1
00:00:00,000 --> 00:00:05,200
Another author of this presentation is Seungjoo Kim.

2
00:00:05,260 --> 00:00:10,340
In this presentation, we prepared together, but only I speak.

3
00:00:10,340 --> 00:00:16,880
The title is Blockchain for Cyber Defense and Will It Be Good As You Think?

4
00:00:16,880 --> 00:00:18,900
is our topic.

5
00:00:19,080 --> 00:00:21,320
It's 5 a.m.

6
00:00:21,320 --> 00:00:27,440
in Korea, so I think the condition is not normal, but I hope you understand.

7
00:00:36,920 --> 00:00:40,340
Again, I'm Seungri Lee, and I'm a Ph.D.

8
00:00:40,340 --> 00:00:42,040
student at Korea University.

9
00:00:42,260 --> 00:00:45,460
I'm the captain of the Republic of Korean Army.

10
00:00:45,520 --> 00:00:50,660
I have three years' experience as a researcher in the Agency for Defense Development.

11
00:00:50,660 --> 00:00:56,580
It's about the development of the defense and armed system.

12
00:00:56,940 --> 00:01:02,120
As a security researcher, I'm interested in network security and cyber defense.

13
00:01:03,340 --> 00:01:17,200
About blockchain, I was a speaker of CryBlock 2019 at IEEE Infocom.

14
00:01:17,520 --> 00:01:22,120
The title was Countering Block Withholding Attack Efficiently.

15
00:01:22,240 --> 00:01:28,540
Also, I will speak at CryBlock 2020 at ACM Mobicom.

16
00:01:28,540 --> 00:01:41,560
It will be September, and the title will be No Prosperous Take Has Taken Predatory Destructive Attack on Prosperous Take Cryptocurrencies.

17
00:01:41,560 --> 00:01:48,760
It will be about a novel attack methodology about POS cryptocurrency.

18
00:01:49,760 --> 00:01:51,600
It's not about research.

19
00:01:51,600 --> 00:01:56,360
I like to get groundbreaking ideas from philosophy.

20
00:01:56,360 --> 00:02:03,180
My favorite philosophers are Derrida, Nietzsche, Foucault, and Wittgenstein.

21
00:02:03,180 --> 00:02:07,980
Another author of this presentation is Seungju Kim.

22
00:02:07,980 --> 00:02:15,460
He's my advisor, and he's a professor of cybersecurity at Korea University.

23
00:02:15,460 --> 00:02:27,680
He's a reviewer in several international hacking conferences like Black Hat Asia and Secure Insight.

24
00:02:27,680 --> 00:02:31,900
He's also an advisor of an undergraduate hacking club, Cyker.

25
00:02:32,780 --> 00:02:38,440
The hacking group Cyker is now competing in DEF CON online.

26
00:02:38,440 --> 00:02:56,640
His main research areas are focused on trustworthy systems, development methodology, secure SDLC, RMAF, common criteria, CMVP, blockchain, etc.

27
00:02:58,060 --> 00:03:02,940
So our topics are, what is blockchain for cyber defense?

28
00:03:02,940 --> 00:03:13,200
Maybe many of you are blockchain professionals but not familiar with cyber defense or blockchain for cyber defense.

29
00:03:13,260 --> 00:03:29,400
Our main discussions are challenges in cyber defense, and then we will talk about related military projection analysis.

30
00:03:30,220 --> 00:03:33,600
As a summary, we will talk about takeaway.

31
00:03:40,490 --> 00:03:44,130
Targets of this talk are four kinds of people.

32
00:03:44,650 --> 00:04:02,530
Someone interested in blockchain, someone interested in cyber defense, and someone interested in how blockchain can be hacked, and someone who needs fresh ideas.

33
00:04:04,150 --> 00:04:07,890
Who doesn't know blockchain or what is cyber defense?

34
00:04:07,890 --> 00:04:15,950
I hope this talk will give you fresh ideas about this topic or any ideas.

35
00:04:19,270 --> 00:04:22,250
So blockchain for cyber defense, what is it?

36
00:04:22,250 --> 00:04:27,170
Maybe you know what is blockchain.

37
00:04:27,170 --> 00:04:33,110
Actually, blockchain is not clearly defined.

38
00:04:33,110 --> 00:04:38,510
Blockchain is started from Bitcoin founded by Satoshi Nakamoto.

39
00:04:38,510 --> 00:04:53,210
In his white paper, he didn't write clear definition of blockchain, but his main topic was Bitcoin.

