# Blockchain-Based Internet of Things Access Control Technology in Intelligent Manufacturing
## 6 Security and Performance Analysis
### Performance Analysis Experiment  
In order to verify the performance and effectiveness of the proposed solution, this paper analyzed and evaluated the computing and storage performance of the access control scheme. These experiments were conducted under Ubuntu OS. Hyperledger Fabric version 2.0 was used to build the federated chain, and the smart contract algorithm for access control was programmed in Go/Java language. The start operations for the orderer node and peer node are shown in Figure 4.  
Figure 3: Interaction diagram of access control process between communication parties.  
Since most of the devices in IoT systems have extremely limited storage resources, the size of the data storage space and the data access performance required for this scenario are important factors to consider. In the scheme proposed in this paper, the IoT devices must store at least four additional types of data locally, including global parameters of the whole system, session keys between the IoT devices, salt values used to generate symmetric keys, and access control policies.  
(1) Global parameters of the whole system: The blockchain-based IoT access control system has corresponding global parameters, through which all entities within the system can share data, which contain security parameters, elliptic curves, secure hash functions, authorization authorities for attributes that need to be interacted with, and public keys of the IoT devices. The size of the global parameters is determined after the initialization of the system, and this part of the storage overhead is measured in bytes, which is certainly within the acceptable range.  
(2) Session key between IoT devices: To improve the performance of access control across the system, while still ensuring security, a suitable expiration period can be set for the session key of both communication parties. The number of this session key is determined by the number of individual IoT devices and other devices that need to communicate, and, in general, the session key is used as a symmetric key, if the state-secure SM9 encryption algorithm [21] is used. The storage overhead of this part is very small.  
(3) Access control policy: A single device keeps an access control policy file, which can be defined based on the Casbin [22] model, and supports common arithmetic, relational and logical operators when defining the matching rules of the policy, making the policy supportive of fine-grained description and powerful expression.  
The storage overhead of the file is related to the number of access control policy attributes. In practice, the number of attributes designed for the access control policy of a single device does not exceed 15, and, in this case, only about 200 bytes of space are required, which is obviously an acceptable storage overhead.  
The results are shown in Figure 5, which compares the storage overhead with two similar recent solutions.  
Figure 4: The start of the orderer node and peer node.  
Figure 5: A comparison graph of storage overhead.  
From Figure 5, we can observe that the storage performance of the access control methods mentioned in this paper is better than that of schemes such as those in [23]. However, because the scheme of this paper uses attribute value pairs, that is, conditions to describe the ACP policy, while schemes such as those in [24] use attributes to describe the ACP policy, the scheme of this paper is worse than schemes such as those in [24], in terms of the storage overhead, but it is well within the acceptable range.  
Compared with two similar schemes, in terms of time cost, the comparison results are shown in Table 1 below.  
In terms of the time overhead, this method is significantly better than the other methods because it uses a light-weight access control mechanism and does not involve complex operations; n indicates the number of attributes in the access control policy, and m indicates the number of attribute value pairs or conditions in the access control policy.