Blockchain access control system

Patent metadata

Field	Value
Publication number	US-11201746-B2
Application number	US-201916529343-A
Country	US
Kind code	B2
Filing date	Aug 1, 2019
Priority date	Aug 1, 2019
Publication date	Dec 14, 2021
Grant date	Dec 14, 2021

Abstract

A system may receive a credential token and an access command. The access command may identify access logic to modify a datablock stored in a blockchain. The credential token may be mapped to a role token included in a role-based access control model. The system may determine a role-based access control framework authorizes the access command by identifying an authorization token in the role-based access control model, and the system may determine the role token is mapped to the identified authorization token in the role-based access control model. The system may determine the datablock includes the identified authorization token. The system may validate the identified authorization token. The system may authorize execution of the access logic to modify the datablock in response to the access command being authorized by the role-based access control framework, and validation of the identified authorization token included in the datablock.

First claim

What is claimed is:

1. A participant node of a distributed ledger network, the participant node comprising:
a blockchain comprising a plurality of datablocks previously stored therein;
a role-based access control framework configured to access a role-based access control model to provide role-based authorization; and
a processor circuitry, the processor circuitry configured to:
receive a credential token and an access command, the access command identifying access logic to modify a datablock previously stored within the blockchain, the credential token being mapped to a role token included in a role-based access control model;
determine the role-based access control framework authorizes the access command to modify the datablock, by:
identification of an authorization token in the role-based access control model, and
determination of the role token being mapped to the identified authorization token in the role-based access control model;

extract, from the access command, a parameter indicative of a location of the blockchain storing the datablock;
extract, from a header of the datablock, information to confirm the datablock is storing the identified authorization token;
validate the identified authorization token; and
authorize execution of the access logic in response to:
the access command being authorized by the role-based access control framework, and

validation of the identified authorization token included in the datablock.

2. The participant node of claim 1 , wherein to access the datablock and confirm the datablock includes the identified authorization token, the processor circuitry is further configured to:
extract a header from the datablock; and
determine the header includes the identified authorization token stored therein.

3. The participant node of claim 1 , wherein the processor circuitry is configured to validate the identified authorization token in response to the identified authorization token being digitally signed based on a public key associated with a trusted authority.

4. The participant node of claim 1 , wherein the processor circuitry is further configured to:
execute the access logic to modify the datablock in response to the execution being authorized.

5. The participant node of claim 4 , wherein the processor circuitry is further configured to:
modify, based on the access logic and the access command, the datablock; and
commit the modified datablock to the blockchain.

6. The participant node of claim 5 , wherein the processor circuitry is further configured to:
generate a log entry indicative of modification to the datablock, the log entry comprising the credential token, a digital signature, a time value, a description of the modification to the log entry, or any combination thereof; and
include the log entry in the modified datablock as a historical record of modification of the datablock.

7. The participant node of claim 1 , wherein the processor circuitry is further configured to:
access, in response to the role token being mapped to the identified authorization token, an encrypted access control logic; and
unencrypt the encrypted access control logic based on a key associated with the credential token.

8. The participant node of claim 1 , wherein the processor circuitry is further configured to:
modify the datablock using the access logic;
store a record of modification in the modified datablock; and
synchronize, based on a consensus protocol of a distributed ledger network, the blockchain with a corresponding remote blockchain stored on another participant node of the distributed ledger network to update the corresponding remote blockchain with the modified datablock.

9. The participant node of claim 1 , wherein the processor circuitry is further configured to:
receive transaction data to store on the blockchain;
generate a new datablock;
include the authorization token in the new datablock; and
commit the new datablock to the blockchain.

10. The participant node of claim 9 , wherein the authorization token is stored in a header of the new datablock.

11. A method, comprising:
receiving, by a processor circuitry, a credential token and an access command, the access command identifying access logic to modify a datablock previously and permanently stored in a blockchain, the credential token being mapped to a role token included in a role-based access control model, wherein a role-based access control framework accesses the role-based access control model;
executing, with the processor circuitry, a role-based access control framework to confirm the access command to modify the datablock is authorized by:
identifying, with the processor circuitry, in the role-based access control model, an authorization token mapped to or representing the access command, the authorization token included in the role-based access control model, and
confirming, with the processor circuitry, the role token is mapped to the identified authorization token in the role-based access control model;
obtaining, with the processor circuitry, the datablock from the blockchain;
determining, with the processor circuitry, the identified authorization token is also stored in a header of the datablock;
validating, with the processor circuitry, the identified authorization token; and
authorizing, with the processor circuitry, execution of the access logic in response to:
the access command being authorized by the role-based access control framework, and
validation of the identified authorization token stored in the datablock.

12. The method of claim 11 , wherein determining the datablock includes the identified authorization token further comprises:
extracting, with the processor circuitry, a header from the datablock; and
determining, with the processor circuitry, the identified authorization token is stored in the header.

13. The method of claim 11 , wherein validating the identified authorization token further comprises:
determining, with the processor circuitry, the identified authorization token is digitally signed based on a public key associated with a trusted authority.

14. The method of claim 11 , further comprising:
modifying, with the processor circuitry, the datablock based on the access logic and the access command; and
committing, with the processor circuitry, the modified datablock to the blockchain.

15. The method of claim 14 , further comprising:
generating, with the processor circuitry, a log entry indicative of the modification to the datablock, the log entry comprising the credential token, a digital signature, a time value, a description of the modification to the log entry, or any combination thereof; and
including, by the processor circuitry, the log entry in a header of the modified datablock as a historical record of modification to the datablock.

16. The method of claim 11 , further comprising:
receiving, with the processor circuitry, transaction data to store on the blockchain;
generating, with the processor circuitry, the datablock;
including, by the processor circuitry, the authorization token in the datablock; and
committing, with the processor circuitry, the datablock to the blockchain.

17. The method of claim 11 , further comprising:
accessing, in response to the role token being mapped to the identified authorization token, an encrypted access control logic; and
unencrypt the encrypted access control logic based on a key associated with the credential token.

18. A non-transitory computer readable storage medium comprising:
instructions ex

Assignees

• Accenture Global Solutions Ltd

Inventors

• Ranganathan Sridhar

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L9/3239 Primary

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title