基于区块链的访问控制技术研究进展

doi:10.11959/j.issn.2096-109x.2021044

摘要/Abstract

摘要：

区块链技术有着去中心化、可信度高、难以篡改的特点，能够解决传统访问控制技术中存在的信任难题。通过总结现有的基于区块链的访问控制机制，分别从基于交易事务和基于智能合约两种实现方式分析了将区块链技术应用于访问控制领域的独有优势。根据区块链应用中的关键问题，从动态访问控制、链上空间优化、隐私数据保护3个关键技术总结了现有的研究进展。结合目前基于区块链的访问控制机制面临的挑战，提出了5点研究展望。

关键词: 区块链, 访问控制, 大数据, 智能合约, 隐私保护

Abstract:

Blockchain technology has the features of decentralization, high credibility, non-tampering and traceability, which can address the trust problem in traditional access control technology.Based on the implementation with blockchain, the unique advantages of applying blockchain to access control are analyzed from two aspects: based on transaction and based on smart contract.Based on the key issues in blockchain application, the current research progress is summarized from three key technologies: dynamic access control, blockchain space optimization, and privacy data protection.Based on the challenges faced by the current blockchain-based access control mechanism, five research prospects are proposed.

Key words: blockchain, access control, big data, smart contract, privacy protection

中图分类号:

TP309

高振升, 曹利峰, 杜学绘. 基于区块链的访问控制技术研究进展[J]. 网络与信息安全学报, 2021, 7(6): 68-87.

Zhensheng GAO, Lifeng CAO, Xuehui DU. Research progress of access control based on blockchain[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 68-87.

