abstract: We extend a simple model of a charge trap coupled to a single-electron box to energy ranges and parameters such that it gives new insights and predictions readily observable in many experimental systems. We show that a single background charge is enough to give lines of differential conductance in the stability diagram of the quantum dot, even within undistorted Coulomb diamonds. It also suppresses the current near degeneracy of the impurity charge, and yields negative differential lines far from this degeneracy. We compare this picture to two other accepted explanations for lines in diamonds, based respectively on the excitation spectrum of a quantum dot and on fluctuations of the density-of-states in the contacts. In order to discriminate between these models we emphasize the specific features related to environmental charge traps. Finally we show that our model accounts very well for all the anomalous features observed in silicon nanowire quantum dots.
author: M. Pierre; M. Hofheinz; X. Jehl; M. Sanquer; G. Molas; M. Vinet; S. Deleonibus
date: 2024-09-30
title: Background charges and quantum effects in quantum dots transport spectroscopy

# Introduction

The diversity of nanostructures available for physicists to perform transport experiments at low temperature has grown considerably in the last decade. Following pionnering works on single-electron transistors (SETs) and quantum dots in the early 90's, it is now very common to observe and analyze Coulomb blockade in novel structures such as carbon based electronics or semiconducting nanowires. We have developped in the past a silicon nanowire MOSFET which turns into a remarkably stable and simple SET below approximately 10 K. As it is widely accepted that background charges in the vicinity of the Coulomb island or the tunnel barriers are responsible for the large 1/f noise observed in many SETs, we developped a model based on a single charge trap capacitively coupled to the SET. This picture has been considered before in metallic single electron transistor, but without predictions for the Coulomb blockade spectroscopy . A peculiarity of our model is that the charge trap energy is not only sensitive to both source-drain and gate voltages, but also to the dot occupation number, because of the capacitive back-action of the dot upon the trap. We have shown that solving the rate equations for this model gives the same sawtooth pattern than observed experimentally . Sawtooth-like distortions of Coulomb diamonds are widely reported in the literature of quantum dots, for instance in carbon nanotubes SETs , graphene , molecules in gaps or epitaxial nanowires . As the data published on Coulomb blockade transport spectroscopy, either from us or other groups, have released more and more details, we have pushed our model further in order to see if the features observed by experimentalists and usually attributed to other effects can also arise from our model. The most common feature is certainly lines of differential conductance above the blocked region, parallel to the diamonds edges. These lines are often observed in undistorted diamonds, therefore one can conclude that our Background Charge (BC) model cannot apply in this case, as it predicts a clear distortion of the pattern. In this work we show that with the right choice of capacitive couplings our BC model does predict these lines in Coulomb spectra. It also gives negative differential conductance lines in a natural way without introducing adhoc hypothesis. We compare the BC model to the excitation spectrum (ES) model and the density of states (DOS) fluctuations model which are both usually invoked to explain such lines. We explain in details the origin of the most important features predicted by the BC model, the differences between the 3 models and how they can be distinguished. Finally we report data on silicon nanowire transistors where the traps are implanted arsenic dopants. We observe lines of differential conductance which are well reproduced by the BC model.

# The background charge model

In this paper we consider the general case represented in figure of a quantum dot connected to a source, a drain and a control gate allowing to shift its electrostatic energy. In addition a charge trap occupied by 0 or 1 electron is located nearby. The current through the trap is negligible compared to the main current through the dot but the trap is weakly coupled by tunneling barrier to one contact and to the dot to allow its electron occupation to toggle between 0 and 1 electron. The energy of the trap is also fixed by the same gate voltage used to control the dot, but with a different capacitive coupling. This purely electrostatic model is a particular case of coupled quantum dots . We chose arbitrarily to locate the trap on the source side. The source is grounded and a transport voltage is applied to the drain ($V_d$). We neglect any energy dependence of the tunnel transparencies. The dots are neither simply in series, as there is a finite transparency between the source and the dot, nor in parallel as there is no direct source-drain current via the trap. The electrostatic model is fully characterized by the capacitive couplings (see Fig. ): $C_\mathrm{mn}$ is the capacitance between m and n where m,n=d (dot), t (trap), s (source), dr (drain) or g (gate). $C_\mathrm{t}= C_\mathrm{td}+ C_\mathrm{st} +C_\mathrm{gt}$ is the total capacitance of the trap. $C_\mathrm{d}= C_\mathrm{td}+ C_\mathrm{sd} +C_\mathrm{drd} +C_\mathrm{gd}$ is the total capacitance of the dot. We consider sequential tunneling events driving the system into a finite number of states, defined by $(\mathrm{N}_\mathrm{dot},\mathrm{N}_\mathrm{trap})$, the occupation numbers of the dot and trap. We deduce the drain-source current from the stationary occupation probability of the trap and the probability distribution of each charge state in the dot calculated with the rate equations. It is possible to null the dot-trap or source-trap current without changing the conclusions. This does not change the electrostatic scheme but changes the resulting differential conductance lines (not discussed here). The reference of electrostatic energies is arbitrary and does not affect our model which implies only energy differences between configurations.

Figure  shows the result for $C_\mathrm{gt}$, $C_\mathrm{gd}$, $C_\mathrm{td}$, $C_\mathrm{st}$, $C_\mathrm{d}$ $= 0.004$, $16$, $1$, $2$, $117$ aF respectively i.e. for very small trap-gate capacitance. The current via the trap is 1 pA, to be compared with the dot-source and dot-drain conductances of $0.1\,\frac{ e^{2}}{h}$ (0.4 nA for $V_{d} = 10^{-4}\,\mathrm{V}$). The level arm parameter for the trap, $\alpha_{t}= \frac{ C_\mathrm{gt} }{ C_\mathrm{t}} \simeq 0.0013$ is very small, about 10 times smaller than in ref. . The number of successive distorted Coulomb diamonds increases as $\alpha_{t}$ decreases. A small $\alpha_{t}$ means that the trap is much less sensitive to the gate voltage than to the dot occupation and drain voltage. As we will see later the limit $\alpha_{t}\rightarrow 0$ is similar to the DOS model. A small $\alpha_{t}$ also implies that the differential conductance lines are parallel to the diamond edges. We have checked that larger $\alpha_{t}$ gives different slopes. We set to 0 volt the degeneracy point where the trap mean occupation number is $\frac{1}{2}$. Near this point we observe distorted Coulomb diamonds: two replicas appear, corresponding to the two charge states of the trap. The shift in gate voltage for the replicated diamond is given by $\Delta
  V_\mathrm{g} = \frac{e C_\mathrm{td}}{C_\mathrm{gd}C_\mathrm{t}}$. The largest distortion $\Delta
  V_\mathrm{g} \simeq \frac{e}{2 C_\mathrm{gd}}$ occurs when $C_\mathrm{st}= C_\mathrm{td}$ . This occurs if the trap has equal couplings to source and dot. If the trap is more coupled either to the source or to the dot the apparent shift is reduced.

A very important point is that the drain current vanishes at small bias near the degeneracy point, when the diamonds are replicated. Figure illustrates the physical origin of the effect: Starting from $V_g=0\,\mathrm{V}$ at small bias ($V_d \simeq 0\,\mathrm{V}$) when the gate voltage increases an electron is transferred from the trap onto the main dot. This corresponds to the (N-1,1)$\rightarrow$(N,0) transition (left square in figure ), which occurs before the (N-1,1)$\rightarrow$(N,1) transition (circle on figure ) because of the repulsion by the charged trap. This charge exchange between the trap and the dot does not give any drain-source current. More complex sequences with the same initial and final states and an intermediate state could in principle give a finite current. First, co-tunneling events are not taken into account. One could also expect an extra electron to tunnel first from the source onto the dot, then the trap releasing its electron to the source. Alternatively the latter could happen first, then an electron could tunnel from source to dot. However both sequences involve intermediate states too high in energy ((N,1) and (N-1,0) respectively), and therefore are forbidden. For the same reason, once in the (N,0) state it is impossible for an electron to exit the dot into the drain, because the (N-1,0) state is too high in energy at this gate voltage. Increasing the gate voltage further, the system reaches the (N,0)$\leftrightarrow$(N,1) degeneracy (right square in Figure ). At this point the source can release an electron to the trap. This second transition at constant number of electrons in the dot does not yield any source-drain current. In summary the (N-1,1)$\rightarrow$(N,1) transition has been replaced by the (N-1,1)$\rightarrow$(N,0)$\rightarrow$(N,1) sequence where the trap occupation oscillates in gate voltage by successive transfers from the source and into the dot. In this gate voltage range the only way to recover a drain current is by applying a sufficient bias to allow N-1 or N electrons on the dot. Although a comparable situation has been described qualitatively in Ref. , our calculations do not predict the 'kinks' they observe, but replicas instead.

