The rapid growth of the Internet of Things (IoT) and its attributes of constrained devices and a distributed environment make it difficult to manage such a huge and growing network of devices on a global scale. Existing traditional access-control systems provide security and management to the IoT system. However, these mechanisms are based on central authority management, which introduces issues such as a single point of failure, low scalability, and a lack of privacy. In order to address these problems, many researchers have proposed using blockchain technology to achieve decentralized access control. However, such models are still faced with problems such as a lack of scalability and high computational complexity. In this paper, we propose a light-weight hierarchical blockchain-based multi-chaincode access control to protect the security and privacy of IoT systems. A clustering concept with BC managers enables the extended scalability of the proposed system. The architecture of the proposed solution contains three main components: an Edge Blockchain Manager (EBCM), which is responsible for authenticating and authorizing constrained devices locally; an Aggregated Edge Blockchain Manager (AEBCM), which contains various EBCMs to control different clusters and manage ABAC policies, and a Cloud Consortium Blockchain Manager (CCBCM), which ensures that only authorized users access the resources. In our solution, smart contracts are used to self-enforce decentralized AC policies. We implement a proof of concept for our proposed system using the permissioned Hyperledger Fabric. The simulation results and the security analysis show the efficiency and effectiveness of the proposed solution.

The Internet of Things paradigm is growing rapidly. In fact, controlling this massive growth of IoT globally raises new security and privacy issues. The traditional access control mechanisms provide security to IoT systems such as DAC (discretionary access control) and mandatory access control (MAC). However, these mechanisms are based on central authority management, which raises some issues such as absence of scalability, single point of failure, and lack of privacy. Recently, the decentralized and immutable nature of blockchain technology integrated with access control can help to overcome privacy and security issues in the IoT. This paper presents a review of different access control mechanisms in IoT systems. We present a comparison table of reviewed access control mechanisms. The mechanisms’ scalability, distribution, security, user-centric, privacy and policy enforcing are compared. In addition, we provide access control classifications. Finally, we highlight challenges and future research directions in developing decentralized access control mechanisms for IoT systems.