Position: Home page » Blockchain » It is necessary to promote the safe and orderly development of b
It is necessary to promote the safe and orderly development of b
Publish: 2021-05-20 15:50:04
1.
Although driven by the influx of capital and talents, the blockchain instry ushered in rapid development, but as an emerging instry, the frequent warning of its security vulnerabilities caused people to worry about the risk of blockchain
Yu Kequn, director of the national information technology security research center, pointed out that the emergence of blockchain has brought people a lot of expectations for privacy exposure, data leakage, information tampering, network fraud and other issues. However, there are still many challenges in the security of blockchain 
Li Bin, assistant director of China Information Security Evaluation Center, analyzed that the current blockchain is divided into three types: public chain, private chain and alliance chain. No matter which type, it faces security challenges in algorithm, protocol, use, time limit and system. What is particularly critical is that the current blockchain is still facing 51% attack problem, that is, nodes can successfully tamper and forge blockchain data by mastering more than 51% of the network examples
it is worth noting that in addition to external malicious attack risk, blockchain also faces the threat of its endogenous risk. Yu Kequn reminded that how to build a complete security application system around the equipment, data, application, encryption, authentication and authority of the application system of the whole blockchain is an important problem that all parties must face
Wu Jia also analyzed that as an emerging instry, employees in the blockchain instry are lack of safety awareness, which leads to the low safety factor of the software and hardware related to the blockchain and a large number of security loopholes. In addition, there are many ecological links in the whole blockchain. In contrast, the strength of the relevant security employees is scattered and it is difficult to form a joint force to solve the problem. A systematic solution is needed to meet the above challenges
content source: zhongxin.com
2. Blockchain itself solves the problem of large-scale cooperation between strangers, that is, strangers can cooperate with each other without mutual trust. So how to ensure the trust between strangers to achieve mutual consensus mechanism? The centralized system uses trusted third-party endorsements, such as banks. In the eyes of the common people, banks are reliable and trustworthy institutions. The common people can trust banks to solve real disputes. But how does a decentralized blockchain guarantee trust
in fact, blockchain uses the basic principles of modern cryptography to ensure its security mechanism. The knowledge system involved in the field of cryptography and security is very complicated. Here, I only introce the basic knowledge of cryptography related to blockchain, including hash algorithm, encryption algorithm, information digest and digital signature, zero knowledge proof, quantum cryptography, etc. Through this lesson, you can learn how to ensure the confidentiality, integrity, authentication and non repudiation of the blockchain using cryptography technology
basic course lesson 7 basic knowledge of blockchain security
1. Hash algorithm (hash algorithm)
hash function (hash), also known as hash function. Hash function: hash (original information) = summary information. Hash function can map any length of binary plaintext string to a shorter (generally fixed length) binary string (hash value)
a good hash algorithm has the following four characteristics:
1. One to one correspondence: the same plaintext input and hash algorithm can always get the same summary information output
2. Input sensitivity: even if the plaintext input changes slightly, the newly generated summary information will change greatly, which is greatly different from the original output
3. Easy to verify: plaintext input and hash algorithm are public, anyone can calculate by themselves, and whether the output hash value is correct
4. Irreversibility: if there is only the output hash value, the hash algorithm can never dece the plaintext
5. Conflict avoidance: it is difficult to find two plaintexts with different contents, but their hash values are the same (collision)
for example:
hash (Zhang San lent Li Si 100000 yuan for 6 months) = 123456789012
such a record as 123456789012 is recorded in the account book
it can be seen that hash function has four functions:
simplify information
it is easy to understand, and the information after hashing becomes shorter
identification information
you can use 123456789012 to identify the original information, and summary information is also called the ID of the original information
hidden information
the account book is a record like 123456789012, and the original information is hidden
verification information
if Li Si cheated that Zhang San only lent Li Si 50000 when repaying, both parties can verify the original information with the hash value of 123456789012 recorded before
hash (Zhang San lent Li Si 50000 for 6 months) = 987654321098
987654321098 is completely different from 123456789012, which proves that Li Si lied, Then the information can't be tampered
common hash algorithms include MD4, MD5 and Sha series algorithms, and Sha series algorithms are basically used in mainstream fields. Sha (secure hash algorithm) is not an algorithm, but a group of hash algorithms. At first, it was SHA-1 series, and now the mainstream applications are sha-224, SHA-256, sha-384 and sha-512 algorithms (commonly known as SHA-2). Recently, Sha-3 related algorithms have been proposed, such as keccak-256 used by Ethereum
MD5 is a very classic hash algorithm, but unfortunately, both it and SHA-1 algorithm have been cracked. It is considered by the instry that its security is not enough to be used in business scenarios. Generally, sha2-256 or more secure algorithm is recommended
hash algorithm is widely used in blockchain. For example, in blocks, the latter block will contain the hash value of the previous block, and the content of the later block + the hash value of the previous block will jointly calculate the hash value of the later block, which ensures the continuity and non tamperability of the chain< Encryption and decryption algorithm is the core technology of cryptography, which can be divided into two basic types: symmetric encryption algorithm and asymmetric encryption algorithm. According to whether the key used in the encryption and decryption process is the same or not, the two modes are suitable for different needs, just forming a complementary relationship, and sometimes can be combined to form a hybrid encryption mechanism
symmetric cryptography (also known as common key cryptography) has the advantages of high computational efficiency and high encryption strength; Its disadvantage is that it needs to share the key in advance, which is easy to leak and lose the key. The common algorithms are des, 3DES, AES and so on
