Dejan Podgorsek - Is Hyperledger Fabric secure enough for your Business?

Is Hyperledger Fabric secure
enough for your Business?
Cybersecurity with Blockchain
HackIT 4.0, Kyiv

Name: Dejan Podgoršek
Company: IBM
Position: IBM Software Channel Technical Leader, CEE
https://www.linkedin.com/in/dejanpodgorsek
/
dejan.podgorsek@si.ibm.com
HackIT 4.0, Kyiv

Is Hyperledger Fabric secure
enough for your Business?
Cybersecurity with Blockchain
HackIT 4.0, Kyiv
Agenda
• About Blockchain
• Why Hyperledger Fabric (HLF) for Business
• Some Use Cases
--------------------------------------------------------------------
• Could Blockchain be a hacker’s dream come true?
• CIA and Blockchain Hyperledger Fabric
&
• How to protect your Blockchain APIs and HLF network

What is Blockchain?
• A chain (sequence, typically a hash chain) of blocks of transactions
#234 #235 #236…#1
#0
Genesis
block
datastructure
Node A Node E
Node B Node D
Node C
Node F
Ledger
Ledger
Ledger
Ledger
Ledger
Ledger
Consensus
protocol ensures
ledger replicas
are identical*
network of (potentially)
untrusted nodes

© 2017 IBM Corporation
Functional requirements of blockchain for
business
9
• Append-only
• Shared through
replication
• Permissioned
• Business terms/logic
embedded on
blockchain
• Coded in high-level
programming
languages
• Ledger is the trusted
source of information
• Auditability
• Flexible trust models
• Confidentiality of
business logic, data
• Unlinkability of
transactions
Privacy
Shared ledger Smart
contrac
t
Trus
t

Key differentiating elements between blockchain protocols:
• Permission model (private vs. public)
• Consensus approach
• Smart contracts
• Extensibility & programmability
• APIs
• Scalability & latency
• Resource consumption
Multiple implementations of blockchain related protocols :
• Hyperleger Project @ Linux Foundation
• R3 Corda
• Ethereum
• Ripple
• Stellar
• Factom
• …and many more
There is not one blockchain protocol
10

IBM has a long provenance with
blockchain…
Aug 2015
IBM starts developing first prototype of blockchain technology (Open Blockchain); first client engagements
Feb 2016
IBM becomes a founding member of Linux Foundation Hyperledger; donates code and intellectual property
Jun 2016
IBM opens first blockchain garages for clients; Hyperledger Fabric v0.6 released
Dec 2016
Number of IBM blockchain client engagements now totals over 400
Feb 2017
First early program for Hyperledger Composer run in IBM Hursley
Jul 2017
Hyperledger Fabric v1.0 released
Aug 2017
IBM Blockchain Platform announced

Premier Members

members

HackIT 4.0, Kyiv
Overview of Hyperledger Fabric v1 – Design Goals
• Better reflect business processes by specifying who endorses transactions
• Support broader regulatory requirements for privacy and confidentiality
• Scale the number of participants and transaction throughput
• Eliminate non deterministic transactions
• Support rich data queries of the ledger
• Dynamically upgrade the network and chaincode
• Support for multiple credential and cryptographic services for identity
• Support for ”bring your own identity”

Open Governance
Anyone can join or contribute
Built from the ground up for enterprise
With a maturity model to help companies move to production
Performance
Supports up to 1000 tps*
Confidentiality and privacy
Built-in channels for isolation and membership services for signing and
encryption. Supports IBM Blockchain Platform.
Modularity and flexibility
Choice of consensus algorithms and programming languages
HackIT 4.0, Kyiv
Why Hyperledger Fabric?

