# Securing Blockchain-Based Supply Chain Workflow against Internal and External Attacks
## 2 Proposed Methodology
### Constraints
Our threat model is generic enough to integrate any architecture among the supply chain network, and it is capable of integrating any distributed sub-system, e.g., various warehouses that may be located in different physical locations. Analogously, a BSW is a typical supply chain application that requires an infrastructure to handle blockchain technology. The infrastructure includes smart contracts that usually ensure secure interactions among parties, and a distributed ledger that stores all the corresponding interactions. The focus of this work is to protect existing BSW systems against internal computational and external communication attacks as depicted in Figure 1, which is adapted from [17]. ### Internal Attack

In a supply chain process, a supply chain workflow performs _business computations_ that typically implement rules of business processes in an application and _interaction computations_ that typically implement interactions in a smart contract. Therefore, the process is protected when its execution is protected. In an internal computational attack, the adversary aims to compromise the functionality of the supply chain setting by various means. For instance, the adversary may compromise the functionality either by modifying the execution of the workflow process application or smart contracts, or by exploiting any vulnerability or bug in the application or contract, its execution engine or workflow implementation. This attack can be viewed as analogous to a Stuxnet attack [18]. The attack can compromise the internal infrastructure of either the stakeholder or blockchain. The internal infrastructure involves software applications that implement the supply chain process and corresponding smart contracts. Examples of the internal threats are sketched in Figure 1.

### External Attack

The _external communication process_ of the workflow is responsible for the exchange of data among different parties (processes or people) involved in the supply chain. In an external communication attack, the adversary aims to compromise the information that is exchanged among various connected services. For instance, the adversary may compromise the information either by leaking the data of the involved parties, tampering input values to smart contracts or other components, or by breaching the integrity of the communication by selective forward and drop tactics, or by injecting false information based on mining of public contracts and the ledger. The attack can compromise the external infrastructure of either the stakeholder or blockchain. In fact, some attacks first compromise the other applications to steal data of the involved stakeholders or blockchain (e.g., customer data breach of British Airways [19]), which are then used by the adversary to compromise the actual stakeholder or blockchain infrastructure, e.g., breach of customer or business data by another attack as evidenced by recent attacks. Examples of external threats are sketched in Figure 1.

To demonstrate our methodology, the above-mentioned attacks may also involve _internal_ and _external_ attacks and sources. The former one includes Stuxnet-like attacks that can modify the application, while the latter one occurs when some involved stakeholder is under an external attack that causes a cascaded effect on the supply chain workflow process. ## 4 Implementation

To realize the objectives mentioned in Section 2, we developed a distributed web application that uses an Ethereum [20; 21]-based blockchain to record the interactions among supply chain process entities. The key elements of the approach and its workflow are shown in Figure 2. The four main components of the prototype are the following:

1. **Workflow manager application (WMA)** is a Java-based server application that (a)  Implements all the business rules for the workflow process; and

Figure 1: Threat model. Internal threats (red-dotted area): blockchain infrastructure; External threats (blue-dotted area): stakeholder’s infrastructure.