Skip to content

Security Module (hierachain/security/*)

Overview

The security module provides the main protections for HieraChain. It does not rely on one layer. Instead it combines identity, access control, resource protection, and zero-knowledge proofs so that a failure in one area does not expose the whole system.

Six security areas

The design groups protections into six areas that work together:

  • Authorization and access

    Identity management (MSP), API key authentication, and attribute-based access control (ABAC). Details

  • Lockdown and logging

    Emergency cluster lockdown and tamper-evident logging. Details

  • Integrity and guard

    Resource protection against DoS and integrity checks for code and configuration at startup. Details

  • Risk and sanitization

    Anomaly detection and input sanitization against injection attacks. Details

  • Encryption and keys

    Key lifecycle management (Ed25519, AES-GCM) and X.509 certificates. Details

  • Zero-knowledge proofs

    Cross-chain privacy using zero-knowledge proofs (ZKP) so verifiers learn nothing beyond validity. Details

How it connects

Each part of HieraChain uses the same layers:

  • API server uses ResourceGuard and APIKeyVerifier as middleware. They run first on every request.
  • Consensus signs every consensus message and checks integrity before accepting it.
  • Storage encrypts sensitive data before write and sanitizes input on queries.

Security configuration

Main settings live in hierachain/config/settings.py:

  • AUTH_ENABLED turns API authentication on or off.
  • HRC_CLUSTER_SECRET is the secret for cluster control commands.
  • HRC_ENABLE_ZK_PROOFS enables ZK proof verification.