System-level function-based access control for smart contract execution on blockchain

Abstract

Techniques for system-level function-based access control for smart contract execution on a blockchain are shown. Access control rules control function calls at the system level by leveraging function boundary detection tools in the kernel that executes smart contracts. The detection tool generates a call stack, which represents a series of function calls in the kernel used to execute smart contracts. Access control rules are applied to the function call stack to allow or prohibit specific functions or function call chains. Access control rules can also define parameter data that is allowed or prohibited in a function call chain. If the function call chain or parameters do not meet the requirements defined in the access control rules, the function call can be prevented from executing or completing the execution. Access control rules can generate sophisticated access control policies based on complex function call chains.

Description

Background Art

[0001] Blockchains generally provide a decentralized distributed ledger to securely and immutably record transactions and other data. Currently, there are several methods for maintaining security in blockchains.

[0002] One aspect of blockchain security is achieved through proof of work, which is typically a cryptographic puzzle with a dynamic level of difficulty. Proof of work generally ensures that it is computationally infeasible for a single party to rewrite the blockchain with its own entries. For public blockchains, this also allows the selection of a winning node that can append a new transaction block to the blockchain.

[0003] Another aspect of blockchain security is the use of consensus protocols, which act as gatekeepers to authorize "miners" to write to the blockchain. These protocols are generally of two types: 1) cryptographic calculations with very low collision probabilities to ensure that only one writer wins in a time period; and 2) non-cryptographic protocols such as Proof of Elapsed Time (PoET), Asynchronous Byzantine Fault Tolerance (aBFT), Practical Byzantine Fault Tolerance (pBFT), or hashgraph-enhanced parallel consensus protocols.

[0004] Another aspect of blockchain security is the use of private keys by all blockchain participants (e.g., users, contracts, signatories / validators / miners). Each of these entities diligently protects its private keys in software or hardware frameworks (digital wallet systems such as METAMASK, TREZOR, or LEDGER NANO series).

[0005] However, none of the above security methods can effectively act as a security gatekeeper for the operation of the blockchain platform itself or the smart contracts deployed on the blockchain. If a blockchain is coded with gates (inadvertently by design or due to errors), or if the execution environment provided by the blockchain platform that runs smart contracts is compromised, the blockchain may be vulnerable to security vulnerabilities. As a result, smart contracts on some blockchains have been hacked and funds stolen.

[0006] For example, the Ethereum blockchain supports a fallback function for smart contracts, which is always executed at the end of the smart contract. Hackers exploited this fallback function to drain the wallet by inserting a Deposit() call from the smart contract wallet into a wallet controlled by the hacker.

[0007] It is with respect to these and other considerations that the disclosure made herein is presented. Summary of the invention

[0008] Techniques for system-level function-based access control for smart contract execution on a blockchain are disclosed.

[0009] Examples of the disclosed technology relate to methods, systems, and media for system-level function-based access control for smart contract execution on a blockchain, wherein the following steps are performed in a kernel execution framework for smart contract execution on a blockchain, wherein the kernel execution framework is configured to perform function boundary detection, and the steps involve: detecting function calls made by one or more methods of a smart contract on a blockchain, adding the function calls to a function call stack of the smart contract; checking the function call stack against a function-based access control rule set, the function-based access control rule set defining one or more allowed or prohibited function call sequences, and if the function call stack includes one or more function calls that are not allowed under the function-based access control rule set, preventing the execution or completion of the function call.

[0010] In some examples, a function call stack includes each function called during execution of the smart contract, a function-based access control rule set includes at least one access control rule that defines a function call sequence, and the step of checking the function call stack against the function-based access control rule set includes: checking the function call stack against the function call sequence defined in the access control rule that defines the function call sequence.

[0011] In some other examples, the function-based access control rule set includes at least one data-based access control rule, and the step of detecting a function call made by one or more methods of a smart contract on a blockchain includes: detecting at least one value included in a function call stack. The step of checking the function call stack against the function-based access control rule set involves: checking at least one value included in the function call stack against the data-based access control rule. If the function call sequence is not allowed under the function-based access control rule set, the step of blocking the function call includes: blocking the function call if at least one value included in the function call sequence is not allowed under the data-based access control rule set.

[0012] In a specific example, a function-based access control rule set is stored on a blockchain, and the method includes modifying the function-based access control rule set by adding a function-based access control rule block to the blockchain.

[0013] In other examples, the kernel execution framework is a Linux operating system framework, and the function boundary detection includes extended Berkeley packet filtering.In some examples, the function-based access control rule set includes at least one of: a whitelist of allowed function call sequences and a blacklist of prohibited function call sequences.

[0014] In yet another example, the following steps are performed within a virtual machine executing a framework for smart contract execution on a blockchain: detecting a function call made by one or more methods of a smart contract on a blockchain, adding the function call to a function call stack of the smart contract, checking the function call stack against a function-based access control rule set, and blocking the function call if the function call is not allowed under the function-based access control rule set.

[0015] It should be understood that the above subject matter may also be implemented as a computer-controlled device, a computer process, a computing system, or as an article such as a computer-readable medium. These and various other features will become apparent by reading the following detailed description and viewing the associated drawings. This summary is provided to introduce a selection of concepts that are further described below in the detailed description in a simplified form.

[0016] This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Furthermore, the claimed subject matter is not limited to implementations that solve any or all disadvantages noted in any part of this disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The detailed description is described with reference to the accompanying drawings. In the drawings, the left-most digit(s) of a reference number identifies the drawing in which the reference number first appears. The same reference numbers in different drawings indicate similar or identical items.

[0018] Figure 1 is an architectural diagram showing an illustrative example of a system for storing transaction data using a blockchain and storing access control rules using a blockchain;

[0019] Figure 2A is a data architecture diagram showing an illustrative example of a transaction data blockchain protecting transaction data;

[0020] Figure 2B is a data architecture diagram showing an illustrative example of a transaction data block protecting transaction data, the transaction data block including a method performed by a blockchain platform;

[0021] Figure 3A is a functional block diagram showing an illustrative example of a blockchain platform with a virtual machine that executes a method for a block of transaction data from a kernel with function boundary access control according to the disclosed technology;

[0022] Figure 3B is a data architecture diagram showing an illustrative example of function or data based access control rules according to the disclosed technology;

[0023] Figure 4Ais a control-flow diagram showing an illustrative example of a process for defining a function- or data-based access control rule set in accordance with the disclosed technology;

[0024] Figure 4B is a control-flow diagram showing an illustrative example of a process for applying function- or data-based access control rules to function calls in a call stack in a kernel with function boundary access control in accordance with the disclosed technology;

[0025] Figure 4C is a control flow diagram illustrating an example of a verification process for a block added to a transaction data blockchain or an access control policy blockchain distributed to an untrusted node;

[0026] Figure 5 is a data architecture diagram showing an illustrative example of a user using an application programming interface to call a method in a data block on a transaction data blockchain;

[0027] Fig. 6A It is shown based on Figure 1 A data architecture diagram of a simplified example of a blockchain ledger that includes a transaction data block of a transaction data blockchain or an access control rule block of an access control policy blockchain;

[0028] Figure 6B is a data architecture diagram showing an illustrative example of smart contract code, transactions, and messages that are bundled into blocks so that their integrity is cryptographically secure and so that they can be appended to a blockchain ledger;

[0029] Figure 7 is a computer architecture diagram illustrating a schematic computer hardware and software architecture for a computing system capable of implementing various aspects of the techniques and methods presented herein;

[0030] Figure 8 is a diagram illustrating a distributed computing environment capable of implementing various aspects of the techniques and technologies presented herein; and

[0031] Fig. 9 is a computer architecture diagram illustrating a computing device architecture for a computing device capable of implementing various aspects of the approaches and techniques presented herein. DETAILED DESCRIPTION

[0032] In the context of blockchain security, it is advantageous to utilize function-based access control (FBAC) according to the disclosed technology to improve the security of blockchain operations on a blockchain platform.

[0033] A security framework utilizing FBAC according to the disclosed technology can operate at the function call level in the kernel that executes blockchain methods on a blockchain platform to significantly improve the security of the blockchain at the system level in addition to the cryptographic and consensus security methods typically utilized in blockchains.

[0034] A technical advantage of certain aspects of the system-level security of the disclosed technology is that a smart contract or block that has been deployed to a blockchain and is therefore immutable can be protected without editing or redeploying the smart contract or block. Because the disclosed technology provides security at the system level, it can be highly scalable and easily configurable.

[0035] Another technical advantage of certain aspects of the disclosed technology is that function- and data-based access control rules can be directed to checking a series of function calls in a call stack, rather than being limited to checking a single function call.

[0036] The access control rules themselves may also be stored on the blockchain and protected by the multi-signature cryptographic and consensus security methods utilized by the blockchain. Storing access control rules on the blockchain allows the rules to be audited and traced back to their source. Updates to the access control rules may also be stored on the blockchain, and the disclosed technology may be configured to obtain the latest rules for the FBAC security framework.

[0037] Because access control rules are generally static data rather than executable code, the rules themselves are highly resistant to exploitation. In contrast, executable code in a smart contract or blockchain may be vulnerable to exploits in the underlying virtual machine (VM) that executes the smart contract code.

[0038] In some embodiments, the access control rules can be implemented by an appendix of a VM in a blockchain platform that executes smart contracts. In other embodiments, the access control rules are read from the blockchain into an independent privileged system-level module.

[0039] In general, the FBAC framework of the disclosed technology can prevent the invocation of specific smart contracts, specific smart contract function chains, and blockchain infrastructure functions. The FBAC framework makes it possible to define roles and bindings at various levels (e.g., functions, contracts, channels, or consensus algorithms). The FBAC framework can be used in some cases for sandbox algorithms used in blockchain platforms, which can help, for example, ensure configuration consistency between nodes with different consensus algorithms.

[0040] In general, the FBAC framework of the disclosed technology utilizes a function boundary detection tool in the kernel of the blockchain platform. The function boundary detection tool can track when a function enters the kernel and when a function exits the function. An example of a function boundary detection tool is the Berkeley Packet Filter (eBPF) framework in the LINUX operating system.

[0041] In some implementations, the FBAC framework of the disclosed technology can run with system-level support. For example, in one embodiment, the FBAC framework can run in its own privileged VM running FBAC and can exercise control over the VM running the smart contract. However, in another embodiment, the same VM can run both the smart contract and FBAC. The VM can also use the underlying operating system's function boundary detection tool support, such as eBPF.

