RBAC-SC: Role-Based Access Control Using Smart Contract
RBAC-SC: Role-Based Access Control Using Smart Contract
复制标题
DOI：
10.1109/access.2018.2812844
复制
发表时间：
2018-01-01
期刊：
影响因子：
3.9
通讯作者：
Yanai, Naoto
中科院分区：
文献类型：
--
作者：
Cruz, Jason Paul;Kaji, Yuichi;Yanai, Naoto
基于角色的访问控制（RBAC）框架是一种描述访问控制原理的机制。作为一种常见的交互，组织向拥有由不同组织颁发的特定角色的用户提供服务。这种跨组织的RBAC在面对面的通信中很常见，但在计算机网络中却不常见，因为很难既建立禁止恶意角色冒充的安全性，又建立允许小组织参与和用户完全控制自己角色的灵活性。在本文中，我们提出了一个使用智能合约的RBAC（RBAC-SC），这是一个利用以太坊的智能合约技术实现角色跨组织利用的平台。以太坊是一个开放的区块链平台，旨在安全，适应性和灵活性。它开创了智能合约，这是一种分散的应用程序，作为“自主代理”，完全按照编程运行，并部署在区块链上。RBAC-SC使用智能合约和区块链技术作为通用基础设施来表示RBAC中必不可少的信任和认可关系，并实现验证用户角色所有权的挑战-响应认证协议。我们描述了RBAC-SC框架，该框架由两个主要部分组成，即智能合约和挑战-响应协议，并给出了性能分析。智能合约的原型被创建并部署在以太坊的Testnet区块链上，源代码是公开的。
The role-based access control (RBAC) framework is a mechanism that describes the access control principle. As a common interaction, an organization provides a service to a user who owns a certain role that was issued by a different organization. Such trans-organizational RBAC is common in face-to-face communication but not in a computer network, because it is difficult to establish both the security that prohibits the malicious impersonation of roles and the flexibility that allows small organizations to participate and users to fully control their own roles. In this paper, we present an RBAC using smart contract (RBAC-SC), a platform that makes use of Ethereum's smart contract technology to realize a trans organizational utilization of roles. Ethereum is an open blockchain platform that is designed to be secure, adaptable, and flexible. It pioneered smart contracts, which are decentralized applications that serve as "autonomous agents" running exactly as programmed and are deployed on a blockchain. The RBAC-SC uses smart contracts and blockchain technology as versatile infrastructures to represent the trust and endorsement relationship that are essential in the RBAC and to realize a challenge-response authentication protocol that verifies a user's ownership of roles. We describe the RBAC-SC framework, which is composed of two main parts, namely, the smart contract and the challenge-response protocol, and present a performance analysis. A prototype of the smart contract is created and deployed on Ethereum's Testnet blockchain, and the source code is publicly available.