Far from the trap degeneracy ($V_g \gg 0\,\mathrm{V}$), our model recovers undistorted Coulomb diamonds, as shown in Figure . Drain current is restored at low bias as (N-1,1)$\rightarrow$(N,1) is now the lowest energy transition. More interestingly, our model predicts lines of differential conductance in the non blockaded regions, both negative and positive, as readily visible in Figure  and shown in more detail in Figure . At some bias, the mean occupation of the trap is allowed to vary. The system can therefore be in various charge states, implying different total conductances, hence maxima of differential conductance. We now discuss in more detail the origin of a negative differential conductance line between regions labeled *a* and *c* in Figure . As mentionned before, in both of these regions (N-1,1)$\leftrightarrow$(N,1) transitions are allowed and responsible for a finite drain current. In addition, the (N-1,1)$\rightarrow$(N,0) transition is possible only in region *c*, allowing the trap to transfer its electron to the dot. Whenever this event happens no current passes through the dot anymore until the trap is filled again by an electron from the source. The latter event is much slower than tunneling between source, dot and drain, so the current is smaller in region *c* than in *a* and therefore the differential conductance is negative. The (N,0) state (trap empty) is a "dark state" blocking the current through the dot. We have checked that slowing the (N,0)$\rightarrow$(N,1) transition by decreasing the source-trap tunneling rate reduces further the current in region *c*.

The main conclusion of this study over a large gate voltage range (Figure ) is that both the negative differential conductance lines far from degeneracy and the suppression of current at low bias near degeneracy have the same origin, namely the electrostatic interaction between the trap and the dot. This effect can be exploited to build Coulomb blockade rectifiers suggested in ref. .

# Comparison with the ES and DOS models

Usual explanations for lines parallel to the edges of Coulomb diamonds are based on the ES or DOS models. Transport excitation spectra have been investigated in much detail and their modification due to the Zeeman effect , photons or phonons are widely observed in the Coulomb blockade stability diagram of quantum dots.

The ES Model is based on the existence of a resolved excitation spectrum because of the quantized kinetic energy of electrons confined in a small volume. It requires a temperature much lower than the mean energy level spacing $\Delta$. We illustrate how lines appear in this model in figure . The left panel is the orthodox model simulation of a quantum dot with $\Delta\ll k_BT$. The charging energy is constant and equal to 1.38 meV ($C_d = 116\,\mathrm{aF}$). The right panel corresponds to a dot with the same charging energy, at the same temperature but with 4 electrons occupying 4 non degenerate orbital states with spacings of 0.4, 0.3 and 0.1 meV respectively. Positive differential conductance lines appear. In this constant charging energy model the one-particle excitation spectrum shifts between successive diamonds as levels get occupied, the first excited state for N electrons becoming the ground state for N+1 electrons. Very often scrambling of the one-particle spectrum after adding electrons is observed but recently a clear correlation between successive diamonds has been reported . The absence of scrambling is interpreted as the absence of variation of the dot shape when adding electrons. That requires a steep enough confinement potential, for instance sharp etched edges. In the ES model it is natural to expect only positive differential conductance lines because excited states (at higher energies than ground states by principle) are more tunnel coupled to the electrodes. If equal tunneling rates are supposed for the ground and excited states, as done in Figure , then differential conductance is always positive. To observe negative differential conductance within the ES model the excited state must be less conducting. This could occur because of a specific fluctuation of the wavefunction envelop, a selection rule , a blocking state or Stark effect .

The DOS model is appropriate if the very same pattern is observed in successive diamonds , in strong contrast with the ES model, because the energy in the electrodes does not depend on the gate voltage. In this model the source-drain current is proportionnal to the local density of states $\nu_{S,D}(E)$ in the source and drain. If for simplicity we suppose that the conductance is dominated by source-dot tunnel barrier, then $G(V)\propto {\frac{d\nu_{S}}{dE}}$. In that case lines of differential conductance are expected to be parallel to the negative slope edge of the Coulomb diamond. This edge corresponds to the alignment of the last unoccupied level in the dot with the Fermi level in the source. In the opposite case of a dominating dot-drain barrier the lines will be parallel to the positive slope and $G(V)\propto{\frac{d\nu_{D}}{dE}}$.

In heavily doped semiconducting electrodes, just like in any diffusive reservoir, the local DOS fluctuates with the energy because of quantum interferences of elastically scattered quasi-particles diffusing coherently within a length scale related to their lifetime at a particular energy . The characteristic energy for these fluctuations is set by the inverse of the quasi-particle relaxation time, which decreases as the energy moves away from the Fermi energy. The local DOS fluctuations increase when the diffusion coefficient $D=\frac{1}{d} v_{F}^{2}\tau$ decreases, with $d$ the dimensionality of the electrodes, $v_{F}$ the Fermi velocity and $\tau$ the elastic mean free time. Indeed a very large $D$ corresponds to a near perfect electronic reservoir without local fluctuations of the DOS. The local DOS fluctuations are reinforced in small, confined geometries. If the trap considered in our model gets closer to the source, at some point electronic orbitals in the source and trap will overlap and a strong local fluctuation of the DOS appears due to hybridization. Then the energy of the trap depends less and less on the gate voltage. Therefore there is a continuous evolution from the DOS model (which is a purely quantum mechanical model) to our electrostatic model when increasing the trap-electrode distance. The DOS model can explain other features which cannot be understood within the ES model . First the DOS model naturaly explains negative differential conductance lines, as the sign of $\frac{d \nu_{S}}{dE}$ changes. In average one expects as many positive and negative differential conductance lines. Also the DOS model, can explain lines pointing to energies below the first available level in the dot. Such lines cannot arise from the ES model, as shown in the first diamond in the right panel of Figure .

Our model differs from the ES and DOS models by the 3 following facts. 1) Lines are shifted progressively from one diamond to the next, in contrast to both ES and DOS models. 2) Lines coexist with sawtooth distortions (replicas) of diamonds at different gate voltages. 3) Negative differential conductance appears at finite bias voltage together with anomalously small current at low bias in distorted diamonds. Like the DOS model it explains why lines can appear at energies extrapolated below the ground state of the artificial atom. Finally our model, unlike both ES and DOS models, can explain lines not parallel to the diamond edges (if $\alpha_{t}$ is large) .

# Silicon Quantum dot with arsenic donor as a trap

We originally developped our model for silicon nanowire transistors with implanted arsenic traps in the tunnel barriers . Here we report new data recorded in similar samples which clearly show the correlations in successive undistorted Coulomb diamonds predicted by our model. Fig. b shows a typical stability diagram with a pattern of differential conductance lines very weakly dependent on the number of carriers in the dot. This weakly shifted pattern is a characteristic signature of our model for traps much more coupled to the source (or drain or dot) than to the gate. The samples are described in ref. and schematically drawn in Fig. a. They are SOI-MOSFETs adapted in terms of doping to become controlled SETs at low temperature. A 20 to 80 nm wide wire is etched to form the channel. The source and drain parts of the wire are highly doped to form good metallic reservoirs (As, $\simeq 10^{20}\,\mathrm{cm}^{-3}$). The central part of the wire is covered by a 40 nm poly-Si gate electrode, isolated by Si0$_\mathrm{2}$, and self-aligned silicon nitride spacers (35 nm long) are deposited on both sides of the gate (rounded walls in Fig. a). The part of the wire below the gate and spacers (light gray regions on Fig. a) is only lightly doped (As, $5\times 10^{17}\,\mathrm{cm}^{-3}$), so that at low temperature it forms an insulator. However directly below the gate electrode it can be tuned into a metallic state by applying a positive gate voltage. That way a quantum dot is formed under the gate. The tunnel barriers are the low-doped parts of the wire adjacent to the dot. The arsenic dopants inside these tunnel barriers are weakly capacitively coupled to the gate and are the traps considered in our model. Well centered donors give replica for the diamonds . There is a gradient of Arsenic concentration (typically one order of magnitude for a 5 nm lateral distance in our process) at the border between the source-drain and channel. Many arsenic donors are located close, and are therefore well coupled to the source or drain. Such donor have a small lever arm parameter $\alpha_{t}$ and give undistorted diamonds with lines of differential conductance. Donors which are strongly coupled to the dot (due to electrostatic bending of the impurity band below the gate edges) produce the same effect.

We performed our measurements at 350 mK in a $^\mathrm{3}$He refrigerator and measured the differential conductance with a standard ac lock-in technique. At this temperature we do not expect to resolve the quantum levels in the dot. The mean energy level spacing $\Delta$ between quantum states is the largest for small dots at low gate voltages where only a 2D electron gas is formed at the surface of the channel. In this limit we expect $\Delta_\mathrm{2D} \sim \frac{2 \pi \hbar^2}{d m^* A} \sim
150\,\mu\mathrm{eV}$, with $d=4$ the spin and valley degeneracy, $m^*=0.19\,m_e$ the 2D effective mass, and $A \simeq
4000\,\mathrm{nm}^2$ the total surface area of the gate/wire overlap, including the flanks of the wire. As the dot gets filled, the electron gas eventually fills up the whole volume of the wire below the gate and $\Delta$ falls below $20\,\mu\mathrm{eV}$. Quantum levels can only be resolved when $\Delta$ is larger than the width of the resulting lines of differential conductance. These lines have a full width at half maximum of approximately $3.5\,k_\mathrm{B}T \sim 100\,\mu\mathrm{eV}$ given by the Fermi distribution in the leads. For the large gate voltages shown in figure  we are in the high density regime where $\Delta$ is too small to play a significant role. Therefore the sharp lines of differential conductance seen on figure   cannot be explained within the ES model. The lines have a typical energy separation of 1 meV, much larger than the calculated mean spacing of $20\,\mu\mathrm{eV}$. They are also observed at larger energy than expected in the DOS model. In our samples the reservoirs are highly doped silicon wires in which the mean level spacing is very small, and local DOS fluctuations have a correlation in energy of the order of the inverse inelastic time $\simeq 1\,\mathrm{ns}$ (${\frac{h}{\tau_{in}}} \simeq  4\,\mu\mathrm{eV}$) at T=1K in heavily doped silicon .