图/表 18

图1

图2

图3

图4

表1

图5

图6

图7

图8

图9

表2

图10

图11

图12

表3

图13

图14

表4

参考文献 78

[1]	李昊, 张敏, 冯登国 ,等. 大数据访问控制研究[J]. 计算机学报, 2017,40(1): 72-91.
	LI H , ZHANG M , FENG D G ,et al. Research on access control of big data[J]. Chinese Journal of Computers, 2017,40(01): 72-91.
[2]	信息通信研究院. 大数据安全白皮书[EB].
	China Academy of Information and Communications Technology. White paper of big data security[EB].
[3]	沈海波, 洪帆 . 访问控制模型研究综述[J]. 计算机应用研究, 2005,22(6): 9-11.
	SHEN H B , HONG F . Survey of research on access control model[J]. Application Research of Computers, 2005,22(6): 9-11.
[4]	李国杰, 程学旗 . 大数据研究:未来科技及经济社会发展的重大战略领域——大数据的研究现状与科学思考[J]. 中国科学院院刊, 2012,27(6): 647-657.
	LI G J , CHENG X Q . Research status and scientific thinking of big data[J]. Strategy ＆ Policy Decision Research, 2012,27(6): 647-657.
[5]	NAKAMOTO S . Bitcoin:a peer-to-peer electronic cash system[EB].
[6]	方巍, 郑玉, 徐江 . 大数据:概念、技术及应用研究综述[J]. 南京信息工程大学学报(自然科学版), 2014,6(5): 405-419.
	FANG W , ZHENG Y , XU J . Big data:Conceptions,key technologies and application[J]. Journal of Nanjing University of Information Technology (Natural Science Edition), 2014,6(5): 405-419.
[7]	张锐卿, 汤泰鼎, 万可 . 大数据环境下细粒度的访问控制与审计管理[J]. 信息安全研究, 2017,3(6): 509-516.
	ZHANG R Q , TANG T D , WAN K . Fine-grained access control and audit management in big data environment[J]. Journal of Information Security Research, 2017,3(6): 509-516.
[8]	SANDHU R S , COYNE E J , FEINSTEIN H L ,et al. Role-based access control models[J]. Computer, 1996,29(2): 38-47.
[9]	YUAN E , TONG J . Attributed based access control (ABAC) for web services[C]// IEEE International Conference on Web Services (ICWS'05). 2005.
[10]	THOMAS R K , SANDHU R S . Task-based authorization controls (TBAC):A family of models for active and enterprise-oriented authorization management[M]. Database Security XI. Berlin: Springer, 1998: 166-81.
[11]	邓集波, 洪帆 . 基于任务的访问控制模型[J]. 软件学报, 2003,14(1): 76-82.
	DENG J B , HONG F . Task-based access control model[J]. Journal of Software, 2003,14(1): 76-82.
[12]	MOLLOY I , HONG C , LI T ,et al. Mining roles with multiple objectives[J]. ACM Transactions on Information ＆ System Security, 2010,13(4): 1-35.
[13]	MOLLOY I , LI N , YUAN Q ,et al. Mining roles with noisy data[C]// Proceedings of the 15th ACM Symposium on Access Control Models and Technologies. 2010: 45-54.
[14]	MOLLOY I , CHARI S . Generative models for access control policies:applications to role mining over logs with attribution[C]// Proceedings of the 17th ACM Symposium on Access Control Models and Technologies. 2012: 45-56.
[15]	聂伯敏, 熊桂喜 . 分布式环境下基于角色访问控制的实现[J]. 计算机工程, 2002,28(8): 181-183.
	NIE B M , XIONG G X . Implementation of role-based access control in distributed environment[J]. Computer Engineering, 2002,28(8): 181-183.
[16]	LONGSTAFF J , NOBLE J . Attribute based access control for big data applications by query modification[C]// IEEE Second International Conference on Big Data Computing Service and Applications (BigDataService). 2016: 58-65.
[17]	BHATT S , PATWA F , SANDHU R . ABAC with group attributes and attribute hierarchies utilizing the policy machine[C]// Proceedings of the 2nd ACM Workshop on Attribute-Based Access Control. 2017: 17-28.
[18]	惠榛, 李昊, 张敏 ,等. 面向医疗大数据的风险自适应的访问控制模型[J]. 通信学报, 2015,36(12): 190-199.
	HUI Z , LI H , ZHANG M ,et al. Risk-adaptive access control model for big data in healthcare[J]. Journal on Communications, 2015,36(12): 190-199.
[19]	SANTOS D R D , WESTPHALL C M , WESTPHALL C B . A dynamic risk-based access control architecture for cloud computing[C]// IEEE Network Operations and Management Symposium (NOMS). 2014: 1-9.
[20]	何蒲, 于戈, 张岩峰 ,等. 区块链技术与应用前瞻综述[J]. 计算机科学, 2017,44(4): 1-7,15.
	HE P , YU G , ZHANG Y F ,et al. Survey on blockchain technology and its application prospect[J]. Computer Science, 2017,44(4): 1-7,15.
[21]	邹均, 张海宁 . 区块链技术指南[M]. 北京:机械工业出版社. 2017.
	ZOU J , ZHANG H N . Blockchain technology guide[M]. Beijing:Machinery Industry Press. 2017.
[22]	SWAN M . Blockchain:blueprint for a new economy[M]. O'Reilly Media,Inc, 2015.
[23]	LAMPORT L , SHOSTAK R , PEASE M . The Byzantine generals problem[J]. ACM Transactions on Programming Languages and Systems (TOPLAS), 1982,4(3): 382-401.
[24]	FISCHER M J , LYNCH N A , PATERSON M S . Impossibility of distributed consensus with one faluty process[J]. ACM Tocs, 1985,32(2): 374-382.
[25]	ZHENG Z , XIE S , DAI H ,et al. An overview of blockchain technology:architecture,consensus,and future trends[C]// IEEE International Congress on Big Data (BigData Congress). 2017: 557-564.
[26]	TAPSCOTT D , TAPSCOTT A . Blockchain revolution:how the technology behind bitcoin is changing money,business,and the world[M]. Penguin, 2016.
[27]	ZYSKIND G , ZEKRIFA D M S , ALEX P ,et al. Decentralizing privacy:using blockchain to protect personal data[C]// IEEE Security ＆ Privacy Workshops. 2015: 180-184.
