Blockchain Based Auditable Access Control for Distributed Business Processes.
Blockchain Based Auditable Access Control for Distributed Business Processes.
复制标题
DOI：
10.1109/icdcs47774.2020.00015
复制
发表时间：
2020-11
期刊：
影响因子：
--
通讯作者：
Rana O
中科院分区：
文献类型：
--
作者：
Akhtar A;Shafiq B;Vaidya J;Afzal A;Shamail S;Rana O
建议使用区块链技术为单个资源提供可审计的访问控制。然而，当所有资源都由一个组织拥有时，可能就不需要这种昂贵的解决方案了。在这项工作中，我们将重点关注分布式应用程序，如业务流程和分布式工作流。这些应用程序通常由多个资源/服务组成，这些资源/服务受不同组织域的安全和访问控制策略的约束。在这里，区块链可以提供一个有吸引力的去中心化解决方案来提供可审计性。但是，就组件条件/规则而言，底层访问控制策略可能是重叠的，并且简单地使用现有的解决方案将导致对每个资源分别重复评估用户的授权，从而在成本和计算时间方面产生巨大的开销。为了解决这一挑战，我们提出了一种制定约束优化问题以生成最优组合访问控制策略的方法。该策略符合所有本地访问控制策略，使策略评估成本比区块链最小。然后可以将开发的智能合约部署到区块链，并用于访问控制实施。我们还讨论了如何使用博弈论方法来审计访问控制的实施以最小化成本。我们已经使用以太坊作为底层区块链实现了我们方法的初始原型，并通过实验验证了我们方法的有效性和效率。
The use of blockchain technology has been proposed to provide auditable access control for individual resources. However, when all resources are owned by a single organization, such expensive solutions may not be needed. In this work we focus on distributed applications such as business processes and distributed workflows. These applications are often composed of multiple resources/services that are subject to the security and access control policies of different organizational domains. Here, blockchains can provide an attractive decentralized solution to provide auditability. However, the underlying access control policies may be overlapping in terms of the component conditions/rules, and simply using existing solutions would result in repeated evaluation of user’s authorization separately for each resource, leading to significant overhead in terms of cost and computation time over the blockchain. To address this challenge, we propose an approach that formulates a constraint optimization problem to generate an optimal composite access control policy. This policy is in compliance with all the local access control policies and minimizes the policy evaluation cost over the blockchain. The developed smart contract(s) can then be deployed to the blockchain, and used for access control enforcement. We also discuss how the access control enforcement can be audited using a game-theoretic approach to minimize cost. We have implemented the initial prototype of our approach using Ethereum as the underlying blockchain and experimentally validated the effectiveness and efficiency of our approach.