asymmetric cryptography (also known as public key cryptography) is different from the encryption and decryption key, and its advantage is that it does not need to share the key in advance; Its disadvantage is that it has low computational efficiency and can only encrypt short content. Common algorithms include RSA, SM2, ElGamal and elliptic curve series. Symmetric encryption algorithm is suitable for the encryption and decryption process of a large number of data; It can't be used in signature scenario: and it often needs to distribute the key in advance. Asymmetric encryption algorithm is generally suitable for signature scenario or key agreement, but it is not suitable for large amount of data encryption and decryption< Third, information digest and digital signature
as the name suggests, information digest is to hash the information content to obtain a unique digest value to replace the original and complete information content. Information digest is the most important use of hash algorithm. Using the anti-collision feature of hash function, information digest can solve the problem that the content has not been tampered
digital signature is similar to signing on paper contract to confirm contract content and prove identity. Digital signature is based on asymmetric encryption, which can be used to prove the integrity of a digital content and confirm the source (or non repudiation)
we have two requirements for digital signature to make it consistent with our expectation for handwritten signature. First, only you can make your own signature, but anyone who sees it can verify its validity; Second, we want the signature to be only related to a specific file and not support other files. These can be achieved by our asymmetric encryption algorithm above
in practice, we usually sign the hash value of information instead of the information itself, which is determined by the efficiency of asymmetric encryption algorithm. Corresponding to the blockchain, it is to sign the hash pointer. In this way, the front is the whole structure, not just the hash pointer itself< Zero knowledge proof means that the verifier can make the verifier believe that a certain conclusion is correct without providing any additional information to the verifier
zero knowledge proof generally meets three conditions:
1. Completeness: authentic proof can make the verifier successfully verify
2. Soundness: false proof can not make the verifier pass the verification
3. Zero knowledge: if you get proof, you can't get any information other than the proof information from the proof process< With more and more attention paid to the research of quantum computing and quantum communication, quantum cryptography will have a huge impact on the information security of cryptography in the future
the core principle of quantum computing is that qubits can be in multiple coherent superposition states at the same time. Theoretically, a large amount of information can be expressed by a small number of qubits and processed at the same time, which greatly improves the computing speed
in this way, a large number of current encryption algorithms are theoretically unreliable and can be cracked, so the encryption algorithm has to be upgraded, otherwise it will be broken by quantum computing
as we all know, quantum computing is still in the theoretical stage, which is far from large-scale commercial use. However, the new generation of encryption algorithms should consider the possibility of this situation.
in fact, blockchain uses the basic principles of modern cryptography to ensure its security mechanism. The knowledge system involved in the field of cryptography and security is very complicated. Here, I only introce the basic knowledge of cryptography related to blockchain, including hash algorithm, encryption algorithm, information digest and digital signature, zero knowledge proof, quantum cryptography, etc. Through this lesson, you can learn how to ensure the confidentiality, integrity, authentication and non repudiation of the blockchain using cryptography technology
basic course lesson 7 basic knowledge of blockchain security
1. Hash algorithm (hash algorithm)
hash function (hash), also known as hash function. Hash function: hash (original information) = summary information. Hash function can map any length of binary plaintext string to a shorter (generally fixed length) binary string (hash value)
a good hash algorithm has the following four characteristics:
1. One to one correspondence: the same plaintext input and hash algorithm can always get the same summary information output
2. Input sensitivity: even if the plaintext input changes slightly, the newly generated summary information will change greatly, which is greatly different from the original output
3. Easy to verify: plaintext input and hash algorithm are public, anyone can calculate by themselves, and whether the output hash value is correct
4. Irreversibility: if there is only the output hash value, the hash algorithm can never dece the plaintext
5. Conflict avoidance: it is difficult to find two plaintexts with different contents, but their hash values are the same (collision)
for example:
hash (Zhang San lent Li Si 100000 yuan for 6 months) = 123456789012
such a record as 123456789012 is recorded in the account book
it can be seen that hash function has four functions:
simplify information
it is easy to understand, and the information after hashing becomes shorter
identification information
you can use 123456789012 to identify the original information, and summary information is also called the ID of the original information
hidden information
the account book is a record like 123456789012, and the original information is hidden
verification information
if Li Si cheated that Zhang San only lent Li Si 50000 when repaying, both parties can verify the original information with the hash value of 123456789012 recorded before
hash (Zhang San lent Li Si 50000 for 6 months) = 987654321098
987654321098 is completely different from 123456789012, which proves that Li Si lied, Then the information can't be tampered
common hash algorithms include MD4, MD5 and Sha series algorithms, and Sha series algorithms are basically used in mainstream fields. Sha (secure hash algorithm) is not an algorithm, but a group of hash algorithms. At first, it was SHA-1 series, and now the mainstream applications are sha-224, SHA-256, sha-384 and sha-512 algorithms (commonly known as SHA-2). Recently, Sha-3 related algorithms have been proposed, such as keccak-256 used by Ethereum
MD5 is a very classic hash algorithm, but unfortunately, both it and SHA-1 algorithm have been cracked. It is considered by the instry that its security is not enough to be used in business scenarios. Generally, sha2-256 or more secure algorithm is recommended
hash algorithm is widely used in blockchain. For example, in blocks, the latter block will contain the hash value of the previous block, and the content of the later block + the hash value of the previous block will jointly calculate the hash value of the later block, which ensures the continuity and non tamperability of the chain< Encryption and decryption algorithm is the core technology of cryptography, which can be divided into two basic types: symmetric encryption algorithm and asymmetric encryption algorithm. According to whether the key used in the encryption and decryption process is the same or not, the two modes are suitable for different needs, just forming a complementary relationship, and sometimes can be combined to form a hybrid encryption mechanism
symmetric cryptography (also known as common key cryptography) has the advantages of high computational efficiency and high encryption strength; Its disadvantage is that it needs to share the key in advance, which is easy to leak and lose the key. The common algorithms are des, 3DES, AES and so on
