No abstract

Access Control systems are used in computer security to regulate the access to critical or valuable resources. The rights of subjects to access such resources are typically expressed through access control policies, which are evaluated at access request time against the current access context. This paper proposes a new approach based on blockchain technology to publish the policies expressing the right to access a resource and to allow the distributed transfer of such right among users. In our proposed protocol the policies and the rights exchanges are publicly visible on the blockchain, consequently any user can know at any time the policy paired with a resource and the subjects who currently have the rights to access the resource. This solution allows distributed auditability, preventing a party from fraudulently denying the rights granted by an enforceable policy. We also show a possible working implementation based on XACML policies, deployed on the Bitcoin blockchain.

Several blockchain projects to help against COVID-19 are emerging at a fast pace, showing the potential of this disruptive technology to mitigate the multi-systemic threats the pandemic is posing on all phases of the emergency management and generate value for the economy and society as a whole. This survey investigates how blockchain technology can be useful in the scope of supporting health actions that can reduce the spread of COVID-19 infections and allow a return to normality. Since the prominent use of blockchains to mitigate COVID-19 consequences are in the area of contact tracing and vaccine/immunity passport support, the survey mainly focuses on these two classes of applications. The aim of the survey is to show that only a proper combination of blockchain technology with advanced cryptographic techniques can guarantee a secure and privacy preserving support to fight COVID-19. In particular, the paper first presents these techniques, i.e. zero-knowledge, Diffie Hellman, blind signatures, and proxy re-encryption, then describes how they are used in combination with blockchains to define robust and privacy-preserving solutions. Finally, a brief description of blockchain applications beyond contact tracing and vaccine certification is presented.

This work proposes to exploit blockchain technology to define Access Control systems that guarantee the auditability of access control policies evaluation. The key idea of our proposal is to codify attribute-based Access Control policies as smart contracts and deploy them on a blockchain, hence transforming the policy evaluation process into a completely distributed smart contract execution. Not only the policies, but also the attributes required for their evaluation are managed by smart contracts deployed on the blockchain. The auditability property derives from the immutability and transparency properties of blockchain technology. This paper not only presents the proposed Access Control system in general, but also its application to the innovative reference scenario where the resources to be protected are themselves smart contracts. To prove the feasibility of our approach, we present a reference implementation exploiting XACML policies and Solidity written smart contracts deployed on the Ethereum blockchain. Finally, we evaluate the system performances through a set of experimental results, and we discuss the advantages and drawbacks of our proposal.