►
From YouTube: Transparency, Security and Auditability of Critical Reporting - Nikolaos Saklampanakis & Ece Kubilay
Description
Transparency, Security and Auditability of Critical Reporting Chains with Blockchain - Nikolaos Saklampanakis & Ece Kubilay, Fujitsu
E. Kubilay and N. Saklampanakis will present a joint project of Fujitsu and Hexagon that brings together IoT, AI , security monitoring and HL-Fabric for handling critical security events. Handling security incidents, results in reporting chains: The creation of an alarm, the context, the handling it receives, and finally the auditing process, are all rings of such a reporting chain. Critical security incidents might result increased monetary costs or even lead to life-threatening situations if not handled optimally. It is thus of utmost importance to ensure that the event is handled with the highest possible standards, and that the reporting chain depicts the truth in a transparent auditable manner. And these are exactly the challenges we address with Hyperledger Fabric. Join our session to get insights and lessons learned from building this project and enjoy a live demo.
Sessions Details & Slides (if available)- https://sched.co/j3bF
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #HyperledgerGlobalForum2021 #Blockchain
A
B
B
Okay.
Let's
start
with
talking
about
critical
reporting
chains
and
why
they're
so
critical
and
to
get
us
into
context.
We
can
first
talk
a
bit
about
critical
infrastructures
and
to
give
those
a
few
examples,
we
can
name
transportation,
water
systems,
defense
infrastructures,
energy
related
installations,
industrial
units,
so
on
and
so
forth.
B
What
happens
next
is
theories
of
entities
with
different
levels
of
handling
and
different
sorts
of
long
and
complex
protocols
will
be
involved
and
at
the
very
end
of
it
there
might
be
an
auditing
process
by
an
auditing
body
taking
place
to
determine
if
each
level
of
handling
has
been
done
correctly
or
not.
Nicolas.
A
We
need
to
make
a
decision
if
they
say
that
it
could
be
that
it's
something
non-significant
or
it
could
be
something
critical
that
needs
to
be
escalated
to
the
next
stakeholder,
which,
in
our
scenario,
could
be
a
public
emergency
service.
The
public
emergency
service
intercepts
this
piece
of
information
and
they
need
to
start
acting
accordingly,
so
they
start
acting
as
their
protocols
dictate,
which
means
they
maybe
need
to
shut
down
traffic
around
the
station.
A
Probably
they
would
need
to
dispatch
some
emergency
units
that
are
around
the
area
to
take
over
the
handling
of
the
emergency
on
the
spot
where
the
alarm
was
created.
At
the
end,
we
have
the
auditing
body
involved
where
it
needs
to
audit.
If
everything
worked
according
to
what
was
expected
from
all
the
stakeholders
that
were
involved,
they
need
to
investigate
and
and
see
if
things
were
as
expected.
A
In
the
case
of
something
going
wrong,
each
actor
must
prove
that
they
acted
according
to
the
protocol
in
the
case
of
something
going
wrong.
Every
actor
has
the
motivation,
of
course,
to
deny
wrongdoing
or
deny
any
negligence
that
would
cause
to
liabilities,
and
obviously
this
makes
the
auditor's
job
very
very
hard.
The
auditor
must
make
conclusions
based
on
collected
evidence
through
investigating
each
stakeholder.
B
So
we,
as
the
digital
incubation
department
at
fujitsu,
partnered
with
hexagon,
to
try
and
address
these
challenges
that
we
just
talked
about
to
give
a
bit
more
detail
about
us.
We
are
digital
incubation,
we're
located
in
fujitsu
central
europe
cto's
office,
and
we
are
basically
a
group
of
experts
in
novel
technologies
such
as
blockchain,
artificial
intelligence
and
digital
annealing.
B
What
we
do
is
we
identify
use
cases
with
high
potential
of
scaling
from
business
perspective
and
work
with
early
adapters
from
different
market
segments
for
co-creation
of
pocs
and
mvps.