40
00:04:54,450 --> 00:05:01,310
In my thought, I think blockchain is constructed by three concepts.

41
00:05:01,310 --> 00:05:07,570
Maybe some can think differently because the start of blockchain was not clearly defined.

42
00:05:07,570 --> 00:05:23,910
One is, as a data structure, hash chain blocks, as a network structure, distributed network, and as a consensus structure, decentralized consensus.

43
00:05:24,650 --> 00:05:35,810
And it has some fundamental problems.

44
00:05:35,810 --> 00:05:37,750
It's called trilemma.

45
00:05:37,750 --> 00:05:41,310
Scalability, security, and decentralization.

46
00:05:41,310 --> 00:05:49,410
Three kinds of characteristics can be satisfied at the same time.

47
00:05:51,230 --> 00:05:53,310
Then what is cyber defense?

48
00:05:53,310 --> 00:05:58,930
Maybe some of you know, but maybe majority of you don't know.

49
00:05:58,930 --> 00:06:00,710
This picture is just for fun.

50
00:06:00,710 --> 00:06:02,510
It's not like cyber defense.

51
00:06:03,150 --> 00:06:05,190
It's just funny.

52
00:06:07,310 --> 00:06:09,370
So what is cyber defense?

53
00:06:09,370 --> 00:06:17,330
Before I talk about this, I should define what is cyber security.

54
00:06:17,330 --> 00:06:28,570
Classically, many people talk about information security, but also many people just talk about cyber security like information security.

55
00:06:28,570 --> 00:06:42,510
If cyber security is the same as information security, then it's not worth to talk about cyber security or name cyber security.

56
00:06:42,510 --> 00:06:52,670
So I bring a clear and distinguishable definition from the reference at the bottom you can see.

57
00:06:53,130 --> 00:07:02,230
In their research, they define cyber security as treating stress using ICT.

58
00:07:02,230 --> 00:07:04,550
Then what is classical information security?

59
00:07:04,550 --> 00:07:09,870
Information security is treating stress to information-based assets.

60
00:07:09,870 --> 00:07:15,110
But cyber security is treating any stress using ICT.

61
00:07:15,610 --> 00:07:18,990
ICT is information and communication technology.

62
00:07:18,990 --> 00:07:26,550
For example, car accident is not included in information security.

63
00:07:26,550 --> 00:07:37,690
But if car accident is by a car remotely controlled by a hacker, then it is included in cyber security domain.

64
00:07:37,690 --> 00:07:41,930
Now we can define what is cyber defense.

65
00:07:42,830 --> 00:07:49,410
Cyber defense is intersection of cyber security and national security or national defense.

66
00:07:49,410 --> 00:07:57,830
National security and national defense are used in the same way many times.

67
00:07:59,650 --> 00:08:08,990
Not only cyber defense is about military defense, but widely it's all about national security.

68
00:08:09,570 --> 00:08:11,850
So why is it like that?

69
00:08:11,850 --> 00:08:14,950
You can see in the picture.

70
00:08:15,670 --> 00:08:24,670
At the past, the stress to countries was through only military domain.

71
00:08:24,670 --> 00:08:31,310
They should overcome armed forces, army, air force, and navy.

72
00:08:32,610 --> 00:08:40,270
So general physical stress on defense is through military area.

73
00:08:40,270 --> 00:08:50,930
But non-military domain, including severe assets and critical infrastructures, are covered by military domain.

74
00:08:50,930 --> 00:08:59,030
But these days, they can be attacked directly by ICT, information and communication technologies.

75
00:08:59,030 --> 00:09:14,310
For example, they can hack the plant and hack the financial systems and hack governmental information systems.

76
00:09:14,350 --> 00:09:18,230
It's already happened.

77
00:09:18,230 --> 00:09:23,810
In 2007, cyber attack to Estonia was really severe.

78
00:09:23,810 --> 00:09:28,670
That's the beginning of the CCTCOE in NATO.

79
00:09:28,730 --> 00:09:33,770
In 2010, Stuxnet to Iranian nuclear facilities.

80
00:09:33,770 --> 00:09:45,070
It was shocking accident that computer virus can stop the nuclear targets and stop nuclear plant.

81
00:09:45,070 --> 00:09:53,230
In 2015, Black Energy temporarily stopped the Ukrainian power grid.

82
00:09:53,570 --> 00:10:01,530
Now, cyber attacks can directly attack national security and national assets.

83
00:10:01,530 --> 00:10:06,890
Therefore, national countries need powerful cybersecurity technologies.

