Securing Hyperledger Fabric

In this chapter, we will learn about Hyperledger Fabric, one of the most well known industrial examples of distributed ledger technology (DLT). Although DLT solutions are inspired by blockchain, they nonetheless show peculiar and distinctive characteristics. We will, therefore, analyze the differences between blockchain and DLTs, examining the pros and cons of these technologies. After introducing the Hyperledger architecture, we will analyze the security aspects related to the digital identities associated with the members participating in the DLT, and we will examine the security of chaincode, the equivalent of smart contracts in Hyperledger. Finally, we will learn how to protect Hyperledger from security and privacy threats by using the product's features.

The topics covered in the chapter are listed here:

• Permissioned blockchains and DLTs
...

Permissioned blockchains and DLTs

As anticipated in Chapter 1, Introducing Blockchain Security and Attack Vectors, when we speak generically of blockchain, we actually refer to differing types of technologies united by the fact of storing transaction information within a shared ledger. However, these differences take on significant importance, both in terms of implementation and security.

Therefore, it is important to explore the different characteristics of blockchain-based technologies, with particular regard to public and private (also known as permissioned) blockchains. This will allow us to fully understand the characteristics of Hyperledger Fabric, which represents one of the most popular permissioned blockchain implementations.

So, let's first clarify the distinction between public and private blockchains.

...

Getting to know Hyperledger Fabric

Hyperledger Fabric is a permissioned blockchain managed by a consortium of companies. The project has been hosted and promoted by the Linux Foundation since December 2015, since the Linux Foundation together with 30 sponsoring companies (including IBM) decided to create an enterprise-class open source blockchain. Other major companies of the caliber of Intel, Accenture, and Huawei have subsequently joined the project, and their number currently exceeds 250 members.

Hyperledger Fabric is designed to provide high flexibility and extensibility, both at an architectural and application level. The modular architecture extends to the consensus mechanism, thus allowing specific consensus algorithms to be adopted on the basis of the different use cases, simply by choosing the most suitable component to implement the consensus mechanism of choice. The...

Hyperledger strong identities

Of central importance in the permissioned blockchain model adopted by Hyperledger Fabric is the management of the digital identities of the members of the network. This ensures not only security but trust in transactions between trusted counterparties. In Hyperledger Fabric, the creation, maintenance, and revocation of digital identities is entrusted to a specific component, known as the Membership Service Provider (MSP). The MSP component manages digital identities in the form of cryptographically signed certificates. In Hyperledger Fabric, there is a default MSP, known as Fabric CA, which has the task of issuing certificates in X.509 format to be associated with members authorized to participate in the network.

But before we find out about the details of identity management, we need to focus on how to carefully design our network of trusted counterparts...

Hyperledger chaincode security

Smart contracts, which in Hyperledger Fabric take the name of chaincodes, are programs containing instructions regarding transactions and are characterized by self-execution, meaning that when a trigger event occurs, the instructions contained in the smart contract are executed. In Hyperledger Fabric, chaincodes can be programmed using standard programming languages.

Please note that chaincodes do not have direct access to the transaction ledger, and only after their execution will the transactions be added to the ledger.

Chaincodes can be deployed by peer nodes, even in multiple versions of the same program.

In the next section, we'll see how the installation and deployment of chaincodes is carried out.

Installing and deploying chaincodes

...

Preventing common threats with Hyperledger

Hyperledger Fabric manages some of the most common threats by leveraging its own architectural security model. Obviously, this does not exempt those who administer the platform from adopting the appropriate perimeter measures (firewall, routing, and so on) to safeguard the security of network infrastructures.

Common security threats can relate to the following:

• The identity of the participants: A typical attack consists of using stolen user credentials to authenticate on the system as an authorized user. The management of the X.509 digital certificates, made possible by Fabric CA, limits this type of attack, provided that the CRL is constantly updated and shared with all the member organizations.
• Data integrity and confidentiality: Hyperledger Fabric's transaction management mechanisms, combined with the use of cryptography, is...

Summary

In this chapter, we have seen the differences between permissionless (public) and permissioned (private) blockchains and the main implications of different consensus mechanisms and transaction management. We also addressed the various architectural, application-related, and security-related aspects of Hyperledger Fabric, one of the most popular enterprise-class permissioned blockchains, highlighting the advantages of adopting a modular architecture with Hyperledger Fabric. Special attention was paid to trusted execution environments and preserving transaction privacy by exploiting multi-channel functionality and private data.

In the next chapter, our journey continues with an analysis of the security of decentralized apps and smart contracts in the Ethereum environment.