Hyperledger Foundation Hyperledger Global Forum 2021, 11 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Hyperledger Fabric Security Monitoring based on Hyperledger Explorer - Benedikt Putz & Fabian Böhm

Description

Hyperledger Fabric Security Monitoring based on Hyperledger Explorer - Benedikt Putz & Fabian Böhm, University of Regensburg

Hyperledger Fabric is increasingly being deployed in production environments by many users, as evident from the many successful Hyperledger use cases. Thus it becomes paramount to detect attempts at attacking them. Our research focuses on monitoring Hyperledger Fabric for ongoing attacks and threats. We chose the Hyperledger Explorer project instead of a SIEM solution, since it offers a good starting point for data analytics with Hyperledger Fabric. For this purpose we extend Explorer with additional data collection and security monitoring features, while contributing bug fixes upstream. The bulk of our development work focused on developing appropriate visualizations for security experts to aid them in detecting attacks. Our talk will focus on the development of these visualizations and the technical challenges we faced with data sources and integration of these Hyperledger projects.
Sessions Details & Slides (if available)- https://sched.co/j3b9

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2021 #Blockchain

A

Hello and good morning, everyone- I hope you can hear me out it's fine and I would like to um also wish a good evening to our friends in asia that have a little bit later time right now. um Our talk today will discuss hyperledger fabric security monitoring based on hyperledger explorer. So these are two hyperledger projects that we connected and used to monitor the security of average fabric.

A

So a little brief overview of our talk that we'll be giving today so with me, is my colleague fabian bim, who is also a researcher with me at our department, and we will first give like a brief motivation. So why should you actually care about hyperledger fabric security and then go in some more detail on background on hyperledger fabric and hyperledger explorer before detailing our security monitoring architecture? So how we build the security monitoring variable fabric and then we will go into even more detail on the processing pipeline.

A

um So what data did we collect? um How did we process it and how did we visualize it at the end, and then we will give a brief live demo of the hyperlink prototype that we built at the end. We will go into a question answer session as those customary for all presentations here and have electrical before so.

A

Why should you actually care about hyperledger fabric security fabric is trusted to provide security for a lot of critical applications. So, for example, there is the trade lens platform that I'm sure most of you probably have heard of uh then there's other platforms like we trade, open, ideal, etc. We're all using cavalier fabric in production right now, and so for this reason is quite important.

A

That appalachian fabric is a secure system and it can't be hacked easily, especially since blockchain has a reputation that well, it can't be hacked among many organizations, which is obviously not the case, and you should never take it for guaranteed that blockchain can't be hacked because, like any software, hyperledger fabric is vulnerable to bugs and exploits, and of course, also to deny our service attacks.

A

And another important aspect to keep in mind is that the independent operation of these hyperelectrophobic nodes could potentially also increase the attack surface. So, for example, if one of the operators has not configured the node properly, then it might be easier for an attacker to get access to that node, even though you have configured your own organization's node correctly.

A

So that's also something to keep in mind with blockchain security, because you have this distributed system that many organizations operate together so um yeah. I want to give a brief overview of attacks that are known for hyperledger fabric. There is a precondition for this, so many of these attacks require that you at least have some kind of access to the network.

A

So, for example, you can send transactions to the network um that you um can maybe access an api that likes the network, so you need to have a little bit of access, but not for every attack, of course. So, for example, a network-based service attack will also work, if you don't have any credentials for the network but, um for example, to abuse a chaincode bug.

A

You, of course, need to be able to send a transaction so to have a valid identity on the network and to be able to sign transactions and regarding chaincodebox, there was also a great presentation at television global forum two years ago by gen security who went to detail on some possible chance bugs and yeah. There's also other topics that could potentially compromise the state database, for example, her default application fabric. If using a couch database or couchdb, it has an unsafe default configuration where anybody can access the state database or modify it.

