Department of Computer Engineering, Ajou University, Suwon 16499, Korea.
Department of Software and Computer Engineering, Ajou University, Suwon 16499, Korea.
Sensors (Basel). 2022 May 21;22(10):3903. doi: 10.3390/s22103903.
Current blockchain-based cloud (BBC) systems have several security vulnerabilities regarding smart contracts (SC), and several attacks have been reported recently. The SC development lacks standard design processes that follow software lifecycle principles to model secure SC. Secondly, the security mechanisms in the SC are not constantly evolved to resist evolving adversary attacks. BBC systems lack self-adaptive security capability to make spontaneous decisions when adversarial attacks are encountered. To build a self-adaptive secure BBC system that follows standard software development lifecycle principles to model secure SC, we propose the so-called self-adaptive security RE_BBC framework. The framework would utilize the MAPE-BBC adaptation loop to make decisions internally based on the threat models, goal models, and service level agreement (SLA) SC security specifications. The framework identifies vulnerabilities and threats and takes precautionary measures using self-adaptive SC agents. We validated the proposed methodology theoretically and empirically, and statistically proved the research questions and hypothesis using the -test and Mann-Whitney test. Subsequently, we compare our proposed approach with the Security Quality Requirements Engineering approach (SQUARE). The feasibility results and the replicated study results indicate that the proposed approach outperformed the SQUARE approach in terms of artifacts quality, self-adaptive security evaluation quality, efficiency in response time, complexity, and usefulness of the proposed approach for the Healthcare Data Management (HDM) system. SC security developers can immensely benefit from our proposed methodology. They need not reengineer SC from scratch; depending on their security needs and plan, the contract can be adapted to execute a new plan.
当前基于区块链的云 (BBC) 系统在智能合约 (SC) 方面存在几个安全漏洞，最近有报道称已经发生了几次攻击。SC 的开发缺乏遵循软件生命周期原则的标准设计流程来对安全的 SC 进行建模。其次，SC 中的安全机制并没有不断发展以抵御不断发展的对手攻击。BBC 系统缺乏自适应安全能力，在遇到对手攻击时无法做出自发的决策。为了构建一个遵循标准软件开发生命周期原则来对安全 SC 进行建模的自适应安全 BBC 系统，我们提出了所谓的自适应安全 RE_BBC 框架。该框架将利用 MAPE-BBC 自适应循环根据威胁模型、目标模型和服务水平协议 (SLA) SC 安全规范在内部做出决策。该框架使用自适应 SC 代理识别漏洞和威胁并采取预防措施。我们从理论和实证两方面验证了所提出的方法，并使用 -检验和 Mann-Whitney 检验对研究问题和假设进行了统计证明。随后，我们将我们提出的方法与安全质量要求工程方法 (SQUARE) 进行了比较。可行性结果和复制研究结果表明，在所提出的方法在工件质量、自适应安全评估质量、响应时间效率、复杂性以及对医疗保健数据管理 (HDM) 系统的实用性方面优于 SQUARE 方法。SC 安全开发人员可以从我们提出的方法中受益匪浅。他们不必从头重新设计 SC；根据他们的安全需求和计划，可以对合同进行调整以执行新计划。
