Threat detection method and system for cross-chain bridge application

Abstract

The invention discloses a threat detection method and system for a cross-chain bridge application. According to the method, model classification and threat feature matching are carried out on cross-chain bridge application source codes, and security threats existing in the cross-chain bridge application are found and reported, so that the security and availability of the cross-chain bridge application are improved, and economic losses caused by the security threats of the cross-chain bridge application are reduced. According to the method, the known cross-chain bridge model and the known threats can be automatically detected, compared with an existing threat detection method based on manual auditing, the method has the advantages that the detection range is wider, the detection efficiency is higher, the detection accuracy is higher, potential safety threats of cross-chain bridge application are fully analyzed, the safety and usability of a cross-chain bridge are improved, and the method is suitable for popularization and application. And unnecessary loss is avoided.

Description

Technical Field

[0001] The present invention relates to the field of cross-chain bridge technology, and in particular to a threat detection method and system for cross-chain bridge applications. Background Art

[0002] Blockchain technology is a decentralized, open and transparent distributed ledger technology that can achieve data immutability and decentralized storage of digital assets. Through a decentralized node network and cryptographic algorithms, blockchain technology removes the intermediary links of traditional centralized banks and financial institutions, making asset exchange and information transmission safer and faster. Blockchain technology has been widely used in finance, communications, the Internet of Things, and smart cities. It has the characteristics of immutability, openness, transparency, security, and efficiency, and will bring a more credible and reliable digital world to society.

[0003] Cross-chain bridge is an important technology in the field of blockchain technology. It realizes the interconnection between different blockchain systems, allowing different blockchain networks to communicate with each other, and data or assets can flow freely across different blockchain systems. Cross-chain bridge technology mainly realizes the asset transfer and information transmission functions between different blockchain networks through smart contract technology and algorithm design, so its implementation involves some technical fields such as network protocols, cryptography and mathematical algorithms. Cross-chain bridge technology can effectively solve the island problem between blockchains, expand the application scenarios of blockchain technology, and promote the development and popularization of blockchain technology.

[0004] In cross-chain bridge technology, smart contracts play a key role. A smart contract is a contract represented by a computer program that realizes the automated execution of transactions. In cross-chain bridge technology, smart contracts automate the cross-chain transaction process by writing cross-chain transaction rules.

[0005] In order to ensure the security and stability of cross-chain bridge technology, cross-chain bridge technology needs to adopt various algorithms. Among them, hash locking technology is one of the most important technologies in cross-chain bridge technology. Hash locking technology is based on the irreversibility and uniqueness of hash functions. By establishing a hash transaction relationship between two blockchains, the order and consistency of cross-chain transactions are guaranteed.

[0006] In addition, cross-chain bridge technology also includes multi-signature technology and token locking technology. Multi-signature technology is to improve the security of assets by controlling asset transactions by multiple parties. Token locking technology is to lock tokens in smart contracts, making the transfer of tokens between different blockchains safe and controllable.

[0007] However, while cross-chain bridge technology achieves interoperability, it also brings some security threats. Due to the differences in security and credibility between different blockchain systems, cross-chain bridge technology may face the following security threats:

[0008] Cross-chain bridge contract threat: Since the cross-chain bridge involves multiple blockchain systems, the security vulnerabilities of any of the on-chain contracts may affect the security of the entire cross-chain bridge system;

[0009] Security threats of off-chain devices of cross-chain bridges: Since cross-chain bridges need to rely on off-chain devices to realize the interactive communication of multiple blockchain systems, whether the off-chain devices meet the expected execution business and whether the off-chain devices are likely to be attacked and hijacked will affect the security and availability of the cross-chain bridge system;

[0010] Cross-chain bridge security protocol vulnerabilities: Since the cross-chain bridge system involves multiple security protocols and algorithms, there may be security vulnerabilities in these protocols and algorithms, allowing attackers to tamper with or forge data, or perform other malicious operations.

[0011] In order to deal with these security threats, people began to study cross-chain bridge threat detection technology; cross-chain bridge threat detection technology aims to detect and prevent various security threats in the cross-chain bridge system by detecting the relevant code and execution status of the cross-chain bridge application, thereby ensuring the security and reliability of the cross-chain bridge system. Existing cross-chain bridge threat detection solutions are mainly based on manual auditing of contract codes, which makes the detection efficiency very low and the detection results are highly dependent on the professionalism of the auditors. Especially in the threat detection of large-scale systems, the effect of this method will be very limited.

