IEEE Consumer Electronics Magazine - September/October 2021 - 24

Consumer Electronics Security
mining competition, in which nodes need to compete
for the right of creating a new block by solving
a cryptographic puzzle. The winner of the
mining competition packs a set of verified transactions
into a new block and then adds it to the valid
chain after this new block is confirmed.3 A valid
chain containing a sequence of blocks is the one
that has the most accumulation of computational
power. Hence, creating a forged chain to replace
the valid chain is difficult. However, some attackers
can leverage other network vulnerabilities or
some combined attack strategies to easily launch
double-spend attacks. For instance, eclipse
attacks,5 distributed denial-of-service attacks,6
etc., can help attackers achieve their goals.
In this article, we introduce a new type of
combined attack: double-spending with a Sybil
attack. The general Sybil attack uses Sybil nodes
to broadcast forged information,7 which can be
discovered by some detection methods.11
Instead, our combined attack only uses Sybil
nodes to interfere with the propagation of the
block information instead of sending forged
information. Note that more details about the
process and the degree of harm of this combined
attack are presented in.13 This article focuses on
studying how to mitigate this combined attack.
We thus propose two effective mitigations. Our
first mitigation exploits a method that increases
the attack cost of the attacker, which does not
introduce any checking nodes or detecting software
as usual.11 The second mitigation is a network
delay detection mechanism that will
remind vendors to abandon transactions if there
is malicious behavior. We combine these two
mitigations and analyze the effect of them in the
form of economics. The analysis results are presented
before concluding this article.
ATTACK DESCRIPTION
Let attackers and honest nodes denote malicious
nodes and nonmalicious nodes, respectively.
One attacker deploys a large number of
forgednodes calledSybil nodes8 in the Bitcoin network
before conducting a double-spend attack.
Each Sybil node owns multiple fake identities,
whereas eachhonest node only owns one identity.
These fake identities can cheat the honest nodes,
making them believe they are communicating
with different nodes. Note that these Sybil nodes
just interfere with the block propagation instead
of participating in the blockmining competition.
24
Figure 1. Communication between the Sybil node
and the honest node.
First, the attacker sends a transaction TX1 to
one vendor (i.e., Bitcoin honest node) to buy a
kind of commodity. TX1 is broadcasted over the
network and then verified by some honest nodes.
Before TX1 is included into the block at height H,
the attacker also initiates a transaction TX2 to
other attackers or his other Bitcoin addresses.
The trick the attacker takes here is that TX2 uses
the transaction output first spent by TX1.Bitcoin
transactions use the UTXO (Unspent Transaction
Output) model that each transaction output can
only be spent once. In order not to be detected to
violate the UTXO model, the attacker does not
publish the block containing TX2,and he also withholds
the blocks he mines later, thus creating the
private chain forked from the block height H.
The attacker also uses Sybil nodes to influence
the growth of the main chain while creating the
privatechain.Figure1 presentsthecommunication
process between a Sybil node and an honest
node after each round of mining competition.
When one Sybil node receives a new block mined
by a winner node, he uses hismultiplefakeidentities
to send inv messages to the neighbor honest
nodes who have not received this new block.8
Then, these honest nodes respond with getdata
messages to request the block information.8 However,
this Sybil node does not send the block information
to these honest nodes, thus making them
repeatedly request block information. After
requesting the same node for several times, the
honest nodes may change other neighbor nodes
IEEE Consumer Electronics Magazine
IEEE Consumer Electronics Magazine - September/October 2021

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - September/October 2021
