Publication result detail

The Security Reference Architecture for Blockchains: Toward a Standardized Model for Studying Vulnerabilities, Threats, and Defenses

HOMOLIAK, I.; VENUGOPALAN, S.; REIJSBERGEN, D.; HUM, Q.; SCHUMI, R.; SZALACHOWSKI, P.

Original Title

The Security Reference Architecture for Blockchains: Toward a Standardized Model for Studying Vulnerabilities, Threats, and Defenses

English Title

The Security Reference Architecture for Blockchains: Toward a Standardized Model for Studying Vulnerabilities, Threats, and Defenses

Type

WoS Article

Original Abstract

Blockchains are distributed systems, in which security is a critical factor for their success. However, despite their increasing popularity and adoption, there is a lack of standardized models that study blockchain-related security threats. To fill this gap, the main focus of our work is to systematize and extend the knowledge about the security and privacy aspects of blockchains and contribute to the standardization of this domain.
We propose the security reference architecture (SRA) for blockchains, which adopts a stacked model (similar to the ISO/OSI) describing the nature and hierarchy of various security and privacy aspects. The SRA contains four layers: (1) the network layer, (2) the consensus layer, (3) the replicated state machine layer, and (4) the application layer. At each of these layers, we identify known security threats, their origin, and countermeasures, while we also analyze several cross-layer dependencies. Next, to enable better reasoning about security aspects of blockchains by the practitioners, we propose a blockchain-specific version of the threat-risk assessment standard ISO/IEC 15408 by embedding the stacked model into this standard. Finally, we provide designers of blockchain platforms and applications with a design methodology following the model of SRA and its hierarchy.

English abstract

Blockchains are distributed systems, in which security is a critical factor for their success. However, despite their increasing popularity and adoption, there is a lack of standardized models that study blockchain-related security threats. To fill this gap, the main focus of our work is to systematize and extend the knowledge about the security and privacy aspects of blockchains and contribute to the standardization of this domain.
We propose the security reference architecture (SRA) for blockchains, which adopts a stacked model (similar to the ISO/OSI) describing the nature and hierarchy of various security and privacy aspects. The SRA contains four layers: (1) the network layer, (2) the consensus layer, (3) the replicated state machine layer, and (4) the application layer. At each of these layers, we identify known security threats, their origin, and countermeasures, while we also analyze several cross-layer dependencies. Next, to enable better reasoning about security aspects of blockchains by the practitioners, we propose a blockchain-specific version of the threat-risk assessment standard ISO/IEC 15408 by embedding the stacked model into this standard. Finally, we provide designers of blockchain platforms and applications with a design methodology following the model of SRA and its hierarchy.

Keywords


Reference architecture, blockchains, distributed
ledgers, security, privacy, vulnerabilities, threats, ISO/IEC 15408

Key words in English


Reference architecture, blockchains, distributed
ledgers, security, privacy, vulnerabilities, threats, ISO/IEC 15408

Authors

HOMOLIAK, I.; VENUGOPALAN, S.; REIJSBERGEN, D.; HUM, Q.; SCHUMI, R.; SZALACHOWSKI, P.

RIV year

2022

Released

15.03.2021

ISBN

1553-877X

Periodical

IEEE Communications Surveys and Tutorials

Volume

23

Number

1

State

United States of America

Pages from

341

Pages to

390

Pages count

50

URL

https://doi.org/10.1109/COMST.2020.3033665

BibTex

@article{BUT168173,
  author="HOMOLIAK, I. and VENUGOPALAN, S. and REIJSBERGEN, D. and HUM, Q. and SCHUMI, R. and SZALACHOWSKI, P.",
  title="The Security Reference Architecture for Blockchains: Toward a Standardized Model for Studying Vulnerabilities, Threats, and Defenses",
  journal="IEEE Communications Surveys and Tutorials",
  year="2021",
  volume="23",
  number="1",
  pages="341--390",
  doi="10.1109/COMST.2020.3033665",
  url="https://doi.org/10.1109/COMST.2020.3033665"
}

Documents

IEEE-COMST-2021-Homoliak_clanek
Security_Reference_popis