[0042] Multiple FBAC policies can be associated or collaborated with multiple entities. For example, a wallet address on the blockchain for a financial transaction entity can be associated. For enterprise transactions, this collaboration can be specified as a field within each FBAC policy. After the FBAC policy is stored in the blockchain, every peer, validator, or transaction initiator in the blockchain can have a unified view of the policy.

[0043] As described above, access control rules can be based on both functions and data. Data passed as function parameters can be monitored to control access based on the parameters. Data-based access control rules can be stored in the blockchain. Data-based access control rules can, for example, be used to protect certain data fragments of the blockchain from general access. For example, in a permissioned blockchain, a tag or key can be utilized to determine access to data.

[0044] As described above, a hacker is able to exploit a fallback function in a smart contract by inserting a Deposit() call that directs funds in an unprotected wallet to a wallet controlled by the hacker. In one example, the disclosed technology can be used to prevent such exploitation using access control rules to prohibit a Deposit() call at the end of a series of function calls.

[0045] Another example of a possible use of the disclosed technology is a permissioned blockchain. Current blockchain platforms implement different permission views for different participants by isolating messaging and access to data across channels. However, some smart contracts may end up being shared among hundreds of entities. The disclosed technology can be applied to define access control rules that determine the functions of different users (e.g., users, user administrators, group administrators, cluster administrators, logical grouping administrators).

[0046] Another example of a possible use of the disclosed technology is to provide quality of service (QoS) in a blockchain platform. The disclosed technology can be used to apply access control rules to achieve differential resource allocation at a highly granular level to deliver the required QoS for specific entities or functions.

[0047] Another example of possible use of the disclosed technology is resource or rate limit enforcement. The framework can identify the chain of functions being called and continuously update their resource utilization, and apply access control rules to enforce resource or rate limits based on this or based on a fixed count per time period.

[0048] Another example of a possible use of the disclosed technology is to implement a circuit breaker. For example, an error will occur when a smart contract fails due to an underlying error or similar problem or due to an external failure (such as a network I / O problem or similar problem). If a specific function chain is called repeatedly and it is known that the function chain keeps failing, a circuit breaker may be useful. In this context, access control rules are applied to implement a circuit breaker function by preventing further calls of the function chain until a predetermined / preset time has passed. This is particularly useful for preventing blockchain platforms from being overwhelmed. In the context of a larger distributed system (on a large scale), this may help to achieve optimal blockchain request routing.

[0049] One other example of a possible use of the disclosed technology is to prevent smart contract spoofing. By defining an FBAC policy that determines the allowed function chains, any other function chains can be invalidated by applying access control rules to terminate their execution. In the event that a critical path function or a general smart contract is forged by defining access control rules that require internal function calls inherent to the underlying blockchain, spoofing of the critical path function or the general smart contract can be prevented at the system level in such a way that the forged smart contract or critical path function cannot perform operations that should not be performed. When coupled with a trusted root that can be obtained from the access control rules defined on the blockchain, the function call chain can be made more reliable.

[0050] In general, the disclosed technology utilizes one or more access control rules or policy sets to control function calls at the system level by utilizing a function boundary detection tool in the kernel. The function boundary detection tool can generate a function call stack representing a series of function calls in the kernel. Access control rules can be applied to the function call stack to allow or prohibit specific function call chains. If the function call chain or parameters do not meet the requirements defined in the access control rules, the function call can be blocked or terminated. Access control rules can be defined to generate sophisticated access control policies based on complex function call chains and data parameters.

[0051] The following detailed description section describes techniques for function-based access control at a system level in a blockchain platform using access control rules. The access control rules can be maintained on the blockchain for security, accessibility, and immutability.

[0052] Note that in some cases, different entities may provide access control rules. For example, a certificate authority or other trusted source may be utilized to own and control access control rules. In some examples, modifications or additions to access control rules may be stored in an additional access control rules block on the blockchain that requires a signature from a trusted entity.

[0053] The resulting access control rules block can provide a record of the access control rules or policies defined for the blockchain platform or VM, and provide a traceable and auditable history of the access control rules.

[0054] Technical advantages of the disclosed function-based access control technology include securely controlling access at the system level. Another technical advantage of the disclosed function-based access control technology is its ability to control complex function call chains. Yet another technical advantage of the disclosed function-based access control is the distributed nature of the blockchain, which prevents unauthorized entities from modifying or destroying access control rules at any single point. Other technical effects besides those mentioned herein can also be achieved according to the embodiments of the technology disclosed herein.

[0055] As will be described in greater detail herein, it will be appreciated that implementations of the means and techniques described herein may include the use of solid-state circuits, digital logic circuits, computer components, and / or software executed on one or more input devices. The signals described herein may include analog and / or digital signals for communicating the changed state of a data file or other information related to a data file.

[0056] Although the subject matter described herein is presented in the general context of program modules executed in conjunction with the execution of an operating system and application programs on a computer system, those skilled in the art will recognize that other embodiments may be executed in conjunction with other types of program modules. Generally, program modules include routines, programs, components, data structures, and other types of structures that perform specific tasks or implement specific abstract data types. In addition, those skilled in the art will appreciate that the subject matter described herein may be practiced with other computer system configurations, including multiprocessor systems, mainframe computers, microprocessor-based or programmable consumer electronics, minicomputers, handheld devices, and the like.

[0057] In the following detailed description, reference is made to the accompanying drawings that form a part hereof and that show specific configurations or examples by way of illustration. Referring now to the drawings, in which like reference numerals represent like elements throughout the several figures, aspects of a computing system, a computer-readable storage medium, and a computer-implemented method for function-based access control at a system level will be described. As will be described in greater detail below with reference to the drawings, there are many applications and services that can embody the functions and techniques described herein.

[0058] Figure 1 1 is an architectural diagram showing an illustrative example of a system architecture 100, wherein a blockchain platform 130 maintains a transaction data blockchain 140 that can be accessed via a wide area network 102. In this example, the blockchain platform 130 also maintains an access control policy blockchain 150 that stores access control rules that can be utilized in the disclosed function-based access control technology. During the execution of a function in a transaction data block 142 of the transaction data blockchain 140, the access control rules are applied at the system level to perform function-based access control.

[0059] exist Figure 1 In an embodiment of the invention, blockchains 140 and 150 can each be a publicly available blockchain that supports scripts, such as the Ethereum blockchain that supports the SOLIDITY scripting language or BITCOIN that supports a scripting language called SCRIPT. Blockchains 140 and 150 can also each be a private blockchain, or a combination of public and private blockchains can be utilized. Transaction data block 142 and access control rules block 152 can also reside on the same blockchain.

[0060] In this example, the certificate authority is a trusted entity that controls the access control policy blockchain 150. The certificate authority can add or modify the access control policy by adding an access control rules block 152 to the blockchain 150, which adds, deletes, or modifies access control rules. The access control rules block 152 requires the cryptographic signature of the certificate authority to be valid.

[0061] The certificate authority 110, such as a client device, one or more servers, or a remote computing resource, is controlled by a trusted entity that creates access control rules. In one example, the certificate authority 110 initiates the access control policy blockchain 150 by creating a genesis block 152A. In other examples, the transaction data block 142 and the access control rules block 152 may be added to an existing blockchain.

[0062] The transaction data blockchain can be used to securely store different types of data, such as data related to the transaction or other data suitable for storage on the blockchain ledger, in the transaction data block 142. The transaction data block 142 can include a method or function call executed by the blockchain platform 130.

[0063] For the access control policy blockchain 150, the access control rules block 152 may include access control rules for a domain, blockchain platform service, enterprise, or other entity that wishes to apply the disclosed function-based access control to method executions in a smart contract.

[0064] In some embodiments, certificate authority 110 may be replaced by another computing node (eg, a computer or other computing device on a peer-to-peer network).

[0065] exist Figure 1 In the example of , a transaction data block is generated by an entity that owns the transaction and the block is protected on the transaction data blockchain 140. The transaction data stored in the transaction data block 142 may be related to a transaction performed by an entity (e.g., client / server 120A, 120B, or 120C). In this example, the client / server 120 may communicate with a network of servers of a certificate authority 110 and a blockchain platform 130 that supports and maintains blockchains 140 and 150. For example, the Ethereum blockchain platform from the Swiss Ethereum Foundation provides a decentralized distributed computing platform and operating system that provides scripting capabilities.

[0066] In one example, the certificate authority 110 owns and controls access control rules blocks 152 in the access control policy blockchain 150. Each access control rule block 152 includes one or more access control rules related to function calls that are allowed or prohibited in the blockchain platform 130. When defining access control rules, the certificate authority 110 creates an access control rule block 152 containing the access control rules and links it to the access control policy blockchain 150. When adding, modifying, or deleting access control rules, a new access control rule block 152 incorporating these changes is created, and the new block 152 is signed by the certificate authority 110 and linked to the previous access control rule block in the access control policy blockchain 150.

[0067] Although the certificate authority 110 maintains control over the access control rules, the access control policy blockchain 150 may be made accessible to other entities, such as the client / server 120, so that these entities may identify, track, or audit relevant access control rules in blocks stored in the blockchain 150. Furthermore, the access control rules in the blockchain 150 may be accessed by the blockchain platform 130 to command the application of the access control rules to perform the disclosed function-based access control.

[0068] In some examples, the access control policy blockchain 150 may be visible to other entities using an application that can access blockchain information. By providing access to the access control policy blockchain 150, under the control of a trusted entity (e.g., a user of the certificate authority 110), the method allows users to easily access control rules maintained on the access control policy blockchain 150.

[0069] In another example, aspects of the access control policy blockchain 150 may be restricted to be visible only to entities authorized to access the blockchain 150 , such as the certificate authority 110 and the blockchain platform 130 .

[0070] Figure 2A It is shown based on Figure 1 A data architecture diagram of a simplified example of a transaction data blockchain ledger 200 of blocks 142A-142E of a transaction data blockchain ledger 140. Figure 2A The example of a blockchain ledger 200 of transaction data is simplified to show the block headers, metadata, and signatures of blocks 210A-210E in order to demonstrate the use of a blockchain to store transaction data. In summary, a blockchain ledger can be a globally shared transaction database. In some examples, the signature can involve all or part of the data stored in blocks 142A-142E, and can also involve a public key address corresponding to a resource initiating entity involved in resource creation.

[0071] The blockchain ledger 200 may be arranged as a Merkle tree data structure, as a linked list, or as any similar data structure that allows cryptographic integrity. The blockchain ledger 200 allows verification that transaction data and similar access control rules on the access control policy blockchain 150 have not been broken or tampered with, because any tampering attempt will change (or have) the message authentication code of the block, and other blocks pointing to that block will no longer correspond. Figure 2A In one embodiment, each block can point to another block. Each block can include a pointer to another block and a hash (or message authentication code function) of the other block.

