论文标题
在区块链上执行协作过程的细粒度数据访问控制
Fine-grained Data Access Control for Collaborative Process Execution on Blockchain
论文作者
论文摘要
多方业务流程基于分布式环境中不同参与者的合作。即使在参与者之间的部分信任条件下，区块链也可以为这种过程的自动化提供支持。链上数据存储在分类帐的所有副本中，因此可以访问网络中的所有节点。尽管这促进了可追溯性，诚信和持久性，但它破坏了采用公共区块链以进行过程自动化，因为它与企业设置中的典型机密性要求冲突。在本文中，我们提出了一种新颖的方法和软件体系结构，该方法允许对消息部分级别的流程数据进行细粒度的访问控制。在我们的方法中，加密数据存储在链接到备份过程执行的区块链系统的分布式空间中；数据所有者指定访问策略，以控制哪些用户可以阅读信息的哪些部分。为了实现所需的属性，我们利用基于属性的加密来存储数据，并利用智能合约来访问控制，完整性并链接到过程数据。我们在概念验证中实施了方法，并在供应链管理方面进行了案例研究。从实验中，我们发现我们的体系结构坚固，同时仍然保持执行成本相当低。
Multi-party business processes are based on the cooperation of different actors in a distributed setting. Blockchains can provide support for the automation of such processes, even in conditions of partial trust among the participants. On-chain data are stored in all replicas of the ledger and therefore accessible to all nodes that are in the network. Although this fosters traceability, integrity, and persistence, it undermines the adoption of public blockchains for process automation since it conflicts with typical confidentiality requirements in enterprise settings. In this paper, we propose a novel approach and software architecture that allow for fine-grained access control over process data on the level of parts of messages. In our approach, encrypted data are stored in a distributed space linked to the blockchain system backing the process execution; data owners specify access policies to control which users can read which parts of the information. To achieve the desired properties, we utilise Attribute-Based Encryption for the storage of data, and smart contracts for access control, integrity, and linking to process data. We implemented the approach in a proof-of-concept and conduct a case study in supply-chain management. From the experiments, we find our architecture to be robust while still keeping execution costs reasonably low.
