Blockchain cross-domain security solution

1. Evolution of blockchain development

Looking back to 2008, the financial crisis caused by the subprime mortgage crisis spread across the world. In November, a paper titled "Bitcoin: A peer-to-peer electronic cash system" was published. At that time, it was only discussed in a small circle, and few people knew the significance of the paper. Time quickly turned to the new year, and the first version of Bitcoin code was released. On January 4, the genesis block was mined. Five days later, the second block was generated, and the Bitcoin network was officially launched. A person who called himself "Satoshi Nakamoto" quietly blew a ripple in the vast ocean of Internet applications. Today, this ripple has become a huge wave.

[[218372]]

Blockchain V1.0 is mainly applied to Bitcoin and large financial ledgers, while Blockchain 2.0 is gaining momentum and investment in industries and application fields. However, the evolution of blockchain from 1.0 to Blockchain 2.0 is not a simple process. The complexity and challenges of this transformation are summarized in the three stages described below:

• Registration stage: First, registration-related issues must be resolved. Blockchain is credible and traceable because it uses a "proof of work algorithm" and other recognized rules to ensure that only legitimate blocks can be added. Once a block is thoroughly verified and linked to the blockchain, it will be saved forever. The local ledger chain database on the Internet will never be destroyed, and the recorded information fields match the generation time. All information in the trusted ledger chain is unique and tamper-proof. Therefore, blockchain can be used to record various types of information.
• Verification phase: The second area of ​​improvement is accurate verification. Blockchain is open source and shareable, allowing various organizations and individuals to access the operation of the entire system. Each node involved in maintenance receives a complete copy of the entire database to ensure ownership of the information. Blockchain is an ideal solution for storing permanent records such as authenticity verification, land ownership, equity transactions, and other applications.
• Management phase: This brings us to the third phase. Here, it is imperative to focus on smart management. Blockchain fans believe that the core contribution of blockchain is to solve any credibility issues in the process of multi-point information interaction. This problem or challenge is coined as the "Byzantine Generals' Problem". As the name suggests, this problem originated from the Roman Empire and the Byzantine Empire. Given the vast territory of the empire, the generals of the imperial army were geographically separated and difficult to interact. There were also traitors in the army who would mislead the generals' decisions and prevent them from striving for victory. This made it difficult to reach a consensus due to the lack of accurate information.

Now we have entered the Blockchain 3.0 era, which still focuses on the application and specification of its derivative fields. The distinguishing feature of Blockchain 3.0 is the introduction of a decentralized domain name system – Namecoin. Here is a brief description of Namecoin and its functions, challenges and applications:

1. What is Namecoin?

The functionality provided by Namecoin is similar to that provided by traditional DNS providers. The main difference is that Namecoin is based on decentralized blockchain technology. Because of this, Namecoin can bypass Internet censorship and ensure the free and neutral distribution of information.

2. Features of Namecoin

In Namecoin, there is no authority that can change a domain name. For example, the US government controls the DNS provider for the .com domain and is able to censor websites registered under that domain. However, Namecoin corresponds to the .bit domain, which is not controlled by any authority. The domain is permanently written to the blockchain, ensuring that information is published on the website for free.

3. How Namecoin works

Namecoin shares the DNS query table through a peer-to-peer network. As long as someone is running the Namecoin server application, the domain name can be accessed and is not controlled by anyone.

4. Application areas of Namecoin

Since .bit domains can be used to circumvent supervision and censorship, they are suitable for the free and legal dissemination of information. Namecoin, an application based on the idea of ​​decentralized domain names, is one of the first applications to apply blockchain technology to non-monetary fields. These applications have high research value. Although the ideology can be applied to various fields, there are currently some limitations that prevent them from being popularized.

5. Major limitations of Namecoin

Most browsers do not support parsing .bit URLs by default, and users need to install a plug-in to access .bit websites. This problem will prevent most users from accessing .bit websites, making it difficult to popularize. Anonymity, low cost, and immunity from censorship make Namecoin prone to misuse. Users can use .bit to host illegal content or businesses without legal consequences. In addition, websites in China must be recorded. Since .bit websites cannot be recorded in China, they cannot be used in the country.

2. Evolution of blockchain algorithms

From another perspective, the technological evolution of blockchain is also the continuous optimization and improvement of algorithms. Consensus and Algorithm can be said to be important pillars in the blockchain technology system.

