2020企业级区块链安全白皮书关于绿盟科技绿盟科技集团股份有限公司（以下简称绿盟科技），成立于2000年4月，总部位于北京。公司于2014年1月29日起在深圳证券交易所创业板上市，证券代码：300369。绿盟科技在国内设有40多个分支机构，为政府、运营商、金融、能源、互联网以及教育、医疗等行业用户，提供全线网络安全产品、全方位安全解决方案和体系化安全运营服务。公司在美国硅谷、日本东京、英国伦敦、新加坡设立海外子公司，深入开展全球业务，打造全球网络安全行业的中国品牌。关于中国移动研究院中国移动研究院成立于2001年，是集团公司直属单位。研究院以做“中国移动技术创新的引擎”为愿景，落实国家创新驱动发展战略和公司“大连接”战略，致力于成为公司权威的战略智库，深入开展技术产业引领、现网运营与战略支撑、新型产品和重大平台研发，研究领域覆盖了无线、网络、人工智能、业务、安全、物联网、实验测试、用户与市场、战略研究等。研究院拥有高素质、专业化的干部队伍，高水平、国际化专家研发团队，目前有员工1120多人，平均年龄34岁，硕士以上超过90%，拥有首席科学家3人和一大批国家级科技专项课题负责人和国际标准化组织领导人。研究院拥有国际一流的试验基地，总面积超过1万平方米，包括五个国家级工程实验室、两个国际组织全球测试认证基地，为行业提供了协同创新的平台。关于北京航空航天大学自1952年10月建校以来，北京航空航天大学一直是国家重点建设的高校，2017年北航入选国家“双一流”建设高校名单（A类），学校突出人才培养中心地位，坚持“把一流学生培养成一流人才”的育人理念，在人才培养中创造知识，在创造知识中培育人才，为中国的航空航天事业和国家建设发展培养了一批领军人物和奠基人才。2017年8月，北航网络空间安全学院正式成立。同年9月，北航获批由中央网信办、教育部共同授牌的“一流网络安全学院建设示范项目高校”，成为国内七所示范项目建设高校之一。北航网络空间安全学院在空天信息网络高速数据加密、卫星网络通信系统安全、移动互联网安全、区块链安全、大数据与云计算安全、工业互联网安全等研究领域形成了特色鲜明的研究方向。版权声明为避免合作伙伴及客户数据泄露，所有数据在进行分析前都已经过匿名化处理，不会在中间环节出现泄露，任何与客户有关的具体信息，均不会出现在本报告中。企业级区块链安全白皮书A目录 CONTENTS目录执行摘要 ··································································································································································· 11. 区块链产业发展 ···················································································································································· 31.1 区块链政策推进 ·········································································································································································· 41.2 区块链产业分类 ·········································································································································································· 41.3 区块链产业预测 ·········································································································································································· 52. 企业级区块链介绍 ················································································································································ 62.1 企业级区块链和联盟链的关系 ·················································································································································· 72.2 企业级区块链的特点 ·································································································································································· 72.3 企业级区块链的应用场景 ·························································································································································· 82.3.1 去中心化金融 ······························································································································································································ 82.3.2 物联网应用 ·································································································································································································· 92.3.3 能源和工业互联网 ···················································································································································································· 102.3.4 司法存证 ···································································································································································································· 112.3.5 食品溯源 ···································································································································································································· 112.3.6 去中心化身份认证 ···················································································································································································· 122.4 企业级区块链的参考架构 ························································································································································ 122.5 主流企业级区块链平台 ···························································································································································· 132.5.1 Hyperledger ·······························································································································································································132.5.2 Quorum ······································································································································································································142.5.3 R3 Corda ····································································································································································································162.5.4 FISCO BCOS ······························································································································································································162.6 联盟链的关键技术 ···································································································································································· 182.6.1 共识机制 ···································································································································································································· 182.6.2 智能合约 ···································································································································································································· 212.6.3 数据安全共享与计算 ················································································································································································ 272.6.4 隐私保护 ···································································································································································································· 303. 企业级区块链面临的安全风险 ··························································································································· 333.1 基础层风险 ················································································································································································· 343.2 核心层风险 ················································································································································································· 343.3 服务层和用户层风险 ································································································································································ 353.4 跨层功能风险 ·············································································································································································354. 企业相关的区块链安全态势 ······························································································································ 364.1 区块链漏洞统计 ········································································································································································ 374.2 公开的企业级区块链安全事件和安全研究 ···························································································································· 39企业级区块链安全白皮书B目录 CONTENTS4.3 企业级区块链安全态势分析 ···················································································································································· 405. 