Keywords

1 Introduction

The idea of a secure chain of blocks is certainly not a fresh one. In 1991, Stuart Haber [1] proposed a method for digitally timestamping electronic documents in order to prevent manipulating. However, in recent years, it has grown in prominence as a result of its application in blockchain technology to hold transaction records for the cryptocurrency “Bitcoin”. Blockchain has the ability to “revolutionize apps and reshape the digital economy,” according to experts [2]. By enabling collaboration without trust, blockchain holds immense promise for re-establishing “trust” in society. Blockchain technology offers enormous promise for a wide range of applications and provides diverse foundations with a lot of flexibility. The technology aids resource management and ensures secure and effective communication. When using blockchain to conduct financial transactions between parties, trust is increased because it reduces the chances of fraud and automatically provides a record of movement. In the traditional framework, when it comes to monetary exchanges, people must faith in a third party to complete the transaction. However, blockchain will provide optimum security in exchanges. Each exchange should be recorded in a block, which will act as a record book. When an exchange is completed, a block is added to the blockchain, which serves as a permanent information database. When a block is finished, it is either added to another block or a new block is created. Every block in a blockchain has a hash of its previous block [3]. In its most fundamental form, blockchain is called a distributed ledger. Blockchain exchanges are nearly tamper-proof thanks to hashing and appropriate calculations. People may for the most part access historical transactions provided by a blockchain, yet changing historical transactions inside the record is somewhat inconceivable. This is expected to some degree to the way that it is scattered; however, it is additionally secured with different factors.

In Sect. 2, we started with a brief explanation of different types of blockchain followed by the inherent security features of blockchain in Sect. 3. The novelty of our paper started from Sect. 4, where we discussed various possible attacks to blockchain network and research done for counter measuring those attacks. Additionally, some security enhancements to blockchain has been discussed in Sect. 5 followed by some frameworks proposed by researchers in Sect. 6. In Sect. 7, we gave some topics on which future research can be carried out followed by conclusion and references at the end.

2 Different Type of Blockchains

There are three major kinds of blockchain technology.

2.1 Public Blockchain

From the security point of view, public blockchain is more secure as it is completely decentralized and no one is able to change past transactions; however, any node from the network is able to keep an eye on transaction, hence confidentiality is not maintained. Bitcoin and Ethereum are two examples.

2.2 Private Blockchains

In private blockchain, a centralized authority is assigned that means they can change or update any transactions, as a result becomes less secure. While, transactions are kept private in this blockchain. Proof of authority consensus is often used in private blockchain.

2.3 Consortium Blockchains

In consortium blockchains, a central authority preapproves known members before they may engage in consensus on a blockchain network. When using this “semi-permissioned” strategy, a network can be dispersed or partially decentralized, while yet maintaining some level of control. In banking or supply chain management, this form of blockchain is utilized between parties as to maintain security and save it from attacks.

3 Blockchain Features for Security

See (Table 1).

Table 1 Security features
Full size table

4 What Are the Effects of Security Attacks to Blockchain Network and Solutions Proposed to Combat that Attack

4.1 51% Vulnerability

Effect: There is a possibility of 51% launch on blockchains with proof of work (PoW) hashing control if a miner’s hashing control exceeds half the entire blockchain. The content on blockchain might be deliberately altered by an intruder by launching a 51% assault. His control over that blockchain will be total.

Solution: Sayeed and Macro-Gisbert in their paper [9] tried focusing on cryptocurrencies that had low hashing power to demonstrate the flaws in the consensus process which bolsters this attack. They then provide 5 security techniques in their work. Another recent effort to combat this attack in named as “Permapoint” [10] minimizes the chain re-organization.

4.2 Selfish Mining Attack

Effect: By this attack, intruders can earn excessive incentives by wasting genuine miners’ incentives. Forking a private chain is attempted by the attacker, who retains found blocks secretly. They would then mine on this secret chain and continue to achieve a considerably longer private branch than that of the public branch since they have more freshly found blocks on their own private chain. Fair miners are still working in public chains. So honest miners will waste computer resources and intruders will get incentives.

Solution: In order to mitigate this attack, the researchers tried using a genuine approach of mining to create truth state notation for each blocks along with allotting self-confirmation height to users’ transactions.

