###### Abstract
For example, while a doctor is on duty, they may require access to the full medical history data maintained in multiple hospital databases, for a patient under emergency treatment, or an administrator of a medical device manufacturer may require access to the configuration data of connected medical devices installed in different hospitals. In addition, regulators may require that the data be accessible from a single entrance platform, in order to log all data access requests and monitor privacy violations. At the same time, new sectors or stakeholders can dynamically join or leave the system. Note that users who are simultaneously members of multiple authorities may require special access. For example, a doctor in a hospital may also be a researcher at a university. This doctor would also require access to (statistical) health data maintained in _all_ hospitals, for research purposes. _Example 2: Fine-grained access to data in a multi-domain supply chain._ Consider a distributed supply chain tracking system, collectively used by supply chain stakeholders for collecting, integrating and analyzing data from a variety of sources. The various stakeholders have different requirements for data access. For example, a container shipping company requires access to data on cargo weight and quantity, while a retail end-user requires access to data on product provenance, storage, and transportation conditions (especially for sensitive merchandise). These systems must be interoperable, but also provide granular access to data. In addition, authorities such as customs or other governmental agencies may also require a single point of access for all queries to data, for global access verifiability, i.e., it must be possible for any entity, either inside or outside the system, to verify all access attempts to the data (either successful or not). **Contribution. ** The main contribution of this paper is to design and implement a secure and efficient access control model specifically targeted to dynamic, multi-domain and multi-authority environments. In particular:  
* We formally define _Hierarchical Multi Blockchain-Based Access Control_ (HMBAC), a novel access control model for multi-domain and multi-authority environments (see Section 4.1). HMBAC supports: _dynamic trust management_ between different authorities; granular and flexible _domain-level access control policy enforcement_; a global source of truth for all entities, allowing for an _immutable and forensics-by-design auditing mechanism_. * We describe the architecture design of HMBAC (Section 4.2), which in turn is implemented by _Janus_[5], an _artifact and reproducible_ implementation of HMBAC for large-scale setup environments (Section 4.3). Our implementation uses Hyperledger Fabric [6] as the underlying blockchain technology. To support system orchestration, we develop APIs to allow _controlled user interaction_ with the blockchain and _inter-blockchain synchronization_. User interaction with the API occurs through an Electron application, while global system orchestration is achieved through Docker containers and Kubernetes. * Based on our implementation, we have conducted extensive efficiency analysis (Section 5) to actually verify the practicality and efficiency of the proposed system. * Finally, we formally analyze Janus security (Section 6). Our system enforces _a single point of entry_ that cannot be bypassed by users or authorities. This is achieved by modifying the well-known Multi-Authority Attribute-based Encryption (MA-ABE) scheme of [7] in a _distributed two-step decryption procedure_. Part of the ABE decryption is performed by the multichain system itself by generating an attribute key linked to the requesting user on the fly. The user will be able to fully decrypt the data, provided that they obtained the relevant attribute keys which are required by the access policy. We developed a Go library as an add-on for Hashicorp Vault [8] and integrated it into Hyperledger Fabric.