eBPF Function-Call Stack Access Control for Smart Contracts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing blockchain security mechanisms fail to effectively protect smart contracts from security breaches, as they do not serve as security gatekeepers for the operations of the blockchain platform or smart contracts, leading to vulnerabilities that can be exploited by hackers.
Innovation Solution
Implementing system-level function-based access control (FBAC) using access control rules stored on the blockchain, which are checked against a function call stack to ensure only authorized function calls and data parameters are executed, leveraging kernel execution frameworks like Linux eBPF for detection and control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blockchain security mechanisms (Proof of Work, consensus protocols, private keys) are used, then basic blockchain security is maintained, but smart contracts remain vulnerable to security breaches and exploits
Solution Approach 1:
The patent segments security control into multiple layers: system-level FBAC rules stored on blockchain, kernel-level eBPF bytecode execution, and function-call-level access control. This segmentation allows each layer to handle specific security tasks, improving smart contract security without requiring complete architectural overhaul.
Solution Approach 2:
The patent introduces eBPF bytecode as an intermediary layer between the smart contract execution environment and the underlying blockchain platform. This intermediary enforces FBAC rules by monitoring and controlling function calls, preventing direct exploitation of smart contract vulnerabilities while maintaining platform compatibility.
2Reliability
If access control rules are implemented at the smart contract level, then security is improved, but the rules can be modified by redeploying contracts which reduces immutability
Solution Approach 1:
The patent moves access control rules from the smart contract dimension to the blockchain dimension by storing FBAC rules as separate blockchain entries. This dimensional shift allows rules to be enforced at the platform level while maintaining blockchain immutability, as rules become part of the blockchain's immutable ledger rather than contract code.
Solution Approach 2:
The patent implements preliminary action by pre-defining FBAC rules on the blockchain before smart contract execution. These pre-established rules are automatically enforced by the eBPF bytecode during function calls, preventing unauthorized access before exploits can occur rather than requiring post-exploit contract modifications.
3Object-affected harmful factors
If system-level FBAC with eBPF bytecode is implemented, then unauthorized function invocations are prevented, but execution overhead and system complexity increase
Solution Approach 1:
The patent replaces traditional mechanical access control mechanisms (permission checks, authentication layers) with eBPF bytecode-based FBAC enforcement. This substitution leverages the eBPF virtual machine's efficient bytecode execution to monitor and control function calls, reducing reliance on complex kernel-level modifications while maintaining security.
Solution Approach 2:
The patent makes the eBPF-based FBAC system universal by designing it to work across multiple blockchain platforms and smart contract languages. The FBAC rules and eBPF bytecode serve multiple functions: enforcing access control, preventing exploits, and maintaining compatibility with existing blockchain infrastructure, thereby reducing overall system complexity through consolidation.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
According to disclosed aspects, a computer-implemented method, a system and computer storage media for system level function based access control are provided. The method comprises executing a smart contract in a kernel execution framework that is configured with function boundary detection instrumentation. The method further comprises detecting, by the function boundary detection instrumentation, a function call at a system level. The method further comprises creating a function call stack for the detected function call. The method further comprises checking the function call stack against function or data based access control rules. If the access control rules indicate that the function call is allowed, the method further comprises allowing execution of the function call. If the access control rules indicate that the function call is not allowed, the method further comprises blocking execution of the function call.