Security Audit of a Blockchain-Based Industrial Application Platform

Round 1

Reviewer 1 Report

The manuscript is very timely as the blockchain is being embraced at rapid pace. Few suggestions:

• Figure 1 needs to be of higher resolution, not readable now. 
• The industrial platforms could have a taxonomy to clarify better.

Author Response

Thank you for your feedback. Please see the attachment for our Responses.

Author Response File: Author Response.pdf

Reviewer 2 Report

Summary:

This paper presents a platform that tries to integrate blockchain technology into existing enterprise environment. The use case, attackers and attacks are described as well the possible types of attacks and countermeasures. there is a strong use case in designing such a platform. An architecture is provided which puts in context the new platform in the context of the existing enterprise environment. Different attacks with in the environment are described and also some real-world scenarios is given. 

Evaluation: It seems that this paper is not yet ready for publication. I think the major question is how to make blockchain work in the context of enterprise environment. For example, how the block is made, how it is stored, what the transactions look like in a block, which nodes act as miners/validators. This aspect is far from addressed in the paper. The presentation in the paper just says that if we use blockchain then some of the attacks can be easily identified and mitigated. This is a very high level description and it only makes an incremental contribution on the existing knowledge of attacks and countermeasures in the enterprise environment. Furthermore, the introduction does not clearly talk about the contribution BISS 4.0 platform. Why the 4.0 in the platform? Figure 1 is unreadable and attack types on Figure 3 are adapted from another paper. Therefore, I suggest authors to revise the paper toward the direction given in the comments above and resubmit again.

Author Response

Thank you for your feedback. Please see the attachment for our Responses.

Author Response File: Author Response.pdf

Reviewer 3 Report

The manuscript presents the interesting and current topic however its need a lot of improvements.

The weak points of the paper are as follows:

1. The title of the manuscript does not correspnd to its content. The manuscript looks rather as a review article.
2. What is the contribution of the paper? I can't identify it.
3. I don't understand the purpose of presenting the use cases in section 4.
4. The idea of using the blockchain concept and its associated technologies is not well presented and justified
5. The list in Introduction contains many information about the  types of attacts but thsi classification is not logical, it contains many drawbacks.
6. please write the paper in impersonal form
7. In the description of manuscript's structure (Introduction) please use the numbers of sections, not the names.
8. description of the use case in subsection 2.1 is very unclear
9. many structure drawbacks, e.g. 2.2. is subsection - NOT section
10. many notation errors in the use case diagram presented in figure 1
11. figure 2 is very low quality and not clear; all attack abbreviations should be explained
12. Please, don't use word "app" or "apps" in research paper - you should use word "application"
13. there are much more types of attacks that were classified and presented in subsection 2.3
14. Table 1 is not clear - add more names of the columns
15. each subsection should be started at least with the short introduction - it is a reserach paper, NOT the technical report
16. table 2 is not clear
17. no discussion is provided
18. the conlusion is too general
19. English has to be improved, there are many typos

Author Response

Thank you for your feedback. Please see the attachment for our Responses.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

Looks good, I have no more concern.

Author Response

Thank you for your review.

Reviewer 3 Report

Firstly, I would like to mention that it is a pity that the introduced changes,/improvements added paragraphs in the new version of the manuscript  were not marked
It would greatly facilitate the assessment and prove what the authors have corrected in their manuscript.
Unfortunately most of my comments were not taken into account.

My comment for this manuscript:

1. Errors in use case diagram - relations between the use cases !!!!! names of use case should be clear and unequivocal.
2. types of attacks???
3. Don't name the subsections the same, e.g. 3.3.3. and 4.1.4
   Moreover the names of the subsection by one work makes the manuscript unclear, especially when there are so many subsections as in this manuscript.
4. What is the contribution of the paper? I can't identify it. The sentences presented as the contribution are weak.
5. The idea of using the blockchain concept and its associated technologies is not well presented and justified. "Blockchain" concetpt is given in the title of the paper so its use should be justified.
6. there are much more types of attacks that were classified and presented
7. Table 1 is not clear
8. table 2 is not clear
9. the conlusion is too general

Author Response

Please see the attachment.

I also included the highlighted paper version here, last time I just uploaded it to the general editor section, thinking you would be able to access it there. Please accept my apologies.

Author Response File: Author Response.pdf

Round 3

Reviewer 3 Report

Still there are the errors in use case diagram - Please don't use UML notation if you don't know how to use it

Author Response

Thank you for your feedback.
We switched the figure to a general version without any UML notation.
We hope it is clearer what we want to express with the figure (a typical maintenance process and the different attack categories, which are applicable to different parts/procedures of the system).
Please see the attachment for an updated paper version (we also adapted the text to fit the new figure, see line 111-114).

Author Response File: Author Response.pdf