In summary, unlike the ES and DOS models, our model explains quantitatively the weakly shifting lines between successive diamonds measured in Figure b, with a trap located on the drain side of the dot. Figure c shows the result of the simulation with $C_\mathrm{gt}$, $C_\mathrm{gd}$, $C_\mathrm{td}$, $C_\mathrm{drt}$, $C_\mathrm{d} = 0.006$, $13.3$, $0.4$, $0.046$, $53.3$ aF.

# Conclusions

We have extended a simple electrostatic model of a charge trap coupled to a dot to the case of very weak coupling to the gate. In this regime new features are predicted over a large gate voltage range. Near degeneracy of the trap the sawtooth pattern calculated in a previous work is recovered and the current suppression at low bias voltage is understood in more detail. We obtained new features far from this degeneracy, where Coulomb diamonds are not distorted. Lines of differential conductance appear in the diamonds, very similar to the ones usually attributed excited states, although our model does not involve a discrete spectrum for the dot. These differential conductance lines can be positive or negative, and parallel to either edge of the diamond. They also evolve very weakly with gate voltage, an original feature not predicted by other models. Our model easily accounts for negative differential conductance lines, a feature usually attributed to density-of-state fluctuations in the contacts. This model and ours are converging when considering a trap located very close to the electrodes, as hybridization occurs and coupling to the gate goes to zero. Although the most basic signature of our model is the sawtooth pattern and associated current suppression, we emphasize that its experimental observation is not required to validate our charge trap scheme. Indeed lines can very well be observed in undistorted diamonds while the degeneracy region remains out of the energy range which can be probed experimentally.

Even though our model involves only a single trap occupied with zero or one electron and a dot treated in the orthodox model, it already gives a complicated pattern of lines and features in the stability diagram. It provides a quantitative but simple way to simulate the Coulomb blockade spectroscopy of quantum dots, and shows the great impact of a single charge on this spectrum. Further extensions like several traps, resolved mean one-particle level spacing in the dot, non-negligible current through the trap, double occupation of the trap, Zeeman effect on the trap energy can be implemented in the near future. As more and more nanostructures designed for transport experiment exhibit Coulomb blockade, our model could account for many features observed experimentally as the presence of charge traps is very realistic.


author: J.M.Deutsch
University of California, Santa Cruz, U.S.A.
title: Equilibrium size of large ring molecules

The equilibrium properties of isolated ring molecules were investigated using an off-lattice model with no excluded volume but with dynamics that preserve the topological class. Using an efficient set of long range moves, chains of more than 2000 monomers were studied. Despite the lack of any excluded volume interaction, the radius of gyration scaled like that of a self avoiding walk, as had been previously conjectured. However this scaling was only seen for chains greater than 500 monomers.

truein

# Introduction

The effects of topology on the equilibrium properties of polymer systems is important both experimentally and theoretically to the understanding of polymeric materials. Many experimental systems, for example as polymer networks, possess non-trivial topology. Furthermore DNA is often in the form of a ring and possesses a well defined and non-trivial topology. This fact has important biological implications. Topological effects arise because a polymer chain cannot cross itself and is therefore confined to a fixed topological class that depends on its initial configuration. However the effects of topology are, in theory, very hard to understand. The simplest example is that of the ring polymer. Even when it is in the state of a "trivial" knot, that is the same topological class as a circle, its statistical properties have not as yet been well understood. This is because there are an infinite number of invariants that characterize a knot and so evaluating, or even writing down, the partition function is a daunting task. Questions about this system, such as how radius of gyration $R_g$ scales with chain length $N$, have not been answered with any certainty. The effects of topology on the size of a simple ring has been conjectured to give the same scaling exponent $R_g \sim N^\nu$, as excluded volume chains. It is not clear that $\nu$ should be identical to that of the self avoiding chain. Topological effects may induce effective power law interactions between monomers in the ring. In this paper, we wish to analyze how topology alters the fractal dimension of a polymer ring.

To simulate polymers, lattice models have often been employed because in many circumstances they are more efficient and easier to implement than off-lattice models. However a large class of lattice models with local dynamics have been proven to be strongly non-ergodicsokal. Even if an ergodic model is usedquake some of the subtle effects of topology that we wish to examine here can be masked by this kind of model. To avoid segments crossing, which would violate topology, lattice models add in a hard core repulsion. This makes analysis of the results difficult because this repulsive potential must also be taken into account. The same can be said for many off-lattice models that include repulsive potentials between the monomers of the ring. Again this has the problem of masking delicate topological effects making results difficult to interpret.

Therefore it would seem worthwhile to explore an off-lattice model whose interactions are purely topological. The idea is to isolate topological effects to gain some understanding as to how they effect statistical properties.

To achieve this goal we explore topological effects numerically using an efficient off-lattice algorithm which *has no excluded volume*. The chain is a phantom chain, except that it is not allowed to cross itself and therefore can explore only one topological class. As mentioned above, this differs from other work in this area where excluded volume was also present. An efficient long range algorithm is developed that allows the exploration of rings up to $2048$ links. In addition, the chain is more flexible than chains on a cubic lattice which as we will see is important in light of the results that were obtained.

What was found is rather surprising. We did find that phantom ring polymers confined to the "trivial knot" are swollen with respect to phantom linear chains. But even with these very flexible chains, the effect of topology is rather weak, and rings must be longer than $500$ links before the scaling exponent $\nu$ appears to reach that of a self avoiding walk (SAW).

# The Model

The model is illustrated in figure . A chain in three dimensions of $N$ links, all of equal length, is constructed so as to have the topology of a simple ring. All configurations are of equal energy, however moves must not be allowed to alter the topological class. That is, the chain is not allowed to cross itself.

To investigate the dynamics of small chains, moves were chosen that were local, involving rotations of two adjacent links. Moves of this type are illustrated in figure , where links initially adjacent to A are moved to locations shown by the dashed lines by B. The relaxation time with such moves is slightly greater than $N^2$ which is prohibitively long for chain lengths in the thousands. Therefore a long range algorithm was used instead.

A long range move is illustrated in the same figure. It is a variation of a pivot algorithm. To construct a new conformation, the algorithm attempts to rotate the chain about some axis. Two points C and D are chosen randomly from the backbone of the chain and the line going through C and D is defined to be the axis of rotation. An angle is chosen randomly between $-90$ and $90$ degrees and all chain segments between C and D are rigidly rotated about this axis. If the ring is found to cross itself as chain segments are being rotated, the move is rejected, otherwise it is accepted.

These long range moves are repeated millions of times and the radius of gyration was averaged.

The simulation was tested by starting two rings in a locked configuration and checking to see that they never became unlocked. This test was performed for over $10^8$ cycles and always remained locked. The simulation was further tested by taking a long ring of length 512, after it had moved many million cycles, and turning on a repulsive coulomb potential. It was always found that the ring would swell up into what could clearly be seen as being a circle, in other words a trivial knot. This contrasted with what happened when a deliberately knotted ring was swollen. There the final configuration was not circular.

The simulation was checked by allowing the ring to cross itself by turning off the checking algorithm. In such a case it is easy to show that $R_g^2 = N/4$, when $N >> 1$. The results found agreed with this value within statistical error. With the crossing constraint enforced, the radii of gyration were always larger than this value.

# Results

The radius of gyration defined as $$R_g^2 \equiv {2\over N} \sum_{i=0}^{N/2-1} |{\bf r}_{i+N/2}-{\bf r}_i|^2$$ was examined by averaging over millions of iterations. Here $\bf r_i$ is the vector position of the ith monomer, and N is the total number of links in the ring.

Figure shows the $R_g^2$ as a function of chain length. The best fit to this line gives an exponent of $1.11 \pm 0.03$. However the best fit for the last two data points at $N ~=~ 1024$ and $N ~=~ 2048$ is an exponent of $1.17$ close to the result $1.175$ found for an SAW in three dimensions. Because this only involves two data points, the up turn is not statistically significant so we now further analyze this possibility by probing the internal structure of the rings.

The self similarity of these rings was examined by means of the correlation function $$g(s) \equiv {1\over N-s} \sum_{i=0}^{N-s-1} |{\bf r}_{i+s}-{\bf r}_i|^2$$ Figure examines how this scales with chain length by writing $g(s)$ in the scaling form $$g(s) = N^\nu f_N(2s/N)$$ The function $f_N(x)$ should become independent of $N$ for large enough $N$. In fig , we plot $f_N(x) \equiv  g(s)/N^\nu$ as a function of $x \equiv 2s/N$. This is done for three different chain lengths, $N=$ $512$, $1024$, and $2048$. $\nu$ was chosen to be $1.17$. Note that only the two longest chain lengths overlap. In order to get the $512$ link ring to overlap with $N=2048$ , a smaller value, $\nu = 1.11$ must be chosen. This suggests that the rings of length $512$ are not long enough to be in the asymptotic scaling regime.

