Interledger Smart Contracts for Decentralized Authorization to Constrained Things

We present models that utilize smart contracts and interledger mechanisms to provide decentralized authorization for constrained IoT devices. The models involve different tradeoffs in terms of cost, delay, complexity, and privacy, while exploiting key advantages of smart contracts and multiple blockchains that communicate with interledger mechanisms. These include immutably recording hashes of authorization information and policies in smart contracts, resilience through the execution of smart contract code on all blockchain nodes, and cryptographically linking transactions and IoT events recorded on different blockchains using hash and time-lock mechanisms. The proposed models are evaluated on the public Ethereum testnets Rinkeby and Ropsten, in terms of execution cost (gas), delay, and reduction of data that needs to be sent to the constrained IoT devices.

[1]  D. Culler,et al.  WAVE : A Decentralized Authorization System for IoT via Blockchain Smart Contracts , 2017 .

[2]  Dick Hardt,et al.  The OAuth 2.0 Authorization Framework , 2012, RFC.

[3]  Thomas Hardjono Decentralized Service Architecture for OAuth2.0 , 2018 .

[4]  Michael B. Jones,et al.  JSON Web Token (JWT) , 2015, RFC.

[5]  Michael B. Jones,et al.  JSON Web Signature (JWS) , 2015, RFC.

[6]  Luca Veltri,et al.  IoTChain: A blockchain security architecture for the Internet of Things , 2018, 2018 IEEE Wireless Communications and Networking Conference (WCNC).

[7]  Jonathan Katz,et al.  Aggregate Message Authentication Codes , 1995 .

[8]  Ludwig Seitz,et al.  Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs) , 2020, RFC.

[9]  Genshe Chen,et al.  BlendCAC: A BLockchain-Enabled Decentralized Capability-Based Access Control for IoTs , 2018, 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData).

[10]  Michael B. Jones,et al.  CBOR Web Token (CWT) , 2018, RFC.

[11]  Jim Schaad,et al.  CBOR Object Signing and Encryption (COSE) , 2017, RFC.

[12]  Xiaohong Jiang,et al.  Smart Contract-Based Access Control for the Internet of Things , 2018, IEEE Internet of Things Journal.

[13]  Alexandra Boldyreva,et al.  Efficient threshold signature, multisignature and blind signature schemes based on the Gap-Diffie-Hellman-group signature scheme , 2002, IACR Cryptol. ePrint Arch..

[14]  Laura Ricci,et al.  Blockchain Based Access Control , 2017, DAIS.

[15]  Hannes Tschofenig,et al.  Authentication and Authorization for Constrained Environments Using the OAuth 2.0 Framework (ACE-OAuth) , 2020, RFC.

[16]  Nikos Fotiou,et al.  Interacting with the Internet of Things Using Smart Contracts and Blockchain Technologies , 2018, SpaCCS.

[17]  Mehdi Mani,et al.  Use Cases for Authentication and Authorization in Constrained Environments , 2016, RFC.

[18]  Carsten Bormann,et al.  An architecture for authorization in constrained environments , 2018 .