asymmetric cryptography (also known as public key cryptography) is different from the encryption and decryption key, and its advantage is that it does not need to share the key in advance; Its disadvantage is that it has low computational efficiency and can only encrypt short content. Common algorithms include RSA, SM2, ElGamal and elliptic curve series. Symmetric encryption algorithm is suitable for the encryption and decryption process of a large number of data; It can't be used in signature scenario: and it often needs to distribute the key in advance. Asymmetric encryption algorithm is generally suitable for signature scenario or key agreement, but it is not suitable for large amount of data encryption and decryption< Third, information digest and digital signature
as the name suggests, information digest is to hash the information content to obtain a unique digest value to replace the original and complete information content. Information digest is the most important use of hash algorithm. Using the anti-collision feature of hash function, information digest can solve the problem that the content has not been tampered
digital signature is similar to signing on paper contract to confirm contract content and prove identity. Digital signature is based on asymmetric encryption, which can be used to prove the integrity of a digital content and confirm the source (or non repudiation)
we have two requirements for digital signature to make it consistent with our expectation for handwritten signature. First, only you can make your own signature, but anyone who sees it can verify its validity; Second, we want the signature to be only related to a specific file and not support other files. These can be achieved by our asymmetric encryption algorithm above
in practice, we usually sign the hash value of information instead of the information itself, which is determined by the efficiency of asymmetric encryption algorithm. Corresponding to the blockchain, it is to sign the hash pointer. In this way, the front is the whole structure, not just the hash pointer itself< Zero knowledge proof means that the verifier can make the verifier believe that a certain conclusion is correct without providing any additional information to the verifier
zero knowledge proof generally meets three conditions:
1. Completeness: authentic proof can make the verifier successfully verify
2. Soundness: false proof can not make the verifier pass the verification
3. Zero knowledge: if you get proof, you can't get any information other than the proof information from the proof process< With more and more attention paid to the research of quantum computing and quantum communication, quantum cryptography will have a huge impact on the information security of cryptography in the future
the core principle of quantum computing is that qubits can be in multiple coherent superposition states at the same time. Theoretically, a large amount of information can be expressed by a small number of qubits and processed at the same time, which greatly improves the computing speed
in this way, a large number of current encryption algorithms are theoretically unreliable and can be cracked, so the encryption algorithm has to be upgraded, otherwise it will be broken by quantum computing
as we all know, quantum computing is still in the theoretical stage, which is far from large-scale commercial use. However, the new generation of encryption algorithms should consider the possibility of this situation.
3. 1) First of all, it defines the technical value and positioning of the blockchain. As I said at the beginning, the positioning of the blockchain should take the blockchain as an important breakthrough for core technology and independent innovation
2) blockchain, Internet and artificial intelligence should be regarded as technologies of the same height, and blockchain should formally enter our hard science and technology development category
3) pointed out the development and application direction of our blockchain, including the speech that the technology of blockchain has extended to many fields, such as digital finance, Internet of things, intelligent manufacturing, supply chain management, digital asset trading, and so on. In terms of application, there will inevitably be some regulatory or legal problems in the process of application, What are the instructions in this speech? He mentioned that we should implement the rule of law in the management of blockchain, and promote the safe and orderly development of blockchain
4) in the more important point of application and development, it is mentioned that the blockchain is from virtual to real, enabling entity, improving people's livelihood, obtaining instrial advantages, and better serving the development of the whole instrial economy. In fact, through the study of blockchain technology, from one side or the signal released, we express our attitude towards the innovation and leadership of blockchain. We hope that in the development of blockchain, we can first have our own core technology, and we should be a leader in today's fierce international competition
5) it is to enhance the market confidence of the whole blockchain instry, especially for the application and development of the whole blockchain technology. With a great increase in market confidence, it is bound to attract more people in the next period of time, including the capital market and for example, more talents and research applications will enter this field. More capital, more manpower and more other social related aspects, including the rule of law and legislation, will positively promote the application and landing of the whole blockchain technology. These are my four points of view or summary of blockchain technology learning
if you have been concerned about blockchain for a long time, in fact, from the national level, including the 13th five year plan, blockchain technology has been written into the 13th five year plan, which is developed as a parallel technology with artificial intelligence, big data and cloud computing. It has been introced in the second half of 2018, and the office of network information technology has put the blockchain application service on record, From all aspects, it is actually a positive guidance or protection for the development of the whole blockchain
of course, when it comes to blockchain, you may also say that blockchain always thinks of money speculation and so on. In fact, digital currency is only a relatively narrow field in the field of blockchain. We now include support from the mainstream of modern society or the national level, and more support for the application of blockchain technology in the real instry, The core advantage of blockchain technology is decentralization, which can realize point-to-point transaction, coordination and cooperation based on decentralized credit in the distributed system without mutual trust by means of data encryption, timestamp, distributed consensus and economic incentives, so as to solve the common high cost and low cost problems of centralized institutions Low efficiency and data storage insecurity provide solutions
the application fields of blockchain include digital currency, token, finance, anti-counterfeiting traceability, privacy protection, supply chain, entertainment, etc. with the popularity of blockchain and bitcoin, many related top domain names have been registered, which has a great impact on the domain name instry.