84
00:10:07,070 --> 00:10:11,390
That's how cyber defense meets blockchain.

85
00:10:12,390 --> 00:10:16,700
Blockchain looks secure and reliable.

86
00:10:17,270 --> 00:10:27,560
Many articles and news always talk about it's really nice secure world with blockchain.

87
00:10:28,010 --> 00:10:34,210
Secure, reliable, survival, and so on.

88
00:10:34,210 --> 00:10:35,600
It's true.

89
00:10:35,600 --> 00:10:47,980
Blockchain technology is not about single point of failure and it's immune to any minority attacks.

90
00:10:47,980 --> 00:10:53,800
Even DDoS attacks are really difficult to blockchain.

91
00:10:53,800 --> 00:10:57,060
It should overcome majority resources.

92
00:10:59,820 --> 00:11:07,240
So, policy makers of countries easily think like that.

93
00:11:07,240 --> 00:11:15,880
Defense systems require high security and high reliability.

94
00:11:15,880 --> 00:11:19,420
Blockchain looks unhackable.

95
00:11:19,420 --> 00:11:22,980
Okay, then defense needs this technology.

96
00:11:22,980 --> 00:11:26,680
It's really simple logic and expectable.

97
00:11:27,840 --> 00:11:33,800
In reality, many projects are already in progress.

98
00:11:34,600 --> 00:11:42,120
We will discuss about related projects in the next section.

99
00:11:42,120 --> 00:11:47,500
But in preview, military-included messaging app built on blockchain.

100
00:11:47,500 --> 00:11:55,060
Blockchain supply chain enhancement for trusted and assured FPGA and ASICs.

101
00:11:55,060 --> 00:11:58,480
Decentralized key management using blockchain.

102
00:11:58,480 --> 00:12:04,260
Army innovation network provenance using blockchain and disconnected networks.

103
00:12:04,260 --> 00:12:07,140
Navy multi-factor authentication.

104
00:12:07,760 --> 00:12:10,820
Coups through resilient blockchain framework.

105
00:12:10,820 --> 00:12:14,140
Chinese soldiers reward system using cryptocurrency.

106
00:12:14,760 --> 00:12:18,340
Blockchain-based record intelligence.

107
00:12:18,540 --> 00:12:21,720
French military police record on Tazos blockchain.

108
00:12:21,720 --> 00:12:23,160
South Korean military.

109
00:12:23,160 --> 00:12:28,500
Blockchain-based digital identification, DID.

110
00:12:28,500 --> 00:12:31,520
And also other projects.

111
00:12:31,740 --> 00:12:36,480
So, will it be as good as you think?

112
00:12:36,480 --> 00:12:43,300
Well, in this talk, I want to question and introduce some challenges.

113
00:12:45,300 --> 00:12:50,400
So, to meet the challenges, let's go to the battleground.

114
00:12:51,660 --> 00:12:54,700
Maybe some of you like this game.

115
00:12:55,840 --> 00:12:59,660
So, what is waiting for us in the battleground?

116
00:13:00,880 --> 00:13:03,440
There is a profession.

117
00:13:03,720 --> 00:13:07,420
I introduced a profession, Carl von Clausewitz.

118
00:13:07,440 --> 00:13:12,300
And he is a really professional in war and battleground.

119
00:13:12,300 --> 00:13:16,800
He said in Twitter, war is a volume of uncertainty.

120
00:13:16,800 --> 00:13:27,180
Three quarters of the factors on which action in war is based are wrapped in a fog of greater and lesser uncertainty.

121
00:13:27,900 --> 00:13:32,460
In summary, he says, it's full of uncertainty.

122
00:13:32,460 --> 00:13:35,260
So, what is big uncertainty?

123
00:13:35,260 --> 00:13:43,980
Blockchain technology already assumes many uncertain situations, right?

124
00:13:43,980 --> 00:13:50,440
But in battleground, uncertainty can be really extreme.

125
00:13:50,440 --> 00:13:58,000
For example, you got ordered to go to mountain and save the mountains.

126
00:13:58,000 --> 00:14:01,220
In Korea, mountains are like that.

127
00:14:01,460 --> 00:14:10,820
And our territory is covered by mountains like that.

128
00:14:10,820 --> 00:14:20,200
So, when you got ordered to go to mountain, then we expect mountains are covered by trees, usually, right?

129
00:14:20,260 --> 00:14:25,040
But in reality, mountains can be devastated.

130
00:14:26,960 --> 00:14:33,200
You can go to mountain and there can be even no single tree.