We
then
pass
this
to
production
and
hexagon
is
an
established
global
company
who
is
a
pioneer
in
making
of
next-gen
sensors
and
they
are
domain
experts
in
iot
monitoring
fields,
nicholas.
A
A
The
iot
platform
can
collect
and
combine
data
to
build
the
context
and
enhance
the
situational
awareness
of
the
operator.
The
iut
platform
can
also
perform
actions
based
on
rules
that
are
defined
in
its
configuration.
You
can
utilize
computer
vision,
ai
and,
for
example,
decide
by
itself
that
the
information
that
it
receives
from
the
sensors
is
critical
enough
to
automatically
escalate
the
alarm.
A
Another
interesting
component
that
we've
worked
with
into
this
project
is
the
blk247.
The
blk247
from
hexagon
is
a
next-gen
multi-sensor
device.
It
has.
It
comes
with
a
lot
of
very
interesting
features
like
laser
radar.
It
has
thermal
scanners
on
it
and,
and
we
work
on
that
and
that's
a
device
that
is
integrated
with
the
iot
platform,
like
the
rest,
but
being
so
advanced.
It
can
also
directly
speak
to
the
monitoring
dashboard
of
the
operator
and,
for
example,
stream
some
data
there
when
we
are
into
this
situation.
A
A
So
in
order
to
address
the
challenges
that
we
described
before,
we
introduced
a
layer
of
hyperledger
fabric
that
goes
across
and
it
is
crossing
the
boundaries
of
each
individual
organization
of
each
individual
stakeholder
and
we
integrated
all
the
relevant
components
on
it.
First,
the
blk247,
the
bill,
k247
being
a
smart
and
next-gen
device,
was
able
to
be
integrated
and
what
we
get
there
is
that
the
alarms,
the
alarming
event
themselves
and
the
relevant
data
are
being
recorded
in
time-stamped
and
secured
by
the
ledger:
the
devices
of
generation
transaction
transmitted
to
the
ledger.
A
This
brings
in
not
cancelling
out
the
pre-existing
communication
channels,
but
brings
the
additional
benefit
of
having
additional
communication
channels
where
we
can
address
things
like
man
in
the
middle
attacking
the
communication
channels.
With
the
back
end,
we
can
imagine
that,
potentially,
this
is
a
really
edge
device
in
monitoring
a
location
that
might
be
targeted
for
malicious
actions.
So
this
is
important.
An
interesting
feature
of
blk
24
7.
That
is
also
interesting,
with
combination
with
two
using
a
dlt,
is
the
fact
that
blk
has
until
tampering
security
measurements
on
it.
A
So
if
you
try
to
mess
with
its
own
operation
and
tamper,
it
with
it
will
raise
an
alarm
over
the
ledger,
saying
to
the
whole
ecosystem
that
is
involved.
You
should
not
trust
them
from
now
on
so
much
you
should
consider
twice
about
the
date,
I'm
transmitting,
and
we
can
see
your
counter
measures
on
that.
A
A
A
Now
we
can
cross
verify
the
information
that
we
receive
from
the
iit
platform
and
from
devices
like
the
blk
that
transmit
to
us
against
the
ledger.
We
enhance
the
security
we
we
know
exactly
how
the
context
has
been
gradually
built,
and
we
know
that
in
this
context,
we
need
to
make
some
decisions
as
operators
and
proceed
with
the
situation
that
we
are
handling.
A
Now,
if
we
managed
to
integrate
this,
the
obvious
next
step
would
be
that
we
integrate
next
stakeholders
that
previously
were
not
tightly
integrated
because
of
the
decentralized
nature
of
the
dlt.
We
can
enable
apis
that
enable
the
involvement
directly
on
the
technical
level
for
the
additional
entities
which
previously
was
not
possible.
