How you can use ABAC and private data to store confidential information
There are two contexts for talking about confidentiality on the blockchain. When it comes to public and permissionless blockchains, there are projects like Monero and Zcash where privacy is the outcome of anonymous transactions. Transactions in Ethereum, the biggest smart contract blockchain, can be traced and transaction payload is readable.
The openness of Ethereum is excellent from the ideological standpoint, attracts many developers and allows for implementing mechanisms (ICOs, escrows, all sorts of gambling games, collectibles, etc.) in a transparent manner that wasn’t possible before. The flip side is that Ethereum doesn’t work for many businesses that require a high level of confidentiality or have to comply with data privacy regulations.
Private and permission blockchains like Hyperledger Fabric try to address these business requirements allowing the organization to manage who can participate in the network and what data they can access.
Hyperledger Fabric
Hyperledger Fabric is a modular framework for building hierarchical and permission blockchain networks capable of running the chaincode. The chaincode in Hyperledger Fabric is an installed and initialized program that runs on the blockchain, an equivalent of a smart contract in Ethereum.
Applications running on Hyperledger Fabric are upgradeable and since version 1.2 they can also save and read from the private data storage. The other feature that allows programmers to secure data is an application-level solution in the form of attribute-based access control (ABAC). Private data and ABAC together give enough flexibility to model a non-trivial business process without revealing confidential information.
Ledger in Hyperledger Fabric consists of the current world state (database) and transaction log (blockchain). Assets are represented by a collection of key-value pairs. Changes are recorded as transactions on a channel ledger. Assets can be in binary or JSON format. World state is maintained so reading data doesn’t involve traversing the entire blockchain. Each peer can recreate the world state from the transaction log.
Chaincode
To understand how to incorporate private data and ABAC into your smart contract let’s implement a simple use case that involves storing medicine prescription:
- The doctor can create a new prescription for the patient
- The doctor can see the prescription that he issued
- The doctor cannot see the prescription that he didn’t issue
- The patient can see his prescription
- The patient cannot see the prescription that doesn’t belong to him
- The patient can reveal his prescription to the pharmacy
- The pharmacy can see only prescriptions that the pharmacy filled
Access to the private data is configurable on the organization-level. Doctors and patients access ledger using peers that are members of the first organization (Org1). Doctors can issue new prescriptions and patients can access them. These two rules will have to be programmed in the chaincode as private collections config doesn’t allow for specifying such action-based rules. The pharmacy should maintain their own set of prescriptions for patients (Org2). That’s the minimal configuration for private collections to meet those requirements:
We will have to specify a path to that file later when we instantiate the chaincode.
I use hyperledger/fabric-samples/first-network as the foundation for my network setup.
Start with generating the required certificates, genesis block, and docker compose file for configuration with two Fabric CA containers, one per each organization. Fabric CA is a certificate authority for Hyperledger Fabric.
Specify newly generated docker compose file and bring up the network.
On the application level, we can restrict data access using custom attributes. Certificates issued by the Fabric CA can contain custom attributes that we will use for authorization.
For more information on how to issue the certificate with Fabric CA, check out hyperledger/fabric-samples/fabcar example.
Chaincode is written in Go and uses cid library that might not be available in your container. Make sure to have fabric available in your $GOPATH and install two additional dependencies.
Let’s start with defining the prescription struct, which we will use for storing prescription information. We can use the same prescription type for both pharmacyPrescriptions and healthcarePrescriptions collections.
Our smart contract has to handle invoking of four functions. The best practice is to have a separate method for state initialization. Let’s add one prescription to the healthcarePrescriptions private data for testing purposes. In the main call, we only start the chaincode.
Prescriptions stored in the healthcarePrescriptions collection should be only readable by patient owning the prescription and the doctor that issued the prescription. We know who is who as each user of the system should identify himself by using the certificate issued by Fabric CA with a role attribute. We respond with “Prescription not found” error also when the user is unauthorized to see the prescription.
Pharmacies store only prescriptions that they filled in, in a separate private collection. We don’t check their specific identifier.
Doctors can add prescriptions specifying patient’s identifier. We use doctor’s role attribute to reference him in the Prescription.
The last feature to implement is to allow the patient to transfer the prescription to the pharmacy upon filling the prescription. The patient can use the chaincode that writes to the pharmacyPrescriptions private collection.
We could consider changing this implementation so it involves the pharmacy allowing the patient to transfer the prescriptions. It adds very little to how we work with ABAC or private data, so I decided to skip it.
You can find the complete implementation here: prescriptions.go.
Client
To interact with the Hyperledger Fabric, we can use fabric-client or fabric-ca-client SDKs. To test the implementation, you can start with scripts from hyperledger/fabric-samples/fabcar example. Some modifications are needed as our network uses TLS encryption, and fabcar doesn’t.
In query.js change
to
In invoke.js change
to
and change
to
and change
to
Now you should be able to query the chaincode and make transactions.
Hyperledger Composer
If you feel like Hyperledger Fabric is a just bare bones, you might want to look at Hyperledger Composer. Hyperledger Composer is a set of tools that provide higher-level abstraction over the Hyperledger Fabric. It allows to model a business network that consists of assets and participants, runs JavaScript to execute a query or a transaction and provides easy-to-use REST API with different authorization schemes.
Hyperledger Composer is built on top of the Hyperledger Fabric v1.1 and doesn’t support the newest features. Lack of support for private data is a limiting factor for applying Hyperledger Composer where lack of confidentiality can be a problem. Nonetheless, developer experience of using Hyperledger Composer is much better than setting up and using Hyperledger Fabric. The project is under active development, and I’m looking forward to trying new version that comes with a driver for Hyperledger Fabric v1.2.
Conclusion
At Tooploox we incorporate blockchain into applications taking into consideration their long-term impact on the product. Currently, Hyperledger Fabric is the best fit for implementations where there are other reasons than transparency for using blockchain like compliance, building trust between business parties or streamlining processes.
On the other hand, when you would like to provide your users with the ability to easily participate in the network, collaborate and trade, you will be better off with Ethereum. There are multiple standards driven by the community so we can make your product compatible with the ever-growing ecosystem of decentralized applications.
