The cybersecurity for IoT devices is often an afterthought, as they often have little need for a "human interface". If IoT designers think about security at all, they may follow the "hard and crunchy on the outside, soft and chewy inside" model, which emphasizes perimeter defense, on the theory that if hackers can't get in, they can't do damage. The catch is that even the smallest IoT devices may have a software stack that's too complex for the designers to comprehend as a whole, usually leading to obscure vulnerabilities in dark corners of the code, where normal designers would never look.

Blockchain interoperability conflates the need for distributed systems to communicate with third- party systems without the existence of a canonical chain or orchestration layer. As there is not “a chain to rule them all” (due to reasons such as performance, privacy, and market forces), these distributed systems rely on exchanging data and value across network boundaries. Interconnected systems achieve a higher value than the sum of their parts, similar to how the Internet emerged as a set of isolated Local Area Networks (LANs) - and, by force of surprising synergies, such networks fundamentally transformed society, forever. Concurrently, in the last decade, we have witnessed the astonishing development of blockchain technologies, which seem more connected than ever: via bridges [13, 15, 16, 31], oracles [45], and other interoperability mechanisms [4, 9, 17, 48, 89]. These recent developments have, slowly but steadily, contributed to the improvement of the scalability of blockchain networks, as well as providing new functionality and use cases [66], but there is still a long way to go until mass adoption. In this paper, we will dive into the rabbit hole of blockchain interoperability and explain why it is needed, what has been done in the last decade, and where it is going.

An identity and data fiduciary model for source validation in social networks is needed, one that protects users' privacy and independence, while ensuring that data being transmitted is authentic and human-generated. Such a model will enable new types of reputation scoring services to emerge, utilizing data on the networks based on the pseudonymous user's posts and transaction history.

Recent years have witnessed significant advancements in cross-chain technology. However, the field faces two pressing challenges. On the one hand, hacks on cross-chain bridges have led to monetary losses of around 3.1 billion USD, highlighting flaws in security models governing interoperability mechanisms and the ineffectiveness of incident response frameworks. On the other hand, users and bridge operators experience restricted privacy, which broadens the potential attack surface.In this paper, we present the most comprehensive study to date on the security and privacy of blockchain interoperability. We employ a systematic literature review, yielding a corpus of 212 relevant documents, including 58 academic papers and 154 gray literature documents, out of a pool of 531 results. We systematically categorize 57 interoperability solutions based on a novel security and privacy taxonomy. Our dataset, comprising academic research, disclosures from bug bounty programs, and audit reports, exposes 45 cross-chain vulnerabilities, 25 theoretical attacks, and 93 mitigation strategies. Leveraging this data, we analyze 14 notable bridge hacks accounting for over 2.9 billion USD in losses, mapping them to the identified vulnerabilities.Our findings reveal that a substantial portion (65.8%) of stolen funds originates from projects secured by intermediary permissioned networks with unsecured cryptographic key operations. Privacy-wise, we demonstrate that achieving unlinkability in cross-chain transactions is contingent on the underlying ledgers providing some form of confidentiality. Our study offers critical insights into the security and privacy of cross-chain systems. We pinpoint promising future research directions, underscoring the urgency of enhancing security and privacy efforts in cross-chain technology. The identified improvements can mitigate the financial risks associated with bridge hacks, fostering user trust in the blockchain ecosystem and, consequently, wider adoption.

For many organizations the emergence of the zero-trust architecture (NIST SP800-207) has necessitated the introduction of new security technologies that go beyond user-authentication and device/assets management products. Device attestations can play a crucial role in the defense-in-depth strategy of "layering" access to resources that are partitioned into domains, where access into each domain requires a more stringent authentication and verification process. This short discussion paper explores the possible use of the OpenID-Connect (OIDC) user-authentication flows as a means to also convey attestation evidences generated by devices1.

Decentralized ledger technology (DLT) is becoming ubiquitous in today’s society.  After an initial grassroots adoption, enterprises embrace this technology, following the opportunity to expand to new businesses - the technology is maturing. However, organizations need to connect their existing systems and processes to blockchains (centralized - decentralized) securely and reliably, sometimes also implying to connect blockchains (decentralized - decentralized). This challenge is known as blockchain interoperability. Blockchain interoperability comes in three modes: data transfers, asset transfers, and asset exchanges. As blockchain interoperability is still maturing, there are many unsolved challenges across the different interoperability modes. In this \emph{position paper}, we illustrate the remaining challenges of interoperability, focusing on the systematic evaluation of interoperability mechanisms, based on the state of the art and our own experience. We first introduce the notion of cross-chain interoperability and cross-chain rules. Then, we present our survey and results. We ran an online survey comprised of 17 items targeting blockchain specialists. Our quantitative analysis shows that several interesting metrics can show promising directions to evaluate integration solutions systematically. Finally, building upon our study, we propose the blockchain interoperability evaluation framework, the first step to evaluate blockchain interoperability solutions systematically.