16
Hyperledger Fabric V1 Architecture
Client
Application
SDK
(HFC)
Membership
Services
Peer
Endorser
Ledger
Committer
A
Chaincode B
!Events
Ordering-Service
O
O O
O

Fabric-CA

External-CA
Hyperledger Fabric Network
optionaloptional

17
Application proposes transaction
Endorsement policy:
• “E0, E1 and E2 must sign”
• (P3, P4 are not part of the policy)
Client application submits a transaction
proposal for Smart Contract A. It must
target the required peers {E0, E1, E2}
Sample transaction: Step 1/7 – Propose transaction
E0
E1
E2
Client
Application
S
D
K
Endorser Ledger
Committing
Peer
Application
Ordering Node
Smart Contract
(Chaincode)
Endorsement
Policy
Key:
Ordering-Service
O
O O
OP
P4P3
A
B
A
B
A
B
A
D

18
Sample transaction: Step 2/7 – Execute proposal
Endorsers Execute Proposals
E0, E1 & E2 will each execute the
proposed transaction. None of these
executions will update the ledger
Each execution will capture the set of
Read and Written data, called RW sets,
which will now flow in the fabric.
Transactions can be signed & encrypted
Key:
Ordering-Service
Endorser Ledger
Committing
Peer
Application
Ordering Node
Smart Contract
(Chaincode)
Endorsement
Policy
O
O O
O
E0
E1
E2
P
P4P3
A
B
A
B
A
B
A
D
Client
Application
S
D
K

19
Sample transaction: Step 3/7 – Proposal Response
Application receives responses
RW sets are asynchronously returned to
application
The RW sets are signed by each
endorser, and also includes each record
version number
(This information will be checked much
later in the consensus process)
Key:
Ordering-Service
Endorser Ledger
Committing
Peer
Application
Ordering Node
Smart Contract
(Chaincode)
Endorsement
Policy
O
O O
O
E0
E1
E2
P
P4P3
A
B
A
B
A
B
A
D
Client
Application
S
D
K

20
Sample transaction: Step 4/7 – Order Transaction
Responses submitted for ordering
Application submits responses as a
transaction to be ordered.
Ordering happens across the fabric in
parallel with transactions submitted by
other applications
(other applications)
Key:
Ordering-Service
Endorser Ledger
Committing
Peer
Application
Ordering Node
Smart Contract
(Chaincode)
Endorsement
Policy
O
O O
O
E0
E1
E2
P
P4P3
A
B
A
B
A
B
A
D
Client
Application
S
D
K

21
Ordering-Service
Sample transaction: Step 5/7 – Deliver Transaction
Orderer delivers to committing peers
Ordering service collects transactions
into proposed blocks for distribution to
committing peers. Peers can deliver to
other peers in a hierarchy (not shown)
Different ordering algorithms available:
• SOLO (Single node, development)
• Kafka (Crash fault tolerance)
O
O O
O
*
Key:
Endorser Ledger
Committing
Peer
Application
Ordering Node
Smart Contract
(Chaincode)
Endorsement
Policy
E0
E1
E2
P
P4P3
A
B
A
B
A
B
A
D
Client
Application
S
D
K

22
Ordering-Service
Sample transaction: Step 6/7 – Validate Transaction
Committing peers validate transactions
Every committing peer validates against
the endorsement policy. Also check RW
sets are still valid for current world state
Validated transactions are applied to the
world state and retained on the ledger
Invalid transactions are also retained on
the ledger but do not update world state
Endorser Ledger
Committing
Peer
Application
Ordering Node
Smart Contract
(Chaincode)
Endorsement
Policy
Key:
O
O O
O
E0
E1
E2
P
P4P3
A
B
A
B
A
B
A
D
Client
Application
S
D
K
* * *
*
*

23
Client
Application
S
D
K
Ordering-Service
Sample transaction: Step 7/7 – Notify Transaction
Committing peers notify applications
Applications can register to be notified
when transactions succeed or fail, and
when blocks are added to the ledger
Applications will be notified by each peer
to which they are connected!
!
!
!
! !
Key:
Endorser Ledger
Committing
Peer
Application
Ordering Node
Smart Contract
(Chaincode)
Endorsement
Policy
O
O O
O
E0
E1
E2
P
P4P3
A
B
A
B
A
B
A
D

24
Ordering-Service
O
O O
O
Hyperledger Channels
E0
E1
E2
E3
A
B
A
B
A
B
Peers finally instantiate the Chaincode on the channels they want to transact on:
$ peer chaincode instantiate ... –P ‘policy’
An Endorsement Policy is specified and once instantiated chaincode can process transactions.