Maybe-
and
this
is
granted
and
enabled
by
dlt
in
its
decentralized
nature,
we
know
that
we
can
in
essence,
grow
beyond
the
single
organization
boundaries.
A
This
obviously
can
continue
as
long
as
the
chain
of
involvement
and
engagement
demands.
The
situation
to
to
be
handled
at
the
very
end
we
have
enabled
the
order
to
be
done
and
performed
not
against
assumptions
or
indications
or
claims
of
individual
stakeholders,
but
on
cryptographically,
verifiable
and
undeniable
facts,
as
they
recorded
on
the
ledger.
A
So
we
are
managing
to
record
the
whole
critical
reporting
chain
on
the
ledger
with
undeniable
ways:
cryptographically,
verifiable
facts
and
actions,
and
this
reduces
the
risk
and
the
effort
that
is
required
to
perform
an
audit,
because
we
do
that
and
in
this
way
we
address
these
challenges.
We
claim
that
it's
a
smart
monitoring
ecosystem
so
to
recapitalize.
A
Let's
see
the
major
benefits
of
tlt
enablement,
invest.
We
have
the
alarms
and
it's
relevant
data
recorded
on
dlt.
The
handling
is
recorded
on
dlt
because
we
have
the
whole
process
recorded
there
and
the
process
itself
is
enforced.
It's
enforced
by
rules
of
the
chain
code,
so
the
application
enforces
the
rules
who
isn't
required
to
engage
in
each
way
and
when
the
decision
and
the
relevant
context
is
tightly
bind
to
the
time
that
it
was
taken-
and
this
leads
to
the
auditing
being
greatly
enhanced,
we
reduce
the
risk
actors
who
perform.
A
A
A
So,
let's
see
how
this
works
again.
Typically,
we
have
a
fabric
framework
components
that
are
relevant
for
each
organization,
so
we
have
peer
certificate
authorities,
databases
and
so
on
for
rich
and
also
the
ordering
service.
Each
integrated
component
for
each
individual
organization
is
integrated
through
an
api
gateway.
We
follow
the
api
gateway
pattern.
The
api
gateway
externalizes
fabric
calls
to
traditional
apis
that
are
meaningful
for
such
more
mainstream
applications.
Let's
say,
and
our
api
gateway
is
deployable
in
flexible
fashion.
A
A
These
components
are
actually
plagable
from
us.
As
developers,
we
can
choose
exactly
the
services
that
are
relevant
for
the
integration
that
we
need
to
provide.
Typically,
it
will
provide
some
external
apis
enabling
other
actors
to
call
it,
and
typically
it
will
also
provide
a
fabric
line
so
that
it
enables
the
interaction
of
the
fabric
infrastructure
there
if
it
is
required
to
a
handle,
configuration
connect
to
databases
externally
and
so
on,
perform
business
logic
concern.
A
B
Yeah,
last
but
not
least,
as
it's
matching
perfectly
with
our
project
requirements,
we
definitely
needed
a
permission.
Network
fabric
offers
modular
architecture,
hence
maximizes.
The
flexibility
and
the
resilience
of
our
solution
fabric
follows
enterprise
paradigms
thus
meeting
modern
business
demands.
Finality
of
transactions
is
not
an
issue
as
their
instant
fabric
offers
features
like
channels,
transaction
anonymity,
data
access,
scoping,
so
privacy
regarding
who
can
access
what
sets
of
data.
Hence
we
do
not
have
to
implement
this
from
scratch
ourselves
and
all
in
all,
it
is
certainly
meeting
our
projects.
A
All
right,
let
us
try
to
make
a
little
demo,
as
I
just
said,
and
we
can
stay
back
in
the
context
of
the
example
we
brought
before.
Let
us
consider
that
we
are
handling
some
alarms
in
a
in
a
train
station
or
in
a
tube
station,
where
we
have
two
virtual
blk
24
7
devices
installed
in
this
example
that
we
see
here
we
have
the
monitoring
dashboard
of
a
subway
security
operator
in
a
subway
station
in
central
munich.