# Discussion

The results above confirm the prediction that $\nu$ for a polymer ring in a trivial knot, is swollen compared to an ideal chain. What is surprising is that the length of chain needed to clearly see its asymptotic fractal dimension are in the thousands of links. This contrasts with a self avoiding walk, where $\nu$ can be calculated from chain lengths in the teens to quite high accuracy.

Fairly compelling arguments have been given to why $\nu_{ring}$ for a trivial ring should be greater than or equal to $\nu_{SAW}$ for a linear SAW. It is still an open question as to whether $\nu_{ring}$ is actually *greater* than $\nu_{SAW}$. There is no answer to this that is available at present. However if the ring is trapped between to parallel plates, then this is amenable to a fairly convincing analytical argument. It is argued here that when the separation between the plates is very small, so that the walk is almost two-dimensional, that the exponent must be less than or equal to $\nu$ for an SAW in two dimensions. This taken with the argument that $\nu_{ring} \ge \nu_{SAW}$, which carries over to this case also, we can conclude that $\nu_{ring} = \nu_{SAW}$.

If the separation between the two walls is much less than the length of a link, then the chain is essentially confined to a two dimensional x-y plane. However besides the coordinates of the monomers we also must keep track, in a crossing between two links, of which one lies on top. If we want the ring to preserve the initial topology of a trivial knot, some configurations where the chain crosses itself in the x-y plane must be excluded. Essentially the only configurations that are allowed are those of a flattened trivial knot. Therefore the phase-space of all configurations are the coordinates in the x-y plane, and the type of crossing of which there are two possibilities.

If in addition to the topological constraint, we introduce a fictitious repulsive potential between links in the chain, it seems highly plausible that this can only increase the average radius of gyration of this system. In the limit of complete excluded volume, no crossing is allowed, and this system is identical to the usual self avoiding ring. This is because complete excluded volume implies that there is no crossing allowed at all, and this by itself enforces the topological constraint. Therefore the radius of gyration of the ring without the repulsive potential should be less than or equal to that of a two dimensional SAW.

In three dimensions the numerical results presented here are consistent with an exponent less than or equal to that of an SAW. However one cannot exclude the possibility that at even longer chain lengths, a ring becomes more swollen than a linear SAW. Until a better theoretical understanding of knots has been achieved, it is not possible to exclude this possibility.

It is surprising that scaling behavior has not yet reached asymptotic behavior for chains of length $512$ as the model we have used allows for the formation of nontrivial knotted chains even for rings of $6$ monomers. However this work is consistent with enumeration of knot types for random phantom rings where the mean number steps needed to observe a nontrivial knot was of order hundreds of steps.

From an experimental view point, the rings analyzed here are large but easily achievable experimentally. A linear chain in good solvent could be synthesized with functional end-groups that chemically bond in good solvent. This should create a rings that are predominantly trivial knots. By changing solvent conditions to those of theta solvent for linear chains, one should observe that these rings are still swollen, albeit far less so than a linear chain in good solvent.

Ring polymers in other situations, are conjectured to have many interesting properties. For example, a melt of rings, and this is the subject of active investigation. It might be useful to apply the model described here, to these other systems.

# Acknowledgements

This work is supported by NSF grant number DMR-9419362 and acknowledgment is made to the Donors of the Petroleum Research Fund, administered by the American Chemical Society for partial support of this research.


abstract: We discuss the development of a Java toolbox for astronomical time series data. Rather than using methods conventional in astronomy (e.g., power spectrum and cross-correlation analysis) we employ rule discovery techniques commonly used in analyzing stock-market data. By clustering patterns found within the data, rule discovery allows one to build predictive models, allowing one to forecast when a given event might occur or whether the occurrence of one event will trigger a second. We have tested the toolbox and accompanying display tool on datasets (representing several classes of objects) from the RXTE All Sky Monitor. We use these datasets to illustrate the methods and functionality of the toolbox. We also discuss issues that can come up in data analysis as well as the possible future development of the package.
author: Eric Perlman, Akshay Java
title:  Predictive Mining of Time Series Data in Astronomy

#  Introduction

Many types of variable objects exist in the universe, including stars with predictable behavior (e.g., Cepheids), objects with behavior that is inherently unpredictable (e.g, AGN), and objects with both predictable and irregular variability patterns (e.g., X-ray binaries). Constant monitoring of variable objects has been a continuing interest in astronomy, beginning with 16th century astronomer David Fabricius, and extending through history to Herschel, Leavitt and others. Today, monitoring is done by a wide variety of techniques, observers and instruments, from dedicated amateurs, to professional astronomers interested in intensive monitoring of individual objects, to all-sky monitors such as the RXTE ASM and BATSE aboard CGRO.

While they are a new tool, already all-sky monitors have have made important, if not decisive contributions to solving some of astronomy's most persistent mysteries, such as the cosmological origin of gamma-ray bursts and linking emission regions in AGN. With major initiatives such as the Large-Area Synoptic Survey Telescope (LSST) and Supernova Acceleration Probe (SNAP), all-sky monitors are poised to become a major discovery tool in astronomy. To maximize the utility of large monitoring programs, it is important to devise ways of handling large amounts of data in real time and find not only variability but also predictive patterns among these large data streams. It was with these goals in mind that we undertook this project.

# Clustering and Rule Discovery

The need to understand time series data is not unique to astronomy: time series data exists in a wide variety of fields including geology and atmospheric science as well as many business applications. The common problem is how to efficiently find patterns in the data. Fourier transform and power spectrum methods, commonly used in astronomy research, are well suited for finding patterns with well-determined periodicities (e.g., see Scargle 1997). However they may be less helpful for objects with irregular behavior, and are not optimized to serve as predictive tools. Our approach was to employ clustering and rule discovery, which are optimized for finding patterns that do not rely on a regular periodicity.

We first attempt to represent the dataset as a collection of patterns, by sliding a window of size through the time series to get subsequences. We then cluster these points using the greedy clustering algorithm explained in Das, Gunopulos & Mannila 1997). Once a good fit is achieved, these clusters can then be considered as the basic shapes of the time series, with the entire series composed of superpositions and/or combinations of these basic shapes. The next and main step of the process is to find interesting probabilistic rules between the clusters in the two time series. These rules are of the form: "If a cluster A occurs in time series 1 then we can say with confidence c that B will occur in time series 2 within time T". Figure 1 displays a flow chart of the basic algorithm used in predictive time series analysis.

# Data Analysis Structure and Usage

Two goals are possible with this approach, each requiring a slightly different analysis tree: (1) to schedule a telescope more intelligently to objects when they are at their brightest or most interesting stage, or (2) as an analysis tool to find patterns within a (possibly multivariate) time series (see Figure 2).

Within the time-series analysis (TSA) module, the user can control three main parameters: the window size, the minimum cluster distance and the time period for prediction. The TSA module analyzes the time series data and performs trend prediction and rule discovery on both real time and historical data. This output can either be used directly for data analysis in a paper or to forecastboth the activity level of an object and the ability of the telescope or satellite to perform the desired observations. All of these factors could be considered in the light of the constraints imposed by individual investigators as well as the review committee. The goal of such a process would be to maximize the scientific usefulness of all the observations. If, for example, a given observation required that a source be above a certain flux level, such a program might have a better chance of ensuring that this was so during the observations.

# Results, Limitations and Future Work

To test and validate the toolbox, we used RXTE ASM datasets for various objects, spanning several different object classes. In Figure 3, we show one particularly interesting dataset, from SMC X-1. SMC X-1 shows interesting periodic behavior on several different timescales: a long time-period behavior as well as short time-scale variations superposed upon the long-period behavior, but occurring only when the object is bright (see e.g., Kahabka & Li 1999). The toolkit was found to be particularly effective for predicting short-period rules. Longer-period rules can be found by varying the window size, although possibly at the expense of losing short time-scale rules as the window size becomes larger than the rules in question. We can also find longer-period rules with smoothing techniques.

The current implementation of the toolkit consist of a rule inference engine, programmed in C and a visualizer, programmed in Java. The current toolkit has several limitations. First, the current toolkit can analyze only a single time series at any time. This obviously gives it limited functionality, as many objects are studied with multiple instruments. Second, it has limited ability to deal with missing data. In addition, one could envision multiple processing options, including the incorporation of dynamic time warping techniques, which could be particularly useful to spot quasi-periodic oscillations.


author: Peter Grassberger and Thomas Schreiber
Physics Department, University of Wuppertal, Germany
title: Does macroscopic disorder imply microscopic chaos?

We argue that Gaspard and coworkers  do not give evidence for microscopic chaos in the sense in which they use the term. The effectively infinite number of molecules in a fluid can generate the same macroscopic disorder without any intrinsic instability. But we argue also that the notion of chaos in infinitely extended systems needs clarification: In a wider sense, even some systems without local instabilities can be considered chaotic.
In a beautiful recent experiment , Gaspard and coworkers verified that the position of a Brownian particle behaves like a Wiener process with positive resolution dependent entropy . More surprisingly and dramatically , they claim that this observation gives a first proof of "microscopic chaos", a term they illustrate by examples of finite dimensional dynamical systems which are intrinsically unstable. While the recent literature finds such chaos on a molecular level quite plausible, we argue that the observed macroscopic disorder cannot be taken as direct evidence. In fact, Brownian motion can be derived for systems which would usually be called non-chaotic, think of a tracer particle in a non-interacting ideal gas. All that is needed for diffusion is *molecular chaos* in the sense of Boltzmann, i.e. the absence of observable correlations in the motion of single molecules.