企业级区块链相关安全技术 ······························································································································ 415.1 密钥管理机制 ·············································································································································································425.2 参与者身份管理 ········································································································································································ 425.3 监管 ····························································································································································································· 425.4 隐私保护 ····················································································································································································· 425.5 防双花 ························································································································································································· 436. 企业级区块链安全治理 ······································································································································ 446.1 政策监管 ····················································································································································································· 456.2 数据治理 ····················································································································································································· 456.3 智能合约治理 ·············································································································································································467. 企业级区块链安全解决方案 ······························································································································ 487.1 基础层安全 ················································································································································································· 497.1.1 容器安全 ···································································································································································································· 497.1.2 网络安全 ···································································································································································································· 507.1.3 密钥安全 ···································································································································································································· 507.1.4 终端安全 ···································································································································································································· 507.2 核心层安全 ················································································································································································· 507.2.1 跨链安全 ···································································································································································································· 507.2.2 智能合约安全 ···························································································································································································· 517.2.3 隐私保护 ···································································································································································································· 527.2.4 数据治理 ···································································································································································································· 527.3 用户和服务层安全 ···································································································································································· 527.3.1 Web安全 ··································································································································································································· 527.3.2 业务安全 ···································································································································································································· 537.3.3 API安全 ····································································································································································································· 537.3.4 认证和身份管理 ························································································································································································ 537.4 全生命周期安全 ········································································································································································ 547.4.1 开发交付 ···································································································································································································· 547.4.2 安全防护 ···································································································································································································· 547.4.3 异常检测 ···································································································································································································· 547.4.4 响应恢复 ···································································································································································································· 557.4.5 安全服务 ···································································································································································································· 558. 结语 ····································································································································································· 57参考文献 ································································································································································· 59企业级区块链安全白皮书C执行摘要执行摘要区块链（ Blockchain）技术自 2008年问世，至今已有 12年之久，从最初的加密货币比特币（区块链 1.0），发展到当前火热的基于智能合约的去中心化应用（区块链 2.0），乃至现在各行各业在讨论各自垂直领域的泛区块链应用（区块链 3.0），发展受到监管和外部环境变化有起有伏，但总体方向是前进的。可以预见，区块链应用借助其天然的数据不可篡改、去中心化、可取证可溯源等特性，必将超越最初金融经济领域的应用，会在政府交通、文化健康、数字金融、智能制造、供应链管理、数字身份等领域发挥更大的作用。区块链技术可构建去中心化的可信数据交换的业务模式，减少因缺乏信任而损失社会成本、经济成本和时间成本，提高多方参与的系统性运转效率。2019年 10月，习总书记在中央政治局第十八次集体学习时强调，把区块链作为核心技术自主创新重要突破口，加快推动区块链技术和产业创新发展。习总书记的这番讲话，将区块链技术放到了新的战略高度，预计越来越多的企业将在其业务中使用区块链技术，与此同时，企业级区块链面临严峻的安全问题。借着这个契机，绿盟科技、北京航空航天大学、中国移动研究院联合推出企业级区块链安全白皮书，旨在对企业级的区块链的概念、架构、技术、安全等进行一个全面的介绍，使读者对企业级区块链相关的内容有一个较为深入的了解。本白皮书的主要观点如下： 加快推动区块链技术和产业创新发展，探索“区块链 +”模式 2020年 1月，国务院办公厅发布关于支持国家级新区深化改革创新加快推动高质量发展的指导意见。该意见指出，加快推动区块链技术和产业创新发展，探索“区块链 +”模式，促进区块链和实体经济深度融合。 智能合约不是“完美合约”，安全问题需警惕从区块链自身的漏洞和安全事件来看，企业级区块链应用还在早期，但随着区块链应用的普及，相关的公开漏洞会越来越多。可以预测大部分漏洞会来自智能合约，特别是不安全的函数、越界等常规安全问题。 区块链两大安全威胁：