A Blockchain-Based Hybrid ABAC–CapBAC Framework for Secure IoT Access Control

Growing Internet of Things (IoT) deployments require access control for heterogeneous and resource-constrained devices without excessive repeated-authorization overhead. This study proposes and evaluates a blockchain-based hybrid access-control framework that combines Attribute-Based Access Control (ABAC) and Capability-Based Access Control (CapBAC) using Hyperledger Fabric. ABAC evaluates initial requests using certificate-derived user attributes and the requested device and action, while successful authorization produces a digitally signed capability token for subsequent requests. Hyperledger Fabric maintains policy and token-state records, and a Smart Gateway validates signed tokens through either direct Ledger retrieval or an event-synchronized local Cache. The framework was implemented as a proof-of-concept with simulated IoT devices on a single host and evaluated for functional correctness and repeated-validation performance. Functional tests rejected unauthorized requests, tampered, revoked, and expired tokens, and device/action mismatches. In the main repeated-validation benchmark, Cache-mode throughput was 1.50–1.87 times Ledger-mode throughput. At 1000 concurrent requests, Cache validation reduced mean request latency from 2099.45 ms to 1120.88 ms, a reduction of 46.61%, and increased mean throughput from 221.59 to 358.16 requests per second, corresponding to 1.62 times the Ledger-mode throughput. Under the evaluated prototype conditions, the framework provided attribute-based initial authorization and reusable signed-token validation, while synchronized Gateway caching improved repeated-access performance.