Dynamic access control on blockchain
AssigneeCommonwealth Scientific and Industrial Research Organisation
InventorsMark Staples, Paul Rimba
Life of this patent
Estimating the term…
Abstract
This disclosure describes dynamic access control using capabilities (via dynamic access control interface (150)) on a blockchain system (180). The blockchain data structure is a time-stamped list of blocks, chained together cryptographically. In this disclosure, capabilities can be recorded on a blockchain system (via capabilities storage (170)) and thus access propagation is known. This makes revocation of access achievable by recording a new transaction, which in effect removes the previous authorization. There will be no change to transaction history and instead a new transaction records (170) the current status of the capability. An example implementation on a blockchain system (180) is given in Ethereum, which allows programs called “smart contracts” to run as transactions.
Claims15
A computer implemented method, performed by one or more smart contract instances executing on a blockchain system, and for dynamic capability-based access control granting a capability for an object, where the capability is a secure reference to the object, and where the capability is stored on the blockchain system, the computer implemented method comprising:
- receiving a request from a sender to grant a capability for an object for a target, the sender being a first user process that initiates a capabilities operation and the target being a second user process that acquires capabilities according to the capabilities operation;
- determining access rights for the sender for the object for the target;
- determining whether the access rights allow for the capability for the object to be granted for the target;
- storing the capability for the object for the target on the blockchain system, wherein the capability is for dynamically determining access control for the object;
- determining whether the access rights allow for the capability for the object to be revoked for the target;
- and
- revoking the capability for the object for the target.
A computer system including:
- processing hardware corresponding to one or more smart contract instances executing on a blockchain system, the processing hardware configured to:
- for dynamic capability-based access control granting a capability for an object, where the capability is a secure reference to the object, and where the capability is stored on the blockchain system:
- receive a request from a sender to grant a capability for an object for a target, the sender being a first user process that initiates a capabilities operation and the target being a second user process that acquires capabilities according to the capabilities operation;
- determine access rights for the sender for the object for the target;
- determine whether the access rights allow for the capability for the object to be granted for the target;
- store the capability for the object for the target on the blockchain system, wherein the capability is for dynamically determining access control for the object;
- determine whether the access rights allow for the capability for the object to be revoked for the target;
- and
- revoke the capability for the object for the target.
A product including:
- non-transitory machine-readable media;
- and
- instructions stored on the non-transitory machine-readable medium, the instructions configured to, when executed, cause one or more processors corresponding to one or more smart contract instances executing on a blockchain system to:
- for dynamic capability-based access control granting a capability for an object, where the capability is a secure reference to the object, and where the capability is stored on the blockchain system:
- receive a request from a sender to grant a capability for an object for a target, the sender being a first user process that initiates a capabilities operation and the target being a second user process that acquires capabilities according to the capabilities operation;
- determine access rights for the sender for the object for the target;
- determine whether the access rights allow for the capability for the object to be granted for the target;
- store the capability for the object for the target on the blockchain system, wherein the capability is for dynamically determining access control for the object;
- determine whether the access rights allow for the capability for the object to be revoked for the target;
- and
- revoke the capability for the object for the target.
Dependencies are inferred from the claim text.