[28]	PINNO O J A , GRéGIO A , BONA L C E D . ControlChain:blockchain as a central enabler for access control authorizations in the IoT[C]// Globecom IEEE Global Communications Conference. 2017: 1-6.
[29]	MAESA D D F , MORI P , RICCI L . Blockchain based access control[C]// IFIP International Conference on Distributed Applications and Interoperable Systems. 2017: 206-220.
[30]	SHAFAGH H , BURKHALTER L , HITHNAWI A ,et al. Towards blockchain-based auditable storage and sharing of IoT data[C]// Proceedings of the 2017 on Cloud Computing Security Workshop. 2017: 45-50.
[31]	ALI M , NELSON J , SHEA R ,et al. Blockstack:a global naming and storage system secured by blockchains[C]// 2016 USENIX Annual Technical Conference. 2016: 181-194.
[32]	NELSON J , ALI M , SHEA R ,et al. Extending existing blockchains with virtualchain[C]// Workshop on Distributed Cryptocurrencies and Consensus Ledgers. 2016.
[33]	DORRI A , KANHERE S S , JURDAK R ,et al. Blockchain for IoT security and privacy:The case study of a smart home[C]// IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops). 2017: 618-623.
[34]	ALANSARI S , PACI F , SASSONE V . A distributed access control system for cloud federations[C]// IEEE 37th International Conference on Distributed Computing Systems (ICDCS). 2017: 2131-2136.
[35]	JEMEL M , SERHROUCHNI A . Decentralized access control mechanism with temporal dimension based on blockchain[C]// IEEE 14th International Conference on e-Business Engineering (ICEBE). 2017: 177-182.
[36]	JIE Z , XUE N , XIN H . A secure system for pervasive social network-based healthcare[J]. IEEE Access, 2016,4(99): 9239-9250.
[37]	焦通, 申德荣, 聂铁铮 ,等. 区块链数据库:一种可查询且防篡改的数据库[J]. 软件学报, 2019,30(9): 2671-2685.
	JIAO T , SHEN D R , NIE T Z ,et al. BlockchainDB:querable and immutable database[J]. Journal of Software, 2019,30(09): 2671-2685.
[38]	ZYSKIND G , NATHAN O , PENTLAND A . Enigma:decentralized computation platform with guaranteed privacy[J]. arXiv preprint arXiv:150603471, 2015.
[39]	章宁, 钟珊 . 基于区块链的个人隐私保护机制[J]. 计算机应用, 2017,37(10): 2787-2793.
	ZHANG N , ZHONG S . Mechanism of personal privacy protection based on blockchain[J]. Journal of Computer Applications, 2017,37(10): 2787-2793.
[40]	乔蕊, 董仕, 魏强 ,等. 基于区块链技术的动态数据存储安全机制研究[J]. 计算机科学, 2018,45(2): 57-62.
	QIAO R , DONG S , WEI Q ,et al. Blockchain based secure storage scheme of dynamic data[J]. Computer Science, 2018,45(2): 57-62.
[41]	乔蕊, 曹琰, 王清贤 . 基于联盟链的物联网动态数据溯源机制[J]. 软件学报, 2019,30(6): 1614-1631.
	QIAO R , CAO Y , WANG Q X . Traceability mechanism of dynamic data in Internet of things based on consortium blockchain[J]. Journal of Software, 2019,30(6): 1614-1631.
[42]	CRUZ J P , KAJI Y , YANAI N . RBAC-SC:role-based access control using smart contract[J]. IEEE Access, 2018,6: 12240-12251.
[43]	ZHANG Y , KASAHARA S , SHEN Y ,et al. Smart contract-based access control for the Internet of Things[J]. IEEE Internet of Things Journal, 2018,6(2): 1594-1605.
[44]	AZARIA A , EKBLAW A , VIEIRA T ,et al. Medrec:using blockchain for medical data access and permission management[C]// 2016 2nd International Conference on Open and Big Data (OBD). 2016: 25-30.
[45]	EKBLAW A , AZARIA A , HALAMKA J D ,et al. A case study for blockchain in healthcare:“MedRec” prototype for electronic health records and medical research data[C]// Proceedings of IEEE Open ＆ Big Data Conference. 2016.
[46]	刘敖迪, 杜学绘, 王娜 ,等. 基于区块链的大数据访问控制机制[J]. 软件学报, 2019,30(9): 2636-2654.
	LIU A D , DU X H , WANG N ,et al. A blockchain-based access control mechanism for big data[J]. Journal of Software, 2019,30(9): 2636-2654.
[47]	王秀利, 江晓舟, 李洋 . 应用区块链的数据访问控制与共享模型[J]. 软件学报, 2019,30(6): 1661-1669.
	WANG X L , JIANG X Z , LI Y . Model for data access control and sharing based on blockchain[J]. Journal of Software, 2019,30(6): 1661-1669.
[48]	SAHAI A , WATERS B . Fuzzy identity-based encryption[C]// Annual International Conference on the Theory and Applications of Cryptographic Techniques. 2005: 457-473.
[49]	DAGHER G G , MOHLER J , MILOJKOVIC M ,et al. Ancile:privacy-preserving framework for access control and interoperability of electronic health records using blockchain technology[J]. Sustainable Cities ＆ Society, 2018,39: 283-297.
[50]	OUADDAH A , ABOU ELKALAM A , AIT OUAHMAN A . FairAccess:a new Blockchain-based access control framework for the Internet of Things[J]. Security ＆ Communication Networks, 2016,9(18): 5943-5964.
[51]	OUADDAH A , EL KALAM A A , OUAHMAN A A . Harnessing the power of blockchain technology to solve IoT security ＆ privacy issues[C]// Proceedings of the ICC. 2017.
[52]	BLOOM B H . Space/Time trade-offs in hash coding with allowable errors[J]. Ipsj Magazine, 1970,12(7): 422-426.
[53]	FERDOUS M S , MARGHERI A , PACI F ,et al. Decentralised runtime monitoring for access control systems in cloud federations[C]// IEEE 37th International Conference on Distributed Computing Systems (ICDCS). 2017: 2632-2633.