4.3 Double Spending Attack

Effect: When some crypto assets are spent and those are then duplicated and spent again, then this process is called double spending attack. It becomes impossible to avoid double spending attacks. Example: 51% vulnerability, race, and vector76 attacks.

Solution: Nicolas and Wang introduced multistage secure pool which verify the transactions by using four well-defined steps. Begum et al. [11] present a series of countermeasures against double spending assaults.

4.4 BGP Hijacking Attack

Effect: At the point when packets are sent to their objective, border gateway protocol (BGP) is utilized as a routing protocol. Aggressors use BGP directing to capture the organization traffic of blockchain. To do BGP hijacking, network administrators should be in charge, which might be taken advantage of to postpone network traffic. A BGP attack on Bitcoin is investigated by Maria et al. [12].

Solution: A scheme named BGPCoin is proposed by Xang in [13] that creates smart contracts to conduct and manage allocation of resources on a temper-resistant Ethereum network. It is a reliable solution to this problem based on Ethereum and smart contract coding.

4.5 DAO Attack

Effect: A “decentralized and automated” smart contract allowed for duplicate withdrawals, putting people’s digital assets at risk. The “DAO” hack, for example, saw $60 million US dollars stolen from a “decentralized and automated” smart contract.

Solution: To combat this attack, researchers proposed a technique on trials conducted with a tool named Contiki (A low power built tool for resource constrained environment) [14].

4.6 Liveness Attack

Effect: Liveness attack is proposed by Aggelos et al. [15] in order to delay the confirmation time of a target transaction. Both Bitcoin and Ethereum have been attacked in two different ways. There are three steps to a liveness attack, namely assault preparation, transaction denial, and blockchain retarder.

Solution: Conflux’s consensus protocol effectively encapsulates two distinct block generation algorithms developed by Li et al. [16] to prevent the active liveness attack. The first is the ideal method, which allows for speedy confirmation, while the second is the cautious technique, which ensures consensus advancement. It is scalable and distributed blockchain technology with maximum bandwidth and rapid verification. It combines these two methodologies into an integrated consensus process by employing a revolutionary adaptive weight mechanism.

4.7 Sybill Attack

Effect: Attackers fabricate their identity and enter in a peer-to-peer network in order to harm the reputation of the computer security system.

Solution: Swathi in her paper [17] presented strategy to combat this attack by observing other nodes’ behavior and scanning the nodes that are only transmitting the blocks to a single user.

5 Solutions/Research Proposed for Better Security

Security is the primary emphasis when it comes to blockchain technology, which is continuously being discovered and enhanced in order to achieve the goal of giving customers with better sufficient protection.

5.1 Mixing

Mixing services were created to keep users’ addresses separate. As a consequence, the observer’s ownership of coins is obscured through mixing, which is essentially a random exchange of user’s coins with other users’ coins. These mixing services, however, do not offer security against currency theft.

Mixcoin

CoinJoin was the first mixing technique [18]. Bonneau et al. suggested Mixcoin in 2014 as a way to make anonymous payments in Bitcoin and Bitcoin-like coins. The first stage was the introduction of Mixcoin, a cryptocurrency that aims to minimize the risk of robbery by holding the mixing service “responsible” if it takes a customer’s money. Mixcoin expands the anonymity set to enable all users to mix coins at the same time to protect against passive attackers.

TumbleBit

To solve Mixcoin’s accountability and anonymity issues, TumbleBit [19] proposes a solution that is completely compatible with Bitcoin. TumbleBit enables parties to send money to each other via an untrustworthy Tumbler. During a TumbleBit era, no one, not even the Tumbler, can identify which payment paid which payee.

CoinShuffle

CoinShuffle [20] is a protocol that enables users to use Bitcoin anonymously. CoinShuffle is based on the dissent accountable anonymous group communication system and has many benefits over the Bitcoin mixing methods that came before it. It does not need the involvement of a third party (whether trusted, responsible, or untrustworthy), and it is fully compatible with the existing Bitcoin system.

