Secure blockchain in the enterprise: A methodology

Abstract

The adoption of blockchain in a software architecture should be perceived as a double-edged sword: if on the one hand, it allows to achieve benefits in terms of auditability, strong integrity protection and virtual tokens management, on the other hand they come together with peculiarities, like immutability, that need to be properly considered; for example, in the interaction with personal data, blockchain adoption may result particularly critical. Therefore, in order to guide software architects wishing to leverage the potential of an existing blockchain technology for their solutions, we propose a list of security threats specific to blockchain, integrated in a multi-staged architecture analysis approach based on threat modeling. It comprises methods for the evaluation and identification of the most suitable blockchain technology (if at all viable) for the scenario, coupled with design analysis processes which consider web application — as well as our blockchain-specific security threats. We illustrate our approach through a paradigmatic example.

Introduction

The term “blockchain” has become popular in the last decade, also for the general public. Mainstream media used it extensively, especially to discuss and explain crypto-currencies, and the concepts were studied and analyzed by the finance research community (as examples, see [1], [2], [3]); Bitcoin [4] in particular, whose importance is demonstrated by observing its market capitalization, about 5B dollars in April 2019 [5]. Such interest is also motivated by the properties of blockchain technologies and their promises of decentralization, robustness, immutability, transparency and at the same time, anonymity. It is only natural, therefore, that the software engineering community begin to adopt the blockchain, in different technology flavors [6]. However, blockchain adoption requires specific cares, spanning from an understanding of the underpinnings to architectural and implementation details, that are not necessarily adopted everywhere [7]. Recent studies in the international development sector [8] seem to confirm this perception.

In this work, we propose our methodology for a secure adoption of blockchain technologies in enterprise software development projects. It relies on threat modeling as means to achieve a security-by-design and sound approach to software security. The methodology guides software architects in understanding if blockchain adoption should be considered or not, and in case, which flavors to consider. Subsequently, we focus on the security implications of blockchain adoption, by including in our proposal an extension to a well-known and industrial-adopted architecture review methodology, the Microsoft-developed threat modeling approach STRIDE [9]. We do so by proposing a list of blockchain-specific security risks. We aim in this way at maximizing the general applicability of our methodology, considering the broad scope of STRIDE.

To exemplify our methodology, we will follow the activities of a persona character, Alice, a software architect, that is about to start a new software project considering the inclusion of blockchain technologies.

Alice is starting her new software project. And as long as she remembers, she has been a big fan of retrogaming. Back in the times, she was spending countless hours playing shooter games at the arcade, always aiming at reaching place 1 in the leaderboard. Today she thinks about giving the new generation the thrill of this experience in a new kind of video game. She has the idea of a coin-operated game and of a global leaderboard; this makes her think that she may use a blockchain solution. Afew days of brainstorming later, she comes-up with an initial design. Now is the time to validate the concept from a security point of view by applying our blockchain-specific threat modeling methodology.

Threat modeling can be defined as “an approach for creating an abstraction of a software system, aimed at identifying attackers’ abilities and goals, and using that abstraction to generate and catalog possible threats that the system must mitigate”. It can integrate the early stages of a software development process, where software architectures are reviewed from a security perspective, effectively materializing a security-by-design approach. Among the threat modeling methods, we chose the Microsoft-developed STRIDE for its industrial adoption and support tool availability.¹ The methodology includes the analysis of a software architecture and its data flows according to a list of threats organized in the mentioned six threat categories. Its result is a list of actual threats for the software system under analysis.

Alice will then perform her analysis following our blockchain threat modeling methodology, composed of four different steps.

• Assess whether blockchain can be a viable solution at all for the project at hand, in a motto: “when to use the blockchain”.

• Analyze which blockchain implementation can be up to the task, i,e., “choosing a blockchain implementation”.

• Review threats specific to the building blocks of the chosen blockchain solution.

• Perform a traditional threat modeling assessment for the global solution.

The paper is structured as follows. Section 2 presents the main concepts on blockchains and on threat modeling that are relevant background for our contribution. The four steps of our methodology are covered in Section 3 with an introduction of our methodology, followed by Section 3.1 that presents our criteria to decide about the inclusion of blockchain technologies. Section 3.2 illustrates the different blockchain technologies and their usages, while the associated threats are presented in Section 3.3. The threat modeling analysis of Alice’s software project, considering our threat list, is presented in Section 3.4. Lastly, Section 4 shall offer a conclusion.