HackIT 4.0, Kyiv
Blockchain with Confidentiality, Integrity and
Availability (CIA)
Confidentiality with Hyperledger Fabric
Attribute-based access control
support both chaincode and an entire fabric.
determine whether a user can execute any specific chaincode.
Hyperledger Fabric encryption literary
The smart contract can be configured to encrypt information or a subset of information in the
transaction.
This information will remain encrypted in the ledger with the key only being available to the
peer who is supposed to see and access it.

Chain Business Insights recently released a benchmark
survey of 42 supply chain professionals from companies
of various sizes and revenues, and more than a third of the
respondents indicated that they’re piloting or using
blockchain in their organizations. (A “1” in the chart below
signifies no knowledge of blockchain, whereas a “5”
signifies that the organization is already implementing the
technology.)
35.7% already implementing blockchain

27
Introducing IBM Food Trust
TM
built on Blockchain
technology
The IBM Food Trust solution is a set of modules
providing traceability to improve food transparency
and efficiency
Blockchain is used to create a trusted connection with
shared value for all ecosystem participants, including
end consumers
The solution offers connectors for interoperability and
leveraging existing standards (e.g., GS1)
Enterprise Ready leveraging the IBM Blockchain
Platform to provide enterprise level security and
scalability

28
Where are we on our journey?
Pork
Traceability /
safety
Mango
Traceability /
global trade
Onboarding agriculture,
ingredient suppliers, retailers,
CPGs, QSRs and others
2017 2018
Additional partners joined the IBM
Food Trust™ network, with growing
food data transactionsconducts traceability pilots
2016

Some examples by (selected) industry
31
Financial Public Sector Retail Insurance Manufacturing
• Trade Finance
• Cross currency
payments
• Mortgages
• Asset
Registration
• Citizen Identity
• Medical records
• Medicine supply
chain
• Supply chain
• Loyalty
programs
• Information
sharing (supplier
– retailer)
• Claims
processing
• Risk provenance
• Asset usage
history
• Claims file
• Supply chain
• Product parts
• Maintenance
tracking

What makes a good blockchain use case?
Identifying a good blockchain use-case is not always easy!
However there should always be:
1. A business problem to be solved
• That cannot be more efficiently solved with other
technologies
2. An identifiable business network
• With Participants, Assets and Transactions
3. A need for trust
• Consensus, Immutability, Finality or Provenance

IBM Hyperledger Fabric is built to provide private blockchain
solutions for industries as shown in the following diagram:

HackIT 4.0, Kyiv
Motivation #1 = SNOOP
• Hackers love to break into systems and gain access to sensitive
information.
• … a breach will occur at some time & assuming the hacker gets
in.
• Transactions and Smart Contracts are encrypted with best-
in-class cryptography technology, and the information could
only be accessed via the cryptographic keys.
https://www.ibm.com/blogs/insights-on-business/government/hack-blockchain-dont-bother/
Could Blockchain be a hacker’s dream come true, or
just not worth the effort?

HackIT 4.0, Kyiv
Motivation #2 = DISRUPT
• Hackers like to mess up business networks by
• modifying the underlying blockchain fabric (aka plumbing),
• corrupting transactions committed to the blockchain or
• modifying the Smart Contract.
• Hyperledger Fabric is open source.
• Malicious code modification attempts are quickly spotted, never make it to
verified code releases.
• Each block in the blockchain contains a digital fingerprint (#hash) of the contents
of the previous block, so rendering modification is impossible – “immutability”.
• Smart Contracts are also cryptographically protected and rendering modification
is a virtually impossible.
• If one network node is compromised, it would be quickly detected and rectified.

HackIT 4.0, Kyiv
Motivation #3 – DENY
• If the hacker can’t disrupt the business network, maybe he can
deny the participants access to their critical information systems.
• Mitigation approaches here are infrastructure dependent, and
protection methods against the many forms of denial of
service attack are well documented.
• The distributed nature of the shared ledger adds to the
overall resilience of the business network.