131
00:14:33,260 --> 00:14:36,740
Rare trees burned down a year ago.

132
00:14:36,740 --> 00:14:43,620
In Korean war in 1950, most of our trees burned down.

133
00:14:44,340 --> 00:14:55,560
So, what I want to say is situations in battleground can be extremely miserable.

134
00:14:56,680 --> 00:15:04,800
But you got ordered and you should say, I swear in army.

135
00:15:06,580 --> 00:15:14,680
So, let's assume policy makers said adopt the blockchain technology and secure our networks.

136
00:15:16,100 --> 00:15:19,880
Also, let's assume it's not questionable.

137
00:15:19,880 --> 00:15:24,340
You are not allowed to question about this decision.

138
00:15:25,340 --> 00:15:37,640
Actually, many people don't agree with private blockchain networks.

139
00:15:40,000 --> 00:15:43,420
So, we will encounter three challenges.

140
00:15:43,420 --> 00:15:45,800
Challenge one, air gap networks.

141
00:15:45,800 --> 00:15:49,720
And challenge two, first dynamic environment.

142
00:15:50,240 --> 00:15:54,240
And challenge three, the resource shortage.

143
00:15:55,220 --> 00:15:58,480
So, challenge one, air gap networks.

144
00:15:58,480 --> 00:16:00,100
So, what is air gap networks?

145
00:16:00,400 --> 00:16:04,400
This is maybe familiar for most of you.

146
00:16:04,900 --> 00:16:18,940
In military networks and critical infrastructures in most countries, many networks have air gap environments.

147
00:16:20,200 --> 00:16:26,880
Air gap is something technology to make networks isolated.

148
00:16:26,880 --> 00:16:35,620
So, you can see internet, mainly stressors come from outer internet.

149
00:16:35,620 --> 00:16:41,160
So, to protect internet, you can make air gaps.

150
00:16:41,160 --> 00:16:47,540
Air gaps can be software-based air gap and hardware-based air gap.

151
00:16:47,540 --> 00:16:50,080
And there is true air gap.

152
00:16:50,080 --> 00:16:54,520
True air gap means there is no communication between air gap.

153
00:16:54,520 --> 00:16:58,380
But, well, it's not always magical.

154
00:16:58,380 --> 00:17:03,220
Because Stuxnet exploded air gap networks.

155
00:17:03,220 --> 00:17:14,120
Anyway , if there is an air gap, then it is hard to construct blockchain.

156
00:17:14,120 --> 00:17:23,740
Because communication is not possible and many networks are partitioned and isolated.

157
00:17:23,740 --> 00:17:28,880
So, anyway, let's make blockchain here.

158
00:17:29,260 --> 00:17:44,760
So , for example, you can construct servers of each isolated network and communicate messages by those servers.

159
00:17:44,760 --> 00:17:50,040
Then, it will be a single point of failure and it's just centralized.

160
00:17:51,040 --> 00:18:02,940
Another way, you can make isolated networks and each isolated network has isolated blockchain.

161
00:18:02,940 --> 00:18:15,440
But isolated networks have not enough nodes or servers to make enough decentralized networks.

162
00:18:15,440 --> 00:18:20,940
So, it will make decentralization not effective.

163
00:18:21,860 --> 00:18:30,420
So, in summary, because of the air gap structure of defense network, it may be hard to adopt blockchain.

164
00:18:31,700 --> 00:18:36,560
And second challenge, first dynamic environment.

165
00:18:38,400 --> 00:18:44,580
Wherever the military goes, communication must always exist.

166
00:18:46,260 --> 00:19:05,300
Actually, it was same as the past warfare, but in modern warfare, getting information and process the information and make decisions are really important and should be fast.

167
00:19:05,300 --> 00:19:13,080
Because we should make decisions faster than enemy and move faster than enemy.

168
00:19:14,580 --> 00:19:20,480
So that we can make the superior position.

169
00:19:20,480 --> 00:19:33,080
So, anyway, for this process, communication must be followed.

170
00:19:33,080 --> 00:19:44,560
So, in this picture, in modern warfare, all of these things require communication.

171
00:19:44,560 --> 00:19:50,640
So, it means, let's see the example.

172
00:19:53,300 --> 00:20:10,980
It's map of World War II and second map is how Nazi extended their occupied territory really fast and broadly.

173
00:20:10,980 --> 00:20:17,340
And right map is how their occupied territory shrinked really fast.

174
00:20:18,080 --> 00:20:22,380
Let's see the left map.

