  An authorisation has been recognised as an important security measure for
preventing unauthorised access to critical resources, such as devices and data,
within the Internet of Things (IoT) networks. Existing authorisation methods
for the IoT network are based on traditional access control models, which have
several drawbacks, including architecture centralisation, policy tampering,
access rights validation, malicious third-party policy assignment and control,
and network-related overheads. The increasing trend of integrating Blockchain
technology with IoT networks demonstrates its importance and potential to
address the shortcomings of traditional IoT network authorisation mechanisms.
This paper proposes a decentralised, secure, dynamic, and flexible
authorisation scheme for IoT networks based on attribute-based access control
(ABAC) fine-grained policies stored on a distributed immutable ledger. We
design a Blockchain-based ABAC policy management framework divided into
Attribute Management Authority (AMA) and Policy Management Authority (PMA)
frameworks that use smart contract features to initialise, store, and manage
attributes and policies on the Blockchain. To achieve flexibility and
dynamicity in the authorisation process, we capture and utilise the
environmental-related attributes in conjunction with the subject and object
attributes of the ABAC model to define the policies. Furthermore, we designed
the Blockchain-based Access Management Framework (AMF) to manage user requests
to access IoT devices while maintaining the privacy and auditability of user
requests and assigned policies. We implemented a prototype of our proposed
scheme and executed it on the local Ethereum Blockchain. Finally, we
demonstrated the applicability and flexibility of our proposed scheme for an
IoT-based smart home scenario, taking into account deployment, execution and
financial costs.