[0012] Manual audit process:

[0013] Auditors need to learn about cross-chain bridge threats in advance

[0014] Auditors read the relevant documents and codes of the cross-chain bridge application and understand the application business logic

[0015] Auditors use the threat knowledge they have learned before to determine if there are any threats in the code.

[0016] The auditor confirms, tests and reviews the threats found in the previous step to ensure that the cross-chain bridge application actually exists.

[0017] Auditors prepare audit reports based on audit results and disclose threats and security risks involved in cross-chain bridge applications

[0018] In view of the relevant shortcomings of the above-mentioned prior art, the present invention aims to realize automated cross-bridge threat detection, which has a wider scope of application, higher efficiency, lower probability of threat omission, and is more worthy of promotion and use.

[0019] Terminology Introduction:

[0020] Crosschain Bridge: A crosschain bridge is a technical solution or tool that connects different blockchains. It can achieve interoperability between different blockchain networks, allowing users to freely transfer digital assets between different blockchain networks.

[0021] Formalization: Formalization refers to the systematization of a concept, theory or knowledge into a formal description for the purpose of systematic research, analysis and utilization. Formalization can make a certain knowledge, idea or theory clearer, more specific and more accurate, thus making it easier to understand and reason about.

[0022] Feature matching: Feature matching is a program threat detection technology that matches program analysis results with threat features to determine whether the program has related threats;

[0023] Behavior-Event Inconsistency: In blockchain technology, Behavior-Event Inconsistency refers to the situation in which, during the execution of a blockchain transaction, a contract maliciously emits false events, resulting in inconsistency between the behavior and the emitted events during the transaction, causing the event recipient to be deceived by the false event and cause losses. Summary of the invention

[0024] The purpose of the present invention is to provide a threat detection method and system for cross-chain bridge applications to overcome the deficiencies in the prior art.

[0025] To achieve the above object, the present invention provides the following technical solutions:

[0026] This application discloses a threat detection method for cross-chain bridge applications, comprising the following steps:

[0027] S1. The user submits a detection request to the system and uploads the cross-chain bridge source code to be audited;

[0028] S2. The system extracts the model from the uploaded cross-chain bridge source code and obtains the model information;

[0029] S3, feature matching the model information of step S2 with the cross-chain bridge model in the system model library; if the match fails, a matching failure is returned to the user and the process terminates; if the match succeeds, proceed to step S4;

[0030] S4. Determine the threats and threat characteristics of the model based on the successfully matched model information and the model-threat mapping table;

[0031] S5. The system performs program analysis on the source code of the cross-chain bridge to be audited based on the threats existing in the model. It performs feature matching based on the program analysis results and the threat features of the model to detect known threats.

[0032] Preferably, the cross-chain bridge model includes a cross-chain bridge model based on a hash time lock, a cross-chain bridge model based on a notary, a cross-chain bridge model based on an off-chain repeater, and a formalized model of a cross-chain bridge supplemented by the user.

[0033] Preferably, the threats include erroneous event emission threats, vulnerable event parser threats, cross-chain bridge message hijacking threats, unconditional refund threats, private key leakage threats caused by repeated ECDSA signature random numbers, unauthorized asset unlocking threats, and user self-supplement threats; the threat features are formalized formulas and key behaviors of threat information.

[0034] Preferably, the method further comprises updating the model-threat mapping table, wherein the updating of the model-mapping table comprises updating the system model library, and specifically comprises the following steps:

[0035] A1. The user uploads the cross-chain bridge model to the system, including the entities, main behaviors and formalized formulas of the cross-chain bridge application;

[0036] A2. The system performs feature matching between the cross-chain bridge model uploaded by the user and the cross-chain bridge model in the system model library. If the match is successful, it means that the model already exists and the process terminates. Otherwise, the model is updated to the system model library and the user is requested to check the threats existing in the model.

[0037] A3. The system receives threat information about the module and updates the model-mapping table.