The nascent tokenized assets industry needs to develop standards around asset definition schemas that permit each industry or vertical to create profiles based on the schemas that are specific for addressing the needs of that industry. Machine-readable asset schemas and profiles are a core element of a proper tokenized assets management lifecycle. As metadata artifacts supporting tokenization, they must be managed as part of the lifecycle. A global network of decentralized registries is needed to provide persistence and accessibility to the published asset schemas and profiles. The notion of schemas, profiles, and registries aligns with the asset-referenced tokens (ART) in the recent EU MiCA Regulation on markets in crypto-assets.

Many businesses seeking new capabilities that blockchains may offer are deterred from fully embracing the technology due to fears of the classic "vendor lock-in" and platform-capture into one specific blockchain. From an asset-centric perspective, most business applications seek certain desirable functional guarantees with regard to the state of the tokenized asset on the blockchain. These new capabilities must be accessible through standardized service interfaces. The emerging tokenized asset networks based on decentralized ledger technology must integrate seamlessly into existing financial IT systems through similar standard interfaces. As such, if blockchains are to be a foundational technology in the future Web3 Internet of Value, then several classes and types of standardized APIs must be specified, published, and widely deployed by the nascent tokenized asset industry. These standard APIs must provide business applications with a single uniform interface to the many and varied blockchains today, thereby reducing business IT costs and preventing platform-capture.

In order for tokenized asset networks to be accountable as Web3 marketplaces for token-related transactions, identity verification must be conducted by gateways into those token networks. This includes the identity validation and legal status verification of the originators and beneficiaries, the gateway owners/operators, and other relevant service providers. The classic identity provider model could be enhanced to support anti-money laundering regulations, notably the Travel Rule. A privacy-preserving IdP model in combination with a legal service provider is explored where the IdP becomes the issuer of a blinded attestation regarding the user attribute, and where the legal representative with attorney-client privilege becomes the first point of contact for requests for the disclosure of the blinded attestations.

With the growing interest in blockchain technology, researchers and developers in different industries are shifting their attention to creating interoperability mechanisms. Existing mechanisms usually encompass asset exchanges, asset transfers, and general data transfers. However, most of the solutions based on these mechanisms only work for two permissionless blockchains falling short in use cases requiring more complex business relationships. Also, contrary to existing legacy systems, there is little standardization for cross-chain communication. Here we present MP-SATP, a resilient multi-party asset transfer protocol built on top of the Secure Asset Transfer Protocol (SATP). Furthermore, we enhance SATP’s crash recovery mechanism that directly influences the reliability and performance of our solution. Using MP-SATP, we show how to perform N-to-N resilient asset transfers in permissioned environments by decoupling them into multiple 1-to-1 asset transfers. Our results demonstrate that the latency of the protocol is driven by the latency of the slowest 1-to-1 session; and how the usage of backup gateways avoid the overhead caused by rollbacks. Enterprise-grade environments such as supply-chain management systems can immediately leverage our solution to perform atomic multi-party asset transfers as shown by our use case.

If tokenized assets are to be a reality in the future decentralized Web3 then transaction keys need to be distributed and under the control of the asset-owners. This requires a careful design of wallet systems based on trusted hardware. A core feature needed for wallet systems is the attestation of the state of the transaction keys in the wallet without disclosure of the keys. This feature is relevant for relying parties such as insurance providers who need to perform risk assessment based on the security quality of the environment inside the wallet system that is protecting the transaction keys. In the longer term, all key-bearing devices that participate in a decentralized tokenized asset network will need to be hardened using trusted hardware, with attestation capabilities for detecting and countering cyberattacks.

Data cooperatives with fiduciary obligations to members provide a useful source of truthful information regarding a given member whose personal data is managed by the cooperative. Since one of the main propositions the cooperative model is to protect the data privacy of members, we explore the notion of blinded attestations in which the identity of the subject is removed from the attestations issued by the cooperative regarding one of its members. This is performed at the request of the individual member. We propose the use of a legal entity to countersign the blinded attestation, one that has an attorney-client relationship with the cooperative, and which can henceforth become the legal point of contact for inquiries regarding the individual related to the attribute being attested. There are several use-cases for this feature, including the Funds Travel Rule in transactions in digital assets, and the protection of privacy in decentralized social networks.