论文标题
OAuth 2.0使用基于区块链的令牌授权
OAuth 2.0 authorization using blockchain-based tokens
论文作者
论文摘要
OAuth 2.0是授权的行业标准协议。它促进了安全的服务提供，以及不同利益相关者之间的安全互操作性。所有OAuth 2.0协议流都会导致创建访问令牌，然后用户将其用于请求访问受保护的资源。但是，访问令牌的定义对OAuth 2.0协议是透明的，该协议未指定任何特定的令牌格式，如何生成令牌或使用方式。相反，OAuth 2.0规范将所有这些作为集成商的设计选择。在本文中，我们提出了一种由分布式分类帐支持的新型OAuth 2.0令牌。我们的建设是安全的，它支持苏索证明，审计和问责制。此外，我们通过利用智能合约来提供添加值的代币管理服务，包括撤销，授权和公平交流。我们使用以太坊智能合约和ERC-721代币规范实现了解决方案的概念验证实现。
OAuth 2.0 is the industry-standard protocol for authorization. It facilitates secure service provisioning, as well as secure interoperability among diverse stakeholders. All OAuth 2.0 protocol flows result in the creation of an access token, which is then used by a user to request access to a protected resource. Nevertheless, the definition of access tokens is transparent to the OAuth 2.0 protocol, which does not specify any particular token format, how tokens are generated, or how they are used. Instead, the OAuth 2.0 specification leaves all these as design choices for integrators. In this paper, we propose a new type of OAuth 2.0 token backed by a distributed ledger. Our construction is secure, and it supports proof-of-possession, auditing, and accountability. Furthermore, we provide added-value token management services, including revocation, delegation, and fair exchange by leveraging smart contracts. We realized a proof-of-concept implementation of our solution using Ethereum smart contracts and the ERC-721 token specification.