[0038] Preferably, the method further comprises updating the model-threat mapping table, wherein the updating of the model-mapping table comprises updating the system threat library, and specifically comprises the following steps:

[0039] B1. The user uploads the threat to the system, including basic threat information and threat characteristics;

[0040] B2. The system matches the threat uploaded by the user with the threat in the system threat library. If the match is successful, it means that the threat already exists and the process ends. Otherwise, the threat is updated to the system threat library. At the same time, the system requests the cross-chain bridge model that contains the threat from the user.

[0041] B3. The system update module receives the cross-chain bridge model with the threat and updates the model-threat mapping table.

[0042] Preferably, the basic threat information includes threat name, threat level, threat hazard, and threat cause.

[0043] Preferably, in step S2, the system uses a formal verification method to extract the model from the uploaded cross-chain bridge source code to obtain model information.

[0044] Preferably, the program analysis in step S5 includes emission event capture, event parsing, behavior parsing, behavior-event comparison, and business logic extraction.

[0045] The present invention provides a threat detection system for a cross-chain bridge application, comprising a system update module, a cross-chain bridge classification module, and a threat detection module; the system update module is used to implement the update and maintenance of a system model library, a system threat library, and a model-mapping table; the cross-chain bridge classification module is used to implement model extraction of a cross-chain bridge source code and perform feature matching with a cross-chain bridge model in the system model library; the threat detection module is used to implement program analysis of the cross-chain bridge source code and match it with threat features.

[0046] Beneficial effects of the present invention:

[0047] 1. Cross-chain bridge classification, model-threat mapping: The method proposed in this invention is not limited to a specific type of cross-chain bridge application, but can be adapted to a variety of cross-chain bridges. The system can achieve wide coverage of cross-chain bridge types by maintaining a model library and allowing users to update the model. Classifying and retesting cross-chain bridges can make detection more accurate and efficient;

[0048] 2. Cross-chain bridge model extraction based on formal verification: Formal verification technologies such as program invariant detection can realize automated or semi-automated cross-chain bridge application extraction, greatly saving the cost of manual code reading and being more suitable for automated or semi-automated threat detection needs;

[0049] 3. Threat detection based on behavior-event comparison: Cross-chain bridge applications are highly dependent on the emission, capture and analysis of events. Threat detection based on behavior-event comparison is well adapted to the characteristics of cross-chain bridge scenarios, so that fatal cross-chain bridge threats such as erroneous event emission threats and unauthorized asset unlocking threats can be accurately detected.

[0050] The present invention combines formal detection technology with a variety of threat detection technologies including behavior-event consistency comparison technology to achieve automated or semi-automated threat detection in the emerging blockchain scenario of cross-chain bridge applications. It also has compatibility with heterogeneous cross-chain bridges, supports cross-chain bridge model updates and threat updates, has high scalability of scenarios, and high detection accuracy, which greatly saves the time and labor costs of cross-chain bridge threat detection, and has good adaptability and scalability for more complex cross-chain bridge applications in the future.

[0051] The features and advantages of the present invention will be described in detail through embodiments in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a flowchart of a threat detection method for cross-chain bridge applications of the present invention;

[0053] Figure 2 It is a schematic diagram of the process of updating the model library of the system of the present invention;

[0054] Figure 3 It is a schematic diagram of the process of updating the threat library of the system of the present invention;

[0055] Figure 4 It is a system architecture diagram of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below through the accompanying drawings and embodiments. However, it should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the scope of the present invention. In addition, in the following description, the description of known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0057] See also Figure 4 , the present invention is an architecture diagram of a threat detection system for cross-chain bridge applications; including the following modules:

[0058] System update module: Update and maintain the cross-chain bridge models, threats, threat characteristics, and mapping relationships between threat types included in the cross-chain bridges supported by the system;

[0059] Cross-chain bridge classification module: extracts models from the submitted cross-chain bridge application source code using formal techniques such as program invariant detection, performs pattern matching with the cross-chain bridge model pulled from the system update module, and returns the matching results;

[0060] Threat detection module: Receives threat features sent by the system update module, receives submitted cross-chain bridge application source code, performs program analysis including emission event capture, event analysis, behavior analysis, behavior-event comparison, business logic extraction, etc. according to the program source code, and matches features with the threat features sent by the system update module. If the match is successful, it means that the cross-chain bridge has this type of threat; otherwise, it is considered that the cross-chain bridge does not have this threat. The module will further output a detection report based on the matching results and threat-related information for system users to read.