175
00:20:22,820 --> 00:20:37,240
When Nazi extended their occupied territory, then communication system must follow all of occupied territory and cover their communication really fast.

176
00:20:41,160 --> 00:20:48,860
Even if their advance is really fast, communication and their system must follow.

177
00:20:48,860 --> 00:20:50,720
There's no exception.

178
00:20:50,720 --> 00:21:08,240
At the right map, even if their occupied territory shrinks really fast, communication system will shrink really fast.

179
00:21:08,240 --> 00:21:12,240
Anyway , just whatever is distributed throughout.

180
00:21:13,120 --> 00:21:14,960
Another example.

181
00:21:14,960 --> 00:21:17,040
It's our country case.

182
00:21:17,040 --> 00:21:21,700
It's map of Korean War in 1950.

183
00:21:22,960 --> 00:21:33,480
Before the Korean War, the territory was divided at this line, 38th parallel.

184
00:21:33,480 --> 00:21:42,480
In three months, South Korea's territory was shrinked to just two cities, Daegu and Busan.

185
00:21:42,600 --> 00:21:45,640
And we are really shrinking really fast.

186
00:21:45,640 --> 00:21:57,880
But you can see, just in two or three months, we expanded our territory till the nearly end of North Korea.

187
00:21:57,880 --> 00:22:02,200
But we retreated really fast again.

188
00:22:02,200 --> 00:22:20,050
So, what I want to say is, better ground environment is really dynamic and we can't choose and there's no exception.

189
00:22:20,130 --> 00:22:27,250
We are just first to meet situations.

190
00:22:27,370 --> 00:22:34,110
So, let's move on the blockchain.

191
00:22:34,110 --> 00:22:39,530
So, let's consider the case, sudden expansion.

192
00:22:41,110 --> 00:22:47,030
Our private blockchain network is just like PBFT.

193
00:22:48,510 --> 00:22:57,970
At the left situation, we have 8 total nodes and acceptable 30 nodes are like 2.

194
00:22:57,970 --> 00:23:15,370
But we expanded our territory really fast and we just added a lot of nodes because we should cover the occupied territory.

195
00:23:15,370 --> 00:23:19,530
Then, acceptable 30 nodes should be 12.

196
00:23:19,530 --> 00:23:28,650
But in PBFT, this kind of consensus mechanism, we need settings.

197
00:23:29,030 --> 00:23:42,590
But if this expansion is really fast and if this setting is not adapted, then it will be really easy to make consensus.

198
00:23:42,590 --> 00:23:46,270
So, past majority becomes minority.

199
00:23:46,270 --> 00:23:52,850
8 is minority of 36, so that is now your minority can make consensus.

200
00:23:53,590 --> 00:23:57,230
Another case is kind of a reverse case.

201
00:23:57,230 --> 00:23:59,790
So , let's think about sudden sharing key.

202
00:24:00,470 --> 00:24:02,890
Sharing key is this typo.

203
00:24:04,690 --> 00:24:18,950
Your original set is total nodes 36 and in PBFT, the number of acceptable 30 nodes is 11.

204
00:24:19,010 --> 00:24:23,710
But most of nodes are just destroyed.

205
00:24:23,710 --> 00:24:30,750
And then you have total nodes 8 and the number of acceptable 30 nodes should be 3.

206
00:24:30,750 --> 00:24:37,750
But you are just destroyed, so you can't make setting in the time.

207
00:24:37,750 --> 00:24:42,150
So, it will be nearly impossible to make consensus.

208
00:24:42,610 --> 00:24:50,730
So , the past minority becomes the majority in this situation.

209
00:24:50,730 --> 00:24:54,570
That is, now your majority can't make the consensus.

210
00:24:56,690 --> 00:25:00,750
So, another situation, bombing and partitioning.

211
00:25:00,750 --> 00:25:03,200
It's the last situation.

212
00:25:03,450 --> 00:25:07,890
Your nodes just can't be partitioned.

213
00:25:07,890 --> 00:25:19,650
In public blockchain, it's nearly impossible because nodes are connected by a worldwide web.

214
00:25:19,650 --> 00:25:24,220
So, it's really hard to make clear partition.

215
00:25:24,490 --> 00:25:27,250
Just divide into two partitions.

216
00:25:27,250 --> 00:25:33,690
But it's possible in VR situations.

217
00:25:33,690 --> 00:25:41,350
So , for example, you have to turn 36 nodes and partition them.

218
00:25:41,410 --> 00:25:44,210
There's no majority anymore.

