区块链项目的安全落地.pdf

1、目录区块链对数据安全的积极影响从安全3要素看区块链工信部白皮书区块链2.0技术架构和对应的安全层次TOP 8 安全控制智能合约的安全身份管理POSITIVE IMPACT OF BLOCKCHAIN FOR DATA AND TRANSACTION SECURITY（区块链对数据和事物安全的积极影响）Hash of Public KeySignedConsensus ChainedReplicated从安全3要素看区块链:Confidentiality(保密性）Hash of Public KeyHyperLedger Transaction Certificate(full Confiden

2、tiality of the user identity)Encryption of Data using Zero knowledge（零知识）Zcash using zk-SNARK for bitcoin like transaction Hawk using zk-SNARK for smart contractData invisibility（不可见）via State Channel Lightning network for Bitcoin Raiden Network for EtheriumFungibility(同等性）of zcashHomomorphic encryp

3、tion(同态加密）从安全3要素看区块链:Integrity(完整性）SignedChained ReplicatedOpen Source从安全3要素看区块链:Availability(可用性）Each Transaction(or Data)is replicated(availability)But what about the latency?工信部白皮书区块链2.0技术架构和对应的安全层次Application Level Security(OWASP TOP 10);Formal Verification,EVM vulnerability，IAMMaintain the secu

4、rity of public and/or community BlockchainGovernanceFault TolerancePerformanceP2P network encryptionClient to Node Communication EncryptionDefense against DDOSData EncryptionDigital Signature Key Management(key rotation,key escrow,key recovery)HSMTop 8 安全控制智能合约安全检查区块链与身份管理系统应用层源代码安全检查节点的安全加固数据加密（链上和

5、链下，国密算法）数据传输的加密DDOSKey Management智能合约的安全智能合约本身可以存储几千万甚至几个亿美金的资产。智能合约在链上面的部署是通过共识的，一旦部署成功就不能修改。公有链上的智能合约对大家都是公开的，一般没有传统的加密，审计和访问控制。目前智能合约的开发还在初级阶段，编程模式和传统的DevSecOps需要进行有效的改造来适应智能合约的安全需求避免外部调用/mapping(address=uint)private userBalances;function withdrawBalance()public uint amountToWithdraw=userBalances

6、msg.sender;if(!(msg.sender.call.value(amountToWithdraw)()throw;/此时,调用方的代码已经被执行,并且可以再次调用 withdrawBalanceuserBalancesmsg.sender=0;一定要调用外部函数怎么办？mapping(address=uint)private userBalances;function withdrawBalance()public uint amountToWithdraw=userBalancesmsg.sender;userBalancesmsg.sender=0;/用户的余额已经 被设置为