# Securing Blockchain-Based Supply Chain Workflow against Internal and External Attacks
## 2 Proposed Methodology
### Constraints
Considering that the supply chain application is a web-based application and it requires communication with many other remote components, the overhead is indeed negligible, which proves that the prototype is efficient and can detect the threats in real-time. Furthermore, detecting external attacks is challenging mainly because it may involve some components that are beyond the control of monitor. Therefore, we demonstrated an attack scenario through a clever way, in which we only notified the safe stakeholders to the system. ### Complementary Protection to Blockchain-Based System

In this subsection, we discuss the relationship of our protection mechanism with blockchain-based solutions. In fact, our monitor supports protection to the supply chain process and its stakeholders, complementary to what is protected by the blockchain. For instance, we see the blockchain as a central security monitor that is responsible for protecting the collective behavior of the stakeholders limited to their interactions for a specific process. Our monitor is a local security monitor that is responsible for protecting the local behavior of each stakeholder, thus ensuring the end-to-end protection of the supply chain process. Furthermore, in the case of external attacks, the local/distributed monitor can share the information with the blockchain, which can either reconfigure the system to protect against a specific attack or can initiate other appropriate mitigation strategies. The blockchain is mainly used for transparency, traceability, and auditing of the involved stakeholders to improve their confidence in the system. For instance, in the face of an external attack, all stakeholders can verify that their latter interactions did not involve a compromised stakeholder. The blockchain can also be used as a verification method that \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Process** & **Operation** & **Type** & \
\begin{tabular}{c} **Normal Execution** \\ **Time (s)** \\ \end{tabular} &
\begin{tabular}{c} **Threat Detection** \\ **Time (s)** \\ \end{tabular} & **Overhead** \\ \hline \multirow{4}{*}{Procurement} & Issue & Application & 0.00213 & 0.00215 & 0.9389\% \\  & & Contract & 0.00502 & 0.00509 & 1.3752\% \\  & Review & Application & 0.00310 & 0.00313 & 0.9584\% \\  & & Contract & 0.00510 & 0.00517 & 1.3539\% \\ \hline \multirow{4}{*}{Supplier} & Issue & Application & 0.00312 & 0.003152 & 1.0152\% \\  & & Contract & 0.00518 & 0.00525 & 1.3333\% \\  & Review & Application & 0.00407 & 0.00410 & 0.7317\% \\  & & Contract & 0.00520 & 0.00525 & 0.9523\% \\ \hline \multirow{4}{*}{Warehouse} & Issue & Application & 0.00413 & 0.00417 & 0.9592\% \\  & & Contract & 0.00525 & 0.00532 & 1.3157\% \\ \cline{1-1}  & Review & Application & 0.00412 & 0.00416 & 0.9615\% \\ \cline{1-1}  & & Contract & 0.00537 & 0.00543 & 1.1049\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Evaluation of external attacks. ensures that our protection is indeed enforced. For instance, by providing evidence that only safe stakeholders were involved in a bidding and compromised stakeholders were indeed excluded from the process. ## 7 Related Work

The key focus of the contemporary approaches has been to employ blockchain to ensure traceability, anti-counterfeiting, trust, and auditing of the entities involved in the supply chain process. To the best of our knowledge, no effort has been made to protect blockchain-based systems against internal or external attacks. Therefore, in this section, we discuss various attempts that have developed secure supply chain processes based on blockchain in various application domains. For instance, Everledger [23] has been developed to track valuable items, e.g., diamonds, gemstones, wines, and artwork. The tool maintains a recorded history of various valuable items that need provenance with transparency. To this end, the tool records ownership of products and their history of access and profile. With blockchain-based records, the items become tamper-proof and their authenticity can be established automatically.