219
00:25:44,970 --> 00:25:47,210
Furthermore, there's another issue.

220
00:25:47,210 --> 00:26:07,290
If you connect the partitions but they have their own blocks, especially for PVF tier deterministic consensus mechanisms, consistency will be a really big problem.

221
00:26:07,290 --> 00:26:10,550
So, we'll meet our first problem.

222
00:26:10,550 --> 00:26:17,810
In military situation, we can't just throw another information.

223
00:26:17,810 --> 00:26:21,450
We can't choose just one information.

224
00:26:21,450 --> 00:26:26,670
We need to collect all information and process and decide.

225
00:26:26,670 --> 00:26:28,790
So, it'll be a problem.

226
00:26:29,510 --> 00:26:31,750
So, it was the second challenge.

227
00:26:31,790 --> 00:26:39,270
To summarize, in more extreme situations, assumptions can be easily broken.

228
00:26:39,270 --> 00:26:43,370
Weakness can be easily revealed.

229
00:26:43,370 --> 00:26:56,530
So , especially in my examples, deterministic consensus mechanisms that cannot guarantee aliveness are real problems in these situations.

230
00:26:58,270 --> 00:27:00,410
Challenge 3, research shortage.

231
00:27:00,410 --> 00:27:04,730
Actually, it's a classical problem of blockchain.

232
00:27:05,730 --> 00:27:13,630
But I can't mention this problem.

233
00:27:13,630 --> 00:27:19,610
Blockchain's other name is state replication system.

234
00:27:19,610 --> 00:27:29,290
So, it'll replicate computation resource, storage resource, latency resource, bandwidth resource.

235
00:27:29,960 --> 00:27:40,790
But existing military system were considered existing missions and existing systems.

236
00:27:40,790 --> 00:27:49,920
So, just replicating existing performances will be a problem.

237
00:27:50,350 --> 00:27:58,750
And we adopt blockchain for missions, not missions for blockchain.

238
00:27:58,750 --> 00:28:03,330
So, influence on mission-critical functions should be checked.

239
00:28:03,330 --> 00:28:08,870
Mission-critical functions should be guaranteed and then we can adopt blockchain.

240
00:28:09,250 --> 00:28:13,030
But, yeah, first problem is resource consumption.

241
00:28:13,030 --> 00:28:14,490
Then, what is second problem?

242
00:28:14,490 --> 00:28:20,050
Second problem is serving resource consumption is not easy.

243
00:28:20,050 --> 00:28:34,870
So, if we don't have enough resources, then we should get more resources and then we need to get more systems or more resources.

244
00:28:34,870 --> 00:28:43,210
Then, we need to use defense acquisition process.

245
00:28:46,270 --> 00:29:05,670
But maybe some of you already knew that military acquisition process is really conservative and it requires really rigorous tasks and evaluation process.

246
00:29:05,670 --> 00:29:07,830
It's really heavy.

247
00:29:10,290 --> 00:29:17,610
Defense acquisition process was having developed in this way.

248
00:29:17,610 --> 00:29:31,950
So , you can see in the left picture, it's the US military acquisition system and it's really bureaucratic and conservative and really heavy.

249
00:29:31,950 --> 00:29:47,330
So, there are many articles and interviews that DOD or many countries are suffering from full defense acquisition process.

250
00:29:50,030 --> 00:30:00,930
Well, rigorous tasks and evaluations and rigorous acquisition system process is essential.

251
00:30:00,930 --> 00:30:14,710
But, it is a really big problem in cybersecurity because, you know, system is developed and vulnerabilities are always hiding.

252
00:30:16,990 --> 00:30:30,790
Vulnerabilities are just found time by time, but military acquisition system is not that rapid to react from these updates or kind of that.

253
00:30:30,790 --> 00:30:45,790
So, anyway, military bureaucratic acquisition system process, because of that, it will be difficult to solve resource consumption problem.

254
00:30:47,090 --> 00:30:50,450
So, in this situation, what can you do?

255
00:30:50,450 --> 00:30:56,970
To adopt proof-of-work, we can't waste energy.

256
00:30:56,970 --> 00:31:04,550
Of course, proof-of-stake, we don't have coins in defense system.

257
00:31:04,550 --> 00:31:16,510
And when we go to private consensus mechanism like PVRT, then we will go back to the challenge 2 again.

258
00:31:16,510 --> 00:31:22,490
It can't guarantee liveness, so it will make such extreme problems.