2) blockchain, Internet and artificial intelligence should be regarded as technologies of the same height, and blockchain should formally enter our hard science and technology development category
3) pointed out the development and application direction of our blockchain, including the speech that the technology of blockchain has extended to many fields, such as digital finance, Internet of things, intelligent manufacturing, supply chain management, digital asset trading, and so on. In terms of application, there will inevitably be some regulatory or legal problems in the process of application, What are the instructions in this speech? He mentioned that we should implement the rule of law in the management of blockchain, and promote the safe and orderly development of blockchain
4) in the more important point of application and development, it is mentioned that the blockchain is from virtual to real, enabling entity, improving people's livelihood, obtaining instrial advantages, and better serving the development of the whole instrial economy. In fact, through the study of blockchain technology, from one side or the signal released, we express our attitude towards the innovation and leadership of blockchain. We hope that in the development of blockchain, we can first have our own core technology, and we should be a leader in today's fierce international competition
5) it is to enhance the market confidence of the whole blockchain instry, especially for the application and development of the whole blockchain technology. With a great increase in market confidence, it is bound to attract more people in the next period of time, including the capital market and for example, more talents and research applications will enter this field. More capital, more manpower and more other social related aspects, including the rule of law and legislation, will positively promote the application and landing of the whole blockchain technology. These are my four points of view or summary of blockchain technology learning
if you have been concerned about blockchain for a long time, in fact, from the national level, including the 13th five year plan, blockchain technology has been written into the 13th five year plan, which is developed as a parallel technology with artificial intelligence, big data and cloud computing. It has been introced in the second half of 2018, and the office of network information technology has put the blockchain application service on record, From all aspects, it is actually a positive guidance or protection for the development of the whole blockchain
of course, when it comes to blockchain, you may also say that blockchain always thinks of money speculation and so on. In fact, digital currency is only a relatively narrow field in the field of blockchain. We now include support from the mainstream of modern society or the national level, and more support for the application of blockchain technology in the real instry, The core advantage of blockchain technology is decentralization, which can realize point-to-point transaction, coordination and cooperation based on decentralized credit in the distributed system without mutual trust by means of data encryption, timestamp, distributed consensus and economic incentives, so as to solve the common high cost and low cost problems of centralized institutions Low efficiency and data storage insecurity provide solutions
the application fields of blockchain include digital currency, token, finance, anti-counterfeiting traceability, privacy protection, supply chain, entertainment, etc. with the popularity of blockchain and bitcoin, many related top domain names have been registered, which has a great impact on the domain name instry.
4.
the blockchain instry is on the eve of the application outbreak
as a kind of underlying technology, with the support of policy direction, blockchain is attracting more and more exploration of application landing. At the recent 2019 future business ecological link conference, Zhu Youping, deputy secretary of the general Party branch of China economic network management center of the state information center, pointed out that after 11 years of trial and error, the technology of blockchain has basically been commercially available, and the instry is now on the eve of application explosion
Wu Xiaochuan, a senior expert in Zhongan technology's blockchain development, told the 21st century business reporter that the biggest difficulty in the current blockchain landing instry is how to map the physical world and the blockchain world one by one, which needs multi-disciplinary joint efforts to solve. Internet of things technology is an important part of it. With the blessing of 5g, cloud computing and other technologies, it will bring more complement and support to the implementation and application of blockchain technology in the futureaccording to the prediction of tractica, the analysis organization, the global enterprise blockchain market will reach US $20.3 billion by 2025
key node of technology and standard promotion
compared with other underlying technologies, blockchain has also experienced a relatively tortuous development process, and there is still a way to go in terms of integration with multiple technologies and setting of its own standards
Zhang Xiaojun, head of Huawei's blockchain, pointed out in his speech at the conference that today's blockchain technology is more like the development stage of the Internet from 2002 to 2003. If the relevant standards of blockchain can be mature in 2020, including cross chain standards, storage standards and standard data format storage, large-scale commercial use will be accelerated in 2021
China's blockchain instry is still in its infancy, but with the continuous support of national policies, the continuous progress of instry technology and the increasing demand of downstream applications, China's blockchain instry is expected to continue to maintain high-speed growth. In 2011, the market scale of China's blockchain instry was less than 6 million yuan. By 2018, the market scale of China's blockchain instry has grown to 67 million yuan, maintaining a rapid growth rate of more than 80%. It is estimated that in 2022, driven by policy support and downstream demand, the market scale of China's blockchain instry is expected to exceed 450 million yuan
market size statistics and growth forecast of China's blockchain instry from 2015 to 2022 Zhu Youping pointed out to the reporter of the 21st century economic report that with the technical blessing of 5g and even future quantum computing, these weaknesses will be quickly made up
for more data sources and analysis, please refer to the in depth analysis report on business model innovation and investment opportunities of China's blockchain instry published by foresight Instry Research Institute. Meanwhile, foresight Instry Research Institute also provides instrial big data, instrial planning, instrial declaration, instrial park planning, instrial investment promotion and other solutions
5. Maybe it's a problem with the network. You can reset the wireless network with the router
recommend smart TV & Android STB to download and install dangbei application market, with rich applications, fast download speed, which can maximize the playability of TV!