5.2 Non-Interactive Zero-Knowledge Proof (NIZK)

Zcash, zk-SNARK

Zerocoins, on employ fixed-value coins, therefore the e-cash outcome could not support full-fledged nameless payments. Also, before payment, unnamed coins must be converted into nameless coins by someone else. Transactions, on the other hand, do not allow for the concealment of information or transaction amounts. It was thus recommended that we use a currency called Zerocash in order to solve these difficulties. Anonymity and data transaction privacy are particularly important features of Zerocash, which uses anonymous currencies. As a result of this, transactions using a coin are much smaller, and the verification duration is much shorter particularly less than six minutes.

Zero-Knowledge (Range) Proof

Making them unlikable is a common way to safeguard the secrecy and anonymity of a transaction. To complete the transaction, the electronic cash system must verify that the online payer has access to classified information, such as the address from where the cash is coming. Notably, the zero-knowledge proof was designed specifically for situations such as those described in the previous sentence.

5.3 Digital Signature

Hellman and Diffie created the notion of digital signature in 1976 when they invented public key cryptography [8]. In public key cryptography, digital signatures are used for source authentication, integrity, and non-repudiation [8]. Forgery is impossible with the digital signature algorithm (DSA). Some of the signature schemes are discussed below.

Group signature

This method [21] enables members of a group to characterize cluster signed communications anonymously. The following eight criteria must be met by the security components created by group signatures: dependability and integrity, no framing, unforgeability, traceability, anonymity, unlink ability, unforgeable tracing verification, and coalition resistance.

Aggregate signature

A typical digital signature method with an aggregation function based on co-GDH, and bilinear mapping is an aggregate signature [22]. When there are some different signatures on different messages from several users then all these signatures is summarized into one single signature. The burden of signature storage and verification is significantly reduced by the aggregate signatures.

Monero Ring Signature

It was initially based from CryptoNote to protect the source of certain transaction or user handling that transaction. Monero is a hybrid cryptographic model which protect users’ anonymity as it utilizes ring signature technology. It is also worth noting that a collection of prospective signatories is put together to generate an individual signature that may be used for transaction authorization. Its security is so powerful that even in case of any dispute or theft, the original identity of user cannot be revealed.

Blind signature

The issue of big number factor decomposition, discrete logarithm problem, and elliptic curve is used to create a blind signature [23]. Its unique property is because it distinguishes message before it is signed. The main aim is to secure transmitter’s privacy. Encrypted voting systems and digital currency schemes utilizes blind signatures.

Another digital signature technique is proxy signature [24].

6 Other Security Enhancements

There are some frameworks proposed by researchers in order to make blockchain network more secure and private. The following table provides details about the same. These concepts can be explained in detail but due to space constraint, they are summarized below (Table 2).

Table 2 Different types of countermeasures
Full size table

7 Future Recommendations and Conclusion

There are various issues which are yet to be solved. Some of them are mentioned here:

  • Firstly, many frameworks are there to mitigate attacks but a framework that can combat multiple attacks at the same time is a future research prospect in this field.

  • Secondly, decentralized applications are increasing day by day and with that increases issues of data leakage. This problem should be solved using application hardening, code obfuscation, etc.

  • Furthermore, at present, Bitcoin is used worldwide, and the use of cryptocurrencies at global level is increasing exponentially. This results in more criminal activities, with the help of cryptocurrencies, like money laundering, ransomware, and purchase of illegal goods like weed, cocaine, etc. For this, a friendly crypto architecture should be proposed which aids governments to find out those users who are performing suspicious illegal transactions to punish them accordingly.

  • In future with the increasing use of quantum computing, traditional algorithms of digital signature can be easily decoded. For this, some researchers have suggested to use quantum cryptography. So, quantum-base key distribution requires more research.

  • Consensus algorithms play a vital role in blockchain networks and prior research focused significantly on probabilistic reasoning. The difficulty of finding an efficient collection of parameters, modeling options, protocol variations, and compromises in the implementation of these algorithms is still unresolved.

  • As private keys are an important feature, a framework for end-to-end communication of keys should be introduced.

This paper extensively discusses blockchain security and despite the fact that blockchain security is constantly improving, vulnerabilities continue to be discovered, and security research is ongoing. Furthermore, this study explored the many security difficulties, obstacles, and assaults that restrict the growing use of blockchain technology from a range of perspectives. For each assault, we discussed its effect and possible consequence. Eventually, we review recent advancements in blockchain security by different researchers and offered some recommendations for further research.