HackIT 4.0, Kyiv
SOLUTION:
Attribute-based access control
support both chaincode and an entire fabric.
determine whether a user can execute any specific chaincode.
Hyperledger Fabric encryption literary:
The smart contract can encrypt information or a subset of
information in the transaction.
This information will remain encrypted in the ledger with the key
only being available to the peer who is supposed to see and
access it.
CIA: Achieving confidentiality with Hyperledger
Fabric
Sources: https://www.packtpub.com/networking-and-servers/hands-cybersecurity-blockchain
http://composer-playground.mybluemix.net/

HackIT 4.0, Kyiv
Integrity is a way of avoiding any tampering of data.
Blockchain uses cryptographic hashing to ensure that the ledger remains tamper-
proof.
It is impossible to get the data back from the hash result or from the
message digest.
In Hyperledger Fabric, Committing a peer always validates the new block
before adding it to the ledger.
In case a peer is hacked means, that the block may get compromised from the
ledger.
SOLUTION:
To verifying chain integrity, each peer periodically validates its
blockchain and asks the peer to recheck whether a broken block is
detected.
Function: CheckChainIntegrity()
CIA: Achieving integrity with Hyperledger Fabric
Source: https://www.packtpub.com/networking-and-servers/hands-cybersecurity-blockchain

HackIT 4.0, Kyiv
Cyberattacks such as DDoS cause huge disruption to internet services and result
in websites becoming inaccessible
The decentralization nature of blockchain makes it harder to disrupt these
applications.
SOLUTION: No single point of failure
Even if one node in the blockchain goes down, the information can be
accessed and used by the rest of the nodes in the network. As all of the
nodes keep the exact copy of the ledger, it will always be up-to-date.
All of the nodes in the network are logically decentralized with their
ledger, and there is a zero probability of system failure.
CIA: Achieving availiability with Hyperledger
Fabric
Source: https://www.packtpub.com/networking-and-servers/hands-cybersecurity-blockchain

API
API
API
How to protect your Blockchain APIs and HLF network
ACME’s Enterprise
API Gateway & Management
(rate limiting, security, monitoring, permissions,
version management, etc)
A mutually beneficial ecosystem of suppliers &
consumers of APIs.
• Suppliers use APIs to securely provide
specific types of access to sensitive data (e.g.
an API to “Track my package” from ACME)
• Consumers call these API’s from their apps
to make them more useful (e.g. E-Retailer
building a package tracking panel into their
Order Status screen)
Order status
Order# 13593
Shipping status
Shipped on: 1/26/16
Currently in: Atlanta, GA
Estimated delivery: 1/31/16
E-Retailer
Mobile app
ACME
Shipping
ACME Firewall
view status at ACME.com
API
Hyperledger
Fabric Network
Ordering
-Service
O
O O
O

Advanced Threat
Detection
Insider Threat
Securing the
Cloud
Risk and Vuln
Management
Critical Data
Protection
Compliance
Incident
Response
How to protect your Blockchain APIs and HLF network
To effectively detect
threat, a broad
range of analytics
capabilities are
required, from
search, correlation
baselining, threat
intelligence,
machine learning,
and cognitive
analytics
Mind:
More than half of
data breaches
are caused by
insiders
SIEM apps/solutions are essential for success

HackIT 4.0, Kyiv
Or just run it on IBM Cloud as IBM Blockchain as a Service
Protect your new business model against malware and insider attacks with the highest
level of blockchain security available.
https://www.ibm.com/blockchain/platform

HackIT 4.0, Kyiv
Sources:
https://developer.ibm.com/technologies/blockchain/
https://www.ibm.com/blogs/insights-on-business/government/convergence-blockchain-cybersecurity/
and
https://www.packtpub.com/networking-and-servers/hands-cybersecurity-blockchain

Dejan Podgorsek - Is Hyperledger Fabric secure enough for your Business?

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Dejan Podgorsek - Is Hyperledger Fabric secure enough for your Business?

Similar to Dejan Podgorsek - Is Hyperledger Fabric secure enough for your Business? (20)

More from Hacken_Ecosystem

More from Hacken_Ecosystem (13)

Recently uploaded

Recently uploaded (20)

Dejan Podgorsek - Is Hyperledger Fabric secure enough for your Business?