# Securing Blockchain-Based Supply Chain Workflow against Internal and External Attacks
## 2 Proposed Methodology
### Constraints
For instance, references [30] developed smart pharmaceutical system by employing a blockchain that recommends various drugs in a traceable and auditable way. In other efforts, [31; 32] employed blockchain to improve governance of the drugs to improve the trust between patients and health systems. In [33; 34], the authors focused on using blockchain to trace the drugs by targeting inaccurate information, lack of transparency, and limited data provenance. Furthermore, their solution ensures the absence of the counterfeit drugs, which not only has a serious adverse impact on human health but also causes severe economic loss to the healthcare industry. For further case studies, projects, and applications of supply chains in various application domains, the authors kindly direct interested readers to a very comprehensive survey [6] that exhaustively investigated academic and industrial blockchain-based solutions for supply chains. Despite enormous efforts in developing blockchain-based secure supply chain processes, clearly, the aforementioned approaches are mainly focused on using blockchain to ensure transparency, trust, and authenticity of products in various application domains and not on protecting the blockchain-based supply chain process against internal or external attacks. Therefore, in contrast to the above-mentioned approaches, we developed a solution that

1. Allows to define a customized supply chain process based on participating entities and interactions among them and underlying business policies/rules for the process; and
2. Ensures that the blockchain-based supply chain process is protected against internal and external attacks. The customized but dynamic constraints allow protecting the system against internal and external attacks that otherwise cannot be detected, with blockchain being unaware of the current real-time state of the system and/or process. Our approach is comparable to a very recent effort [35], where the authors developed a runtime monitor to protect the blockchain-based supply chain process. However, the developed solution is focused only on detecting internal attacks that arise from various vulnerabilities of the underlying systems (e.g., smart contracts). Furthermore, the approach does not detect internal attacks that can happen to various stakeholders in the process. ## 8 Conclusions and Future Work

We introduced a novel blockchain-based supply chain workflow management for a supply chain management system that is protected against internal and external attacks. Furthermore, the interactions among participating entities are stored in a distributed ledger to ensure transparency, traceability, and trust among parties. The novelty of the methodology is associated with the fact that it allows for the addition of dynamic constraints that provide enhanced protection to the system against internal and external attacks. We also argued about the feasibility of the approach through its application to an example supply chain process. The developed prototype successfully detected internal and external attacks, in real-time, without compromising the performance of the actual system. Currently, our monitor may allow some unsafe constraints to be executed, on the one hand, and may not monitor any arbitrary constraint due to limited expressiveness of the underlying language, on the other hand; therefore, as a future work, we plan to allow only safe and valid constraints that do not introduce any extra or insecure behaviours. Furthermore, the real-time performance of the monitor may also be compromised, if a constraint requires communication with external components to verify them. Conceptualization, S.A.-F., H.B. and S.B. ; methodology, S.A.-F.; investigation, S.A.F. ; writing--original draft preparation, S.A.-F.; writing--review and editing, S.A.-F. and H.B. ; supervision, H.B. and S.B. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable.