# Securing Blockchain-Based Supply Chain Workflow against Internal and External Attacks
## 2 Proposed Methodology
### Constraints
* Allows adding constraints and configurations to protect the execution at runtime; and (c) Stores interaction-related information and constraints in the MySQL database. * **Client** is a web application client that provides an interface for interactions among all corresponding entities involved in the workflow process. * **Distributed ledger application (DLA)** is a smart contract-based distributed ledger (Ethereum [20, 22]) implemented using Solidity--a blockchain implementation language [21]--that: (a) Records all the requests (from the client) and responses (from the server) to prevent process workflow inconsistencies among the corresponding entities and to allow for future audits of the process; and (b) Executes smart contracts that automatically enforce the security and compliance of the business process workflow. * **Database** is a MySQL-based storage of business information, which is exchanged between the client and the server. It does not need to be recorded on the public distributed ledger; it relates to entities and their data and other sensitive information. Note that, in Figure 2, we assume that green components are trusted, while yellow ones may be compromised. The implementation workflow is essentially a two-stage process that is described in the following subsections. ### Stage 1

A client initiates the process (e.g., by requesting the server to register the participating entities and their roles for a given process). The request will be simultaneously sent to the DLA and the WMA, where the WMA will first check if the private and local information of the request (e.g., requesting and requested user, role, organization) is valid, which means that the information respects the required private business rules:

* _IF_ validated, then the DLA (a) Checks the compliance of the request with the workflow smart contract; (b) Records the desired information; and (c) Sends a positive acknowledgement to the WMA to process the request. * _IF NOT_ validated, then the DLA (a) Sends a negative acknowledgement to the WMA to deny the request; (b) Records the essential information; and (c) Records the negative response information for future reference of the request's trust. Figure 2: Workflow architecture of the proposed approach. ### Stage 2

Once validated by the DLA, the WMA will process the request (e.g., store the necessary information) and will produce the desired response, which will be first sent to the DLA for a compliance check with the contract:

1. _If_ the response is found valid and compliant, then the DLA 1. _Sends a positive acknowledgement to the WMA; and 2. _The WMA also sends the response to the client. Importantly, the response includes essential information from the request to ensure that the right client is receiving the response. 2. _Otherwise_, the DLA 1. _Records the essential information about the negative response; and 2. _Suspends the process by sending an appropriate signal to the client._

Based on the above request-response style, the entire process workflow (e.g., interactions among entities) will be automatically executed by the smart contracts and recorded on the blockchain-based distributed ledger. In detail, the WMA application is a Java-based web portal that works as a supply chain management ICT application, and includes the following modules:

1. **Organize module**, which performs the following operations: * User registration--by providing the user's details. * Organization registration--by providing the organization's information and its role in the supply chain process, e.g., supplier or consumer. 2. **Procurement module**, which performs the following operations: * Issuance of purchase requisition--by adding product details that may include up to five items. * Review of purchase requisition--by approving the best requisition. 3. **Supplier module**, which performs the following operations: * Issuance of quotation--by listing the amount for the product. * Preparing supply of the product--by issuing the exact product details of the shipment. 4.