[0061] See also Figure 1 The embodiment of the present invention provides a threat detection method for a cross-chain bridge application, and the steps are as follows:

[0062] 1. The user submits a detection request to the system and uploads the cross-chain bridge source code to be audited;

[0063] 2. The cross-chain bridge classification module uses formal verification methods such as program invariant detection to extract models from the uploaded cross-chain bridge source code;

[0064] 3. The cross-chain bridge classification module submits a cross-chain bridge model acquisition request to the system update module;

[0065] 4. The system update module retrieves the existing model information of the system and returns it to the cross-chain bridge classification module;

[0066] 5. The cross-chain bridge classification module performs feature matching based on the model information extracted in step 2 and the model information obtained in step 4, and attempts to classify the cross-chain bridge application submitted by the user into the cross-chain bridge model known to the system;

[0067] 6. If the matching fails, that is, the cross-chain bridge application uploaded by the user does not belong to any model in the system model library, a prompt message indicating that the model matching failed and the uploaded model is an unknown model will be returned to the user, and the process will terminate;

[0068] 7. If a model is successfully matched, the cross-chain bridge classification module sends the classification result to the system update module;

[0069] 8. The system update module receives the classification results and sends the model information matched by the classification, the possible threat information of the model, and the threat characteristics to the threat detection module;

[0070] 9. After receiving the model information and the possible threat information of the model, the threat detection module requests the cross-chain bridge source code to be detected from the cross-chain bridge classification module;

[0071] 10. The cross-chain bridge classification module sends the cross-chain bridge source code to be detected to the threat detection module;

[0072] 11. The threat detection module receives the source code of the cross-chain bridge to be detected, performs program analysis such as extracting key behavior functions, capturing key event emissions, and extracting key variable changes. It uses these program analysis results to match the threat features sent by the system update module to detect known threats;

[0073] 12. The threat detection module returns a detection report to the user based on the detection results, and the process terminates.

[0074] Among them, the cross-chain bridge model includes the cross-chain bridge model based on hash time lock, the cross-chain bridge model based on notary, the cross-chain bridge model based on off-chain repeater, and the formalized model of the cross-chain bridge supplemented by users themselves;

[0075] Threats include the threat of erroneous event emission, the threat of vulnerable event parser, the threat of cross-chain bridge message hijacking, the threat of unconditional refund, the threat of private key leakage caused by repeated ECDSA signature random numbers, the threat of unauthorized asset unlocking, and the threat of user self-supplement;

[0076] Threat characteristics are formalized formulas and key behaviors of threat information.

[0077] In a feasible embodiment, the system uses a formal verification method to extract a model from the uploaded cross-chain bridge source code; specifically, a formal verification method such as program invariant detection;

[0078] In a feasible embodiment, program analysis includes emission event capture, event analysis, behavior analysis, behavior-event comparison, and business logic extraction;

[0079] The method includes updating the model-threat mapping table, wherein the updating of the model-mapping table includes updating the system model library and updating the threat; wherein the updating of the system model library refers to Figure 2 , specifically including the following steps:

[0080] 1. The user uploads a customized cross-chain bridge model to the system, including the entities included in the cross-chain bridge application, the main behaviors and the formalized formulas of the behaviors;

[0081] 2. The system update module will search and compare in the model library;

[0082] 3. If the model is already included in the system model library, a prompt message indicating that the model already exists will be returned to the user, and the process will terminate;

[0083] 4. If the model does not exist in the system model library, update the model to the system model library;

[0084] 5. The system update module requests the user for possible threats to the model. At this time, the threats should be in the system threat library.

[0085] 6. The system update module receives the possible threats of the model and updates the model-threat mapping table;

[0086] 7. The system returns the model update success information to the user and the process terminates.

[0087] System Threat Database Update Reference Figure 3 , specifically including the following steps:

[0088] 1. Users upload custom threats to the system, including basic threat information and threat characteristics such as threat name, threat level, threat hazard, and threat cause;

[0089] 2. The system update module will search and compare in the threat library;

[0090] 3. If the threat is already included in the system threat library, a prompt message indicating that the threat already exists will be returned to the user, and the process will terminate;

[0091] 4. If the threat does not exist in the system threat library, update the threat to the system threat library;

[0092] 5. The system update module requests the user to provide a cross-chain bridge model that contains the threat. The cross-chain bridge model should be in the system model library at this time.