Part of the confusion is due to the lack of a unique definition of "microscopic chaos" for systems with infinitely many degrees of freedom. The authors of  introduce the term by extrapolating finite dimensional dynamical systems for which chaos is a well defined concept: Initially close states on average separate exponentially when time goes to infinity. The rate of separation, the Lyapunov exponent, is independent of the particular method to measure "closeness". However, the notions of diffusion and Brownian motion involve by necessity infinitely many degrees of freedom. In this thermodynamic limit, Lyapunov exponents are no longer independent of the metric. As a consequence, the large system limit of a finite non-chaotic system will remain non-chaotic with one particular metric and become chaotic with another.

Let us illustrate this astonishing fact with an example introduced by Wolfram  in the context of cellular automata. Consider two states ${\bf x} = (\ldots x_{-2},x_{-1},x_0,x_1,x_2 \ldots)$ and ${\bf y} =
(\ldots y_{-2},y_{-1},y_0,y_1,y_2 \ldots)$ of a one-dimensional bi-infinite lattice system. If the distance between ${\bf x}$ and ${\bf y}$ is defined by $d_{\rm max}({\bf x},{\bf y}) = \max_i |x_i-y_i|$, it can grow exponentially only if the local differences do. This is what one usually means by "chaos", and this is what the authors of  had meant by "microscopic chaos". This mechanism is absent in the thermodynamic limit of finite non-chaotic systems. Therefore, some authors  would also call the limit non-chaotic. However, the metric $d_{\rm exp}({\bf x},{\bf y}) = \sum_i
|x_i-y_i| \, e^{-|i|}$ can also show exponential divergence if an initially far away perturbation just moves towards the origin without growing . Arguably, when observing a localised tracer like in , the latter choice of metric seems more appropriate.

In finite dimensional dynamical systems, chaos arises due to the de-focusing microscopic dynamics. The positive entropy is generated by the initially insignificant digits of the initial condition which are braught forth by the dynamics. In the thermodynamic limit, also a completely different mechanism exists: Perturbations coming from far away regions kick the tracer particle once and move again away to infinity. The entropy is positive due to information stored in remote parts of the initial condition. Associated to this, one can also define suitable Lyapunov exponents .

To resolve the confusion, we suggest to follow Sinai  and first let the system size tend to infinity, and only then the observation time. In that case, a system observed in a particular metric $\mu$ is called $\mu$-chaotic when we find a positive Lyapunov exponent using this metric. However, Gaspard et al. had obviously in mind the type of chaos detectable with the metric $d_{\rm max}$, and arising from a local instability. For this, they fall short of giving experimental evidence.


abstract: Although almost all information about Smart Contract addresses is shared via websites, emails, or other forms of digital communication, Blockchains and distributed ledger technology are unable to establish secure bindings between websites and corresponding Smart Contracts. For a user, it is impossible to differentiate whether a website links to a legitimate Smart Contract set up by owners of a business or to an illicit contract aiming to steal users' funds. Surprisingly, current attempts to solve this issue mostly comprise of information redundancy, e.g., displaying contract addresses multiple times in varying forms of images and texts. These processes are burdensome, as the user is responsible for verifying the correctness of an address. More importantly, they do not address the core issue, as the contract itself does not contain information about its authenticity. To solve current issues for these applications and increase security, we propose a solution that facilitates publicly issued SSL/TLS-certificates of Fully-Qualified Domain Names (FQDN) to ensure the authenticity of Smart Contracts and their owners. Our approach combines on-chain identity assertion utilizing signatures from the respective certificate and off-chain authentication of the Smart Contract stored on the Blockchain. This approach allows to tackle the aforementioned issue and further enables applications such as the identification of consortia members in permissioned networks. The system is open and transparent, as the only requirement for usage is ownership of an SSL/TLS-certificate. To enable privacy-preserving authenticated Smart Contracts, we allow one-way and two-way binding between website and contract. Further, low creation and maintenance costs, a widely accepted public key infrastructure and user empowerment will drive potential adaption of Ethereum Authenticated Smart Contracts (AuthSC).
author:
*Technical University Munich*
Munich, Germany
{ulrich.gallersdoerfer,firstname.lastname@example.com
bibliography: submission.bib
title: AuthSC: Mind the Gap between Web and Smart Contracts

# Introduction

Users in publicly available Blockchain-based systems face a highly dangerous and hostile environment, as attackers have high incentives to steal users' funds. Although the underlying ledger provides immutable Smart Contracts, decentralized key management, and resistant consensus mechanisms, fraud, hacks, impersonation, and other malicious activities are to be encountered on a daily basis. Resolving issues of Smart Contract engineering, the formal verification of Contracts or the design of secure programming languages are subject to active research. However, an often ignored issue is the weak link to the information stored on Blockchains: The user needs to know the exact location of the Smart Contract or the externally owned account to interact with. As these addresses consist of random characters, e.g., in Ethereum 64 hexadecimal characters, users rely on the web and a clipboard to copy and paste address information. The called address or Smart Contract contains no further information to verify whether the user interacts with the intended Contract or not.

The approach of just sharing addresses on web pages without any further connection between the business and the Smart Contract is prone to errors and can be exploited by attackers. The Coindash ICO is an example of such an attack. At the height of Token Sales in 2017, Coindash conducted an Initial Coin Offering (ICO), selling their newly created token to interested investors in return for Ether (the currency of the Ethereum Blockchain). To advertise their token sale, the founders set up a website. The website contained all relevant information on how to invest their company, including the address of the Smart Contract. The sale started and many people participated; several million USD were sent in the first few hours; unfortunately, not to the intended token Smart Contract, but to a different Smart Contract set up by malicious actors, collecting all the investment funds. These malicious actors had previously hacked the website and quietly replaced the original contract address with their own, resulting in the loss of over 7 million USD. While the Wordpress content management system was compromised, the underlying web server remained intact.

To solve the issue of loose coupling between website and Smart Contract, we propose Ethereum authenticated Smart Contracts (AuthSC). AuthSC allows endorsing Smart Contracts with a private/public key pair of a TLS-certificate issued by a certificate authority (CA). This approach enables wallets or other software, which directly interact with Smart Contracts, to verify their authenticity and binding to the respective website.

AuthSC contains three crucial components: the authenticated Smart Contract, which stores information about the endorsement, an off-chain verifier, which authenticates the Smart Contract as well as the AuthSC registry, which prevents downgrade-attacks and offers a discovery service.

Our approach considers privacy-preserving authenticated Smart Contracts: Entities might decide to endorse Smart Contracts, however, do not want other parties to retrieve their endorsement by crawling the respective Blockchain. We expand the system to allow for an explicit discovery of such contracts: In case the user journey is not started at the website, but at the Smart Contract itself, the user is still able to authenticate this Smart Contract. This allows for varying applications, which we cover in Section . Furthermore, we discuss associated risks and potential attacks and countermeasures.

To structure our work, we organize our paper as follows: In Section , we introduce the system architecture and the methodologies to assert and authenticate Smart Contracts. We discuss privacy, risks, and attacks in Section . Section gives an overview of the applicability of the proposed artifact. We discuss the limitations and advantages of our approach in Section . We give an overview of related work in Section and end in Section with a conclusion and potential future work.

# System Architecture

In this Section, we introduce the general approach and give an overview of the architecture, the single components, and the structure of the Smart Contracts. We further display processes of the system and design considerations.

Our goal is to establish a binding between Smart Contracts and websites using common SSL/TLS-certificates which ensure the authenticity of web servers, the privacy, and integrity of messages between browser and server. The owner of a certificate endorses a Smart Contract by signing the respective address and storing it within the respective Smart Contract. Later, other parties can retrieve the certificate from the Blockchain and validate it against their trusted certificate authority servers, thereby authenticating the contract. Afterward, they can engage with the specific Smart Contract or further evaluate data stored in the Smart Contract, aware of the actual identity of the counterparty. A reference interface is available online in, using Solidity for Ethereum. In theory, AuthSC is Blockchain-independent; any other network can profit from this methodology.

To enable identity assertion and authentication, our system consists of three components:

-   The **On-Chain Authenticated Smart Contract** contains methods for storing and updating signature information. This functionality is provided as a library and therefore independent from the actual Smart Contract (e.g., token contract or other purposes).

-   The **Off-Chain Verifier** is an application that runs outside of the Blockchain. It is responsible for verifying on-chain assertions. It retrieves data from the certificate issuer, the website owner, the Blockchain, and potential certificate authorities. With this information, it enables authentication of on-chain information in the context of the user-defined environment.

-   The **Authenticated Smart Contract Registry** prevents downgrade-attacks by providing a list of Smart Contracts for domains. Further, it optionally allows for easy discovery of Smart Contracts which implement this library. It manages a list of existing Smart Contracts and their respective domains such that interested parties can find these Smart Contracts.

