一個基於智慧合約的分散式物聯網裝置自主權限交易管理系統

A Blockchain Smart-Contract-based Distributed Self-Sovereign IoT-Device-Access Transaction System

葉揚(Ya, Young)

指導教授 ： 蔡仁松

國立清華大學/電機資訊學院/電機工程學系所/碩士(2020年)

摘要

傳統以服務商為中心的IOT管理系統在實際使用上因服務商的不可控性而產生許多已知的安全、用戶隱私與交易公平性等疑慮。因此，IOT管理系統的其中一個發展趨勢是將權限與隱私的管理歸還給使用者自行決定管理，也就是分散式自主管理方式，因而消弭服務商不透明的管理方式所造成的不可信任風險。但自主管理方式在授權憑證設計、公平交易機制、硬體建置成本與雙重支付問題上需有配套的完整解決方案。

因此，我們針對上述問題提出一套授權交易系統應用區塊鏈技術並結合我們之前研究的分散式物聯網的權限自主管理的UREKA架構。我們的方法無需改變分散式權限管理系統的設計，而應用區塊鏈智慧合約技術進行額外的授權交易與交易監督。此方法可兼具分散式系統的隱私、安全保護，以及區塊鏈系統的可信任交易。讓IOT系統在隱私、安全與可信任的前提下能實現資料與服務的自主授權交易。

此外，我們的系統特色是物聯網裝置無需有網路連線功能，因此無需昂貴的網路連線硬體。使用者可透過自身持有的行動裝置做為傳遞中介，向區塊鏈申請並下載加密的授權票（U票）證明使用權，然後用近距離傳輸給目標裝置查驗並執行，而後將裝置上的執行結果（R票）由裝置簽名加密再透過使用者回傳區塊鏈結算。

此創新的物聯網裝置自主權限交易管理系統，不只大大降低了IOT裝置的硬體建置成本並增加裝置的可佈署位置的彈性，更重要的是為自主管理系統提供可信任的對外授權交易。

關鍵字

區塊鏈 ； 權限管理 ； 數位資產

並列摘要

The traditional service provider-centric IoT management systems contain many open issues on system security, user privacy, and there are no transparent and fair transaction dispute resolution processes. These issues occur mainly because no proper authorities can monitor service providers. Therefore, the one of trends is to develop distributed user-self-sovereign IoT access management systems and let users manage their own IoT devices. However, more concrete methods are required to realize the access authorization process, establish a fair transaction system, construct economic hardware devices.

Therefore, we propose in this paper a transaction management solution that integrates blockchain smart contract technology along with the distributed UREKA IoT architecture, we have previously developed. The smart-contract transaction system is built on top of the existing distributed IoT system. Our method leverages the privacy and security protection scheme of the UREKA architecture, but establish additional trustable transactions on the blockchain. The proposed design provides a feasible solution to realize the self-sovereign requirements. It allows IoT device owners and users to independently manage access controls of their devices and data of transactions under the premise of privacy, security, and trust.

A unique feature of our proposed design is that our target IoT devices require no internet connection capability and hence eliminate expensive Wi-Fi hardware components and significantly reduce device cost. A user can conveniently use any mobile device as an intermediary, request and retrieve an encrypted access authorization ticket (U-ticket) from the target device owner from the blockchain, and then transfer the U ticket to the target device for verification and access. The execution result of the access is encrypted by the device signature and compiled as an R-ticket to submit to the blockchain smart contract by the user to complete the access transaction.

This innovative IoT-device-access transaction system not only dramatically reduces the IoT device cost, energy consumption, increases the flexibility of the device deployable location, but, most importantly, provides a trustable access transaction method for the distributed self-sovereign IoT management infrastructure.

並列關鍵字

blockchain ； access control ； digital asset

參考文獻

1. Ruj, Sushmita, Milos Stojmenovic, and Amiya Nayak. "Privacy preserving access control with authentication for securing data in clouds." 2012 12th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (ccgrid 2012). IEEE, 2012.

2. Benazzouz, Yazid, et al. "Sharing user IoT devices in the cloud." 2014 IEEE world forum on internet of things (WF-IoT). IEEE, 2014.

3. Maesa, Damiano Di Francesco, Paolo Mori, and Laura Ricci. "Blockchain based access control." IFIP International Conference on Distributed Applications and Interoperable Systems. Springer, Cham, 2017.

4. Nakamoto, Satoshi, and A. Bitcoin. "A peer-to-peer electronic cash system." Bitcoin.–URL: https://bitcoin. org/bitcoin. pdf (2008).

5. Douceur, John R. "The sybil attack." International workshop on peer-to-peer systems. Springer, Berlin, Heidelberg, 2002.