Blockchain hybrid-model scheme for scalable cross-domain authorisation

We introduce a novel blockchain-based interledger authorisation scheme, a unique solution designed to support delegated authorisation management in cross-domain cloud environments. This innovative approach enables client applications, acting on behalf of a user, to request access to specific resources owned by a different organization. It benefits cross-domain multi-cloud applications, such as large-scale collaboration projects involving multiple cloud service providers. Multi-cloud presents authorisation challenges because of complex access control operations in multiple distinct domains. OAuth2 is the state-of-the-art choice for delegated authorisation. However, it falls short in handling such complex interactions with multiple authorisation servers and resource servers, and this is our motivation. Compared with OAuth2, our approach overcomes the limitations of a centralized model and achieves coordinated distinct delegations among multiple entities without a third-party trusted component. authorisation servers are blockchain participants and designated access token issuers, ensuring minimum client data collection and promoting client privacy. Multiple smart contracts are deployed in our multi-ledger blockchain environment to guarantee the provenance of the authorisation operations and facilitate scalable cross-domain authorisation. Our “hybrid interledger model” combines security techniques such as blockchain-based device authentication, hashed time-lock contracts (HTLCs), and service discovery. The blockchain-based device authentication ensures secure and trusted interactions, HTLCs enable time-bound transactions, and service discovery simplifies finding and connecting to the required cloud services. Our experimental evaluation provides insights into the scalability of our approach, which achieves decentralized authorisation in a multi-cloud environment with acceptable latencies compared with related works and shows stable throughput against concurrent authorisation requests in a multi-ledger system.