A

So you should make sure that that is not configured on your system or you would expose yourself to potentially inaccurate work state on your hyperledger fabric instance and, in addition, there's also the problem that we do not have a byzantine fault on consensus algorithms.

A

So you need to basically um trust your uh network participants if you're, using like kafka or ref consensus, I think there is one in the works currently at ibm that is supposed to become the future standard priority fabric, but it's not um in the documentation right now, for example- and I think there's also some custom implementations by some researchers, but nothing officially yet, unfortunately, and of course is also the issue of well credentials, theft or compromise. That could also happen, which is always something to keep in mind.

A

If you notice compromise, then you could of course use confidential data potentially because somebody else could get access to the blockchain data.

A

So how can we support security analysts and detecting these attacks are in getting a better overview of what's happening actually on the network, so I mean the issue, of course, is that you, uh each organization only has access to its own peer and only a limited view of the network, and that you might need to monitor both your own host and the network data at the same time like, um but at least some kind of uh idea of what's going on in the network.

A

uh In addition, each node has some very different data sources, so you have, for example, the log data, and then you have metric data and the actual blockchain data, which you all need to aggregate in some way in order to get a good understanding of.

A

What's going on and, of course, the large volume of blockchain, which depends on your implementation, of course, how many transactions you have in the network, but it might be difficult to keep keep track of what's going on, if you have, for example, 100 transactions per second on your network, and then we don't really have any automated systems yet for attack detection on hyperlite fabric. Unfortunately, so we kind of need the human domain knowledge as well, uh the first security analysis, so we need someone who knows so?

A

How does the text work in order to be able to identify the text properly so to be able to assist the humans or the security analysts properly? We have to find some visualizations and integrate them with hyperledger explorer where we can detect the tags so, but before I go into the architecture, I want to brief the background on average fabric and explorer just briefly for those who have not had much content with them, but I assume there will not be many here.

A

They'll haven't had at least some contact with villager fabric, probably fewer than no hybrid explorer, but I will briefly expand that as well. So uh the application fabric architecture has many different data sources. As I already mentioned, there's the ordering service there's two different peers: um we're each running, maybe different chain codes that are used for different transactions and then they have different logging levels. So you can configure if you want info or warning or error log levels um in order to be able to to get as much information as possible.

A

You should definitely configure info log levels, for example, and on top of that you have the the standard sdk apis, where you can get the transaction subscriptions and the block data, and then you also have the metrics that are made available via premier choice or statsd, but we're using parameters for our project and for hyperledger explorer.

A

Well, it has a basic sync architecture, so it syncs all the blockchain data into a relational sql database, so postgres sql in this case, and it runs basically a sync service that has a channel subscription and stores all the blocks and transactions in the zone database also chain codes into different peers and everything.

A

So this is perfect for analysis so that we can analyze all the data on the blockchain quickly to run queries on it, which is impossible with the standard desktop case so yeah, that's, basically the architecture, and then you also have printed presentation layer on top which accesses the back-end api. Back-End is running in nodejs, and the front-end is react, which I will also get some detail a little bit later in the presentation and the front-end basically just displays the data and runs our visualizations, that we also added.

A

So for the security monitoring architecture, if this is the architecture that we um chose, whatever we went with, basically, the top part um is mostly unmodified from standard habitat explorer, so the oscar sql database was just added. We just added some fields there to support the additional data that we were using and the blockchain transaction data is also the same from the standard implementation and the basic front-end architecture with react and redux is also mostly unchanged, but we added some new dependencies for our facilitations, of course, which farming will explain in more detail.

A

So um yeah. We also added access to docker api into commute toys. We used a reverse proxy to proxy the request to docker and to communitize to get the metrics and lock data that we need to display in the front end for our analysts.

A

So yeah the basic um flow is, of course, data collection first and the pre-processing which happens in the back end, mostly, and then the presentation of the front-end, where data is again to some degree process. So we can display it in the visualization, but most of the more complicated processing happens on the server side in order to not bother the client with it.