259
00:31:24,390 --> 00:31:35,910
So, in summary, mission is always first, but due to the military environment, support is not so timely and sufficient to adopt blockchain.

260
00:31:37,110 --> 00:31:41,840
So, next is related military projects.

261
00:31:42,050 --> 00:31:51,430
So, we surveyed 42 defense projects about blockchain and categorized as below.

262
00:31:51,430 --> 00:31:57,570
And each project can be categorized into multiple categories.

263
00:31:57,570 --> 00:32:09,090
For example, there's a research about key management about military drone system.

264
00:32:09,090 --> 00:32:16,330
Then it's categorized into internet of things and communications and identification and authentication.

265
00:32:16,990 --> 00:32:25,990
And especially data integrity category is just for data integrity project.

266
00:32:25,990 --> 00:32:34,710
It's because adopting blockchain technology is basically about data integrity.

267
00:32:34,970 --> 00:32:44,170
So, we categorized a project only about data integrity into that category.

268
00:32:44,170 --> 00:32:47,470
So, main categories are like that.

269
00:32:47,470 --> 00:32:57,640
Data integrity, supply chain management, internet of things and communications, and identification and authentication.

270
00:32:57,640 --> 00:33:18,440
So, we are somewhat careful about mentioning a project because about related project, detailed information about many real military projects are classified.

271
00:33:18,440 --> 00:33:28,740
We got information from project notification, interviews, and news articles.

272
00:33:28,740 --> 00:33:40,000
So, the information we got can be not clear or can be somewhat misunderstood.

273
00:33:40,200 --> 00:33:48,380
So, we want to notice that our comments are based on limited information.

274
00:33:50,040 --> 00:33:53,140
So, data integrity.

275
00:33:55,340 --> 00:33:58,680
For example, there are three projects.

276
00:33:58,860 --> 00:34:04,000
French military police records on Taz's blockchain.

277
00:34:04,000 --> 00:34:08,280
It's interesting that they put records on public blockchain.

278
00:34:08,680 --> 00:34:18,020
So, maybe they can avoid problems that I mentioned like the problems happening in private blockchain.

279
00:34:18,020 --> 00:34:20,720
And another example is U.S.

280
00:34:20,720 --> 00:34:28,360
DoD project sharing of defense research development testing evaluation on blockchain.

281
00:34:29,540 --> 00:34:34,440
And another project is also U.S.

282
00:34:34,440 --> 00:34:38,000
DoD provenance using blockchain on disconnected networks.

283
00:34:38,000 --> 00:34:48,400
This project is also interesting that they already considered some disconnected network situation in tactical networks.

284
00:34:51,770 --> 00:34:57,530
So, another related category is supply chain management.

285
00:34:57,790 --> 00:35:06,880
In cyber defense, supply chain management is really a big issue.

286
00:35:06,880 --> 00:35:18,140
Maybe you read Bloomberg article about microchip hacking.

287
00:35:18,320 --> 00:35:27,440
I don't know if it's true or not, but what I know is it was truly a big issue.

288
00:35:28,020 --> 00:35:34,760
And there are other articles about supply chain attacks are suspicious.

289
00:35:34,760 --> 00:35:41,220
Yeah, it's truly a really big, really important attack factor.

290
00:35:41,220 --> 00:35:43,260
And so, there's a U.S.

291
00:35:43,260 --> 00:35:51,600
DoD project about it, blockchain supply chain enhancements for trusted and assured LPGA and ASICs.

292
00:35:51,600 --> 00:36:02,580
But blockchain on supply management is actively researched for efficiency about supply chain, not only for security.

293
00:36:03,580 --> 00:36:07,640
Another category is Internet of Things.

294
00:36:08,960 --> 00:36:11,480
There's a U.S.

295
00:36:11,480 --> 00:36:21,560
Department of Homeland Security project combining blockchain technology with critical infrastructure.

296
00:36:21,560 --> 00:36:34,950
This project is about sensors and cameras that protect integrity and authenticity of critical infrastructure.

297
00:36:34,950 --> 00:36:46,530
This project is about IoT, so we can just relate it to Challenge 3 research series.

298
00:36:46,530 --> 00:36:57,450
But I think the infrastructure is not dynamic, so it can be adaptable, I think.

299
00:36:58,450 --> 00:37:10,630
So, in communication category, there's a DARPA project building an encrypted message system based on blockchain technology.

300
00:37:13,110 --> 00:37:25,370
I think it's about tactical networks, so I don't know the detailed information, but if it is related to messages in tactical networks.