[[218373]]

(1) Hash algorithm. Why? When Satoshi Nakamoto designed Bitcoin, he actually used hash functions in many places, such as calculating block IDs, calculating transaction IDs, and constructing token addresses. The algorithm we are talking about specifically refers to the hash function used to calculate block IDs. The so-called algorithm innovation is to work hard on this. Anyway, nowadays, whenever a copycat coin is released, people claim that they have invented a certain algorithm, etc. I will not make any rash assertions^_^.

(2) SHA256 algorithm. Except for one link in address generation that uses the REPID-160 algorithm, SHA256 is used wherever hash operations are required in the Bitcoin system. As Bitcoin becomes more widely known, people began to wonder why Satoshi Nakamoto chose SHA256, and expressed various opinions on the security of SHA256. SHA256 has withstood the doubts. So far, there is no public evidence that SHA256 has vulnerabilities, and SHA256 still firmly holds the banner of protecting the security of Bitcoin.

(3) scrypt algorithm. Later, with the emergence of graphics card mining and mining pools, the community began to worry that mining pools would lead to the concentration of computing power, violating Satoshi Nakamoto's original design concept of "one CPU one vote". During that period, the anxiety of centralization was very serious, the discussion was very intense, and Bitcoin was "killed" again and again. Until now, the debate on whether mining pools violate the principle of decentralization continues. In any case, some people point the finger at SHA256, believing that the algorithm is too easy to lead to the emergence of mining machines and mining pools, and try to find a more difficult algorithm. At the right time, Litecoin, which uses the SCRYPT algorithm, came out. It is said that SCRYPT was developed by a famous hacker. Because it has not received strict security review and comprehensive demonstration like the SHA series, it has not been widely promoted and used.

(4) Serial algorithm: In July 2013, Quark was released, pioneering the use of a multi-round hash algorithm. It looks sophisticated, but it is actually very simple. It computes the hash function nine times on the input data, and the result of the previous round of operations is used as the input for the next round of operations. These nine rounds of hashing use a total of six encryption algorithms, namely BLAKE, BMW, GROESTL, JH, KECCAK and SKEIN. These are all recognized secure hash algorithms, and there are already existing implementation codes. As soon as this multi-round hashing algorithm appeared, it gave people an intuitive feeling of being very secure and powerful, and it has attracted countless fans. DASH (formerly Darkcoin), whose price is still strong today, took over the next step and was the first to use 11 encryption algorithms (BLAKE, BMW, GROESTL, JH, KECCAK, SKEIN, LUFFA, CUBEHASH, SHAVITE, SIMD, ECHO), euphemistically called X11. Soon after, the X13 and X15 series were developed.

(5) Parallel algorithm: some people connect in series, others connect in parallel. Heavycoin (HVC) was the first to try. HVC is now unknown in China, but it was very famous at the time. It was the first to realize on-chain games. The author was a Russian, but unfortunately died young, which caused a lot of regret in the cryptocurrency circle.

(6) Primecoin algorithm. While some people were exploring the algorithm in full swing, the voices of others were very harsh, accusing POW of wasting energy (the POS mechanism had already been implemented at that time). Although the POW party tried their best to defend it, they also acknowledged the fact that it wasted energy. This accusation opened up another path of exploration, that is, if an algorithm could be found that could not only maintain the security of the blockchain, but also generate value in other aspects through these hash operations, it would be even more perfect. The most exciting result on this path of exploration came from Primecoin, invented by Sunny King (this great god had previously developed Peercoin). The core concept of the Primecoin algorithm is to find large prime numbers while performing hash operations. Prime numbers have now been widely used in various fields, but humans still have limited understanding of them. Prime numbers are not only rare on the number axis (compared to even numbers), but also irregularly distributed. Finding prime numbers on the number axis can only be done through blind search and detection, which is exactly the characteristic of POW. Another requirement of POW is that it is easy to verify. In this regard, humans have achieved some results after hundreds of years of exploration. Primecoin uses two methods to test, first the Fermat test, then the Euler-Lagrange-Lifchitz test, if it passes the test, it is considered prime. It should be pointed out that this method cannot guarantee that 100% of the numbers that pass the test are prime, but this does not affect the operation of the system, even if the test result is wrong, as long as each node considers it to be prime.

(7) Ethash algorithm. Ethereum originally planned to use the POS method, but due to some problems in the POS design, the development team decided to use the POW method in the Ethereum 1.0 stage, and it is expected to switch to POS in the Serenity stage. The Ethereum POW algorithm is called Ethash. Although it is only a transitional algorithm, the development team is not ambiguous at all and continues to carry forward its design style of "complexifying simple problems and showing IQ with tedious details". Ethash is the latest version of the Dagger-Hashimoto improved algorithm, which is a new variant of the Hashimoto algorithm combined with the Dagger algorithm. Ethash was designed with two clear goals:

• To resist mining machine performance (ASIC-resistance), the team hopes that CPU can also participate in mining and gain benefits.
• Light client verifiability.