A

So here's an overview of what we changed actually from the original code base, and you can also check it out in our github repository, which is linked on the slides um most of our changes in terms of code changes were, of course in the front end, because the visualizations take up a lot of code.

A

We also made some back-end changes in order to support the additional transaction properties that we want to show, for example, the transaction size and the actual identity with the military section, which is data that is not available in the standard hyperledger explorer implementation. So we added that. Then we added some notifications for conflict transactions, because if somebody sends some malicious conflict transactions, they get probably well destroy the network in the worst case. So you should probably know about these transactions and, of course, potentially approve or deny them.

A

If you have the appropriate permissions for that and yeah, of course, for the um rest services, we added the reverse proxy routes that I mentioned. So there was about 1000 lines of code that we had to adjust for that for the front end, we added a lot of new files for the uh visualizations.

A

We added some new lists to support displaying issues from the apple ledger fabric gyra. So we always want to know about the latest security issues, of course, on hyperledger fabric, so we can can see if potentially somebody's exploiting these security issues on our network. So that's something that we'll display on the dashboard right away.

A

In addition, uh we also have um some modifications to some existing views in order to make them a bit more concise and give a better overview of the network and uh yeah. We also added, of course, connectors to the new back-end api routes, which is something you need to do with the redux in the content.

A

Okay, so that's it! For my part, I will now hand over to fabian who is going to give an overview of the processing pipeline and give a live demo of our prototype.

B

All right all right, thanks for saying that I think you should move here because we're getting an echo.

B

Okay, awesome um also hi everyone um I'll take a look at the data collection and things that benedict now just mentioned.

B

Our hypersec tools collect some additional security. Relevant data beyond the data collected by the original hyperledger explorer project, um for example, get an idea of the current performance of the network with respect to transaction throughput.

B

Look at some additional parameters, metrics, um so just take a look at when a transaction is proposed and when it's on the change to the duration between that, um we also collect grpc metrics, giving us insight into the network activity and the network status. Electric communication between nodes between peers and besides these metrics and data directly related to hyperledger fabric um hypersec, also is able to collect logs from local docker containers. Where the fabric network is running.

B

We also have access to the hype. Legit gyro issues by security, attacks, security, relevant um high, pledged china issues and also have a static scanner chain code and during our work together all this data getting it all. Together, we came across some missing or desirable, metrics or functionalities.

B

For example, um outstanding transactions would be really nice to see how that would allow us easier, detect transaction spam attacks.

B

Now you have we're gonna go for for all this data that we have available.

B

um We need to pre-process all this data before especially important when you're working with the transaction data and the possibly large number of data we need to display. When you take a look at that, so this is relevant in the transaction view um when we get all this. This data, together and in the context of interactive visualizations, uh like a large number or large quantity of data, poses a real challenge, and thus we need an efficient way to handle this data without too much detail and with the data binning or data bucketing.

B

We implement data aggregation approach um into this transaction view. um So originally with the hud ledger, explorer users specify a time range for starting and then timestamp, but then they want you to add the transactions, so maybe take a look at the pre-processing and on this slide um besides this already leading to two large data quantities, because we maybe get a lot of transactions for this time range. um We include the additional metrics from meteorites into the existing view, so this leads us to even more data, so we looked at okay.

B

What can we do to like aggregate the data in here?

B

So in our adapted transaction view, users can also specify their preferred step size for the data buckets, um so the smaller the step sizes, the more detail you can get from the data buckets or from the visualizations, but also you get more data buckets when the steps fall. Visualizations might respond slower and based on this, we built like our empty data, buckets and forms of hash map, where each data bucket has an id starting timestamp, the respective transactions and metrics.

B

For this time range, the bucket is kind of, and the timestamp for the first bucket is just to start user input um and the id of the head gets is calculated by dividing the timestamp by the step size and then round it to the smallest integer.

