Blockchain Based Auditable Access Control for Distributed Business Processes

Abstract

The use of blockchain technology has been proposed to provide auditable access control for individual resources. However, when all resources are owned by a single organization, such expensive solutions may not be needed. In this work we focus on distributed applications such as business processes and distributed workflows. These applications are often composed of multiple resources/services that are subject to the security and access control policies of different organizational domains. Here, blockchains can provide an attractive decentralized solution to provide auditability. However, the underlying access control policies may be overlapping in terms of the component conditions/rules, and simply using existing solutions would result in repeated evaluation of user's authorization separately for each resource, leading to significant overhead in terms of cost and computation time over the blockchain. To address this challenge, we propose an approach that formulates a constraint optimization problem to generate an optimal composite access control policy. This policy is in compliance with all the local access control policies and minimizes the policy evaluation cost over the blockchain. The developed smart contract(s) can then be deployed to the blockchain, and used for access control enforcement. We also discuss how the access control enforcement can be audited using a game-theoretic approach to minimize cost. We have implemented the initial prototype of our approach using Ethereum as the underlying blockchain and experimentally validated the effectiveness and efficiency of our approach.

Applications of Blockchain in Business Processes: A Comprehensive Review

“…Since then, following works utilize similar mechanisms by employing smart contracts as a building block to provide tamper-proof for resource assignment processes. We observe that the work by Akhtar et al [5] can be integrated with Blockchain Studio [98] and Sturm et al [127]. By taking local access control policies into account during configuration (L2), the work by Lopez-Pintado et al [81] addresses dynamic role assignments at runtime (L3).…”

“…Using typical evaluation techniques will result in high overhead. To alleviate this, only one study is found by Akhtar et al [5] which try to optimize the collection of individual policies towards composite unified policies. The policy specification follows XACML standard, which will be translated into smart contracts for enforcement and audit purpose.…”

Blockchain Based Auditable Access Control For Business Processes With Event Driven Policies

“…Instead, we can leverage the fact that for effective validation, it is not necessary to recheck all the accesses, but only a random fraction of them. We have proposed a gametheoretic mechanism for auditing that reduces the auditing cost while incentivizing honest behavior for the BPM in [2].…”

“…We note that an initial study of this problem was conducted in [2] where we also proposed a blockchain-based solution for auditable evaluation of access control policies of distributed BPs. However, [2] only considered static policies, whereas this work can be used for event-driven policies which are dynamic in nature.…”

“…We note that an initial study of this problem was conducted in [2] where we also proposed a blockchain-based solution for auditable evaluation of access control policies of distributed BPs. However, [2] only considered static policies, whereas this work can be used for event-driven policies which are dynamic in nature. The automata-theoretic approach of this work is also completely new and allows for the restructuring and optimization of smart contracts that reduce the overall evaluation cost.…”