[0072] Each block in the blockchain ledger may optionally contain a proof data field. The proof data field may indicate that the reward is due. The proof may be a proof of work, a proof of stake, a proof of research, or any other data field indicating that the reward is due. For example, a proof of work may indicate that computational work has been performed. As another example, a proof of stake may indicate that a certain amount of cryptocurrency has been held for a certain amount of time. For example, if 10 units of cryptocurrency have been held for 10 days, the proof of stake may indicate that 10*10=100 time units have been accumulated. A proof of research may indicate that research has been conducted. In one example, a proof of research may indicate that a certain amount of computational work has been performed—such as exploring whether molecules interact in some way during a computational search for an effective drug compound.

[0073] exist Figure 2A In the example of FIG. 2 , block 210 of transaction data blockchain 200 illustrates the use of a new transaction data block on the blockchain to secure transaction data. In one example, such as Figure 1 A transaction entity such as a user of the client / server 120 provides a transaction identifier and transaction data for the transaction when creating a transaction data block 210A. The transaction entity signs the transaction data block 210A, and the blockchain system verifies the transaction data block based on the proof function, creating a blockchain 200 within the blockchain system.

[0074] Please note, Figure 1 The illustrated access control policy blockchain 150 may take a similar form with an access control rule block 152 including access control rules. Access control rule blocks 152 for successive additions, modifications, or deletions may be linked together on the same or different blockchains, so that the history of access control rules may be immutably and traceably stored using the blockchain.

[0075] Note that a variety of approaches may be utilized consistent with the disclosed technology. In some examples related to access control rules, a user of the certificate authority 110 is a required entity, or the only entity allowed to verify or validate the access control rules block 152. In other examples, other entities, such as a system administrator who defines the access control rules, are the entities required to verify or validate the access control rules block 152.

[0076] exist Figure 2AIn the example of , a transaction data block 210 of the transaction data blockchain 200 includes a transaction identifier and transaction data and a signature of the entity that owns the transaction. To add another transaction data block for another transaction, the transaction entity creates a transaction data block 210B that identifies the transaction and includes the transaction data. The transaction entity signs the transaction data block 210B and submits the block 210B to the blockchain 200 for verification by the blockchain platform.

[0077] To add more transaction data blocks for additional transactions, the same or another transaction entity creates transaction data block 210C to protect the transaction data of transaction TRANS_ID_3 and the data of that transaction. Similarly, transaction data block 242D is created by another transaction entity to store the transaction data of transaction TRANS_ID_4, and transaction data block 242E is created to store the transaction data of TRANS_ID_5.

[0078] The transaction data block 142 may be a smart contract, which includes methods or functions executed by the blockchain platform 130 . Figure 2B is a data architecture diagram showing an illustrative example of a transaction data block 142 having functions executed by a blockchain platform or framework. For example, functions Function_1, Function_2, Function_3, and Function_4 may be executed by a VM running in the blockchain platform 130. Figure 1 The blockchain 150 in the enables access control rules to be securely stored to maintain access control policies that can be used for function-based access control of the disclosed technology. The access control rules are obtained from the blockchain 150 and applied to function calls in the VM at the system level.

[0079] Figure 3A is a functional block diagram illustrating an example of applying function-based access control of the disclosed technology to a function call in a transaction data block 242 executed in a blockchain platform 330. In this example, the blockchain platform 330 includes VMs 332A and 332B, which execute in a kernel 340 and execute function calls from a transaction data block 242.

[0080] The kernel 340 includes a function boundary detection tool 342 (e.g., eBPF) that detects when a function is entered or exited and creates a call stack 344 to represent a series of function calls 346. In this example, the call stack 344 includes a call stack for function calls in the execution of the transaction data block 242, from Function_1 to Function_2, from Function_2 to Function_3, and from Function_3 to Function_4.

[0081] The blockchain platform 330 includes a function boundary access control module 348, which in this example obtains access control rules from the blockchain 350 and applies the rules to the function call chain in the call stack 344. When the function boundary detection tool 342 detects a function boundary, the FBAC 348 applies the access control rules to the call stack 344 to determine whether the function should be blocked, and in this example, sends a signal to the VM 332B to allow or deny execution or completion of the function.

[0082] Note that FBAC module 346 runs with system level support. In some examples, it can be its own privileged VM running FBAC functionality and can exercise control over other VMs (e.g., VMs 332A and 332B) running smart contracts (e.g., transaction data block 242). However, in other examples, the same VM can run smart contracts and FBAC functionality. In either example, the VM will use function boundary detection tools 342 in the kernel of the underlying operating system.

[0083] As described above, the access control rules of the FBAC policy can be stored in the blockchain like a smart contract and supported by the same multi-signature cryptographic signing method currently used by the blockchain framework to ensure that the origin of the deployed access control rules can be traced. Updates to the policy can also be encoded into the blockchain so that the FBAC module 348 only dynamically applies the latest policy. By maintaining the FBAC policies on the blockchain itself, they can be automatically and immutably protected. Because these policies are static and not executed code, they cannot be hacked or exploited by themselves, unlike smart contracts, which are as vulnerable to attacks as the VM that executes the smart contract.

[0084] In different implementations, the FBAC policy can be implemented as an addendum to the VM that executes the smart contract, or as a standalone privileged system-level module that can only be programmed by the FBAC rules / policies read from the blockchain. In either implementation, there are no backdoors in the FBAC module that can be exploited by malicious actors.

[0085] Figure 3B It is shown Figure 3A 350 in an access control policy blockchain 350. In the disclosed technology, access control rules can take a variety of forms.

[0086] For example, access control rules block 352A contains a whitelist of function-based rules that define access rights relative to the Figure 3A The functions and function call chains allowed by the function call of the transaction data block 242. The function call or function call chain in the call stack 344 that does not comply with the whitelist function rules of the rule block 352A will cause the FBAC module 348 to refuse to execute or complete the function call.

[0087] For example, the call from Function_2 to Function_4 in call stack 344 does not match any whitelist rules and will cause the FBAC module 348 to generate a deny signal to VM 342B that is executing the function call chain. However, the call stack of Function_1 to Function_2 to Function_3 does match one of the whitelist rules and will cause the FBAC module 348 to generate an allow signal to VM 342B. Note that the rules in block 352A are constructed to allow each temporary function call to occur for the allowed function call chain of Function_1 to Function_2 to Function_3 to Function_4.

[0088] Another form of access control rule is shown in a blacklist of function-based rules that defines a blacklist of function-based rules relative to a Figure 3A The function calls of the transaction data block 242 are prohibited functions and function call chains. A function call or function call chain in the call stack 344 that matches one of the blacklist function rules in the rule block 352A will cause the FBAC module 348 to reject the execution or completion of the function call.

[0089] For example, prohibiting a call to Function_5 (e.g., a call to Deposit()) will cause the FBAC module 348 to generate a deny signal to VM 342B. Similarly, a call beyond the allowed sequence from Function_2 to Function_4 in the call stack 344 matches one of the blacklist rules and will cause the FBAC module 348 to generate a deny signal to VM 342B that is executing the function call chain. However, a call from Function_1 to Function_2 does not match any of the blacklist rules and will cause the FBAC module 348 to generate an allow signal to VM 342B.

[0090] Another form of access control rules is shown in the whitelist of function and data based rules, which define the access control rules with respect to the Figure 3A The function calls and parameters of the transaction data block 242 are allowed. Function calls or function call chains and parameters in the call stack 344 that do not comply with the whitelist function rules of the rule block 352C will cause the FBAC module 348 to reject the execution or completion of the function call.

[0091] For example, a call from Function_1 must have parameter a=X. The function call chain in call stack 344 from Function_1 with parameter a=X to Function_2 with parameter g=a to Function_3 with parameter n=g matches the whitelist rule of (Function_1[a=X], Function_2[g=a], Function_3[n=g]) and will cause the FBAC module 348 to generate an allow signal to VM 342B that is executing the function call chain. However, the call stack of Function_1 to Function_2 to Function_3 with parameters that do not match any function and parameters in the whitelist rule will cause the FBAC module 348 to generate a deny signal to VM 342B. Note that the rules in block 352A are constructed to allow each temporary function call to occur for the allowed function call chain of Function_1 to Function_2 to Function_3 to Function_4.

[0092] Note that the example whitelist rule shown in access rule block 352C enforces function call parameter relationships where the call parameters in each function call match the parameters in the previous function call, e.g., (Function_1[a=X], Function_2[g=a], Function_3[n=g], Function_4[x=n]). For example, such a rule can be used to enforce the use of consistent transaction identifier values ​​throughout a chain of function calls, which can prevent hacks where malicious actors attempt to redirect transactions being executed in a smart contract.

[0093] Access rules block 352D shows an example of a blacklist of function and data based rules that define access rules relative to those from Figure 3A Function calls and parameters prohibited by the function calls of the transaction data block 242. Function calls or function call chains and parameters in the call stack 344 that match one of the blacklists of function and data-based rules in the rule block 352D will cause the FBAC module 348 to reject the execution or completion of the function call.

[0094] For example, the value of parameter a of a call made from Function_1 must not be greater than 60. The value of parameter g of a function call made from Function_2 must not be equal to 0. The value of parameter n of a function call made from Function_3 must not be greater than 40. The value of parameter x of a function call from Function_4 must not be equal to 25. The rules in the example of rule block 352D illustrate an access control policy that enforces restrictions on input parameters of functions in a smart contract.

[0095] In general, if the blacklist and whitelist are empty, all function calls are allowed. If the blacklist is empty and the whitelist contains access control rules, only the functions or function chains defined in the whitelist rules are allowed. If the blacklist contains access control rules but the whitelist is empty, all functions are prohibited. If both the blacklist and whitelist contain access control rules, the functions and function chains defined in the blacklist are prohibited, while the functions and function chains defined in the whitelist are allowed. If the access control rules in the blacklist and whitelist conflict, the blacklist rules generally take precedence.

[0096] Note that access rules based on functions or data can be stored in a sidechain of the blockchain. Also note that Figure 3B The example access control rules shown are relatively simple, and it will be readily appreciated that the disclosed technology enables highly complex and varied access control policies to be implemented at the system level. For example, multiple different function call chains or multiple call parameter values ​​may be allowed or prohibited.

