0

Im working on a concept where users can allow certain organisations to see their data. I want to store the permission on a private ethereum blockchain. I thought smart contracts would be the way to go but I can't really wrap my head around it.

Would I need te create a contract for each user in which they say which organisations should get acces to their data?

Can users change which organisations have acces to their data if I use contracts, say for instance the user wants to change to another organisation?

Can I add more organisations to already existing contracts?

If contracts aren't the way to go here, could somebody give me a point in the right direction?

Image of the intended flow (simplified top more in depth bottom): enter image description here

EDIT:

I made a start on a contract probably incorrect but lets see it as pseudo code:

pragma solidity >=0.5.0;

contract UserPermissions {
    string private notpermitted;
    

    mapping(address => mapping(bytes32 => mapping(address => bool))) permissions;

    constructor() public {
        notpermitted = "You do not have permission to view this users data";
    }

    function setPermissions(address they, bytes topic, bool allowed) external {
        permissions[msg.sender][topic][they] = allowed;
    }

    function getPermitted(address they, bytes topic){
        if (permissions[they][topic][msg.sender] = true) {
            //if permission is granted return this
            return permissions[they][topic][msg.sender]; 
        } else {
            return notpermitted;
        };
    }

    function getOwnPermitted(){
        //returns list of all permissions this acount has granted
    }
}
0

There is another problem to wrap your head around, but first to address the small questions directly.

Would I need te create a contract for each user in which they say which organisations should get acces to their data?

Probably not. A single contract could store a registry in which each user stores a suitable structure, e.g. a mapping of permissions and authorized users. Something like:

// user => permission => authorizedUsers => true/false
// bool isAllowed = permissions[me][topic][you];
mapping(address => mapping(bytes32 => mapping(address => bool))) permissions;

Can users change which organisations have acces to their data if I use contracts, say for instance the user wants to change to another organisation?

Yes. You need a function for them to do so. Given the hypothetical data structure above and assuming one can only manage their own permission space ...

function setPermission(address they, bytes topic, bool allowed) external {
  permissions[msg.sender][topic][they] = allowed;
}

Can I add more organisations to already existing contracts?

Sure. In the simple examples, all possible addresses are already assumed to exist so there is nothing left to add, but you can define the business rules (i.e. what does "add" mean in the context of you app) and codify the process.

If contracts aren't the way to go here, could somebody give me a point in the right direction?

Now the big issue.

You will find it nearly impossible to keep a secret on the blockchain because the blockchain is optimized for transparency. You can use it to keep a record of who should have access to the secrets and you can use it to authenticate the information (this is a true copy of the secret) but it is not a good place to store the secret itself.

Hope it helps.

6
  • Hey Rob thanks for the detailed answer! "You can use it to keep a record of who should have access to the secrets and you can use it to authenticate the information (this is a true copy of the secret) but it is not a good place to store the secret itself." Seeing I will be using a private blockchain that the users and organisations will only acces using an api/app is it still visible for everyone from the outside then? Second I also think that what I meant is I would only be saving who should have acces to the data not the actual data is this what you meant?
    – Im__Ruben
    Mar 12 at 16:56
  • It depends a little on which "private blockchain" implementation you have in mind and how you plan to deploy it, but generally speaking, all validators will have knowledge of everything. Quorum's private transactions might be able to help but ... Mar 12 at 17:02
  • Not the actual data ... correct. Since you say an API or something would hold the data, then blockchain to manage permissions is a go. You could look at NFTs to govern access control or do your own thing. The API would authenticate by ethereum signatures and then look up permission in a contract. Mar 12 at 17:04
  • Hey Rob, I have added and image to better show my intended flow of how this would work. The data would be saved in a database and the contract would be used purely to check if the organisation has permission to retrieve this data.
    – Im__Ruben
    Mar 12 at 17:22
  • Also added my first try at how I would form the contract
    – Im__Ruben
    Mar 13 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.