Figure depicts the overall structure of the proposed architecture. The On-Chain Authenticated Smart Contract (AuthSC) is placed within the Blockchain system and referred to by the Authenticated Smart Contract Registry. The Off-Chain Verifier accesses the AuthSC, the DNS, and the PKI to verify the correctness of all obtained data and to authenticate the specific Smart Contract.

In the remainder of this Section, we analyze the responsibilities and methodologies of the single components.

## On-Chain Authenticated Smart Contract

An entity asserts its identity to a Smart Contract by binding it to a public domain. To allow such identity assertion, the contract has to store the following data for authentication:

-   the fully qualified domain name for later identification (optional)

-   the signature information (the address of the Smart Contract signed by the private key)

Additional information required for the authentication of the Smart Contract is retrieved from external data sources. This identity assertion functionality can be embedded in an arbitrary Smart Contract, allowing AuthSC to be used in any on-chain environment. The interface a Smart Contract has to implement to adhere to AuthSC is depicted in Listing . Please note that an FQDN is provided as an array, e.g., *hq.example.org* translates to `["org", "example", "hq"]`. This approach allows for easy access to parts of the FQDN.

``` Solidity
interface ERCXXX /* is ERC165 */{

    // @dev Event is emitted when the FQDN changes
    event FQDNChanged(string[] indexed FQDN);

    // @dev Event is emitted when the signature changes
    event SignatureChanged(string signature);

    // @dev Returns the domain for the given SC
    function getFQDN() external view returns (string[] memory);

    // @dev Returns the signature for the given SC
    function getSignature() external view returns (string memory);

    // @dev Allows to set the FQDN
    function setFQDN(string[] calldata _FQDN) external;

    // @notice Sets the signature (containing the SC address)
    function setSignature(string calldata _signature) external;
}
```

Three steps are required to enable authentication of the Smart Contract: Smart Contract creation, signature generation, and signature upload. For simplicity, we omit intermediate or supporting activities such as creating wallet addresses, funding the accounts, and including the library in the respective Smart Contract.

1.  **Smart Contract Creation:** As it is impossible to update previously existing Smart Contracts, one has to create a new Smart Contract upfront. A contract has to be instantiated with information on the address of the owner of the Smart Contract and optionally the domain to which the owner has access to (e.g., the domain or any subdomain). If a domain is not provided, two-way binding is not supported, which we discuss in Section .

    After the first step, the Smart Contract is set up on the Blockchain.

2.  **Signature Generation:** The signature is still missing in the Smart Contract and thus, the SSL/TLS certificate has not endorsed this Smart Contract, as any party can execute the first step for any domain. The entity retrieves the unique contract address and signs this string with its private key of the SSL/TLS-certificate. As the signature contains only one specific Smart Contract address, other Smart Contracts cannot use this information to pretend to be also endorsed by this domain.

3.  **Signature Upload:** The signature created in the previous step is transmitted to the Smart Contract as part of a regular transaction calling the method `setSignature`. The contract validates that the transaction is indeed created by the original owner of the Smart Contract, as the contract itself is not able to verify if the provided data is correct. If the owner issued the transaction, the payload is stored in the respective field of the Smart Contract, awaiting later retrieval.

It is possible to reduce the process to two steps, as it is possible to sign the address of the contract before its initialization, providing the signature alongside the domain name. This is possible as the addresses of to-be generated Smart Contracts are deterministic. For simplicity and to remove possible interference with other transactions issued from the same address, we decided to first upload the contract and then actually submit the signature data, preventing that an incorrect address is signed.

## Off-Chain Verifier

Smart Contract computations must be deterministic. Thus, a Smart Contract cannot request external data like lists of CAs or web servers, as a recurring calculation (e.g., in another full node in the network) might lead to a different result. Therefore, we move the authentication process of the endorsement stored within a Smart Contract off-chain. The software itself needs to access the following data sources:

-   The address of the relevant Smart Contract, which is obtained via the web or is obtained by the Authenticated Smart Contract Registry or proprietary discovery services.

-   The contents of this Smart Contract, e.g., optionally the domain name and the signature

-   The signed certificate, its public key alongside the information of the certificate authority, obtained by requesting the domain and retrieving the SSL/TLS-certificate

-   The list of trusted CAs of the user

It is possible to store the entire SSL/TLS-certificate in the Blockchain, rendering the request to the web server unnecessary. However, as these certificates take additional space, we oppose to storing them on-chain for cost reasons. If decentralized storage systems such as the Interplanetary File System (IPFS) gain practical relevance, it becomes cost-efficient to store complete certificates in decentralized systems, no longer relying on web servers of the respective owners. As long as such systems remain in an early stage, we continue to request the certificate from the respective servers.

The list of trusted certificate authorities is defined by the user, either directly by providing a list themselves or by the certificate authority list stored in her/his computer or browser.

Smart Contract authentication involves four steps. Again, we omit intermediate steps and assume a fully accessible system, also we assume that the contract address is known.

1.  **Smart Contract Information Retrieval:** The application first retrieves all relevant information for later authentication. It collects the domain and signature data from the Smart Contract.

2.  **Certificate Retrieval:** Afterwards, it connects to the respective domain given in the Smart Contract (or previously known by the website) and obtains the certificate.

3.  **Smart Contract Signature Verification:** The software validates if the Smart Contract address is signed by the private key of the certificate. As the certificate has to belong to the website, no additional check is required. If the signature is correct, the software proceeds with step 4, otherwise it aborts the identity authentication with an error.

4.  **Certificate trust:** After the successful verification of the signature, the software checks whether a trusted certificate authority has (indirectly) signed or issued the certificate found in the Smart Contract and the web server. If the certificate and its public key is signed by a trusted CA, then the identity is successfully validated, otherwise, the program aborts with an error. It executes the certification path validation algorithm as defined in *RFC 5280*.

Figure depicts the steps involved in the authentication process in detail. The definitions for digital signature methods are well established. For this algorithm, we assume that the Smart Contract address is previously known.

## Authenticated Smart Contract Registry

The previously described on-chain architecture is comprised of a single type of Smart Contract. A set of such Smart Contracts is sufficient to create and manage identities. However, it is relevant to know 1) whether a contract exists for a given domain and 2) under which address it is deployed. To find such contracts or check if contracts exist, we propose extending this architecture by introducing an Authenticated Smart Contract Registry, which allows to quickly lookup all domains registered on the Blockchain. This registry lists all contracts which adhere to this interface standard and claim to be the identity contract for a specific domain. We need to modify such a registry for two reasons: 1) Our on-chain data does not converge to a single truth, but allows creating different perceptions of reality. 2) A company can decide to offer multiple Smart Contracts, providing various services, with their identity tied to them. We, thus, allow that multiple Authenticated Smart Contracts can exist for the same domain. Even though it is possible to search the complete Blockchain for such contracts, it is easier and faster to use an on-chain Smart Contract.

The registry Smart Contract is in place to map domains to Smart Contract addresses by a) storing SHA3-hashes of domains with respective Smart Contracts and b) domains with respective Smart Contracts for reasons we discuss in Section . The usage of such contract is as follows.

1.  **Insertion of Contract Information:** All parties controlling authenticated Smart Contracts submit information about their contract and optionally the respective domain to the discovery service Smart Contract.

2.  **Domain Lookup:** If a user searches for a domain, s/he queries the registry Smart Contract and asks for all contracts which are assigned to that specific domain or the hash of that domain. The contract returns all relevant contract addresses.

3.  **Contract authentication:** The client can execute the previously described authentication method for each of the returned contracts, ensuring that the correct Smart Contract, if it exists, is found.

This Registry Smart Contract relies on owners submitting their created contracts. Thus, 1) ideally every authenticated contract is added and 2) the amount of incorrect data is minimized. First, the entities creating contracts have a strong incentive to be found, as they want users and other parties to interact with their Smart Contract, otherwise they would not have deployed it on the Blockchain. The discovery service Smart Contract allows them to advertise their service and enable users to find them. Second, malicious entities which do not own the respective TLS/SSL-certificate are discouraged from linking respective contracts as it costs money to add the information, the authentication of these contracts will fail and the users will not even notice the existence of such contracts, as modern computation power is sufficient to process hundreds of such contracts in milliseconds. Given this (dis)incentive structure, we allow every entity in the network to add data to the Authenticated Smart Contract Registry.

# Privacy Concerns, Risks and Attacks

In this Section we discuss privacy considerations, one-way and two-way bindings, key management risks and downgrade-attacks on AuthSC.

## Privacy Considerations

The design goal of open and transparent Blockchains are inherently contrary to the goal of privacy of user activity in such networks, as all transactions, messages and deployed code is available to every node in the system. We are aware that it is possible to crawl all Smart Contracts stored in a Blockchain and also identify Authenticated Smart Contracts. We acknowledge that some parties might want to use the functionality provided by AuthSC, but do not want to publicly state that this is the case. For that, we introduce one-way and two-way binding between FQDN and Smart Contract.