recommend smart TV & Android STB to download and install dangbei application market, with rich applications, fast download speed, which can maximize the playability of TV!
6. For a long time, medical institutions have to enre the inability to share data safely on various platforms. Better data cooperation between data providers means more accurate diagnosis, more effective treatment, and improving the overall ability of the medical system to provide cost-effective medical services. With blockchain technology, everyone's medical data will be saved in a dedicated electronic system, and there is no need to worry about the security and integrity of the data
in the future, jinwowo will continue to tap the value of blockchain technology in the commercial field.
in the future, jinwowo will continue to tap the value of blockchain technology in the commercial field.
7. Blockchain technology has a natural trend of weakening and avoiding centralized supervision, but it will promote the generation of virtual power, which also needs compliance supervision. Tencent's security is particularly important to lead the blockchain, strengthen the supervision of the application of blockchain technology, and ensure the legality and compliance of activities and transactions in the chain.. Are you satisfied with my answer? Please accept if you are satisfied
8. Public chain: refers to the blockchain that anyone in the world can access to the system at any time to read data, send confirmatory transactions and compete for bookkeeping. For example: bitcoin, Ethereum
private chain: refers to the blockchain whose write permission is controlled by an organization and institution, and the qualification of participating nodes will be strictly limited
alliance chain: refers to a blockchain with several institutions participating in the management. Each institution runs one or more nodes. The data only allows different institutions in the system to read, write and send transactions, and record transaction data together
alliance chain is a relatively new way to apply blockchain technology to enterprises. The public chain is open to all, while the private chain usually only provides services for one enterprise. The alliance chain has more restrictions than the public chain, and usually provides services for the cooperation among multiple enterprises
the difference between alliance chain and public chain is that it requires prior permission. Therefore, not everyone with an Internet connection can access the alliance blockchain. Alliance chain can also be described as semi decentralized. The control of alliance chain is not granted to a single entity, but to multiple organizations or indivials
for alliance chain, consensus process may be different from public chain. The consensus participants of the alliance chain may be a group of pre approved nodes on the network, rather than anyone can participate in the process. Alliance chain allows more control over the network
when it comes to the advantages of alliance chain:
first of all, alliance chain is completely controlled by a specific group, but it is not monopoly. When each member agrees, this control can establish its own rules
secondly, it has greater privacy, because the information used to verify the block will not be disclosed to the public, and only alliance members can process the information. It creates greater trust and confidence for platform customers
finally, compared with the public blockchain, the alliance chain has no transaction costs and is more flexible. A large number of verifiers in public blockchain lead to the trouble of synchronization and mutual protocol. Usually this divergence will lead to bifurcation, but the alliance chain will not
alliance chain technology can be used to optimize the business process of most traditional information systems, especially for business scenarios without strong center, multi-party cooperation and controllable risk. The shared ledger mechanism of alliance chain can greatly rece the reconciliation cost, improve the efficiency of data acquisition, increase the fault tolerance, consolidate the trust foundation, and avoid malicious fraud
with the continuous development of blockchain technology, more and more institutions and enterprises begin to increase the research and application of blockchain. Compared with the public chain, the alliance chain has better landing, and has been supported by many enterprises and the government
alliance chain can be understood as a kind of distributed ledger established by internal institutions to meet the needs of specific instries. This account book is open and transparent to internal institutions. However, if there are relevant business needs and the data of this account book is modified, it is still necessary to join the smart contract
smart contract is a kind of computer protocol which aims to disseminate, verify or execute contracts in an information way. Smart contracts allow trusted transactions without a third party, which are traceable and irreversible
generally speaking, the current mainstream architecture of alliance chain intelligent contract is: system contract + business contract
system contract: the configuration is completed before the node is started. It is generally used for system management (such as bcos precompiled contract (permission management, naming management, etc.), and it is written by the project side, with high security
Business Contract: it is written according to the actual business and needs to be deployed. It is similar to the public chain smart contract. It is written by the general internal organization participants and needs to comply with certain requirements. The security is general< However, there are still security risks in the following aspects:
(1) code language security features
one is to continue to use the main stream public chain programming language and improve on it (such as: the solidness used by bcos), The other is to specify the corresponding smart contract mole (such as fabric's go / Java / node. JS) based on the general programming language. No matter what language is used to program the smart contract, there are security problems in its corresponding language and related contract standards< (2) integer overflow caused by contract execution: no matter which virtual machine is used to execute the contract, all kinds of integer types have corresponding storage width. When trying to save data beyond this range, the signed number will overflow
stack overflow: when there are too many method parameters and local variables defined and the bytes are too large, the program may have errors
denial of service attack: it mainly involves the alliance chain that consumes resources to execute the contract, and the corresponding transaction cannot be completed e to the exhaustion of resources
(3) contract security problems caused by system mechanism
here mainly refers to the alliance chain of Multi Chain Architecture:
if the generation of contract variables depends on uncertain factors (such as the time stamp of this node) or a variable that is not persistent in the ledger, the transaction verification may fail because the reading and writing sets of the variable of each node are different