[0097] In addition, the access or rejection signals generated by the FBAC module 348 can be configured to be more complex or define more complex access control policies. For example, instead of a simple rejection signal, the FBAC module 348 can be configured to delay the generation of an allow signal for the purpose of rate limiting. Similarly, instead of a simple allow signal, the FBAC module 348 can be configured to change the time at which the allow signal is generated for the purpose of differential QoS or resource allocation.

[0098] Likewise, in some implementations, state data may be maintained by the FBAC module 348, and the state data may be used to define access control policies, such as state data about the number of times a function has been called within a time interval to generate a deny signal for purposes of a circuit breaker function, or to delay the generation of an allow signal for purposes of a rate limiting function.

[0099] In addition, some access control policies can be defined to enforce permissions. For example, whitelist rules can be used to allow certain users or entities to access specific data in the transaction data block, or blacklist rules can be used to prohibit access to data.

[0100] It can be readily appreciated that the disclosed techniques enable complex and sophisticated access control policies to be defined and enforced at a system level.Many variations other than or beyond the examples shown may be implemented.

[0101] Can be defined and determined in many ways Figure 3B For example, a user with management permission can define access control rules and save them in the FBAC module 348 or as an appendix to the VM in the kernel 340. In another example, a trusted entity (such as a certificate authority) receives the access control rules and manages the distribution of the rules to the FBAC module 348 or VM in the execution platform (e.g., blockchain platform 330) for smart contracts.

[0102] In yet another example, a user with administrative permissions may store the access control rules in a rules block owned by the user on the access control policy blockchain 350. Or in a different example, the administrative user provides the access control rules to a trusted entity, such as a certificate authority, which stores the access control rules in a rules block of the access control policy blockchain 350 owned by the trusted entity.

[0103] Figure 4A 4 is a control flow diagram showing an illustrative example of a process 400 according to aspects of the disclosed technology, whereby an access control policy is defined and distributed for use in function-based access control. At 402, access control rules for the access control policy are defined as described above or in other ways suitable for a particular implementation. At 404, the access control rules are distributed as described above so that the access control rules are secure and accessible to the FBAC module 348 or another module that performs system-level function-based access control according to the disclosed technology.

[0104] Figure 4B 4 is a control flow diagram showing an illustrative example of a process 410 for system-level function-based access control according to aspects of the disclosed technology. At 412, a smart contract is executed in a kernel execution framework, such as a kernel framework provided by a blockchain platform for executing smart contracts, and the kernel execution framework is configured with a function boundary detection tool, such as eBPF. At 414, the function boundary detection tool detects function calls at the system level (e.g., entry or exit function calls made when executing methods in the smart contract).

[0105] At 416, a function call stack is created for the detected function call. The function call stack may include a series of function calls that have been called in the calling order, and may also include parameters passed in the function call. In some embodiments, other data may also be maintained, such as state data about functions and resources.

[0106] At 418, the function call stack is checked against the defined function or data based access control rules. As described above, the access control rules may include a whitelist or blacklist for the function calls or data indicated in the function call stack. Additionally, in some embodiments, access control rules that utilize state data for certain purposes, such as rate limiting or circuit breaker functionality, may be defined.

[0107] At 420, if the access control rules indicate that the function call is allowed, control branches to 422 to allow execution of the function. If the access control rules indicate that the function call is not allowed, control branches to 424 to deny or prevent execution or completion of the function call.

[0108] Process 410 is a simplified process for function-based access control. As described above, access control rules and function-based access control processes can be configured to control function calls at a more sophisticated level, such as delaying or accelerating the execution of function calls for the purpose of QoS, dynamic resource allocation, or rate limiting.

[0109] Figure 4C is a control flow diagram illustrating an example of a verification process 480 for a block added to a transaction data blockchain ledger or an access control policy blockchain ledger implemented using an untrusted blockchain node. In process 480, when Figure 1 The transaction data blockchain 140 in the transaction data creates a transaction data block 142 or for Figure 1 When creating an access control rules block 152 in the access control policy blockchain 150, the transaction is broadcast to the cluster of untrusted nodes at 482. At 484, the nodes compete to compute a verification solution for the transaction. At 486, the winning node broadcasts the verification solution for the transaction data block or the access control rules block and adds the data block to the corresponding data blockchain ledger copy, e.g., Figure 1 The transaction data blockchain 140 or the access control policy blockchain 150 in the.

[0110] At 488, in response to the winning node's broadcast, the other nodes add the transaction data block or access control rule block to their copy of the transaction data blockchain ledger or access control policy blockchain ledger in the transaction order established by the winning node. The decentralized verification protocol can maintain the integrity, immutability, and security of the transaction data blockchain ledger or access control policy blockchain ledger.

[0111] It should be understood that the examples shown and various other methods may be utilized without departing from the disclosed technology.

[0112] Depending on the scripting capabilities of the blockchain platform, methods or functions in a data block of a transaction data blockchain may include more extensive code execution. For example, a transaction data system that provides shared access to transactions by multiple users may involve more extensive code execution capabilities in the blockchain compared to a transaction data system that restricts access to a single user. Such a transaction data system may involve access control policies that utilize system-level functions and data-based access control to implement a permission system for controlling access to different parts of the transaction data.

[0113] It should be appreciated that utilization of system-level function-based access control and function- or data-based access control rules may provide a high degree of flexibility, complexity, and variation in the configuration of implementations without departing from the teachings of the disclosed technology.

[0114] Please note that the disclosed technology is not limited to the above transaction data example, but can be applied to various smart contracts executed on the blockchain platform. The technology can be applied to provide secure system-level access control in a variety of usage contexts.

[0115] Figure 5 is shown for use in Figure 1 , Figure 2A , Figure 2B and Figure 3A 5. In this example, an application program interface (API) 510 provides an interface to a blockchain platform 520 that supports a transaction data blockchain. Blockchain platform 520 supports smart contracts 522, such as Figure 2B The transaction data block 242 in the example embodiment includes a script 524 having code that, when executed by the blockchain platform 520, performs operations relative to the transaction data blockchain.

[0116] exist Figure 5 In the example of , four scripts are shown in smart contract 522. Client / server 502 initiates a transaction on the transaction data blockchain, causing Function_1 to execute and call Function_2. Function_2 calls Function_3, which calls Function_4, and in this example, Function_4 returns message 506 to client / server 502. These functions are executed in an execution framework on blockchain platform 520, such as Figure 3A A framework is shown that uses access control rules to perform system-level function-based access control on function calls.

[0117] Blockchain ledger data structure

[0118] Fig. 6A It is shown based on Figure 1 A data architecture diagram of a simplified example of a blockchain ledger 600 of blocks 142A-142E of the transaction data blockchain 140 or blocks 152A-152E of the access control policy blockchain 150. Fig. 6A The example of blockchain ledger 600 is simplified to show the block headers, metadata and signatures of blocks 142A-142E or blocks 152A-152E to demonstrate secure transaction data or access rules using a blockchain ledger. In general, a blockchain ledger can be a globally shared transaction database.

[0119] Fig. 6A is an illustrative example of a blockchain ledger 600 having a data tree that stores transaction data verified using cryptographic techniques. Fig. 6A In the example, each block 610 includes a block header 612 with information about previous and subsequent blocks, and stores a transaction root node 614 to a data tree 620 that holds transaction data. The transaction data may store smart contracts, data related to the transaction, or any other data. Elements of smart contracts may also be stored within the transaction node of the block.

[0120] exist Fig. 6A In the example of , the transaction data is cryptographically protected using a Merkle tree 620. For example, the transaction Tx1 node 634A of the data tree 620A of the block 610A can be hashed into a hash 1 node 632A, and the transaction Tx2 node 638A can be hashed into a hash 2 node 636A. The hash 1 node 632A and the hash 2 node 636A can be hashed into a hash 12 node 630A. A similar subtree can be formed to generate a hash 34 node 640A. The hash 12 node 630A and the hash 34 node 640A can be hashed into the transaction root 614A hash classified in the data block 610A. By using a Merkle tree or any similar data structure, the integrity of the transaction can be checked by verifying whether the hash value is correct.

[0121] Figure 6B is a data architecture diagram showing an illustrative example of smart contract code, transactions, and messages bundled into blocks so that their integrity is cryptographically secure and they can be appended to a blockchain ledger. Figure 6B In the example, smart contract 642 is a code executed on a computer. More specifically, the code of the smart contract can be stored in a blockchain ledger and executed by a node of a distributed blockchain platform at a given time. The results of the smart code execution can be stored in the blockchain ledger. Optionally, currency can be consumed when the smart contract code is executed. Figure 6B In the example of , smart contract 642 is executed in a virtual machine environment, although this is optional.

[0122] exist Figure 6B In, various aspects of smart contract 642 are stored in Fig. 6A In the transaction data node in the data tree 620 in the block 610 of the blockchain account book. Figure 6B In the example, smart contract 642A is stored in data block Tx1 node 634A of data tree 620A in block 610A, smart contract 642B is stored in Tx2 node 638A, contract account 654 associated with smart contract 642B is stored in Tx3 node 644A, and the external account is stored in Tx4 node 648A.

[0123] Storage of smart contracts and transaction data in blockchain ledgers

[0124] In order to ensure that smart contracts are secure and generate secure data, the blockchain ledger must be kept up to date. For example, if a smart contract is created, the code associated with the smart contract must be stored in a secure manner. Similarly, when the smart contract code executes and generates transaction data, the transaction data must be stored in a secure manner.

[0125] exist Figure 6B In the example of FIG, two possible embodiments for maintaining a blockchain ledger are shown. In one embodiment, untrusted miner nodes ("miners") 680 can be rewarded for solving cryptographic puzzles and thereby allowed to append blocks to the blockchain. Alternatively, a collection of trusted nodes 690 can be used to append the next block to the blockchain ledger. The nodes can execute the smart contract code, and then a winning node can append the next block to the blockchain ledger.

[0126] Although aspects of the technology disclosed herein are similar to smart contracts, in the present technology, the policy of the contract may determine how the blockchain ledger is maintained. For example, the policy may require that the verification or authorization process for blocks on the ledger be determined by centralized control of a cluster of trusted nodes. In this case, the centralized control may be to authorize trusted nodes (e.g., certificate authority 110) to certify and sign transaction blocks to verify them, and verification by miners may not be required.

[0127] Alternatively, the policy may provide for a verification process determined by a decentralized cluster of untrusted nodes. In the case where the blockchain ledger is distributed to a cluster of untrusted nodes, mining of blocks in the chain may be employed to verify the blockchain ledger.

