ZKP-CapBAC: Capability-Based Access Control via On-Chain Zero-Knowledge Proofs for Cross-Domain Hiding Delegation Tree

Among various access control mechanisms, Capability-based access control (CapBAC) stands out as a promising research direction for enhancing system security through its token-based management of minimal permissions, dynamic access rights adjustments, and granular, flexible control over access permissions. However, as distributed networks grow in popularity, more security challenges appear. To address them and further advance CapBAC mechanism, this work proposes ZKP-CapBAC for cross-domain hiding delegation tree, a novel CapBAC mechanism integrating Zero-knowledge Proof (ZKP) and blockchain (on-chain) technology into CapBAC, tailored for distributed environments. The proposed ZKP-CapBAC not only secures single-domain capabilities (creation, authorization, verification, deletion), but also secures cross-domain capabilities of verification by utilizing ZKP to effectively hide the delegation tree, allowing for secure and private management of capabilities across domains without requiring cross-domain administrators to share the tree's details. This enhances security and efficiency of capability management in decentralized, transparent environments. Experimental results show that ZKP-CapBAC offers superior access control security with minimal time overhead and excels in practical environments. It outperforms existing mechanisms across five key metrics: monotonicity, flexible capability authorization, capability hiding, delegation tree hiding, and joint capability verification. This work advances the robustness and applicability of existing CapBAC mechanisms, marking a substantial advancement in access control technology.