# Securing Blockchain-Based Supply Chain Workflow against Internal and External Attacks
## 1 Introduction  
Following the development of Industry 4.0 [1], where systems were developed by combining underlying cyber and physical resources, more recent technical developments (e.g., Industry 5.0 [2, 3], 5G [4], which aim to extend the role of industry to achieve some societal goals) have evolved the flow of industrial processes. As a result, current processes of supply chain workflow (i.e., involving demand and supply planning, procurement, manufacturing, warehousing, order fulfillment, and delivery business processes) have managed to allow several parties and stakeholders to communicate in a distributed but automated way. The process is highly distributed (i.e., external and third parties can communicate from different locations) and highly dynamic (i.e., any party can join during the process). Despite the significant progress in the development of automated techniques to manage the supply chain workflow, they still cannot be adapted for practical and industrial use due to lack of security, trust, and transparency among the participating parties. In particular, supply chain management's existing industrial workflow processes are only partially automated, implying that some third parties involved in the process may need to be integrated in a different way. Hence, such parties are not trustworthy and their activities cannot be traced for compliance or violation of the business rules and policies. Specifically, current supply chain process management involves severalchallenges, including data tampering, single point of failure with a centralized storage, dubious traceability information, distrust of authorities on data authenticity, and lack of provenance [5]. Although blockchain has helped to address these challenges partially through directly supporting traceability, data security, and authenticity, there are internal and external attacks that can compromise the supply chain process and its various entities and stakeholders [6]. The contemporary blockchain technology has been widely used in various application domains (e.g., finance, audit, energy [7], and health [8]) to ensure trust among components of distributed systems [6], on the one hand, and to guarantee traceability and fraud detection [9; 10], on the other hand. Blockchain is used as a distributed ledger database for recording transactions among parties that are verifiable [6; 11; 12]. Furthermore, the blockchain is capable of ensuring data immutability and public accessibility of data stores, which eventually increases the reliability, security, and transparency of each participating entity of the workflow process. More recently, some authors have developed blockchain-based management of the supply chain processes in different application domains, including fresh food delivery [13], pharmaceutical [14], logistics [13; 15] and agriculture [16]. However, these solutions cannot be directly applied to ensure a secure supply chain workflow as they do not support transparent and trusted partially automated workflow processes that involve a third party, on the one hand, and fail to ensure consistency of products and business operations (i.e., the supply chain process), on the other hand. Although blockchain ensures data integrity and provides protection against data tampering attacks by chaining data in a secure-hash way, many supply chain systems have been developed (using blockchain and related technologies) by academia and industries. Most of the academia research has focused on the use of blockchain technology to protect the information exchanged among different business stakeholders. These research efforts have lead to successful detection of attacks that are related to information leakage and tampering [6]. The current blockchain-based supply chain solutions aim to protect communications among distributed components of a business but are limited in detecting any threat that arises from any other layer of the architecture, e.g., the application.