We
see
the
two
virtual
devices
that
are
there.
A
We
see
a
dashboard
for
the
local
police
department
and
we
see
at
the
end
information
for
the
from
the
dashboard
of
the
authority
that
we
need
to
audit
how
the
whole
process
went.
We
have
a.
We
have
a
demo
control
environment
here
that
we
can
raise,
alarms
from
the
two
simulated
devices
that
we
have
the
sensor
one,
the
first
one
can
raise
fencing,
alarms,
fencing
violations.
A
That
means
it
it
can
raise,
alarms
that
match
the
scenario
where
a
perimeter
that
is
defined
with
the
laser
radar
has
been
compromised
and
that
for
an
alarm,
needs
to
be
raised.
The
second
one
is
working
with
computer
vision.
It
can
recognize
a
piece
of
luggage,
for
example
that
has
been
left
unattended
for
too
long
in
the
train
station
and
that
fall
that,
for
it
raises
an
alarm,
it
requires
intervention.
A
A
I
think
it's
being
affected
by
the
fact
that
we
have
any
browser,
call
and
sharing
the
session
and
it
makes
it
very
slow,
so
all
right
it
loads.
Let's
wait
for
it
to
to
render
a
bit
nicely.
So
we
have
now
information
about
the
alarm,
the
nature
of
your
alarm.
For
the
storytelling
perspective,
we
have
skipped
the
the
specifics,
but
you
here
typically,
what
you
would
have
is
that
information
specific
to
to
this
alarm
is
being
passed
to
the
operator
to
the
operator's
dashboard
and
okay.
A
A
We
would
have
much
more
information
there,
so
actually
what
we
have
in
the
background,
you
have
gay
locational
information,
more
technical
information
coming
directly
from
the
device
and
communicated
here,
and
the
operator
is
expected
to
make
some
decision
based
on
that,
for
example,
escalate
alarm
because
she
says
well,
it's
critical.
We
followed
their
protocol
with
this
car,
despite
some
guys,
and
this
alarm
should
be
coming
to
the
dashboard
from
police
now,
because
it
has
been
escalated
and
the
police
it's
intercepted.
A
They
see
that
there
is
an
alarm
that
is
coming
in
and
they
they
need
to
to
handle
it.
First
of
all,
they
acknowledge
that
an
alarm
has
been
communicated
to
them
and
they
start
following
their
own
protocols.
Here
they,
for
example,
maybe
need
to
shut
down
traffic
to
the
station
and
so
on,
dispatch
some
emergency
units
to
the
spot
and
when
the
units
get
there,
for
example,
hearing
our
a
simple
story-
we
say:
okay,
hey!
A
This
is:
I
think
that
the
sharing
of
the
browser,
the
session
is
a
bit
killing
the
all
right,
it's
there.
So
the
unit
has
arrived,
and
this
concludes-
let's
say
the
story.
This
is
again
a
very
simplistic
story
that
we
have
only
to
make
the
demo
the
the
the
the
process
has
been
concluded.
So
we
can
make
a
an
audit
on
that,
so
we
can
filter
by
dates
here.
A
So
all
right
we
are,
we
are
in
today
we
see
the
events
that
were
created
today
we
can
choose
the
relevant
timestamps
and
apply
the
filter,
and
then
we
see
exactly
what
happened
when
and
from
whom.
We
see
that
an
alarm
was
created.
There
was
a
fencing
violation
from
this
sensor
that
was
being
managed
by
I
apologize
from
hexagon.
We
see
that
it
has
been
intercepted
by
the
subway
security
operator.
A
It
there
was
some
decision
to
escalate
it
and
start
some
emergency
process.
We
see
that
the
police
at
the
local
police
department
has
acknowledged
it
started
following
their
own
protocol
and
that
an
external
use
unit
that
was
dispatched
has
arrived
on
the
spot.
