Traditional centralized access control has some shortcomings in robustness, trustworthiness and circulation. Blockchains have the advantages of fault tolerance and trust. Smart contracts have the characteristics of automatic execution and flexible expansion. Tokens can well record credential information and transfer easily. In this paper, blockchain, smart contract and token are integrated and applied to access control to solve the shortcomings of traditional access control. First, access control, blockchain, smart contract and token are briefly described. Second, this paper proposes a solution by giving the general data structure of access control token, elaborating the equivalence, split, merge and verification algorithms of access control token, and explaining the system architecture of token-based access control. Last, this paper uses a token-based access control simulation system to verify that token-based access control has certain comparative advantages in robustness, trustworthiness, circulation, concurrency and so on.

In recent years, advanced smart contract languages (ASCLs) have been proposed to solve the problem of difficult reading, comprehension, and collaboration when writing smart legal contracts among people in different fields. However, this kind of languages are still hard to put into practice due to the lack of an effective conversion method from the ASCLs to executable smart contract programs. Aiming at this problem, we take SPESC as example to explore how to design conversion rules from the contract in it to the target programming language in Solidity, and to propose a three-layer smart contract framework, including advanced smart-contract layer, general smart-contract layer, and executable machine-code layer. These rules provide an approach to convert the definition of SPESC contracting parties into party-contracts on target language, as well as to produce SPESC contract terms into main-contract on target language. Moreover, the proposed framework specifies not only program architecture and storage structure on general smart-contract layer, but also important mechanisms, including personnel management, timing control, exception handling, etc., which can assist programmers to write smart contract programs. Furthermore, taking four SPESC contracts as testing objects, we provide the whole process of converting from SPESC contracts to Solidity programs by the SPESC-Translator, and verify the efficiency and security of the conversion process, including coding, deploying, running, and testing through Ethereum. The instance results show that the conversion rules and the three-layer framework can simplify the writing of smart contracts, standardize the program structure, and help programmers to verify the correctness of the contract programs.

The decentralization mechanism provides manufacturers and distributors with greater customization and flexibility they need through Internet of Things (IoT)-based industrial collaboration systems (IoT-ICS), but it has brought forward security concerns about the shared data-processing tasks and IoT-based access to services and resources. To address them, we propose a practical blockchain solution to achieve decentralized policy management and evaluation on attribute-based access control (ABAC). By offloading the responsibility of ABAC policy administration and decision making to blockchain nodes, a blockchain-based access control framework, called Policychain, is presented to ensure policy with high availability, autonomy, and traceability. To deliver a solid design, we first present a transaction-oriented policy expression scheme with a well-defined syntax and semantics. The scheme can translate ABAC policies into the blockchain transactions with JavaScript object notation (JSON) syntax and script-based logical expression. We further realize a script-driven policy evaluation by extending blockchain inherent scripting instructions to support attribute acquisition of ABAC entities. Furthermore, we propose a policy lifecycle management scheme from policy creation, renovation, to revocation, in which policies are verified by three validation principles at the transaction level. Finally, we provide sophisticated analysis and experiments to show that our framework is secure and practical for decentralized policy management on ABAC in IoT-ICS.

Usage-based pricing or Pay-as-You-Go is a relatively new SaaS business model that may provide customers the option to pay for only what they use. Yet, it is more challenging to implement than traditional Pay-before-Use subscriptions considering that it need not only realize financial payment on consumption-based behaviors, but also regulate the rights and obligations among the providers, consumers, and platforms in a legal form. To address these challenges, in this paper Smart Legal Contract (SLC) is integrated into a service computing platform by introducing a new architecture, called Service as a Smart Contract (SaaSC). On the aspect of service legalization, through combining SaaS and SaaSC, we establish three kinds of terms in SLC-based software subscription contract to support service's registration, discovery and customization, so that a complete transaction procedure can be regulated in terms of service states, transaction process, and interactions among contracting parties. On the aspect of service financialization, we propose a new scheme of service interface declaration in the SLC-based SPESC contract. By automatically executing smart contracts and checking the terms, the pay-as-you-go billing form can be made fine-grained payment after using service interface calls. Moreover, we take weather forecast service as a case to implement and analyze the acquisition, delivery, and contractual payment of software service on Blockchain smart contract. The experimental results demonstrate the feasibility and effectiveness of the proposed SaaS+SaaSC architecture so that it provides a practicable approach for contractual software service.

In this article, we address the problem of secure sensitive data sharing for the specified recipients in Blockchain Internet of Things (BIoT). To do it, we present a cryptographic solution to meet the requirements of decentralization and convenience through key management and programmable ciphertext. First, we design a new ciphertext-policy decentralized-key attribute-based encryption (CP-DK-ABE) scheme. After the master secret key is shared into all full nodes in the form of threshold secret sharing, a decentralized multiparty computation protocol is used to generate the user’s private key in an interactive way. Meanwhile, the attribute subkeys associated with the private key can be reconstructed by obtaining a fragment from each of full nodes, so as to achieve the cooperative management of attribute key through all of full nodes. Furthermore, following the blockchain’s script system, we introduce five new opcodes to represent ciphertext in the programmable format. Such a mechanism provides flexible capability to represent the logical relationship of the access control policy among attribute subciphers in the CP-DK-ABE ciphertext by the scripting language. As a result, the processes of encryption and decryption are implemented entirely by the script interpreter on the blockchain node, thereby greatly improving the convenience of programming in BIoT devices. In addition, we prove that the proposed CP-DK-ABE scheme is key private and semantically secure for a limited number of corrupted full nodes under the decisional linear and bilinear Diffie–Hellman assumption, respectively.