-   One-way binding means that only the website links to the Smart Contract; the contract itself does not link to the website. Without knowledge about the domain, the Smart Contract itself cannot be authenticated, because it is unclear against which domain it should be authenticated. This allows for a privacy-preserving authenticated Smart Contract, resulting in a contract that is findable on-chain, however, cannot be attributed to a domain (and therefore an owner). To enable one-way binding, the Smart Contract itself does not store the domain information. Nonetheless, to prevent downgrade-attacks, it is recommended to store the address and the hash of the domain within the registry Smart Contract as outlined in Section .

-   Two-way binding results in Smart Contracts which can be authenticated by only knowing the respective Smart Contract address. In this case, the Smart Contract stores the FQDN within the Smart Contract, allowing to resolve the certificate which signed the Smart Contract address. In this case, it is also advised to store the hash of the domain (to prevent downgrade-attacks) as well as the domain itself (to enable discovery) within the Authenticated Smart Contract registry.

## Key Management Risks

The key material in TLS/SSL-certificates faces the following risks:

-   **Key Material Expiration:** Key material in X.509 certificates expires regularly. Public key and signature information have to be updated, otherwise, the verifying entity cannot assert the correctness of the authenticated contract. To update the Smart Contract, steps 2 and 3 of the assertion process have to be executed again with the new certificate. This procedure ensures that the previously submitted information stored in the contract remains valid. If an entity wants to invalidate her/his contract, s/he updates the respective SSL/TLS-certificate, thus invalidating the signature stored in the contract.

-   **Certificate Key Revocation:** Key revocation becomes mandatory if key material gets compromised. Such key material could be used to create authenticated Smart Contracts, potentially tricking users into believing that the new Smart Contract does indeed belong to the compromised entity. However, as our approach relies on the public key of the web server, an replacement of the keys stored on the server will also render potential deceiving Smart Contracts invalid. The software is not able to verify Smart Contracts with old keys. Further, the software could also evaluate whether the to-be verified certificates are included in so-called certificate revocation lists (CRL). This becomes relevant when the complete credential is stored on-chain, as the additional check with the web server is omitted.

## Downgrade-Attacks

We found that AuthSC might be vulnerable to downgrade-attacks.

In a downgrade-attack, an adversary tricks a party in a communication protocol to assume that the other party is incapable of adhering to newer (and more secure) versions of the communication protocol, leading to the usage of an older (and less secure) version of the protocol. As an older version is susceptible to further attacks or has no protection at all (e.g., plain text), an adversary can further exploit the communication. The same is also true for AuthSC. Looking at the base case and our introductory example of CoinDash, it becomes apparent that the user needs to know that a website uses AuthSC to protect their users from sending transactions to malicious contracts. However, we cannot expect a user to know whether the counterparty actually implements AuthSC and in case of CoinDash, an address swap is still possible without any further mechanisms in place.

Therefore, the Off-Chain Verifier (or other software implementing the authentication mechanism) needs to know whether a contract exists for a given domain. If the verifier obtains a contract-address from a website, it checks if this contract supports the AuthSC interface and, if that is not the case, another Smart Contract exists for that domain and further if that Smart Contract can be verified. This verification is necessary to prevent Denial of Service attacks, as otherwise attackers could register Smart Contracts for any domain and harm the communication between the website and their users. If such a contract is encountered without the current Smart Contract adhering to the interface standard, a warning is emitted to the user, stating that the current contract has no additional protection against impersonation and that other contracts with such protection exist.

The Authenticated Smart Contract Registry is asked about already existing Smart Contracts for a domain. If the original and authenticated Smart Contract is registered within this registry, downgrade-attacks can be prevented.

# Applicability

In this Section, we briefly introduce potential usages for AuthSC, allowing further usages for authenticated Smart Contracts.

## Consortia Member Identification

Companies and other entities often opt for permissioned settings concerning Blockchain systems: Either they preselect nodes that are allowed to produce blocks in the network (public permissioned Blockchains) or they limit the accounts which are allowed to interact with a given Smart Contract architecture. Often, these entities (Smart Contracts or externally owned accounts) are white-listed after an off-chain proof; usually, teams from different companies communicate their account information outside of the Blockchain network. However, this process is expensive, as for every new connection trust has to be established. To enhance this process, proofs can be generated with AuthSC that endorse accounts and Smart Contracts, allowing the "administrative" party to automatically add new entities to the network after sufficient proof. This not only reduces costs but allows for novel filtering, e.g., any domain with a TLD from e.g., Sweden is allowed to participate in the network. Proofs can be stored in public permissionless Blockchains (e.g., the Ethereum Mainnet) and used in private Blockchains, allowing an even further adoption of SSL/TLS-certificates within these networks.

## Information attribution and authentication in public Blockchains

The properties of immutability, transparency, and longevity of data and information are often used as arguments for Blockchain technology, as many companies value such properties for their use cases, e.g. reduce fraud or increase transparency towards their users. Data stored on Blockchains with the intention of transparency, however, lack the attribution or the connection to the company, such that a proof that data comes from a company or institution is bothersome, as prior communication is required as evidence. For these companies, it is much easier to authenticate this Smart Contract, store their data in it, and let other parties validate the stored data alongside authenticating the Smart Contract. To give an example, this approach could be used for allowing online-authentication of digital certificates, e.g. degrees or references. Hashes of such documents are stored on the Blockchain, similar to other Blockchain-based approaches. The authenticated Smart Contract ensures the correctness of the identity of the issuer. Third parties (e.g., potential employers) can compare the hashes of received documents to the hashes contained in the Smart Contract. This software additionally authenticates the Smart Contract and validates the asserted identity. With such a solution in place, software can automatically scan if uploaded documents by the applicant are valid or not.

# Discussion

In this Section, we discuss the limitations and advantages of our approach to better understand the implications when using this artifact.

## Limitations

To start with, this approach only supports the authentication of domain owners with certificates, e.g., businesses or users with own websites, but not private persons or any other parties without such certificates. This is a caveat, as other parties, e.g., users, are also interested in having authenticated addresses or Smart Contracts. Sending funds to other parties or friends should involve some form of authentication, unfortunately, our approach is not suitable for this. Solving the issue for regular users would also result in reduced onboarding costs if the authenticity of the user is required, e.g., in financial transactions or products. However, identity providers could use AuthSC to authenticate their contracts to later assert identities to their users, such that they can use authenticated addresses later on with other service providers.

The AuthSC approach relies on SSL/TLS-certificates issued by certificate authorities. The utilization of such certificates implies that these institutions are trustworthy and that limitations of this hierarchical public-key infrastructure also apply to AuthSC regards to centralization. However, the transparent storage of signatures of Smart Contract addresses can lead to increased trust in the infrastructure, as outlined in Section . Furthermore, as the basis of information is the web (which is deemed to be trustworthy), we provide similar security.

Blockchain and Smart Contract technology is a growing area of business and research, and a lot of different solutions compete for users, companies, and funds. At the current stage of development, it is impossible to predict which authentication or identity solution will prevail in the long run and even if such technologies will have relevance in the future at all, and this also applies for AuthSC. However, if the usage of Blockchain technology increases, such solutions will be required or even enable such usage increase.

The system is designed such that different entities can reach different conclusions about the validity of on-chain data. Consequently, users verify data "off-chain", not resulting in "absolute truth" on-chain. It is possible to have different perceptions of reality. Further, an entity may not want to engage with another entity, even if it knows it's true identity.

Our presented approach requires rewriting existing contracts to adhere to AuthSC's interface, potentially imposing barriers to companies. Furthermore, access to the SSL/TLS-certificate is required. Every company that uses the AuthSC-approach has to follow the setup process, incurring costs up-front. As many businesses rely on web hosting companies, access might not be trivial, as leakage of the certificate must be prevented.

## Advantages

Our system uses, in contrast to all other approaches outlined in Section , existing signature, and certificate authority schemes. This has a two-fold benefit: First, there is a straightforward onboarding process in place, as existing structures are used. Entities do not have to go through additional Know-Your-Customer-processes (KYC) to authenticate their Smart Contract, it is inherently existent if they own a domain with an SSL/TLS-certificate. No entity is the gatekeeper of this approach and any entity worldwide can immediately use this approach, enabling a completely open system. Second, the system itself does not need a bootstrapping process or the persuasion of other entities to join and create the desired network-effect.

SSL/TLS-certificates are a passive form of authentication. A user requests a website and this website returns the data with the respective certificate. The web server cannot use its certificate in communication as the initiating party, e.g., contacting another web server and being authenticated by the TLS/SSL certificate. With our approach, the SSL/TLS-certificates can be used actively, as other Smart Contracts can allow for transactions from such authenticated contracts, ensuring the authenticity of their counterparty. This is a novelty for world-wide-web based certificates.

Our system enables direct commercial relationships between two businesses, worldwide, as until now there is no way for companies to engage directly over Distributed Ledger Technologies. Both parties can authenticate themselves with their public key and signature in their respective Smart Contract and signal the other party the willingness to engage in further trade activities. Additionally, any other party owning a domain and an SSL/TLS-certificate such as governments, NGOs, or private persons can participate in this scheme, allowing for an open ecosystem.