B

um Timestamps of the following buckets is always just the sum of the previous buckets timestamp, plus the user input step size, um and this hatch map now allows a very efficient population, um as you can get. Can we exactly calculate the bucket for each transaction or metric where it needs to go to? um Therefore we take the timestamp of the event um minus the start user input, so this is kind of a normalization.

B

We need to do and divide it again by the step size rounded, to the smallest integer, and this gives us the id or the hash of the respective bucket, where this transaction or metric data needs to go to.

B

um So we can very efficiently access the data as we do not need to iterate.

B

We need the data for us, but we can just um calculate the hash at this point in time is related to um and then data with a runtime of one.

B

Oh okay, that's it for that's live in a bit. If you just please thanks. um So we are using well-established libraries on our project to visualize them this data. So, as benedict mentions uh explorers ui is originally fitted with react. We just stay with react, of course, um and a very well established library to implement its implements interactive script like three chairs this data driven documents.

B

um Well, this is plotting code of this just a huge spaghetti, but and also one other problem with d3. Is it doesn't really uh integrate, rather that well with react, um but in 2020 bnb introduced a pretty cool.

B

Expressive, low level, visualization primitives, based on d3, but very well integrated and combined with the functionality of react um and still, if necessary, all the underlying d3 functionalities are still accessible.

B

So we mainly worked on the network view of hyperledger explorer and the transaction view the main changes on the network view. You can see bottom left side of the slide. um We extended this with a note link graph. The graph shows local nodes and also external nodes, um or appears beyond these two borders.

B

So these are filled nodes you can see, and then this kind of yeah mark the the border of our local organization um and also we can highlight high frequency links based on grpc metrics, um like the sheer pc metrics, are unusual, high, frequent or low frequent. um We can. You can highlight this second main focus, or our second focus was a transaction view about the right of of this slide, um where we can explore information about the transactions on the chains and we added four different visualizations.

B

We have this first uh chart just displaying the number of transactions within each data bucket um that I explained earlier, and then we have three more fine. Granular charts on the left, we have transaction count per msp per bucket um in the middle we have the average transaction size per msp per bucket and on the left and on the right sorry, we have the average processing times of transactions and on the bottom, is the the part of the original hyperledger explorer a table with additional detailed info about the transactions.

B

How this is all working together and how it's looking interactively? We'll just take a look, a quick video, a quick live demo, so um we start with our little overview at the main landing page of the explorer. So this is the dashboard. We get some high-level data about our small test network consisting only of two peers.

B

Besides all this other data, we have the hyperledger chira hyperledger fabric gyro issues, including some details, um the descriptions and also a direct link pointing to the issue.

B

um Next, we'll take a look at the network view which gives us more information about the active peers in the network. So we have this graph with the details. We know about the current network, meaning the nodes in our organization, which is one pier one order marked by these two different clues. We have the two border nodes and we have one external node from another msp.

B

We have some basic information about the nodes on hover interaction, also some basic metrics about the communication between our nodes when hovering on the links- and we have this table below the graph where we have direct access to the docker containers logs of our local organization's nodes. So this is what we can see here, um just the docker container locks.

B

So next we'll look at the hypersex transaction view, so we have three main parts of this view of the search parameters at the top. We have the interactive charts to explore available information about the transactions and um we have then a bunch of details. Each row is a transaction, so we can start selecting a start date from which point only want to explore the data in the topmost chart.

B

We can now see two buckets which seem to have a bit more activity than the rest of the buckets you can see the time window in which these buckets are and respectively, change, our search parameters to this time window time window is now going to be just around three hours, small and with the small time window, we can also change to a more fine granular aggregation.

B

So we can we change here the the bucket size to one minute buckets, um and then we have a pretty frequent pattern, but two signs that are changing the the pattern. um So we have one msp which published with more transactions. Here we can filter the the msps here on the views um and also what then this is somehow showcasing and highlighting up here is that the endorser proposal metric.

