SymboleoAC: An Access Control Model for Legal Contracts

Legal contracts have served as the bedrock of business transactions for millennia. Many are now automated through the use of smart contracts, supported by blockchain and IoT technologies. However, automation poses security challenges as to who should have access to operate on contract elements. This paper proposes a role-based access control model, treating all contract elements as resources and ensuring regulated access by designated parties. The access control model extends the Symboleo specification language for legal contracts with new modeling concepts inspired by Role-Based Access Control (RBAC), tailored for the legal contract domain, resulting in SymboleoAC. Specifically, we: (i) model a set of access control concepts, including resource, access rule, and access policy, thereby extending the Symboleo ontology, (ii) define controller rules that specify who can authorize access to each resource, and (iii) present pre-authorization rules that specify who has access to what. Our contributions include an access control model for legal contracts, an extension of the Symboleo language with pre-authorization access rules, as well as a tool that generates smart contract code for Hyperledger Fabric (in JavaScript, from SymboleoAC) that is compliant with access policies and access rules.