global variables are not stored in the database, but in a single node. Therefore, if this kind of node fails or restarts, it may cause the global variable value to be no longer consistent with other nodes, and affect node transactions. Therefore, data read, written or returned from the database should not depend on global state variables
when calling the contract of the external chain in the multi chain structure, only the return result of the called chain code function may be obtained, and no transaction will be submitted in any form in the external channel
when a contract accesses external resources, it may expose unexpected security risks of the contract and affect the chain code business logic
(4) business security issues
the smart contract of alliance chain is to complete a business requirement and execute a business, so there may still be security risks in business logic and business implementation, such as function permission mismatch, unreasonable input parameters, and improper exception handling
our suggestions on alliance chain security are as follows:
(1) simplify the design of smart contract to achieve the balance between function and security
(2) strictly implement smart contract code audit (self-evaluation / project team review / tripartite audit)
(3) strengthen the security training for smart contract developers
(4) implement the application of blockchain, It needs to be promoted step by step, from simple to complex. In this process, we should constantly comb the contract and platform related functions / security attributes
(5) consider the idea of devsecops (development + Security + operations)
chain platform security includes: transaction security, consensus security, account security, compliance, RPC security, endpoint security, P2P security, etc
hackers attack alliance chain by means of internal threats, DNS attacks, MSP attacks, 51% attacks, etc
take MSP attack as an example: MSP is the abbreviation of membership service provider in fabric alliance chain. It is a component that provides an abstract member operation framework. MSP abstracts all cryptographic mechanisms and protocols behind the issuance and verification of certificates and user authentication. An MSP can define its own identity, as well as identity management (authentication) and authentication (generation and verification of signatures) rules< Generally speaking, attacks against MSP may exist in the following aspects:
(1) internal threats: a) the current version of MSP allows single certificate control, that is, if an insider holds a certificate that can manage MSP, he can configure the fabric network, such as adding or revoking access rights, Adding identity to CRL (essentially blacklisted identity), too centralized management may lead to security risks. b) If there are sensors and other Internet of things devices connected to the alliance chain, it may spread false information to the chain, and because the sensor itself may not support perfect security protection, it may lead to further attacks
(2) private key leakage, the certificate file of node or sensor is generally stored locally, which may lead to private key leakage, and then lead to witch attack, man in the cloud attack, etc.
(3) DNS attack: when creating a new participant's identity and adding it to MSP, DNS attack may occur in any case. The process of creating certificates to blockchain members may be attacked in many places, such as man in the middle attack, cache poisoning, DDoS. An attacker can convert a simple DNS query into a larger payload, causing DDoS attacks. Similar to Ca attacks, this attack results in certificate tampering and / or theft, such as the permissions and access rights that some blockchain members will have. Sensor networks are particularly vulnerable to DDoS attacks. Smart city is not only faced with the weakness of sensor networks against DDoS attacks, but also the challenge of blockchain system< (4) Ca attack: digital certificate and identity are very important to the operation of MSP. Hyperledger fabric allows users to choose how to run a certification authority and generate encrypted materials. Options include fabric Ca, process built by hyperledger fabric, cryptogen contributors, and own / third party ca. The implementation of these CAS has its own defects. Cryptogen generates all the private keys in a centralized location, which are then fully and securely copied by the user to the appropriate host and container. This facilitates private key disclosure attacks by providing all private keys in one place. In addition to the weakness of the implementation, the whole MSP and the membership of the blockchain run on the Ca, and have the ability to trust that the certificate is valid, and the certificate owner is what they call the identity. If the attack on well-known third-party CA is executed successfully, the security of MSP may be damaged, resulting in forged identity. Another weakness of Ca in hyperledger fabric is how they are implemented in MSP. MSP needs at least one root Ca, and can support as root Ca and intermediate CA as needed. If the root CA certificate is attacked, all certificates issued by the root certificate will be affected
Cheng chain security has launched the alliance chain security solution. With the development of alliance chain ecology, in 2020, Cheng chain security has cooperated with multi provincial network information office to conct multi-level security audit on the alliance chain system of local government, enterprises and institutions from the bottom of the chain to the application layer, and found the loopholes and weaknesses of the alliance chain system with multiple scenarios, multiple applications and multiple forms and its supporting systems
in addition, Cheng Lianan has cooperated with ant blockchain to join the open alliance chain as the first batch of nodes selected by ant blockchain. We will give full play to security technology, service and market
private chain: refers to the blockchain whose write permission is controlled by an organization and institution, and the qualification of participating nodes will be strictly limited
alliance chain: refers to a blockchain with several institutions participating in the management. Each institution runs one or more nodes. The data only allows different institutions in the system to read, write and send transactions, and record transaction data together
alliance chain is a relatively new way to apply blockchain technology to enterprises. The public chain is open to all, while the private chain usually only provides services for one enterprise. The alliance chain has more restrictions than the public chain, and usually provides services for the cooperation among multiple enterprises
the difference between alliance chain and public chain is that it requires prior permission. Therefore, not everyone with an Internet connection can access the alliance blockchain. Alliance chain can also be described as semi decentralized. The control of alliance chain is not granted to a single entity, but to multiple organizations or indivials
for alliance chain, consensus process may be different from public chain. The consensus participants of the alliance chain may be a group of pre approved nodes on the network, rather than anyone can participate in the process. Alliance chain allows more control over the network
when it comes to the advantages of alliance chain:
