Security challenges and defense approaches for blockchain-based services from a full-stack architecture perspective  

作　　者：Hongsong Chen Xietian Luo Lei Shi Yongrui Cao Yongpeng Zhang 

机构地区：[1]Department of Computer Science,University of Science and Technology Beijing(USTB),Beijing,100083,China [2]Beijing Key Laboratory of Knowledge Engineering for Materials Science,Beijing,100083,China

出　　处：《Blockchain(Research and Applications)》2023年第3期18-38,共21页区块链研究（英文）

基　　金：supported by the National Key Research and Devel-opment Program of China(2018YFB0803403);Fundamental Research Funds for the Central Universities(FRF-AT-20-11)from the Ministry of Education of China。

摘　　要：As an advantageous technique and service,the blockchain has shown great development and application prospects.However,its security has also met great challenges,and many security vulnerabilities and attack issues in blockchain-based services have emerged.Recently,security issues of blockchain have attracted extensive attention.However,there is still a lack of blockchain security research from a full-stack architecture perspective,as well as representative quantitative experimental reproduction and analysis.We aim to provide a security architecture to solve security risks in blockchain services from a full-stack architecture perspective.Meanwhile,we propose a formal definition of the full-stack security architecture for blockchain-based services,and we also propose a formal expression of security issues and defense solutions from a full-stack security perspective.We use ConCert to conduct a smart contract formal verification experiment by property-based testing.The security vulnerabilities of blockchain services in the Common Vulnerabilities and Exposures(CVE)and China Nation Vulnerability Database(CNVD)are selected and enumerated.Additionally,three real contract-layer real attack events are reproduced by an experimental approach.Using Alibaba's blockchain services and Identity Mixer in Hyperledger Fabric as a case study,the security problems and defense techniques are analyzed and researched.At last,the future research directions are proposed.

关 键 词：Security and privacy Blockchain-based services Full stack Architecture perspective Case and experimental study Formal verification 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]