# Blockchain-Based Internet of Things Access Control Technology in Intelligent Manufacturing
## 5 Access Control Process Management  
Suppose there are two IoT devices, one of which is [PERSON], the data resource owner, and the other is [PERSON], the data resource requester. When [PERSON] needs to request [PERSON]'s data resources, [PERSON] must implement access controls on the data resources owned by him, to block unauthorized IoT devices from illegally accessing the resources of his device, etc. In general, [PERSON] can only gain access to [PERSON]'s data resources if the set of attribute value pairs owned by [PERSON] and the current environment attributes, etc., can meet the access control policy requirements set by [PERSON]. The execution flow of the access control protocol between these two IoT devices is shown in Figure 3.  
(1) [PERSON] first sends the request message for data resource access to [PERSON], using the identity information IDA, and then [PERSON] and [PERSON] obtain a session key \(K_{m}\), using standard identity-based authentication and key negotiation protocols, which is used for identification and encryption when data are exchanged between the data requester and the data owner.  
(2) [PERSON] generates a random number (\(RN\in Z_{\text{r}}\)) and sends it to [PERSON] by merging its own set of access control policy attribute names [_P_pname_], where [_P_pname_] defines the set of attribute names to be used to access the data resources of the device.  
(3) [PERSON] looks up the subset of attribute value pairs (_prop_n_i, _prop_v_i) \(\in S\) from the set of attributes owned by the IoT device, as maintained by the attribute names in [_P_pname_], where the information of the attribute value pairs in this subset is authorized by the attribute authorization authority to the blockchain address that [PERSON] submitted during the access control request. [PERSON] signs the random number (\(RN\)) using the private key corresponding to each blockchain address in turn, and then sends the random number (\(RN\)), together with its own signature and its corresponding public key pair {\(SigS_{SK}\) (\(RN\)), \(PK_{i}\), (_prop_n_i, _prop_v_i) \(\in S\)}, corresponding to each attribute value pair in the attribute value pair set S, to [PERSON].  
(4) [PERSON] first hashes the \(PK_{i}\mid 1 ID_{A}\) submitted by [PERSON], and, by running the _Base58 Check_ function to encode it, [PERSON] then obtains the blockchain address corresponding to this hash value. Then, [PERSON] looks up the Fabric ledger to obtain the latest data corresponding to the blockchain address, and, if the blockchain address has, indeed, been distributed with attribute value pairs (_prop_n_i, _prop_v_i) by the Authorization Authority, [PERSON] immediatelyuses this corresponding public key \(PK_{i}\) submitted by [PERSON] to verify the validity and legitimacy of the signature value, \(Sig_{SK}\) (\(R\)), as follows:  
\[Ver_{PK}\ (Sig_{SK}\ (RN))^{?}_{=}RN \tag{6}\]  
(5) If all of the above holds, it shows that [PERSON] is, indeed, the owner of the blockchain address, and the attribute value pairs (\(prop\_n_i\), \(prop\_v_i\)) corresponding to the blockchain address are declared in advance by the attribute authority. [PERSON] takes the verified set of attribute value pairs (\(S\), \(PK_{B}\)) and his own identity (\(ID_{B}\)) sent by [PERSON] and invokes the access control determination smart contract on the block to make the determination.