战与未来方向。

提出的方法

• 描述区块链基础知识（哈希链接、默克尔树、数字签名）。
• 解释共识机制及其安全保障（持久性、可用性）。
• 比较 UTXO 与基于账户的交易模型及其对安全与隐私的影响。
• 回顾密码学技术（匿名签名、非交互式零知识证明、混合协议）。
• 分析 CAP 定理的含义以及区块链架构如何解决一致性、可用性与分区容忍性。

实验结果

研究问题

• RQ1 哪些基本和附加的安全/隐私属性对区块链系统至关重要？
• RQ2 存在哪些密码学和体系结构技术以在实践中实现这些属性？
• RQ3 不同的交易模型（UTXO 与基于账户的）对安全、隐私和吞吐量有何影响？
• RQ4 在健壮的区块链安全与隐私方面存在哪些开放挑战和潜在方向？

主要发现

• 提供对区块链概念、安全属性和威胁模型的结构化概览。
• 回顾用于实现安全/隐私的代表性共识算法、数据结构和密码学工具。
• 强调对非安全专家的可访问性和对专家的深度这两个目标。
• 指出开放挑战以及需要对不同区块链部署中的安全/隐私属性进行更深入分析。
• 认为理解安全/隐私属性可以为健壮的防御技巧和部署决策提供信息。