[54]	OUTCHAKOUCHT A , HAMZA E , LEROY J P . Dynamic access control policy based on blockchain and machine learning for the Internet of Things[J]. Int J Adv Comput Sci Appl, 2017,8(7): 417-424.
[55]	DECKER C , WATTENHOFER R . A fast and scalable payment network with bitcoin duplex micropayment channels[C]// Symposium on Self-Stabilizing Systems. 2015: 3-18.
[56]	薛腾飞, 傅群超, 王枞 ,等. 基于区块链的医疗数据共享模型研究[J]. 自动化学报, 2017,43(9): 1555-1562.
	XUE T F , FU Q C , WANG Z ,et al. A medical data sharing model via blockchain[J]. ACTA Automatica Sinca, 2017,43(9): 1555-1562.
[57]	闵新平, 李庆忠, 孔兰菊 ,等. 许可链多中心动态共识机制[J]. 计算机学报, 2018,41(05): 1005-1020.
	MIN X P , LI Q Z , KONG L J ,et al. Permissioned blockchain dynamic consensus mechanism based multi-centers[J]. Chinese Journal of Computers, 2018,41(5): 1005-1020.
[58]	蔡振华, 林嘉韵, 刘芳 . 区块链存储:技术与挑战[J]. 网络与信息安全学报, 2020,6(5): 11-20.
	CAI Z H , LIN J Y , LIU F . Blockchain storage:technologies and challenges[J]. Chinese Journal of Network and Information Security, 2020,6(5): 11-20.
[59]	POON J , DRYJA T . The bitcoin lightning network:scalable off-chain instant payments[R]. 2016.
[60]	EYAL I , GENCER A E , SIRER E G ,et al. Bitcoin-NG:a scalable blockchain protocol[C]// Usenix Conference on Networked Systems Design and Implementation. 2016: 45-59.
[61]	SOMPOLINSKY Y , ZOHAR A . Secure high-rate transaction processing in bitcoin[C]// International Conference on Financial Cryptography and Data Security. 2015: 507-527.
[62]	RON D , SHAMIR A . Quantitative analysis of the full bitcoin transaction graph[C]// International Conference on Financial Cryptography and Data Security. 2013: 6-24.
[63]	SASSON E B , CHIESA A , GARMAN C ,et al. Zerocash:decentralized anonymous payments from bitcoin[C]// 2014 IEEE Symposium on Security and Privacy. 2014: 459-474.
[64]	QI X , SIFAH E B , ASAMOAH K O ,et al. MeDShare:trust-less medical data sharing among cloud service providers via blockchain[J]. IEEE Access, 2017,5(99): 14757-14767.
[65]	YAO C C , . How to generate and exchange secrets[C]// 27th Annual Symposium on Foundations of Computer Science (SFCS 1986). 1986: 162-167.
[66]	KOSBA A , MILLER A , SHI E ,et al. Hawk:the blockchain model of cryptography and privacy-preserving smart contracts[C]// IEEE Symposium on Security and Privacy (SP). 2016: 839-858.
[67]	LE T , MUTKA M W . CapChain:a privacy preserving access control framework based on blockchain for pervasive environments[C]// IEEE International Conference on Smart Computing (SMARTCOMP). 2018: 57-64.
[68]	杨亚涛, 蔡居良, 张筱薇 ,等. 基于SM9算法可证明安全的区块链隐私保护方案[J]. 软件学报, 2019,30(6): 1692-1704.
	YANG Y T , CAI J L , ZHANG X W ,et al. Privacy preserving scheme in block chain with provably secure based on SM9 algorithm[J]. Journal of Software, 2019,30(6): 1692-1704.
[69]	李少卓, 王娜, 杜学绘 . 按需披露的区块链隐私保护机制[J]. 网络与信息安全学报, 2020,6(3): 19-29.
	LI S Z , WANG N , DU X H . Privacy protection mechanism of on-demand disclosure on blockchain[J]. Chinese Journal of Network and Information Security, 2020,6(3): 19-29.
[70]	田有亮, 杨科迪, 王缵 ,等. 基于属性加密的区块链数据溯源算法[J]. 通信学报, 2019,40(11): 101-111.
	TIAN Y L , YANG K D , WANG Z ,et al. Algorithm of blockchain data provenance based on ABE[J]. Journal on Communications, 2019,40(11): 101-111.
[71]	WATERS B , . Ciphertext-policy attribute-based encryption:An expressive,efficient,and provably secure realization[C]// International Workshop on Public Key Cryptography. 2011: 53-70.
[72]	SAHAI A , SEYALIOGLU H , WATERS B . Dynamic credentials and ciphertext delegation for attribute-based encryption[C]// Annual Cryptology Conference. 2012: 199-217.
[73]	邱云翔, 张红霞, 曹琪 ,等. 基于 CP-ABE 算法的区块链数据访问控制方案[J]. 网络与信息安全学报, 2020,6(3): 88-98.
	QIU Y X , ZHANG H X , CAO Q ,et al. Blockchain data access control scheme based on CP-ABE algorithm[J]. Chinese Journal of Network and Information Security, 2020,6(3): 88-98.
[74]	马晓婷, 马文平, 刘小雪 . 基于区块链技术的跨域认证方案[J]. 电子学报, 2018,46(11): 2571-2579.
	MA X T , MA W P , LIU X X . A cross domain authentication scheme based on blockchain technology[J]. Chinese Journal of Electronics, 2018,46(11): 2571-2579.
[75]	周致成, 李立新, 李作辉 . 基于区块链技术的高效跨域认证方案[J]. 计算机应用, 2018,38(2): 316-320,326.
	ZHOU Z C , LI L X , LI Z H . Efficient cross-domain authentication scheme based on blockchain technology[J]. Journal of Computer Applications, 2018,38(2): 316-320,326.
[76]	LI C , WU Q , LI H ,et al. Trustroam:A novel blockchain-based cross-domain authentication scheme for wi-fi access[C]// International Conference on Wireless Algorithms,Systems,and Applications. 2019: 149-161.
[77]	YAO Y , CHANG X , MI?I? J , ,et al. BLA:blockchain-assisted lightweight anonymous authentication for distributed vehicular fog services[J]. IEEE Internet of Things Journal, 2019,6(2): 3775-3784.
[78]	GILBERT S , LYNCH N . Perspectives on the CAP Theorem[J]. Computer, 2012,45(2): 30-36.