[0128] Blockchains can use various timestamping schemes such as proof of work to serialize changes. Alternative consensus methods include proof of stake, proof of burn, and proof of research, which can also be used to serialize changes.

[0129] As described above, in some examples, miners may verify the blockchain ledger to protect the blockchain. In this case, the miners may collectively agree on a verification solution to be used. However, if a small network is used, such as a private network, the solution may be a Merkle tree, and mining of the verification solution may not be required. When a transaction block (e.g., a transaction data block 142 for the transaction data blockchain 140 or an access control rule block 152 for the access control policy blockchain 150) is created, the block is an unconfirmed and unidentified entity. In order to be part of a recognized "currency", it can be added to the blockchain and is therefore related to the concept of a trusted cluster.

[0130] In a trusted cluster, when a data block 142 or 152 is added, each node competes to confirm the next "transaction" (e.g., a new block of transaction data or access control rules). In one example, nodes compete to mine and obtain the lowest hash value: min{previous_hash, contents_hash, random_nonce_to_be_guessed}->result. The transaction order is protected by a computational race (trusting that no single entity can beat the collective resources of the blockchain network). Mutual authentication parameters are broadcast and confirmed to prevent double entry in the blockchain.

[0131] Alternatively, by broadcasting metadata used to authenticate a secure ledger over a restricted network, for example, broadcasting only a signed hash, blockchain can reduce the risks associated with centrally stored data. Decentralized consensus makes blockchain suitable for recording secure transactions or events. Metadata containing information about data files can also be encrypted to restrict access so that the metadata does not disclose information about the data files.

[0132] The mining process can be used (such as Figure 4C The confirmation process 480 is used in conjunction with the consensus to prevent double-entry, overwrite or replay attacks, using a common arrangement based on "integrity", that is, no single node can control the entire cluster. A working assumption of mining is that there is an equal distribution of power among honest parties, and these honest parties have power over dishonest or compromised parties. Each node or miner in a decentralized system has a copy of the blockchain. There is no centralized "official" copy, and no user is more "trusted" than any other user. At 482, the transaction is broadcast to the network using software. At 484, mining nodes compete to calculate verification solutions to verify the transaction, and then broadcast the completed block verification to other nodes at 486. At 488, each node adds blocks to its copy of the blockchain in the transaction order established by the winning node.

[0133] Note that in a restricted network, stakeholders who are authorized to inspect or mine data files may or may not access the transaction blocks themselves, but need keys with metadata (because they are members of the restricted network and are trusted) to obtain detailed information. Since keys are applied to data with different data classifications, stakeholders can be divided.

[0134] Decentralized blockchains can also use ad-hoc secure messaging and distributed networking. In this example, the access control policy blockchain ledger is distinguished from a conventional blockchain by the presence of a centralized intelligence exchange, such as an authorized central control for verification. In the absence of a mining process, a trusted cluster can be included in a centralized blockchain instead of a public or democratic blockchain. One view of this is that the decentralized part is called "N honest parties in democracy" (multiple honest parties are a cryptographic concept), and the centralized part is called "trusted monarchy for blockchain information correction." For example, it may be advantageous to maintain data files as centralized authorizations and keep them offline.

[0135] In some examples, access to resources on the blockchain and access control rules can be restricted to authorized servers through cryptographic means. Since the transaction data or access control policy blockchain ledger is distributed, authorized servers can verify it. The public key can be used as an address on the public blockchain ledger.

[0136] Note that the growth of a decentralized blockchain can come with the risk of node centralization as the computer resources required to run on larger data become increasingly expensive.

[0137] The present technology may involve operations occurring in one or more machines. As used herein, a "machine" means physical data storage and processing hardware programmed with instructions to perform specialized computing operations. It should be understood that two or more different machines may share hardware components. For example, the same integrated circuit may be part of two or more different machines.

[0138] Those skilled in the art will recognize that a variety of methods can be utilized and combined with the present method involving access control policy blockchain ledgers. The specific examples of different aspects of the access control policy blockchain ledger described herein are illustrative and are not intended to limit the scope of the technology shown.

[0139] Smart Contracts

[0140] Smart contracts are defined by code. As previously described, the terms and conditions of a smart contract can be encoded (e.g., by hashing) into a blockchain ledger. Specifically, a smart contract can be compiled into bytecode (if executed in a virtual machine), which can then be stored in a blockchain ledger as previously described. Similarly, transaction data executed and generated by a smart contract can be stored in a blockchain ledger in the manner described above.

[0141] Computer architecture for using smart contracts and blockchain ledgers

[0142] Please note, Figure 4A-4C at least some portions of processes 400, 410, and 480, Figure 2B The script of transaction data block 242, Figure 5 Smart Contract 522, Figure 6B The smart contract 642 and other processes and operations related to the transaction data and access control policy blockchain ledger described herein can be performed on one or more servers (e.g. Figure 8 The computer environment 800 or cloud in the , and data defining the results of the user control input signal translated or interpreted as described herein can be communicated to the user device for display. Alternatively, the access control policy blockchain ledger process can be implemented in the client device. In other examples, some operations can be implemented centrally in one computing resource (such as a server), while other steps can be implemented in other computing resources (e.g., client devices).

[0143] It should be understood that the method described herein can be terminated at any time and does not need to be implemented in its entirety. As described below, some or all of the operations and / or substantially equivalent operations of the method described herein can be performed by executing computer-readable instructions included on a computer storage medium. The term "computer-readable instructions" and variations thereof used in the specification and claims are widely used herein to include routines, applications, application modules, program modules, programs, components, data structures, algorithms, etc. Computer-readable instructions can be implemented on various system configurations, including single-processor or multi-processor systems, minicomputers, mainframe computers, personal computers, handheld computing devices, microprocessor-based programmable consumer electronics, combinations thereof, etc.

[0144] Thus, it should be understood that the logical operations described herein are implemented as: (1) a sequence of computer-implemented actions or program modules running on a computing system and / or (2) interconnected machine logic circuits or circuit modules within the computing system. The implementation is a matter of choice depending on the performance and other requirements of the computing system. Thus, the logical operations described herein are variously referred to as states, operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules may be implemented in software, firmware, dedicated digital logic, and any combination thereof.

[0145] As described herein, in conjunction with the figures described herein, routines (e.g., Figure 4A-4C The processes 400, 410 and 480, Figure 2B The script of transaction data block 242, Figure 5 Smart contract 522, Figure 6B The operation of the smart contract 642) is described herein as being implemented at least in part by applications, components, and / or circuits. Although the following description refers to Figure 1 , Figure 2B , Figure 4A-4C , Figure 5 B, it will be appreciated that the operations of the routines may also be implemented in many other ways. For example, the routines may be implemented at least in part by a computer processor or one or more processors of another computer. In addition, one or more operations of the routines may alternatively or additionally be implemented at least in part by a computer working alone or in combination with other software modules.

[0146] For example, the operation of a routine is described herein as being implemented at least in part by an application, component, and / or circuit, which are collectively referred to herein as a module. In some configurations, a module can be a dynamic link library (DLL), a static link library, a function generated by an application programming interface (API), a compiled program, an interpreter, a script, or any other executable instruction set. Data and / or modules (such as the data and modules disclosed herein) can be stored in a data structure in one or more memory components. Data can be retrieved from a data structure by addressing a link or reference to the data structure.

[0147] Although the following description refers to components of the drawings discussed above, it is understood that routines (e.g., Figure 4A-4C The processes 400, 410 and 480, Figure 2B The script of transaction data block 242, Figure 5 Smart Contract 522, Figure 6BThe operation of the smart contract 642) can also be implemented in many other ways. For example, the routine can be implemented at least in part by a processor of another remote computer or a local computer or circuit. In addition, one or more operations of the routine can alternatively or additionally be implemented at least in part by a chipset working alone or in combination with other software modules. Any service, circuit or application suitable for providing the technology disclosed herein can be used in the operations described herein.

[0148] Figure 7 Additional details of an example computer architecture 700 for a computer, such as devices 110 and 120A-120C ( Figure 1 ), capable of executing the program components described herein. Figure 7 The computer architecture 700 shown shows an architecture for a server computer, a mobile phone, a PDA, a smart phone, a desktop computer, a netbook computer, a tablet computer, an onboard computer, a gaming machine, and / or a portable computer. The computer architecture 700 can be utilized to perform any aspect of the software components presented herein.

[0149] Figure 7 The illustrated computer architecture 700 includes a central processing unit 702 ("CPU"), a system memory 704 including a random access memory 706 ("RAM") and a read-only memory ("ROM") 708, and a system bus 710 coupling the memory 704 to the CPU 702. A basic input / output system containing basic routines that facilitate the transfer of information between sub-elements within the computer architecture 700 (e.g., during startup) is stored in the ROM 708. The computer architecture 700 also includes a mass storage device 712 for storing an operating system 707, data (such as a copy of the transaction data blockchain data 720 or the access control policy blockchain data 722), and one or more applications.

[0150] The mass storage device 712 is connected to the CPU 702 through a mass storage controller (not shown) connected to the bus 710. The mass storage device 712 and its associated computer-readable media provide non-volatile storage for the computer architecture 700. Although the description of computer-readable media included herein refers to mass storage devices, such as solid-state drives, hard disks, or CD-ROM drives, those skilled in the art will appreciate that computer-readable media can be any available computer storage media or communication media that can be accessed by the computer architecture 700.

[0151] Communication media includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and includes any delivery media. The term "modulated data signal" refers to a signal that has one or more of its characteristics changed or set in a manner so as to encode information in the signal. By way of example and not limitation, communication media include wired media such as a wired network or a direct wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media.

[0152] By way of example and not limitation, computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. For example, computer media include, but are not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technology, CD-ROM, Digital Versatile Disc ("DVD"), HD-DVD, Blu-ray or other optical storage devices, cassettes, magnetic tape, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by the computer architecture 700. For the purposes of the claims, the phrases "computer storage medium", "computer readable storage medium" and variations thereof do not by themselves include waves, signals and / or other transient and / or intangible communication media.

[0153] According to various configurations, the computer architecture 700 can operate in a networked environment using logical connections to remote computers through the network 756 and / or another network (not shown). The computer architecture 700 can be connected to the network 756 via a network interface unit 714 connected to the bus 710. It should be understood that the network interface unit 714 can also be used to connect to other types of networks and remote computer systems. The computer architecture 700 can also include an input / output controller 716 for receiving and processing input from many other devices, including a keyboard, mouse, game controller, television remote control, or electronic pen ( Figure 7 Similarly, the input / output controller 716 can send data to a display screen, a printer, or other type of output device ( Figure 7 (not shown) provides an output.