B

So um the transaction duration here increases significantly significantly if it's more than 300 milliseconds with the proposition of of these transactions and the table of the bot at the bottom, now shows the transactions related to the currently selected time selection um and also gives some more details, also the direct link to the transaction.

B

So that's it just for a quick video. um I guess that's it about our hyposec video. We can go on the like last slide. Now um the the tool or the current research prototype is available in github. You can check it out there. We are currently experimenting with some different views, different data processing approaches- and I guess now it's just up to me to say thanks to everybody, for the attention- and we are now happy to answer your questions.

B

um There's already like one question in the q, a um so snork roy asks, how is the docker container connected and how will the integration differ when fabric peels are running on kubernetes? So maybe that's something you could answer benedict.

A

um Yes, so basically um we're accessing only the local docker containers. We have actually not tried it with kubernetes. That is something you would have to experiment with on your own, but we're using a standard node package for accessing docker. So you probably just have to change the the uri, I suppose, and uh then it should work.

A

Hopefully the most most important part is that you actually have access to the docker api, and then you just you, can just access it by putting in the proper, proper uri in the code and then the backend is going to forward the request to the um to the docker mode. Yes, and then you get the logs in the front end again, and of course I mean you are only going to be able to um view your own uh nodes logs and not ones of the other organizations, because you might not have permission for that.

A

Okay, so if there are no other questions, that could also go again in a bit more detail on some potential for improvement that we, we noticed um in the high pressure fabric ecosystem on 13..

A

So there are some missing uh metrics that could potentially be added as well, for example, on outstanding transactions, uh discarded blocks or uh failed leader elections, which is something that's very interesting if you're trying to detect an attack and also regarding vulnerabilities, so there is, of course, a need to have proper threat intelligence by version, and there is no really good source for that currently, and you also want to have chain code scanners for the chain code in other languages.

A

So we used one that's used for go, but there is no proper chain code scanners, for example, for javascript or something so those are all the development needs that the community could potentially fill. I see we have uh some more questions. uh Tayamol is asking: are you querying fabric for data or collecting in real time?

A

So um how about explorer works? Is it has a basically real-time sync connection to have a little fabric, so each block arrives at hyperledger explorer as it is um well as it is published on the network. So you have almost real time or near real time. I would say connection to the network and you also, for example, if a config transaction is published.

A

You should get very shortly after that, uh depending some side processing like get a conflict notification in your user interface, so we're not doing on demand queries, but we instead are syncing to network live and then querying our sync database.

A

So, besides the sync delay, there is not much delay there, so it would be perhaps some seconds, but not more than that and another question by uh so mcroy again um he's asking about the channels.

A

So um in the channel view we actually didn't show that on the prototype and the demo, but I can quickly go back to the slide. You can see that at the top there is a channels tab in hybridge explorer, so you can actually see the different channels there, and you can also select the channel that you want to view the transactions on.

A

um So applejack explorer can store blocks and transactions for all channels that you have access to with with your identity, so we can store it for multiple channels.

A

Of course you need to have access, so if the channel is encrypted for you, then hyperledger explorer can't really analyze much. So that's the practices of course, okay. So I think we have reached the end of our time. If there are any more questions uh feel free to contact us.

A

You can reach us, of course, on on github or using our email addresses you just search for our name and university of dragon square. You should easily find it on google, for example, and uh yeah, so we would be very happy if somebody um wants to, for example, contribute to hypersec and github. We are always very open and welcoming to contributions there, and we, of course, always try to contribute our own developments back to the original project.

A

So we have made some full requests to our village explorer to improve the project and uh are of course, gonna continue to do so, as we have uh improvements in our prototype that are relevant for the main project.

A

So it's very very happy, of course, to do that and yeah. That's it for our presentation feel free to contact us and have a nice experience at the conference.