A blockchain based approach for the definition of auditable Access Control systems. Issue 84 (July 2019)

• Record Type: Journal Article
• Authors: Di Francesco Maesa, Damiano; Mori, Paolo; Ricci, Laura
• Is Part Of: Computers & security. Issue 84(2019)
• Page Start: 93
• Page End: 119
• Publication Date: 2019-07
• Subjects: Blockchain -- Smart Contract -- Ethereum -- Access Control -- XACML; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.03.016
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: Integration of a traditional Access Control System with blockchain technology. A proven auditable blockchain based Access Control System. Implementation of a general XACML Access Control System through smart contracts. Proof of concept implementation and testing of the proposed blockchain based Access Control System. Abstract: This work proposes to exploit blockchain technology to define Access Control systems that guarantee the auditability of access control policies evaluation. The key idea of our proposal is to codify attribute-based Access Control policies as smart contracts and deploy them on a blockchain, hence transforming the policy evaluation process into a completely distributed smart contract execution. Not only the policies, but also the attributes required for their evaluation are managed by smart contracts deployed on the blockchain. The auditability property derives from the immutability and transparency properties of blockchain technology. This paper not only presents the proposed Access Control system in general, but also its application to the innovative reference scenario where the resources to be protected are themselves smart contracts. To prove the feasibility of our approach, we present a reference implementation exploiting XACML policies and Solidity written smart contracts deployed on the Ethereum blockchain. Finally, we evaluate the system performances through a set of experimental results, and we discuss the advantages and drawbacks of our proposal.