In some existing identity solutions, a central entity defines the correctness of identities and their claims. This results in a single point of failure. If the central entity fails, the entire system is rendered useless or even worse, is open to manipulating arbitrary data. In our approach, the users can, if they want, decide on their own which entities to trust, resulting in their perception of what information is correct or not. Other users who are not familiar with the system or technology can use the standard configuration, resulting in a valid perception.

If a company using our approach implements a use case familiar to the credential use case, the experience of potential users visiting the website is similar to other non-Blockchain websites. For the identification and the authentication, no additional tools like MetaMask or other wallet software are required, as every used technology is already available in modern browsers. Therefore, the complexity of the Blockchain and the implemented system is abstracted from the user; if s/he is not interested in the functionality of the system, chances are high that s/he will not notice that the system is Blockchain-based.

The overall costs of our approach are low. Excluding the costs of requesting a certificate, a company (or an entity creating an authenticated contract) faces three primary cost drivers:

-   The deployment of the Smart Contract on the Blockchain (required only once)

-   The insertion/update of certificate material (only required if the certificate changes)

-   The usage of the actual intended Smart Contract functionality (not covered in our calculation, as these costs apply regardless of the authentication)

As the number of computational steps of each of the first two processes depends on several parameters (e.g., domain length, enabled, or disabled compiler optimization), costs cannot be determined precisely upfront. To give a range, deploying an exemplary contract uses about 900,000 to 1 million Gas units. Currently (233 USD / Ether, 1st March 2020), ETHgasstation.info recommends a Gas price of 8 GWei for fastest and 1 GWei as a safe minimum for executing transactions. Selecting the minimum price of 1 GWei as Gas price, the costs amount to approximately 0.23 USD, a high price of 6 GWei amounts to 1.86 USD for the first step. In the second step, the insertion of key material takes about 10% of the amount of Gas of the contract creation. In total, an investment of less than 5 USD is sufficient to get started with this approach, enabling a broad audience to use this system. The detailed prices are depicted in Table 1.

|                     | **Deployment** | **Key Material Insertion** |
|:--------------------|:--------------:|:--------------------------:|
| Gas usage           | 1,000,000 Gas  |        120,000 Gas         |
| Safe Low (1 GWei)   |   0.233 USD    |         0.028 USD          |
| High Speed (8 GWei) |   1.864 USD    |         0.224 USD          |

Costs of Smart Contract Interaction

# Related Work

In this Section, we outline concepts that partly overlap with our research or try to solve similar issues. As our approach lies within multiple domains, we categorize related work in three distinct categories: 1) verification and validation of Ethereum addresses, 2) name services, and 3) decentralized identity or identity attribution systems.

## Verification of Ethereum addresses

We focus on the verification of Ethereum addresses, however, these approaches remain identical for addresses of other Blockchains or public-key address schemes.

-   Address Checksums: In EIP55, an address scheme was introduced which capitalizes parts of the characters in the address to allow for an easy verifyable checksum. It helps to prevent mistakes (e.g., left out characters) while copying the addresses. It is often used inside wallets (e.g., MetaMask). However, as an attacker can easily generate such checksums as well or the tools used to generate them automatically, the checksum does not help the user to distinguish between valid and illicit Smart Contracts.

-   Vanity addresses: Vanity addresses are specially crafted addresses to enable a partly readability. For example, the author of Profanity, a tool for producing these vanity addresses, has given 0x**000dead000**ae1c8e8ac27103e4ff65f42a4e9203 as donation address. The software computes private keys with a respective public key until an address has been found which satisfies the predefined requirements. Alternative approaches include the usage of account nonces (specific to Ethereum) to increase speed, however, the result remains identical. An attacker is also able to generate such an address with similar patterns; given s/he has the computing power.

-   Account address images: An approach used by some wallets is blockies. Blockies is a library that allows generating unique images of addresses, called identicons. These images should help users to identify single addresses and better recognize if addresses have been swapped. However, also this approach suffers from potential brute force to recreate almost identical images, as work by Austin Griffith shows .

-   Multitude of address displayed: Some popular tokens, such as Token-as-a-Service (TaaS), approached the problem by introducing redundancy by displaying the address in multiple settings (website, mail, and others) and formats (image, text, and others). This approach increases resilience against attacks, as attackers might not able to change addresses in already sent emails. However, it shifts the responsibility to the user. S/he is responsible for the tiresome comparison and verifying the correctness of the address. If the user does not compare these addresses, an attack could still be successful.

## Name Services

Name services are systems that allow attributing human-readable names to complex and changing information, e.g., IP-addresses. This is a well-known approach and is also the basis for today's Domain name system , as it maps (amongst other parameters) between FQDN and IP-addresses.

-   Ethereum Name Service (ENS): ENS is a well-known service that allows the registration of domains for the TLD .eth. It started in 2018 and currently, over 700,000 domain auctions have happened. Users bid for domains in a sealed auction and after a predefined time, the ownership is transferred to the bidder with the highest offer. The funds are locked for the time the domain is registered. It can be refunded once the ownership is abandoned. The approach is promising and finds a lot of users within the Ethereum community, however, the overall adoption is practically non-existent. There is no judiciary system that allows reassigning domain names, e.g., in cases of trademark issues. Likely, popular domains registered in ENS do not link to respective company accounts. Further, the "root zone" is managed by a multi-signature wallet owned by seven single individuals.

-   Other PKI-implementations: There is a series of approaches trying to replicate public key infrastructures on Blockchains, creating such systems from scratch. The key difference between these approaches and ours is that we include preexisting infrastructure in our approach, eliminating the need for any bootstrapping. Out of brevity, we do not cover single approaches but rather link to already existing research conducted in , which provides an overview of several implementations and their key differences.

## Decentralized Identity and Identity Attribution

Active research is conducted in the area of decentralized identity, web of trust, and verifiable credentials. W3C's emerging standard on Decentralized Identifiers (DIDs) and Verifiable Credentials (VC) receive a lot of attention . The basic idea is to enable credentials independent from any third party, e.g. a website or a provider (e.g. *Login with Google*) by storing a DID on a distributed ledger. These ledgers (e.g. Ethereum) need to provide methods to resolve such DIDs to DID documents which have additional information about cryptographic mechanisms, keys, and verification endpoints. The research focuses on standardizing interfaces required for interacting with varying verification endpoints. These systems primarily focus on enabling personal identity without the requirement for a third party. In these systems, Blockchain functions as a distributed immutable storage; it is not intended to assign identities to Smart Contracts or on-chain identities. Furthermore, DIDs lack widespread adoption, and bootstrapping is required.

# Conclusion and Future Work

In this paper, we introduce a novel approach to use established forms of certificate authorities and signature schemes to allow for a secure binding between Smart Contract-based Systems and the web. In comparison to other approaches, our method does not depend on the adoption rate or a network effect of the solution, as SSL/TLS-certificates and the cryptographic mechanisms are omnipresent and heavily used in today's world wide web. The low costs and simplicity for the end-user make the usage of SSL/TLS-certificates in the context of Blockchain reasonable.

We identify three major directions of future work: risk mitigation of using TLS/SSL-certificates, integration of AuthSC into already existing identity management systems, and enabling on-chain identity.

As discussed in Section , AuthSC inherits already existing drawbacks of the public key infrastructure, such as revoked certificates, reissued certificates (by malicious actors), or spoofing attacks with stolen keys. To resolve such issues, they need to be addressed in the underlying PKI. However, the increased transparency in the storage can support algorithms in detecting abnormal issuance of certificates or re-issuance of already trusted Smart Contracts. Analog to attempts like Certificate Transparency , transparency of AuthSC Smart Contracts (and thus signatures) could enable heuristics to mitigate risks inherited from the underlying layer.

The integration of this approach into already existing identity management systems like the upcoming Decentralized Identifiers (DID) W3C standard can be promising. A DID-method specifically tailored to account for SSL/TLS-certificates could help to reboot the Web of Trust, as it would provide potential trust anchors without the requirement for bootstrapping.

The on-chain authentication of identities should be a significant direction of future research, as it enables the full potential of this approach, allowing any use case which involves on-chain computation to be implemented and backed by this approach, enabling the usage of identity on-chain. It merely allows for binding between the web and Smart Contracts, but further integrates TLS/SSL-certificates as an identity provider into Smart Contract systems. From our perspective, there are three potentials of how such an approach can be facilitated:

1.  Different types of certificates: The potential forms of SSL/TLS-certificates are varying: EV-certificates, wildcard certificates, or even multiple certificates for a single domain require additional analysis of the current certificate ecosystem to enable the usage within AuthSC. The usage of TLS proxies especially present in enterprises requires further consideration, further invalid, and malformed certificates and their impact on security needs further consideration.

2.  Enabling self-hosted oracles for validation of certificates: Each owner of a Smart Contract who wants to identify other Smart Contracts defines her/his oracle which is responsible for validating certificates s/he wants to engage with. By self-hosting such oracle, the entity can tremendously reduce the costs in comparison to a full on-chain authentication and define its own rules and trusted CAs. This is a simple solution; however, it induces the necessity of off-chain oracles.

3.  Migration of existing CA structures to Blockchain-based systems, such that all data is stored safely and in a transparent manner on the chain. If existing on-chain key mechanisms are in place, such an approach could reduce the costs of true on-chain authentication to a minimum, enabling a truly trustless and widespread usage worldwide.