The Security Reference Architecture for Blockchains: Toward a Standardized Model for Studying Vulnerabilities, Threats, and Defenses

Abstract

Blockchains are distributed systems, in which security is a critical factor for their success. However, despite their increasing popularity and adoption, there is a lack of standardized models that study blockchain-related security threats. To fill this gap, the main focus of our work is to systematize and extend the knowledge about the security and privacy aspects of blockchains and contribute to the standardization of this domain.We propose the security reference architecture (SRA) for blockchains, which adopts a stacked model (similar to the ISO/OSI) describing the nature and hierarchy of various security and privacy aspects. The SRA contains four layers: (1) the network layer, (2) the consensus layer, (3) the replicated state machine layer, and (4) the application layer. At each of these layers, we identify known security threats, their origin, and countermeasures, while we also analyze several cross-layer dependencies. Next, to enable better reasoning about security aspects of blockchains by the practitioners, we propose a blockchain-specific version of the threat-risk assessment standard ISO/IEC 15408 by embedding the stacked model into this standard. Finally, we provide designers of blockchain platforms and applications with a design methodology following the model of SRA and its hierarchy.

Detecting Blockchain Security Threats

“…The low number of filtered results can be attributed to the fact that many papers mention or cite existing vulnerabilities and attacks, but do not contribute new vulnerabilities. We conducted additional in-depth research on each of the found attacks by searching for the attack's name, which yielded additional literature [4], [7], [18].…”

“…If several Orderer Admins collude, they may attempt to rewrite the blockchain in an Alternative History attack [7], [20]. This requires > 50% of nodes to collude (crash-fault tolerance), or > 2f nodes for byzantine-fault tolerant consensus where 3f + 1 nodes tolerate f malicious nodes.…”

“…To illustrate the contribution of this work we use Jaquith's model of IT security controls [6]. While there is plenty of literature detailing threats [7] and exposures [4] of blockchains, approaches for countermeasures are still scarce. In the model shown in Figure 1, countermeasures consist of deterrent, detective, preventative and corrective controls.…”

Artículo 10/2020_EJIC (nº 206) Blockchain, criptomonedas y los fenómenos delictivos: entre el crimen y el desarrollo

“…Un aspecto fundamental para entender el funcionamiento de esta tecnología es su ecosistema, esto es, el conjunto de sujetos que hace posible su funcionamiento e intervienen en mayor o menor medida en el sistema (Homoliak et al, 2019). Blockchain es una base de datos que conserva no solo el estado final del registro, sino el historial completo de transacciones realizadas.…”

“…Existen también los nodos validadores, que a diferencia de los mineros solo pueden leer el contenido de la cadena de bloques, pero no escribir en ella. Su función es dar soporte al sistema, siendo una parte más de estas copias distribuidas y comprobar el correcto funcionamiento de la red (Homoliak et al, 2019).…”