[0154] It should be understood that when the software components described herein are loaded into the CPU 702 and executed, the CPU 702 and the entire computer architecture 700 can be transformed from a general-purpose computing system to a special-purpose computing system customized to facilitate the functions proposed herein. The CPU 702 can be composed of any number of transistors or other discrete circuit elements, which can present any number of states individually or collectively. More specifically, in response to the executable instructions contained in the software modules disclosed herein, the CPU 702 can operate as a finite state machine. These computer executable instructions can transform the CPU 702 by specifying how the CPU 702 transitions between states, thereby transforming the transistors or other discrete hardware elements that constitute the CPU 702.

[0155] Encoding the software modules proposed herein may also transform the physical structure of the computer-readable medium proposed herein. In different embodiments of the present specification, the specific transformation of the physical structure may depend on various factors. Examples of these factors may include, but are not limited to, technologies for implementing computer-readable media, whether the computer-readable media is characterized by primary memory or secondary memory, etc. For example, if the computer-readable medium is implemented as a semiconductor-based memory, the software disclosed herein may be encoded on the computer-readable medium by transforming the physical state of the semiconductor memory. For example, the software may transform the state of transistors, capacitors, or other discrete circuit elements that constitute the semiconductor memory. The software may also transform the physical state of these components in order to store data thereon.

[0156] As another example, magnetic or optical technology can be used to implement the computer readable medium disclosed herein. In such an embodiment, when the software is encoded in a magnetic or optical medium, the software proposed herein can transform the physical state of the magnetic or optical medium. These transformations can include changing the magnetic characteristics of a specific location in a given magnetic medium. These transformations can also include changing the physical characteristics or characteristics of a specific location in a given optical medium to change the optical characteristics of those locations. Without departing from the scope and spirit of this specification, other transformations of physical media are possible, and the aforementioned examples are provided only to facilitate this discussion.

[0157] In view of the above description, it should be understood that many types of physical transformations occur in the computer architecture 700 in order to store and execute the software components presented herein. It should also be understood that the computer architecture 700 may include other types of computing devices, including handheld computers, embedded computer systems, personal digital assistants, and other types of computing devices known to those skilled in the art. It is also contemplated that the computer architecture 700 may not include Figure 7 All components shown may include Figure 7Other components not explicitly shown in the figure or may be used in conjunction with Figure 7 The architecture shown is a completely different architecture.

[0158] Figure 8 An illustrative distributed computing environment 800 is depicted that is capable of executing the software components described herein for system-level function-based access control to a blockchain ledger. Figure 8 The distributed computing environment 800 shown can be used to perform many aspects of the software components proposed herein. For example, the distributed computing environment 800 can be used to perform one or more aspects of the software components described herein. In addition, the distributed computing environment 800 can represent the components of the distributed blockchain platform discussed above.

[0159] According to various embodiments, the distributed computing environment 800 includes a computing environment 802 running on, communicating with, or being part of a network 804. The network 804 may be or may include the network 856 described above. The network 804 may also include various access networks. One or more client devices 806A-806N (hereinafter collectively and / or generally referred to as "clients 806") may communicate with each other via the network 804 and / or other connections ( Figure 8 802). In one illustrated configuration, the client 806 includes a computing device 806A such as a laptop, desktop computer, or other computing device; a tablet or tablet computing device ("tablet computing device") 806B; a mobile computing device 806C such as a mobile phone, smart phone, car computer, or other mobile computing device; a server computer 806D; and / or other devices 806N, which may include a hardware security module. It should be understood that any number of devices 806 may be in communication with the computing environment 802. Reference herein to Figure 7 and Figure 8 Two example computing architectures are shown and described for device 806. It should be understood that the illustrated device 806 and the computing architectures illustrated and described herein are exemplary only and should not be construed as limiting in any way.

[0160] In the configuration shown, the computing environment 802 includes an application server 808, a data storage device 810, and one or more network interfaces 812. According to various embodiments, the functionality of the application server 808 can be provided by one or more server computers that execute as part of the network 804 or communicate with the network 804. The application server 808 can host various services, virtual machines, portals, and / or other resources. In the configuration shown, the application server 808 hosts one or more virtual machines 814 for hosting applications or other functions. According to various embodiments, the virtual machine 814 hosts one or more applications and / or software modules for data management blockchain ledgers. It should be understood that this configuration is illustrative only and should not be construed as limiting in any way.

[0161] The application server 808 may also host a system-level function-based access control functionality module 816, such as a Figure 3A The FBAC module 816 can apply access control policies to smart contracts executed in the virtual machine 814.

[0162] According to various embodiments, the application server 808 also includes one or more transaction data management services 820 and one or more blockchain services 822. The transaction data management service 820 may include a service for managing a transaction data blockchain (e.g. Figure 1 The access control policy management service 823 may include services for managing access control policy blockchains (e.g. Figure 1 The blockchain services 822 may include services for implementing access control rules on the access control policy blockchain 150 in the example embodiment, or otherwise maintaining access control policies applied by the FBAC module 816. The blockchain services 822 may include services for participating in the management of one or more blockchains, such as by creating genesis blocks, transaction data or access control rules blocks, and performing validation.

[0163] like Figure 8 As shown, application server 808 may also host other services, applications, portals, and / or other resources ("other resources") 824. Other resources 824 may include, but are not limited to, data encryption, data sharing, or any other functionality.

[0164] As described above, the computing environment 802 may include a data store 810. According to various embodiments, the functionality of the data store 810 is provided by one or more databases or data stores running on or in communication with the network 804. The functionality of the data store 810 may also be provided by one or more server computers configured to host data for the computing environment 802. The data store 810 may include, host, or provide one or more real or virtual data stores 826A-826N (hereinafter collectively and / or generally referred to as "data stores 826"). The data store 826 is configured to host data and / or other data used or created by the application server 808. Various aspects of the data store 826 may be associated with services for access control policy blockchains. Although in Figure 8 Not shown, but the data store 826 may also host or store web documents, word documents, presentation documents, data structures, algorithms executed by the recommendation engine, and / or other data utilized by any application or another module.

[0165] The computing environment 802 may communicate with or be accessed by a network interface 812. The network interface 812 may include various types of network hardware and software for supporting communications between two or more computing devices, including, but not limited to, the client 806 and the application server 808. It should be appreciated that the network interface 812 may also be used to connect to other types of networks and / or computer systems.

[0166] It should be understood that the distributed computing environment 800 described herein can provide any number of virtual computing resources and / or other distributed functions for any aspect of the software elements described herein, which can be configured to perform any aspect of the software components disclosed herein. According to various embodiments of the concepts and technologies disclosed herein, the distributed computing environment 800 can use device 806 to provide the software functions described herein as a service to the client. It should be understood that the device 806 may include a real machine or a virtual machine, including but not limited to a server computer, a network server, a personal computer, a mobile computing device, a smart phone, and / or other devices that may include a user input device. Therefore, various configurations of the concepts and technologies disclosed herein enable any device configured to access the distributed computing environment 800 to utilize the functions described herein to create and support access control policy blockchain ledgers, etc.

[0167] Now go to Fig. 9, an exemplary computing device architecture 900 for a computing device capable of executing various software components for supporting a blockchain ledger and applying access control policies to the blockchain ledger is described herein. The computing device architecture 900 is applicable to computing devices that can manage blockchain ledgers. In some configurations, the computing devices include, but are not limited to, mobile phones, vehicle computers, tablet devices, slate devices, portable video game devices, traditional desktop computers, portable computers (e.g., laptops, notebooks, ultraportable computers, and netbooks), server computers, game consoles, and other computer systems. The computing device architecture 900 is applicable to Figure 1 The certificate authority 110, client / servers 120A-120C and blockchain platform 130 are shown. Figure 8 Computing devices 806A-806N are shown.

[0168] Fig. 9 The computing device architecture 900 shown includes a processor 902, a memory component 904, a network connection component 906, a sensor component 908, an input / output component 910, and a power supply component 912. In the configuration shown, the processor 902 communicates with the memory component 904, the network connection component 906, the sensor component 908, the input / output ("I / O") component 910, and the power supply component 912. Fig. 9 The connections between the various components shown are not shown, but these components can interact to perform device functions. In some configurations, the components are arranged to communicate via one or more buses (not shown).

[0169] The processor 902 includes a central processing unit ("CPU") configured to process data, execute computer-executable instructions of one or more application programs, and communicate with other components of the computing device architecture 900 in order to perform the various functions described herein. The processor 902 can be used to execute various aspects of the software components presented herein, particularly those aspects that utilize, at least in part, secure data.

[0170] In some configurations, the processor 902 includes a graphics processing unit (“GPU”) configured to accelerate operations performed by the CPU, including, but not limited to, operations performed by executing secure computing applications, general scientific and / or engineering computing applications, and graphics-intensive computing applications such as high-resolution video (e.g., 620P, 1080P and higher resolutions), video games, three-dimensional (“3D”) modeling applications, etc. In some configurations, the processor 902 is configured to communicate with a discrete GPU (not shown). In any case, the CPU and GPU can be configured according to a co-processing CPU / GPU computing model, where sequential portions of an application are executed on the CPU and computationally intensive portions are accelerated by the GPU.

[0171] In some configurations, the processor 902 is a system on a chip ("SoC") or is included in a system on a chip together with one or more other components described herein below. For example, the SoC may include the processor 902, a GPU, one or more of the network connection components 906, and one or more of the sensor components 908. In some configurations, the processor 902 is manufactured in part using package-on-package ("PoP") integrated circuit packaging technology. The processor 902 may be a single-core or multi-core processor.

[0172] The processor 902 may be created in accordance with the ARM architecture licensed from ARM Holdings of Cambridge, England. Alternatively, the processor 902 may be created in accordance with an x86 architecture such as available from Intel Corporation of Mountain View, California. In some configurations, the processor 902 is a SNAPDRAGON SoC available from Qualcomm Incorporated of San Diego, California, a TEGRA SoC available from NVIDIA Corporation of Santa Clara, California, a HUMMINGBIRD SoC available from Samsung of Seoul, South Korea, an Open Multimedia Application Platform (“OMAP”) SoC available from Texas Instruments of Dallas, Texas, a customized version of any of the above SoCs, or a proprietary SoC.