共识机制	优点	缺点	适宜场景	代表项目
PoW	完全去中心化，节点容纳量大，允许节点动态加入删除，可信度高	消耗大量算力和电力，共识达成时间长，存在51%攻击	无许可准入机制的公开链	比特币
PoS	允许节点动态加入删除，与PoW相比资源消耗少，缩短了共识达成时间	记账权易受富裕节点支配，去中心化程度随着时间的推移降低，存在Nothing-at-Stake攻击漏洞	无许可准入机制的公开链	未来币
DPoS	秒级验证，大幅缩短共识达成时间	代表节点验证机制牺牲了去中心化，降低了安全性	无许可准入机制的公开链	EOS
PBFT	共识达成时间快，能够解决拜占庭故障	实现机制复杂，节点数较多时效率降低，1/3记账者受攻击时系统就会瘫痪	带许可准入机制的公开链	Hyperledger
Raft	秒级验证，大幅缩短共识达成时间，节点间通信复杂度低	实现机制复杂，去中心化程度低，属于多中心化机制	可信环境，如私有链	Quorum

文献	核心思想	应用方向	应用场景
[27]	用户与服务商以联合身份发布权限交易，控制权限的授予、更改和撤销	在链上存储访问权限	小数据量的个人数据防护
[28]	使用多条区块链分类别存储主客体信息和权限决策信息，以实现灵活自动的访问控制决策机制	在链上存储访问控制策略以及关键敏感数据	具有多种类型设备的物联网数据防护
[29]	将区块链与ABAC模型相结合，利用区块链的代币机制，实现链上的策略和权限的更新	在链上存储访问控制策略与访问权限	大规模数据防护
[41]	通过双联盟链存储访问权限和访问控制操作日志，具备对攻击节点的溯源功能	在链上存储访问权限与访问控制操作日志	物联网中的动态数据防护