Based on the above two goals, the Ethash mining that the development team finally came up with has basically nothing to do with CPU performance, but is positively correlated with memory size and memory bandwidth. However, the implementation still draws on the design ideas of SHA3, but the "SHA3_256" and "SHA3_512" used are very different from the standard implementation.

(8) Ethash algorithm, the basic process is as follows: for each block, first calculate a seed (seed), which is only related to the information of the current block; then generate a 32M random data set (Cache) based on the seed; then generate a 1GB data set (DAG) based on the Cache. DAG can be understood as a complete search space. The mining process is to randomly select elements from the DAG (similar to finding a suitable Nonce in Bitcoin mining) and then perform a hash operation. The elements at the specified position of the DAG can be quickly calculated from the Cache, and then hash verification is performed. In addition, the Cache and DAG are required to be updated periodically, once every 1,000 blocks, and the size of the DAG is required to grow linearly over time, starting from 1G and increasing by about 7G per year.

(9) Equihash algorithm. The most popular algorithm in China recently is Zcash. The biggest feature of this currency is the use of zero-knowledge proof to achieve private transactions. There are still a few days before the release, but judging from the community discussion, miners from all parties are already sharpening their knives. Zcash is very cautious in choosing algorithms. After considering SHA256D, SCRYPT, CUCKOO HASH and LYRA2, it finally chose Equihash. The Equihash algorithm was jointly invented by Alex Biryukov and Dmitry Khovratovich. Its theoretical basis is a well-known problem in computational science and cryptography - the generalized birthday paradox. Equihash is a memory (ARM) dependent algorithm. The size of the machine's computing power mainly depends on how much memory it has. According to the paper of the two inventors, the algorithm requires at least 700M memory and 1.8 GHz CPU to calculate for 30 seconds. After optimization by the Zcash project, each mining thread currently requires 1G memory. Therefore, Zcash officials believe that it is difficult for this algorithm to appear in mining machines (ASIC) in the short term. In addition, Zcash officials also believe that the algorithm is relatively fair. They believe that it is difficult for someone or an organization to secretly optimize the algorithm because the generalized birthday paradox is a problem that has been widely studied. In addition, the Equihash algorithm is very easy to verify, which is very important for the future implementation of Zcash light clients on restricted devices. The Zcash official team chose Equihash entirely out of the need to resist the performance of mining machines. They also admitted in the official blog that they dare not ensure that Equihash is definitely safe, and stated that if problems are found with Equihash, or a better algorithm is found, Zcash will change the POW algorithm.

The future development of Blockchain will definitely focus more and more on the development of the industry rather than just the development of the monetary and financial system. No one has explored and practiced in the security field yet. The author will first talk about the application of blockchain in the security field.

3. Blockchain Domain Security Solution

In a blockchain network, the role of cross-domain protection will be performed by blockchain network peers installed on high-security platforms, called High Security Business Nodes (HSBNs). Data movement within a distributed cross-domain blockchain business network takes the form of cryptographically protected transaction updates to a shared ledger held by each node in a dedicated channel for specific members of the business network. Other peer nodes of the blockchain business network reside in one or the other security zone, whether high or low, and receive protected blocks of approved ledger transactions. Signed ledger updates occur on the opposite security domain through the border HSBN to guarantee that the security controls provided by the blockchain cannot be bypassed or overridden.

4. Advantages of blockchain domain solution

Blockchain cross-domain solutions can increase the efficiency of your information exchange process and improve the accessibility and traceability of information exchanges. Specifically, it provides:

• A single shared view of every asset throughout its lifecycle, regardless of network domain. In a standard cross-domain protection, there is no way to ensure that information residing on each side of the protection remains in sync throughout its lifecycle. Visibility and scope of control for protection is limited. Auditable control and oversight of asset information throughout the lifecycle. The shared ledger provides a definitive, immutable record, even in the cybersecurity world, of what has been shared and by whom. This eliminates trying to track and connect separate protection-only data streams together.
• Information sharing, not just moving data. Data control and sharing happens naturally through the shared ledger as part of the normal blockchain business network. Traditional protection is only moving data. Extending information sharing to other security domains can be easily accomplished by deploying additional HSBN-hosted nodes and channels.
• Reduce costs and improve security. This technology can be realized by using existing open source blockchains, and companies such as IBM are currently doing commercial work.