[0093] 6. The system update module receives the model that may contain the threat and updates the model-threat mapping table;

[0094] 7. The system returns the threat update success information to the user and the process terminates.

[0095] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, equivalent substitution or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A threat detection method for cross-chain bridge applications, characterized in that: The steps include: S1. The user submits a detection request to the system and uploads the cross-chain bridge source code to be audited; S2. The system extracts the model from the uploaded cross-chain bridge source code and obtains the model information; S3, feature matching the model information of step S2 with the cross-chain bridge model in the system model library; if the match fails, a matching failure is returned to the user and the process terminates; if the match succeeds, proceed to step S4; S4. Determine the threats and threat characteristics of the model based on the successfully matched model information and the model-threat mapping table; S5. The system performs program analysis on the source code of the cross-chain bridge to be audited based on the threats existing in the model. It performs feature matching based on the program analysis results and the threat features of the model to detect known threats.

2. A threat detection method for cross-chain bridge applications as claimed in claim 1, characterized in that: The cross-chain bridge model includes a cross-chain bridge model based on a hash time lock, a cross-chain bridge model based on a notary, a cross-chain bridge model based on an off-chain repeater, and a formalized model of a cross-chain bridge supplemented by users themselves.

3. A threat detection method for cross-chain bridge applications as claimed in claim 1, characterized in that: The threats include the threat of erroneous event emission, the threat of vulnerable event parser, the threat of cross-chain bridge message hijacking, the threat of unconditional refund, the threat of private key leakage caused by repeated ECDSA signature random numbers, the threat of unauthorized asset unlocking, and the threat of user self-supplementation; the threat characteristics are the formalized formulas and key behaviors of threat information.

4. A threat detection method for cross-chain bridge applications as claimed in claim 1, characterized in that: The method further includes updating the model-threat mapping table, wherein the updating of the model-mapping table includes updating the system model library, and specifically includes the following steps: A1. The user uploads the cross-chain bridge model to the system, including the entities, main behaviors and formalized formulas of the cross-chain bridge application; A2. The system performs feature matching between the cross-chain bridge model uploaded by the user and the cross-chain bridge model in the system model library; If the match is successful, it means that the model already exists and the process terminates; Otherwise, the model is updated to the system model library, and the threats existing in the model are requested from the user; A3. The system receives threat information about the module and updates the model-mapping table.

5. A threat detection method for cross-chain bridge applications as claimed in claim 1, characterized in that: The method further includes updating the model-threat mapping table, wherein the updating of the model-mapping table includes updating the system threat library, and specifically includes the following steps: B1. The user uploads the threat to the system, including basic threat information and threat characteristics; B2. The system matches the threat uploaded by the user with the threat in the system threat library. If the match is successful, it means that the threat already exists and the process ends. Otherwise, the threat is updated to the system threat library. At the same time, the system requests the cross-chain bridge model that contains the threat from the user. B3. The system update module receives the cross-chain bridge model with the threat and updates the model-threat mapping table.

6. A threat detection method for cross-chain bridge applications as claimed in claim 1, characterized in that: The basic threat information includes threat name, threat level, threat hazard, and threat cause.

7. A threat detection method for cross-chain bridge applications as claimed in claim 1, characterized in that: In step S2, the system uses a formal verification method to extract the model from the uploaded cross-chain bridge source code to obtain model information.

8. A threat detection method for cross-chain bridge applications as claimed in claim 1, characterized in that: The program analysis in step S5 includes emission event capture, event analysis, behavior analysis, behavior-event comparison, and business logic extraction.

9. A threat detection system for cross-chain bridge applications, characterized by: It includes a system update module, a cross-chain bridge classification module, and a threat detection module; the system update module is used to update and maintain the system model library, the system threat library, and the model-mapping table; the cross-chain bridge classification module is used to extract the model of the cross-chain bridge source code and perform feature matching with the cross-chain bridge model in the system model library; the threat detection module is used to perform program analysis on the cross-chain bridge source code and match it with threat features.

Images