Assuring Policy Integrity: A Blockchain Smart Contract Approach to Zero Trust Authorization

Controlling users’ access to protected resources is essential for providing timely and accurate access to authorized users for performing businesses and services. It is equally necessary to prevent unauthorized or malicious users from accessing resources to avoid unwanted security incidents. Different access control models provide this using well-defined, reviewed, developed, and verified policy sets, attributes, contextual information, and others. It is crucial to maintain the security of these components to protect resources. Considering the improper policy modifications, they could lead to unauthorized access to objects. Detecting and preventing improper policy modifications is important to providing security for protected resources. Towards this direction and considering other secured components, this paper proposes a blockchain smart contract-based Zero-Trust authorization policy integrity assurance mechanism. Policy class integrity is stored on the blockchain. The authorization module calculates policy class integrity from the local policy repository for every access request and checks it against the blockchain. If policy integrity is not matched, it indicates policy tampering. The authorization module rejects the access request and processes it further to make decisions. Otherwise, it considers other components to make decisions. Blockchain provides decentralized and immutable properties, and smart contracts have auto-triggering and unalterable functionalities. All these properties ensure that stored policy integrity is not tampered with and checking is done without compromise. Experimental evaluations show that the proposed approach is feasible and applicable for real-world applications to protect valuable resources and provide emerging services without compromising security properties. The average policy class integrity writing cost for the deployed smart contract is 0.00025 ETH. The average reading time is 0.15845 seconds to verify the integrity on the blockchain network.