first of all, alliance chain is completely controlled by a specific group, but it is not monopoly. When each member agrees, this control can establish its own rules
secondly, it has greater privacy, because the information used to verify the block will not be disclosed to the public, and only alliance members can process the information. It creates greater trust and confidence for platform customers
finally, compared with the public blockchain, the alliance chain has no transaction costs and is more flexible. A large number of verifiers in public blockchain lead to the trouble of synchronization and mutual protocol. Usually this divergence will lead to bifurcation, but the alliance chain will not
alliance chain technology can be used to optimize the business process of most traditional information systems, especially for business scenarios without strong center, multi-party cooperation and controllable risk. The shared ledger mechanism of alliance chain can greatly rece the reconciliation cost, improve the efficiency of data acquisition, increase the fault tolerance, consolidate the trust foundation, and avoid malicious fraud
with the continuous development of blockchain technology, more and more institutions and enterprises begin to increase the research and application of blockchain. Compared with the public chain, the alliance chain has better landing, and has been supported by many enterprises and the government
alliance chain can be understood as a kind of distributed ledger established by internal institutions to meet the needs of specific instries. This account book is open and transparent to internal institutions. However, if there are relevant business needs and the data of this account book is modified, it is still necessary to join the smart contract
smart contract is a kind of computer protocol which aims to disseminate, verify or execute contracts in an information way. Smart contracts allow trusted transactions without a third party, which are traceable and irreversible
generally speaking, the current mainstream architecture of alliance chain intelligent contract is: system contract + business contract
system contract: the configuration is completed before the node is started. It is generally used for system management (such as bcos precompiled contract (permission management, naming management, etc.), and it is written by the project side, with high security
Business Contract: it is written according to the actual business and needs to be deployed. It is similar to the public chain smart contract. It is written by the general internal organization participants and needs to comply with certain requirements. The security is general< However, there are still security risks in the following aspects:
(1) code language security features
one is to continue to use the main stream public chain programming language and improve on it (such as: the solidness used by bcos), The other is to specify the corresponding smart contract mole (such as fabric's go / Java / node. JS) based on the general programming language. No matter what language is used to program the smart contract, there are security problems in its corresponding language and related contract standards< (2) integer overflow caused by contract execution: no matter which virtual machine is used to execute the contract, all kinds of integer types have corresponding storage width. When trying to save data beyond this range, the signed number will overflow
stack overflow: when there are too many method parameters and local variables defined and the bytes are too large, the program may have errors
denial of service attack: it mainly involves the alliance chain that consumes resources to execute the contract, and the corresponding transaction cannot be completed e to the exhaustion of resources
(3) contract security problems caused by system mechanism
here mainly refers to the alliance chain of Multi Chain Architecture:
if the generation of contract variables depends on uncertain factors (such as the time stamp of this node) or a variable that is not persistent in the ledger, the transaction verification may fail because the reading and writing sets of the variable of each node are different
global variables are not stored in the database, but in a single node. Therefore, if this kind of node fails or restarts, it may cause the global variable value to be no longer consistent with other nodes, and affect node transactions. Therefore, data read, written or returned from the database should not depend on global state variables
when calling the contract of the external chain in the multi chain structure, only the return result of the called chain code function may be obtained, and no transaction will be submitted in any form in the external channel
when a contract accesses external resources, it may expose unexpected security risks of the contract and affect the chain code business logic
(4) business security issues
the smart contract of alliance chain is to complete a business requirement and execute a business, so there may still be security risks in business logic and business implementation, such as function permission mismatch, unreasonable input parameters, and improper exception handling
our suggestions on alliance chain security are as follows:
(1) simplify the design of smart contract to achieve the balance between function and security
(2) strictly implement smart contract code audit (self-evaluation / project team review / tripartite audit)
(3) strengthen the security training for smart contract developers
(4) implement the application of blockchain, It needs to be promoted step by step, from simple to complex. In this process, we should constantly comb the contract and platform related functions / security attributes
(5) consider the idea of devsecops (development + Security + operations)
chain platform security includes: transaction security, consensus security, account security, compliance, RPC security, endpoint security, P2P security, etc
hackers attack alliance chain by means of internal threats, DNS attacks, MSP attacks, 51% attacks, etc
take MSP attack as an example: MSP is the abbreviation of membership service provider in fabric alliance chain. It is a component that provides an abstract member operation framework. MSP abstracts all cryptographic mechanisms and protocols behind the issuance and verification of certificates and user authentication. An MSP can define its own identity, as well as identity management (authentication) and authentication (generation and verification of signatures) rules< Generally speaking, attacks against MSP may exist in the following aspects:
(1) internal threats: a) the current version of MSP allows single certificate control, that is, if an insider holds a certificate that can manage MSP, he can configure the fabric network, such as adding or revoking access rights, Adding identity to CRL (essentially blacklisted identity), too centralized management may lead to security risks. b) If there are sensors and other Internet of things devices connected to the alliance chain, it may spread false information to the chain, and because the sensor itself may not support perfect security protection, it may lead to further attacks
(2) private key leakage, the certificate file of node or sensor is generally stored locally, which may lead to private key leakage, and then lead to witch attack, man in the cloud attack, etc.
