The Security Reference Architecture for Blockchains
Total Page：16
File Type：pdf, Size：1020Kb
1 The Security Reference Architecture for Blockchains: Towards a Standardized Model for Studying Vulnerabilities, Threats, and Defenses Ivan Homoliak∗y Sarad Venugopalan∗ Daniel¨ Reijsbergen∗ Qingze Hum∗ Richard Schumi∗ Pawel Szalachowski∗ ∗Singapore University of Technology and Design yBrno University of Technology Abstract—Blockchains are distributed systems, in which secu- Although some standardization efforts have already been rity is a critical factor for their success. However, despite their undertaken, they are either specific to a particular platform [1] increasing popularity and adoption, there is a lack of standard- or still under development [2], [3]. Hence, there is a lack ized models that study blockchain-related security threats. To fill this gap, the main focus of our work is to systematize and of platform-agnostic standards in blockchain implementation, extend the knowledge about the security and privacy aspects of interoperability, services, and applications, as well as the blockchains and contribute to the standardization of this domain. analysis of its security threats [4], [5]. All of these areas are We propose the security reference architecture (SRA) for challenging, and it might take years until they are standardized blockchains, which adopts a stacked model (similar to the and agreed upon across a diverse spectrum of stakeholders. ISO/OSI) describing the nature and hierarchy of various security and privacy aspects. The SRA contains four layers: (1) the In this work, we aim to contribute to the standardization of network layer, (2) the consensus layer, (3) the replicated state security threat analysis. We believe that it is critical to provide machine layer, and (4) the application layer. At each of these blockchain stakeholders (developers, users, standardization layers, we identify known security threats, their origin, and bodies, regulators, etc.) with a comprehensive systematization countermeasures, while we also analyze several cross-layer depen- of knowledge about the security and privacy aspects of today’s dencies. Next, to enable better reasoning about security aspects of blockchains by the practitioners, we propose a blockchain-specific blockchain systems. version of the threat-risk assessment standard ISO/IEC 15408 In this work, we aim to achieve this goal, with a particular by embedding the stacked model into this standard. Finally, we focus on system design and architectural aspects. We do not provide designers of blockchain platforms and applications with a limit our work to an enumeration of security issues, but design methodology following the model of SRA and its hierarchy. additionally, discuss the origins of those issues while listing possible countermeasures and mitigation techniques together with their potential implications. As our main contribution, I. INTRODUCTION we propose the security reference architecture (SRA) for The popularity of blockchain systems has rapidly increased blockchains, which is based on models that demonstrate the in recent years, mainly due to the decentralization of control stacked hierarchy of different threat categories (similar to the that they aim to provide. Blockchains are full-stack distributed ISO/OSI hierarchy [6]) and is inspired by security modeling systems in which multiple layers, (sub)systems, and dynamics performed in the cloud computing [7], [8]. As our next contri- interact together. Hence, they should leverage a secure and bution, we enrich the threat-risk assessment standard ISO/IEC resilient networking architecture, a robust consensus protocol, 15408 [9] to fit the blockchain infrastructure. We achieve this arXiv:1910.09775v3 [cs.CR] 28 Oct 2020 and a safe environment for building higher-level applica- by embedding the stacked model into this standard. tions. Although most of the deployed blockchains need better This paper is based on our previous work outlining the scalability and well-aligned incentives to unleash their full security reference architecture [10]. We substantially modify potential, their security is undoubtedly a critical factor for and extend it by the following: their success. As these systems are actively being developed • We provide a theoretical background related to the and deployed, it is often challenging to understand how secure security reference architecture and the environment of they are, or what security implications are introduced by some blockchains, their types, failure models, consensus pro- specific components they consist of. Moreover, due to their tocols, design goals, and means to achieve these goals. complexity and novelty (e.g., built-in protocol incentives), • For each layer, we model particular attacks or their cate- their security assessment and analysis requires a more holistic gories through vulnerability/threat/defense graphs, while view than in the case of traditional distributed systems. we provide reasoning about several important relations and causalities in these graphs. © 2020 IEEE. Personal use of this material is permitted. Permission from • We modify and significantly extend the application layer, IEEE must be obtained for all other uses, in any current or future media, where we propose a novel functionality-oriented catego- including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers rization, as opposed to the application-domain-oriented or lists, or reuse of any copyrighted component of this work in other works. categorizations presented in related work [11], [12]. 2 75 75 • We extend and revise the consensus layer by mining-pool- 61 specific attacks, time-spoofing attacks, and we provide a 60 59 60 more fine-grained categorization. 46 47 45 43 45 42 • For each layer, we present an incident table that lists and 38 29 29 briefly describes examples of attacks that have occurred 30 30 26 Total #References 17 Total #References worldwide: either caused by malicious parties or by 15 15 9 researchers who demonstrated their practical feasibility. 0 0 • In the lessons learned, we describe the hierarchy of RSM RSM Survey Survey Network Network security dependencies among particular categories, based Consensus Consensus on which, we propose a methodology for designers of App. (Ecosystem)App. (High-Level) App. (Ecosystem)App. (High-Level) blockchain platforms and applications. (a) All references (b) Academic references The rest of the paper is organized as follows: We de- Figure 1: Blockchain-specific references per category. scribe the scope and methodology of our research as well as 58 25 60 Network quantitative analysis of the included literature in Section II. Consensus In Section III, we summarize the background on blockchain 20 RSM App. (Ecosystem) 40 37 systems. Next, in Section IV we introduce the security ref- 15 App. (High-Level) erence architecture whose layers are discussed in the follow- 29 Survey 23 10 up sections. In detail, Section V deals with the security and 20 11 12 privacy of the network layer, Section VI focuses on the 8 5 Total # Academic References 3 consensus layer, Section VII overviews the replicated state 1 1 machine layer, and Section VIII with Section IX describe 0 0 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 applications built on top of the blockchain. In Section X, (a) #References per year (b) #References per year/category we elaborate on lessons learned and propose a methodology for designers of blockchain-based solutions. We discuss the Figure 2: Blockchain-specific academic references over time. limitations of our work in Section XI and we compare our research to related work in Section XII. Finally, we conclude blockchain infrastructure and outside of the extra infrastructure the paper in Section XIII. required for certain blockchain-based applications. Out-of- scope examples are remote exploitation of arbitrary devices (e.g., covert mining/crypto-jacking [14]) and issues related to II. METHODOLOGY &SCOPE using blockchain explorers (e.g., spoofing attacks, availability In contrast to conventional survey approaches, such as issues). Examples of vulnerabilities that we assume only grounded theory for rigorous literature review [13], we do tangentially are semantic bugs and programming errors in not sample included research from existing databases queried the infrastructure of the blockchains – we assume that core with specific terms. Instead, we study and analyze security- blockchain infrastructure is implemented correctly, uses secure oriented literature for vulnerabilities and threats related to cryptographic primitives, and provides expected functionality. the blockchain infrastructure. The literature that we select as the input mainly covers existing blockchain-oriented surveys A. Quantitative Analysis as well as various conferences and journals in security and distributed computing. Moreover, we include other materials For a quantitative summary of the literature, we considered published in preprints, whitepapers, products’ documentation, only the references from the main sections that correspond to and forums, which are also related. particular layers of the proposed stacked model (i.e., Section V We aim to consolidate the literature, categorize found vul- to Section IX) and related work (Section XII). We excluded nerabilities and threats according to their origin, and as a references from other sections and the references on the result, we create four main categories (also referred to as examples of incidents