[0173] The memory component 904 includes random access memory (“RAM”) 914, read-only memory (“ROM”) 916, integrated storage storage (“integrated storage”) 918, and removable storage storage (“removable storage”) 920. In some configurations, the RAM 914 or a portion thereof, the ROM 916 or a portion thereof, and / or some combination of the RAM 914 and ROM 916 are integrated into the processor 902. In some configurations, the ROM 916 is configured to store firmware, an operating system or a portion thereof (e.g., an operating system kernel), and / or a boot loader to load the operating system kernel from the integrated storage 918 and / or the removable storage 920.

[0174] The integrated storage device 918 may include a solid-state memory, a hard disk, or a combination of a solid-state memory and a hard disk. The integrated storage device 918 may be soldered or otherwise connected to a logic board to which the processor 902 and other components described herein may also be connected. In this way, the integrated storage device 918 is integrated into the computing device. The integrated storage device 918 is configured to store an operating system or portions thereof, application programs, data, and other software components described herein.

[0175] The removable storage device 920 may include a solid-state memory, a hard disk, or a combination of a solid-state memory and a hard disk. In some configurations, a removable storage device 920 is provided to replace the integrated storage device 918. In other configurations, a removable storage device 920 is provided as an additional optional memory. In some configurations, the removable storage device 920 is logically combined with the integrated storage device 918 so that the total available storage is available as the total combined storage capacity. In some configurations, the total combined capacity of the integrated storage device 918 and the removable storage device 920 is shown to the user, rather than the separate storage capacities for the integrated storage device 918 and the removable storage device 920.

[0176] Removable storage 920 is configured to be inserted into a removable storage memory slot (not shown) or other mechanism by which removable storage 920 is inserted and secured to facilitate connection by which removable storage 920 can communicate with other components of the computing device, such as processor 902. Removable storage 920 can be embodied in various memory card formats, including but not limited to PC card, CompactFlash card, memory stick, secure digital ("SD"), miniSD, microSD, universal integrated circuit card ("UICC") (e.g., user identity module ("SIM") or universal SIM ("USIM")), proprietary formats, etc.

[0177] It is understood that one or more memory components 904 can store an operating system. According to various configurations, the operating system can include, but is not limited to, a server operating system, such as various forms of UNIX certified by The Open Group and LINUX certified by the Free Software Foundation, or various aspects of a Software-as-a-Service (SaaS) architecture, such as MICROSFTAZURE from Microsoft Corporation of Redmond, Washington, or AWS from Amazon.com, Inc. of Seattle, Washington. The operating system can also include WINDOWS MOBILE OS from Microsoft Corporation of Redmond, Washington, WINDOWS PHONE OS from Microsoft Corporation, WINDOWS from Microsoft Corporation, MAC OS or IOS from Apple Inc. of Cupertino, California, and ANDROIDOS from Google Inc. of Mountain View, California. Other operating systems can be expected.

[0178] The network connectivity component 906 includes a wireless wide area network component ("WWAN component") 922, a wireless local area network component ("WLAN component") 924, and a wireless personal area network component ("WPAN component") 926. The network connectivity component 906 facilitates communication to and from a network 956 or another network, which may be a WWAN, a WLAN, or a WPAN. Although only network 956 is shown, the network connectivity component 906 may facilitate communication with other networks including Fig. 9 The network connectivity component 906 can facilitate simultaneous communication with multiple networks via one or more of a WWAN, a WLAN, or a WPAN.

[0179] The network 956 may be or may include a WWAN, such as a mobile telecommunication network that provides voice and / or data services to computing devices using the computing device architecture 900 via the WWAN component 922 using one or more mobile telecommunication technologies. The mobile telecommunication technologies may include, but are not limited to, Global System for Mobile Communications (“GSM”), Code Division Multiple Access (“CDMA”) ONE, CDMA7000, Universal Mobile Telecommunications System (“UMTS”), Long Term Evolution (“LTE”), and Worldwide Interoperability for Microwave Access (“WiMAX”). In addition, the network 956 may utilize various channel access methods (which may or may not be used by the above standards), including, but not limited to, Time Division Multiple Access (“TDMA”), Frequency Division Multiple Access (“FDMA”), CDMA, Wideband CDMA (“W-CDMA”), Orthogonal Frequency Division Multiplexing (“OFDM”), Space Division Multiple Access (“SDMA”), etc. General Packet Radio Service ("GPRS"), Enhanced Data Rates for Global Evolution ("EDGE"), High Speed ​​Packet Access ("HSPA") family of protocols including High Speed ​​Downlink Packet Access ("HSDPA"), Enhanced Uplink ("EUL") or otherwise known as High Speed ​​Uplink Packet Access ("HSUPA"), Evolved HSPA ("HSPA+"), LTE, and various other current and future wireless data access standards may be used. Network 956 may be configured to provide voice and / or data communications using any combination of the above technologies. Network 956 may be configured or adapted to provide voice and / or data communications in accordance with future generation technologies.

[0180] In some configurations, the WWAN component 922 is configured to provide dual multi-mode connectivity to the network 956. For example, the WWAN component 922 may be configured to provide connectivity to a network 956 that provides services via a combination of GSM and UMTS technologies or via some other technologies. Alternatively, multiple WWAN components 922 may be utilized to perform such functions, and / or to provide additional functionality to support other incompatible technologies (i.e., that cannot be supported by a single WWAN component). The WWAN component 922 may facilitate similar connectivity to multiple networks (e.g., a UMTS network and an LTE network).

[0181] The network 956 can be a WLAN (collectively referred to herein as WI-FI) running according to one or more Institute of Electrical and Electronics Engineers 802.11 standards (e.g., IEEE 802.11a, 802.11b, 802.11g, 802.11n, and / or future 802.11 standards). Draft 802.11 standards can also be considered. In some configurations, the WLAN is implemented using one or more wireless WI-FI access points. In some configurations, one or more wireless WI-FI access points are another computing device with a connection to a WWAN that acts as a WI-FI hotspot. The WLAN component 924 is configured to connect to the network 956 via a WI-FI access point. This connection can be protected via various encryption technologies, including but not limited to WI-FI Protected Access ("WPA"), WPA2, Wired Equivalent Privacy ("WEP"), and the like.

[0182] The network 956 may be a WPAN operating in accordance with the Infrared Data Association ("IrDA"), Bluetooth, wireless Universal Serial Bus ("USB"), Z-Wave, ZIGBEE, or some other short-range wireless technology. In some configurations, the WPAN component 926 is configured to facilitate communication with other devices (e.g., peripheral devices, computers, or other computing devices) via the WPAN.

[0183] Sensor assembly 908 includes a magnetometer 928, an ambient light sensor 930, a proximity sensor 932, an accelerometer 934, a gyroscope 936, and a global positioning system sensor (“GPS sensor”) 938. It is contemplated that other sensors such as, but not limited to, temperature sensors or shock detection sensors may also be incorporated into computing device architecture 900.

[0184] The I / O component 910 includes a display 940, a touch screen 942, a data I / O interface component ("data I / O") 944, an audio I / O interface component ("audio I / O") 946, a video I / O interface component ("video I / O") 948, and a camera 950. In some configurations, the display 940 and the touch screen 942 are combined. In some configurations, two or more of the data I / O component 944, the audio I / O component 946, and the video I / O component 948 are combined. The I / O component 910 may include a discrete processor configured to support the various interfaces described below, or may include processing functionality built into the processor 902.

[0185] The power supply component 912 shown includes one or more batteries 952 that can be connected to a power meter 954. The batteries 952 can be rechargeable or disposable. Rechargeable battery types include, but are not limited to, lithium polymer, lithium ion, nickel cadmium, and nickel metal hydride. Each battery 952 can be made of one or more battery cells.

[0186] The power supply assembly 912 may also include a power connector, which may be combined with one or more of the above-described I / O assemblies 910. The power supply assembly 912 may interface with an external power system or charging device through the I / O assembly.

[0187] Examples of various implementations

[0188] Finally, although various configurations have been described using language specific to structural features and / or methodological acts, it should be understood that the subject matter defined in the accompanying representations is not necessarily limited to the specific features or acts described. Rather, these specific features and acts are disclosed as example forms of implementing the claimed subject matter.

[0189] This disclosure is made under the following terms:

[0190] Clause 1. A computer-implemented method for system-level function-based access control for smart contract execution on a blockchain, the method comprising, in a kernel execution framework for smart contract execution on a blockchain, performing the following steps, wherein the kernel execution framework is configured to perform function boundary detection: detecting function calls made by one or more methods of a smart contract on the blockchain; adding the function calls to a function call stack of the smart contract; checking the function call stack against a function-based access control rule set, the function-based access control rule set defining one or more allowed or prohibited function call sequences; and if the function call stack includes one or more function calls that are not allowed under the function-based access control rule set, preventing execution or completion of the function call.

[0191] Clause 2. A computer-implemented method according to clause 1, wherein: a function call stack includes each function called during the execution of the smart contract; the function-based access control rule set includes at least one access control rule that defines a function call sequence; and the step of checking the function call stack against the function-based access control rule set includes: checking the function call stack against the function call sequence defined in the access control rule that defines the function call sequence.

[0192] Clause 3. A computer-implemented method according to Clause 1, wherein: the step of defining a function-based access control rule set includes at least one data-based access control rule; the step of detecting function calls made through one or more methods of a smart contract on a blockchain includes: detecting at least one value included in a function call stack; the step of checking the function call stack against the function-based access control rule set includes: checking at least one value included in the function call stack against the data-based access control rule; and the step of blocking the function call if the function call sequence is not allowed under the function-based access control rule set includes: blocking the function call if at least one value included in the function call sequence is not allowed under the data-based access control rule set.

[0193] Clause 4. A computer-implemented method according to clause 1, wherein: the function-based access control rule set is stored on a blockchain; and the method includes modifying the function-based access control rule set by adding a function-based access control rule block to the blockchain.

[0194] Clause 5. The computer-implemented method of Clause 1, wherein the kernel execution framework comprises a Linux operating system framework and the function boundary detection comprises extended Berkeley packet filtering.

[0195] Clause 6. A computer-implemented method according to clause 1, wherein the following steps are performed within one or more virtual machines executing a framework for smart contract execution on a blockchain: detecting function calls made by one or more methods of a smart contract on a blockchain, adding the function calls to a function call stack of the smart contract, checking the function call stack against a function-based access control rule set, and blocking the function call if the function call is not allowed under the function-based access control rule set.

[0196] Clause 7. A computer-implemented method as described in clause 1, wherein the function-based access control rule set includes at least one of the following: a whitelist of allowed function call sequences and a blacklist of prohibited function call sequences.