301
00:37:25,370 --> 00:37:31,130
Challenge 2, first dynamic environments, and Challenge 3 research series should be considered.

302
00:37:31,130 --> 00:37:33,310
Maybe they will be considered.

303
00:37:34,570 --> 00:37:42,430
For identification and authentication, there are two projects.

304
00:37:42,430 --> 00:37:44,470
For example, a U.S.

305
00:37:44,470 --> 00:37:48,870
DHS project decentralizes KME management using blockchain.

306
00:37:48,870 --> 00:37:53,590
There's a South Korea project

307
00:37:57,070 --> 00:38:01,030
blockchain -based DID.

308
00:38:01,030 --> 00:38:11,930
But maybe some of you noticed, some of these projects are not domain-specific.

309
00:38:11,930 --> 00:38:16,550
I mean, it's not just only for cyber defense.

310
00:38:16,550 --> 00:38:20,570
Many projects are just general.

311
00:38:20,570 --> 00:38:34,190
But for this project, especially identification and authentication, the decentralized key management and DID is not only military issue, not only cyber defense.

312
00:38:34,190 --> 00:38:37,610
So maybe they are not interesting.

313
00:38:38,170 --> 00:38:45,070
So, related projects in my examples are like that.

314
00:38:45,070 --> 00:38:52,530
Lines mean that projects are not domain-specific.

315
00:38:54,210 --> 00:39:04,470
I'm interested in blockchain specifically for cyber defense.

316
00:39:04,470 --> 00:39:10,530
So I'm still surveying about this topic and I'm preparing a paper.

317
00:39:13,140 --> 00:39:21,580
Actually, I think I criticized a lot with just question this topic and introduced challenges.

318
00:39:21,580 --> 00:39:25,580
But then some can ask, then what are alternatives?

319
00:39:26,280 --> 00:39:32,280
What I want to say is we don't need to choose a perfect blockchain structure.

320
00:39:32,280 --> 00:39:45,720
As I mentioned at the first part of this talk, blockchain is constructed by three concepts.

321
00:39:45,760 --> 00:39:48,580
As a data structure, hash chain blocks.

322
00:39:48,580 --> 00:39:52,040
And as a network structure, distributed network.

323
00:39:52,040 --> 00:39:56,020
And as a consensus structure, decentralized consensus.

324
00:39:56,020 --> 00:40:01,140
But you can just give up one concept or two concepts.

325
00:40:01,140 --> 00:40:07,940
Maybe you only need distributed network and penalized networks.

326
00:40:07,940 --> 00:40:18,220
So what I need to do is figure out problems and figure out right solutions.

327
00:40:18,220 --> 00:40:27,300
Not just decide to use blockchain and figure out which blockchain is adaptable.

328
00:40:28,800 --> 00:40:35,520
So to summarize, takeaway are three.

329
00:40:35,520 --> 00:40:41,700
Cyber defense makes more challenges and requirements for blockchain.

330
00:40:41,820 --> 00:40:45,820
Error gaps, sudden expansion, shrinkage, partitioning.

331
00:40:46,680 --> 00:40:49,860
Extreme situation can exist.

332
00:40:51,700 --> 00:40:57,460
Second, blockchain's resource consumption can be a problem.

333
00:40:57,460 --> 00:41:04,020
But defense environments are not that flexible to assign more resources.

334
00:41:05,980 --> 00:41:11,880
Third, we don't need to cling to blockchain if it's not adaptable.

335
00:41:11,880 --> 00:41:15,320
Otherwise, it will bring more issues.

336
00:41:15,320 --> 00:41:19,220
So it's all of my talk.

337
00:41:19,360 --> 00:41:22,920
And get in touch to these emails.

338
00:41:22,920 --> 00:41:26,780
We welcome any questions and discussions.

339
00:41:27,000 --> 00:41:37,650
And I think this presentation will be uploaded somewhere so you can see our emails.

340
00:41:38,650 --> 00:41:46,250
So thank you for your attention and thank you again.

341
00:41:46,250 --> 00:41:47,650
Any questions?

342
00:42:27,170 --> 00:42:29,370
Is there a question?

343
00:42:41,810 --> 00:42:48,210
If you can't ask now, then you can just send email or send message to Discord.

344
00:42:48,840 --> 00:42:53,340
Any questions and discussions are welcome.

345
00:43:04,070 --> 00:43:05,490
Okay, then.

346
00:43:05,490 --> 00:43:06,910
Thank you.

347
00:43:06,910 --> 00:43:12,430
Then I can just quit the live streaming, right?