(3) DNS attack: when creating a new participant's identity and adding it to MSP, DNS attack may occur in any case. The process of creating certificates to blockchain members may be attacked in many places, such as man in the middle attack, cache poisoning, DDoS. An attacker can convert a simple DNS query into a larger payload, causing DDoS attacks. Similar to Ca attacks, this attack results in certificate tampering and / or theft, such as the permissions and access rights that some blockchain members will have. Sensor networks are particularly vulnerable to DDoS attacks. Smart city is not only faced with the weakness of sensor networks against DDoS attacks, but also the challenge of blockchain system< (4) Ca attack: digital certificate and identity are very important to the operation of MSP. Hyperledger fabric allows users to choose how to run a certification authority and generate encrypted materials. Options include fabric Ca, process built by hyperledger fabric, cryptogen contributors, and own / third party ca. The implementation of these CAS has its own defects. Cryptogen generates all the private keys in a centralized location, which are then fully and securely copied by the user to the appropriate host and container. This facilitates private key disclosure attacks by providing all private keys in one place. In addition to the weakness of the implementation, the whole MSP and the membership of the blockchain run on the Ca, and have the ability to trust that the certificate is valid, and the certificate owner is what they call the identity. If the attack on well-known third-party CA is executed successfully, the security of MSP may be damaged, resulting in forged identity. Another weakness of Ca in hyperledger fabric is how they are implemented in MSP. MSP needs at least one root Ca, and can support as root Ca and intermediate CA as needed. If the root CA certificate is attacked, all certificates issued by the root certificate will be affected
Cheng chain security has launched the alliance chain security solution. With the development of alliance chain ecology, in 2020, Cheng chain security has cooperated with multi provincial network information office to conct multi-level security audit on the alliance chain system of local government, enterprises and institutions from the bottom of the chain to the application layer, and found the loopholes and weaknesses of the alliance chain system with multiple scenarios, multiple applications and multiple forms and its supporting systems
in addition, Cheng Lianan has cooperated with ant blockchain to join the open alliance chain as the first batch of nodes selected by ant blockchain. We will give full play to security technology, service and market
9. Blockchain is the underlying technology of bitcoin, and bitcoin is the first application of blockchain technology. From the perspective of the application of blockchain technology, blockchain technology can be divided into three stages: the first stage is bitcoin, that is, a set of account system and currency issuance mechanism, which does not support other application development; The second stage is Ethereum, which adds a smart contract mechanism on the basis of improving the bitcoin block, so that everyone can develop applications on it; The third stage is the expansion stage similar to Ethereum, and the blockchain will complete the exchange of value
blockchain has the characteristics of decentralization, point-to-point transmission, transparency, traceability, non tampering, data security, etc., which can be used to solve some pain points of existing business and realize the innovation of business model. In essence, blockchain is a robust and secure distributed state machine. The typical technical components include consensus algorithm, P2P communication, cryptography, database technology and virtual machine. Its five essential core capabilities are data storage, shared data, distributed, tamper proof and privacy protection, and digital contract
the number of blockchain projects established in China has increased year by year since 2013, and decreased in 2017 e to policy supervision and other reasons, but the number of investment and average integration amount have graally increased.
blockchain has the characteristics of decentralization, point-to-point transmission, transparency, traceability, non tampering, data security, etc., which can be used to solve some pain points of existing business and realize the innovation of business model. In essence, blockchain is a robust and secure distributed state machine. The typical technical components include consensus algorithm, P2P communication, cryptography, database technology and virtual machine. Its five essential core capabilities are data storage, shared data, distributed, tamper proof and privacy protection, and digital contract
the number of blockchain projects established in China has increased year by year since 2013, and decreased in 2017 e to policy supervision and other reasons, but the number of investment and average integration amount have graally increased.
Hot content