[0197] Clause 8. A system for system-level function-based access control for smart contract execution on a blockchain, the system comprising: one or more processors; and one or more storage devices in communication with the one or more processors, the storage devices having computer-readable instructions stored thereon, which, when executed by the processors, cause the processors to perform a method for system-level function-based access control for smart contract execution on a blockchain, the method comprising performing the following steps in a kernel execution framework for smart contract execution on a blockchain, wherein the kernel execution framework is configured to perform function boundary detection: detecting function calls made through one or more methods of a smart contract on the blockchain; adding the function calls to a function call stack of the smart contract; checking the function call stack against a function-based access control rule set, the function-based access control rule set defining one or more allowed or prohibited function call sequences; and if the function call stack includes one or more function calls that are not allowed under the function-based access control rule set, preventing the execution or completion of the function call.

[0198] Clause 9. A system according to Clause 8, wherein: a function call stack includes each function called during the execution of a smart contract; a function-based access control rule set includes at least one access control rule that defines a function call sequence; and the step of checking the function call stack against the function-based access control rule set includes: checking the function call stack against the function call sequence defined in the access control rule that defines the function call sequence.

[0199] Clause 10. A system according to Clause 8, wherein: the step of defining a function-based access control rule set includes at least one data-based access control rule; the step of detecting function calls between one or more methods of a smart contract on a blockchain includes: detecting at least one value included in a function call stack; the step of checking the function call stack against the function-based access control rule set includes: checking at least one value included in the function call stack against the data-based access control rule; and the step of blocking the function call if the function call sequence is not allowed under the function-based access control rule set includes: blocking the function call if at least one value included in the function call sequence is not allowed under the data-based access control rule set.

[0200] Clause 11. A system according to clause 8, wherein: the function-based access control rule set is stored on a blockchain; and the method includes modifying the function-based access control rule set by adding a function-based access control rule block to the blockchain.

[0201] Clause 12. The system of clause 8, wherein the kernel execution framework comprises a Linux operating system framework and the function boundary detection comprises extended Berkeley packet filtering.

[0202] Clause 13. The system of clause 8, wherein the steps are performed within one or more virtual machines executing a framework for smart contract execution on a blockchain: detecting function calls made through one or more methods of a smart contract on a blockchain, adding the function calls to a function call stack of the smart contract, checking the function call stack against a function-based access control rule set, and blocking the function call if the function call is not allowed under the function-based access control rule set.

[0203] Clause 14. The system of clause 8, wherein the function-based access control rule set comprises at least one of: a whitelist of allowed function call sequences and a blacklist of prohibited function call sequences.

[0204] Clause 15. One or more computer storage media having computer executable instructions stored thereon, which, when executed by one or more processors, cause the processor to perform a method for system-level function-based access control for smart contract execution on a blockchain, the method comprising performing the following steps in a kernel execution framework for smart contract execution on a blockchain, wherein the kernel execution framework is configured to perform function boundary detection: detecting function calls made by one or more methods of a smart contract on the blockchain; adding the function calls to a function call stack of the smart contract; checking the function call stack against a function-based access control rule set, the function-based access control rule set defining one or more allowed or prohibited function call sequences; and if the function call stack includes one or more function calls that are not allowed under the function-based access control rule set, preventing execution or completion of the function call.

[0205] The computer storage medium of clause 16 and clause 15, wherein: the function call stack includes each function called during the execution of the smart contract; the function-based access control rule set includes at least one access control rule that defines a function call sequence; and the step of checking the function call stack against the function-based access control rule set includes: checking the function call stack against the function call sequence defined in the access control rule that defines the function call sequence.

[0206] Clause 17. A computer storage medium according to clause 15, wherein: the step of defining a function-based access control rule set includes at least one data-based access control rule; the step of detecting function calls made through one or more methods of a smart contract on a blockchain includes: detecting at least one value included in a function call stack; the step of checking the function call stack against the function-based access control rule set includes: checking at least one value included in the function call stack against the data-based access control rule; and the step of blocking the function call if the function call sequence is not allowed under the function-based access control rule set includes: blocking the function call if at least one value included in the function call sequence is not allowed under the data-based access control rule set.

[0207] Clause 18. A computer storage medium as described in clause 15, wherein: the function-based access control rule set is stored on a blockchain; and the method includes modifying the function-based access control rule set by adding a function-based access control rule block to the blockchain.

[0208] Clause 19. The computer storage medium of clause 15, wherein the kernel execution framework comprises a Linux operating system framework and the function boundary detection comprises extended Berkeley packet filtering.

[0209] Clause 20. A computer storage medium as described in clause 15, wherein the following steps are performed within one or more virtual machines executing a framework for smart contract execution on a blockchain: detecting a function call made by one or more methods of a smart contract on a blockchain, adding the function call to a function call stack of the smart contract, checking the function call stack against a function-based access control rule set, and blocking the function call if the function call is not allowed under the function-based access control rule set.

[0210] Although the subject matter presented herein has been described in language specific to computer structural features, methods, and conversion actions, specific computing machines, and computer-readable media, it should be understood that the subject matter set forth in the appended claims is not necessarily limited to the specific features, actions, or media described herein. Rather, the specific features, actions, and media disclosed are disclosed as example forms of implementing the claimed subject matter.

[0211] The subject matter described above is provided in the form of illustration only and should not be interpreted as limiting. Various modifications and changes may be made to the subject matter described herein without following the example configurations and applications shown and described, and without departing from the scope of the present disclosure set forth in the appended claims.

Claims

1. A computer-implemented method for system-level function-based access control for smart contract execution on a blockchain, the method comprising performing the following steps in a kernel execution framework for smart contract execution on a blockchain, wherein the kernel execution framework is configured to perform function boundary detection: defining a function-based access control rule set including at least one data-based access control rule defining prohibited function call sequences and function call values; Detecting a function call made by one or more methods of a smart contract on the blockchain, including detecting at least one value included in the function call; adding the function call to a function call stack of the smart contract, wherein the function call stack comprises a sequence of functions called during execution of the smart contract; checking the function call stack against the function call sequence and the function call value defined in the data-based access control rule; as well as If the function call stack includes the function call sequence and the function call value defined in the data-based access control rule, the execution or completion of the function call is prevented.

2. The computer-implemented method of claim 1 , wherein: The function-based access control rule set is stored on a blockchain; and The method includes modifying the function-based access control rule set by adding a function-based access control rules block to the blockchain.

3. The computer-implemented method of claim 1 , wherein: The kernel execution framework includes a Linux operating system framework, and the function boundary detection includes extended Berkeley packet filtering.

4. The computer-implemented method of claim 1 , wherein: The steps of detecting a function call made by one or more methods of a smart contract on the blockchain, adding the function call to a function call stack of the smart contract, checking the function call stack against the function call sequence and the function call value defined in the data-based access control rule, and preventing execution or completion of the function call if the function call stack includes the function call sequence and the function call value defined in the data-based access control rule are performed within one or more virtual machines executing a framework for smart contract execution on the blockchain.

5. The computer-implemented method of claim 1 , wherein: The function-based access control rule set includes at least one of the following: a white list of allowed function call sequences and a black list of prohibited function call sequences.

6. A system for system-level function-based access control for smart contract execution on a blockchain, the system comprising: one or more processors; as well as One or more storage devices in communication with the one or more processors, the storage devices having computer-readable instructions stored thereon, the computer-readable instructions, when executed by the processors, causing the processors to perform a method for system-level function-based access control for smart contract execution on a blockchain, the method comprising performing the following steps in a kernel execution framework for smart contract execution on a blockchain, wherein the kernel execution framework is configured to perform function boundary detection: defining a function-based access control rule set including at least one data-based access control rule defining prohibited function call sequences and function call values; Detecting a function call made by one or more methods of a smart contract on the blockchain, including detecting at least one value included in the function call; adding the function call to a function call stack of the smart contract, wherein the function call stack comprises a sequence of functions called during execution of the smart contract; checking the function call stack against the function call sequence and the function call value defined in the data-based access control rule; as well as If the function call stack includes the function call sequence and the function call value defined in the data-based access control rule, the execution or completion of the function call is prevented.

7. The system of claim 6, wherein: The function-based access control rule set is stored on a blockchain; and The method includes modifying the function-based access control rule set by adding a function-based access control rules block to the blockchain.

8. The system according to claim 6, wherein: The kernel execution framework includes a Linux operating system framework, and the function boundary detection includes extended Berkeley packet filtering.

9. The system according to claim 6, wherein: The steps of detecting a function call made by one or more methods of a smart contract on the blockchain, adding the function call to a function call stack of the smart contract, checking the function call stack against the function call sequence and the function call value defined in the data-based access control rule, and preventing execution or completion of the function call if the function call stack includes the function call sequence and the function call value defined in the data-based access control rule are performed within one or more virtual machines executing a framework for smart contract execution on the blockchain.

10. The system according to claim 6, wherein: The function-based access control rule set includes at least one of the following: a white list of allowed function call sequences and a black list of prohibited function call sequences.

11. One or more computer storage media having computer executable instructions stored thereon, which, when executed by one or more processors, cause the processors to perform a method for system-level function-based access control for smart contract execution on a blockchain, the method comprising performing the following steps in a kernel execution framework for smart contract execution on a blockchain, wherein the kernel execution framework is configured to perform function boundary detection: defining a function-based access control rule set including at least one data-based access control rule defining prohibited function call sequences and function call values; Detecting a function call made by one or more methods of a smart contract on the blockchain, including detecting at least one value included in the function call; adding the function call to a function call stack of the smart contract, wherein the function call stack comprises a sequence of functions called during execution of the smart contract; checking the function call stack against the function call sequence and the function call value defined in the data-based access control rule; as well as If the function call stack includes the function call sequence and the function call value defined in the data-based access control rule, the execution or completion of the function call is prevented.

12. The computer storage medium of claim 11, wherein: The function-based access control rule set is stored on a blockchain; and The method includes modifying the function-based access control rule set by adding a function-based access control rules block to the blockchain.

13. The computer storage medium of claim 11, wherein: The kernel execution framework includes a Linux operating system framework, and the function boundary detection includes extended Berkeley packet filtering.

14. The computer storage medium of claim 11, wherein: The steps of detecting a function call made by one or more methods of a smart contract on the blockchain, adding the function call to a function call stack of the smart contract, checking the function call stack against the function call sequence and the function call value defined in the data-based access control rule, and preventing execution or completion of the function call if the function call stack includes the function call sequence and the function call value defined in the data-based access control rule are performed within one or more virtual machines executing a framework for smart contract execution on the blockchain.

Images