文献	核心思想	应用方向	应用背景
[42]	利用智能合约管理用户角色，通过合约规定的接口实现对角色身份的查验	利用智能合约实现用户信息管理	具有跨组织数据访问需求的数据防护
[44-45]	设计三种智能合约管理用户信息、医疗数据状态以及访问权限，保证用户可以实时监管个人医疗数据	利用智能合约实现用户信息管理和链上数据管理	用户隐私的个人电子医疗数据防护
[46]	结合 ABAC 模型，利用智能合约实现属性收集与整合、策略管理以及访问权限决策，并实现基于Bloom Filter的策略查询功能，能够满足动态访问控制需求	利用智能合约实现数据整合与查询与访问权限判决	具有分布式、动态访问控制需求的数据防护
[53]	通过在区块链节点上搭建数据探针、日志记录合约和行为分析合约来监测用户的数据访问行为	利用智能合约实现违规行为监测	具有访问行为溯源审计需求的分布式访问控制系统

访问控制需求	核心思想	文献
	利用机器学习算法动态调整访问控制策略	[54]
动态访问控制	基于ABAC模型，利用Bloom Filter降低策略查询时延提出使用微支付通道，允许用户在线下交换动态数据	[46][55]
	改进共识算法以达到更快的决策速度，降低时延	[56-57]
	使用自定义的编码格式压缩数据集	[29]
	使用链下存储，链上摘要的方式减少数据量	[27,37-38,44]
存储空间优化	利用微支付通道直接交易数据，不在链上占据空间	[59]
	改进数据区块结构和共识算法，达到在单位时间内产生更多数据区块的目的	[60-61]
	敏感数据存储在链下、链上根据哈希值校验是否被篡改	[27,44,49]
	结合多方安全计算，在不泄露秘密的前提下将数据集分割后处理	[38]
隐私数据保护	利用零知识证明技术，在不泄露敏感信息的前提下确认交易有效性	[66]
	利用密码学知识，加密用户信息	[67-70,73]