Obviously
this
is
a
very,
very
simplistic
workflow
that
we
described
here
more
for
storytelling
purposes
and
when
we
have
skipped
the
internal
information
that
comes
from
the
sensors
and
so
on.
A
A
A
It
ended
up
with
some
accident
on
a
train
with
people's
lives
or
health
being
at
stake,
and
so
on.
That
is.
That
is
something
major,
so
you
really
want
to
have
the
possibility
to
nail
down
and
exclude
any
possibility
that
you
might
have
contradicting
claims
the
the
way
that
you
decentralize
this
and
you
can
really
bind
the
identity
of
the
actor
against
the
act
against
the
action
that
he
took
and
the
context
that
he
had
at
hand
on
the
ledger
is
the
benefit
here
that
enables
for
the
process.
A
The
benefit
also
counts
for
the
actor
himself.
If
we
didn't
have
the
the
ledger
that
directly
shows
that
he
acted
as
he
should,
as
he
should,
as
the
protocols
dictate
and
so
on,
she
would
have
to
prove
it
himself
now
he
doesn't
really
have
to
because
it's
cryptographically
evident
on
the
ledger.
What
happened?
A
So
with
fabric,
we
have
the
possibility
to
really
define
how
fast
we
want
to
finalize
transactions.
I
just
spoke
about
the
instant
finality
that
we
have.
We
don't
have
to
wait
for
a
a
a
generic
time
frame
that
dictates
how
long
it
should
take.
We
are
flexible
to
define
it
ourselves
when
we
address
the
use
case,
and
we
can
be
also
confident
that
when
we
get
the
transaction
through
the
system,
when
we
get
the
block
and
everything,
it
is
really
a
final
block
we
because
of
how
fabric
works.
A
It
cannot
be
that
we
are
on
a
split
on
the
on
on
of
the
chain
or
something
else
that
could
happen
with
a
public
ethereum
chain,
for
example.
So
we
have
finality
it's
practically
instant.
What
you,
what
you
saw
in
the
demo
took
place
in
real
time,
so
we
can
define,
for
example,
that
and
decision
to
escalate
an
event
generate
enter
a
transaction.
Have
it
finalized
in
a
block
and
being
transmitted
to
the
relevant
stakeholder
takes
one
second,
I
hope
this
is
answering
your
question.
A
So
we
are
talking
about
a
controlled
network.
We
are
not
talking
about
the
public
network.
We
are
talking
about
a
permission
network,
so
we
can
define
exactly
who
has
access
to?
One
of
the
reasons
we
used
fabric
is
because
we
can
out
of
the
framework,
have
tooling
that
really
defines
who
has
access
to
watch,
which
data
and
this
this
diverges
from
situation
situation.
A
So
we
can
make
a
private
collections
that
only
the
relevant
entities
have
access
to
or
we
can
use
channels
and
have
responsible
or
organizations
that
need
to,
let's
say,
transfer
the
sequence
from
one
channel
to
the
other
and
the
channels
group
different
stakeholders
that
need
to
be
involved
and
have
different
kind
of
access
to
that
channel.
So
we
are
really
flexible
and
obviously
do
not
expect
that
we
are
writing
on
the
ledger.
A
B
A
We
are
almost
running
out
of
time
again.
This
depends
on
the
scenario
that
we
are
addressing.
We
don't
have
a
generalized
and
we
are
not
trying
to
provide
a
global
ledger
where
everybody
or
all
alarms
in
the
world
need
to
be
recorded
and
handled
with.
We
try
to
provide
the
bespoke
private
network
with
the
relevant
entities
that
are
involved
and
they
should
be
able
to
provide
peers
if
this
is
not
possible
because
of
how
fabric
is
modular,
we
can
come
with
alternative
scenarios,
but
we
are
running
out
of
time
to
discuss
with
all
this.