💻 computer science

ICBAC: an Intelligent Contract-Based Access Control framework for supply chain management by integrating blockchain and federated learning

This paper proposes ICBAC, an intelligent access control framework for supply chains that integrates permissioned blockchain with federated learning and game-theoretic client selection to enable dynamic, privacy-preserving anomaly detection across competing organizations without sharing sensitive data.

Original authors: Sadegh Sohani, Salar Ghazi, Farnaz Kamranfar, Sahar Pilehvar Moakhar, Mohammad Allahbakhsh, Haleh Amintoosi, Kaiwen Zhang

Published 2026-02-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sadegh Sohani, Salar Ghazi, Farnaz Kamranfar, Sahar Pilehvar Moakhar, Mohammad Allahbakhsh, Haleh Amintoosi, Kaiwen Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, global supply chain as a giant, bustling marketplace where thousands of different companies (farmers, factories, truckers, and stores) trade goods. Everyone needs to talk to each other, but they also need to keep their own secrets safe. The problem is that in this marketplace, it's hard to know who is allowed to do what, and even harder to catch someone who looks like they have permission but is actually acting suspiciously (like an employee stealing inventory or a truck driver taking a weird detour).

This paper introduces ICBAC, a new "smart security guard" system designed to fix these problems. Here is how it works, broken down into simple concepts:

1. The Digital Ledger: The "Unbreakable Notebook"

First, the system uses Blockchain (specifically a version called Hyperledger Fabric). Think of this as a giant, unbreakable notebook that everyone in the supply chain shares.

Why it helps: You can't erase or fake entries in this notebook. If someone tries to change a record, the whole group sees it.
The Twist: Instead of one giant notebook for everyone, ICBAC uses private channels. Imagine a building with many different rooms. The "Fruit Room" has its own notebook, and the "Electronics Room" has its own. This keeps the data of competing companies separate and private, so a rival company can't see your sales numbers.

2. The Smart Contracts: The "Automatic Rules"

Inside these digital rooms, the system uses Smart Contracts. Think of these as vending machines with strict rules.

How it works: If you put in the right coin (permission), the machine gives you the snack (access to data). If you don't have the right coin, it says "No."
The Upgrade: Old systems only had static rules (e.g., "John can open the door"). ICBAC adds a Permission Revoke List. If the system thinks John is acting weird, it can instantly put him on a "Pending" list, freezing his access until a human manager reviews it.

3. The AI Agent: The "Behavioral Bodyguard"

This is the most innovative part. The system doesn't just check if you have a key; it watches how you use it.

The Analogy: Imagine a security guard who knows your normal routine. If you usually unlock the front door at 9:00 AM, but suddenly you are trying to unlock the vault at 3:00 AM and downloading 1,000 files, the guard gets suspicious.
The Action: This "AI Bodyguard" lives inside each supply chain room. It learns what "normal" looks like for that specific group. If it spots an anomaly (like a sudden, massive data download), it automatically flags the user and restricts their access.

4. The Privacy Problem: "Teaching Without Sharing"

Here is the tricky part: To get really good at spotting weird behavior, the AI needs to learn from many different supply chains. But companies can't share their secret data (like their customer lists or pricing) with competitors.

The Solution: Federated Learning. Imagine a group of chefs trying to perfect a soup recipe. Instead of sending their secret ingredients to a central kitchen, they each cook a small batch in their own kitchen, taste it, and just send the recipe adjustments (not the soup) to a central pot. The central pot gets smarter, but no one ever sees the other chefs' secret ingredients.
ICBAC's Approach: The AI agents from different supply chains share their "lessons learned" (math updates) but never share the actual raw data. This keeps everyone's secrets safe while making the security smarter for everyone.

5. The "Friend Group" System: "Hedonic Coalition Formation"

The paper realizes that not all supply chains are alike. A "Perishable Food" chain behaves very differently from a "Car Parts" chain. If you mix them all together to learn, the AI gets confused.

The Analogy: Think of it like a school dance. You don't want to dance with everyone; you want to dance with people who like the same music.
The Mechanism: ICBAC uses a game-theory method to let supply chains form "Friend Groups" (Coalitions). Each chain says, "I want to learn from these specific partners." The system then uses a mathematical algorithm (Tarjan's algorithm) to find the most stable groups where everyone is happy to learn from each other.
The Benefit: This ensures that the AI learns from groups that actually make sense (e.g., food chains learning from other food chains), rather than forcing incompatible groups together.

What Did They Find?

The authors tested this system on a computer simulation using real-world supply chain data.

Speed: It runs almost as fast as older, simpler security systems.
Smarts: It successfully caught "bad actors" (anomalies) even when the data was messy or different across groups.
Privacy: It achieved this without any company ever sharing their raw, sensitive data with anyone else.

In short: ICBAC is a security system that combines an unchangeable digital record, automatic rule enforcement, a smart AI that watches for suspicious behavior, and a privacy-preserving way for different companies to teach that AI without revealing their secrets. It's designed to make supply chains safer and more adaptable without breaking the trust between competitors.

Technical Summary: ICBAC – An Intelligent Contract-Based Access Control Framework for Supply Chain Management

1. Problem Statement

Modern Supply Chain Management (SCM) systems operate across multiple independent and often competing organizations, creating a complex environment for access control. Existing mechanisms are predominantly static, centralized, and policy-driven (e.g., RBAC, ABAC), rendering them ill-equipped to handle dynamic insider threats, erroneous behaviors, and context-dependent misuse. While blockchain technology offers decentralization and immutability, current blockchain-based access control frameworks still rely on predefined rules and lack behavioral intelligence.

Conversely, while Machine Learning (ML) based User and Entity Behavior Analytics (UEBA) can detect anomalies, centralized training requires aggregating sensitive behavioral data. This creates a conflict with the privacy, regulatory, and competitive constraints inherent in SCM, where organizations cannot share raw data. Furthermore, applying Federated Learning (FL) directly across heterogeneous and competing supply chains introduces challenges related to data distribution mismatches (non-IID data), convergence instability, and strategic participation, as behaviors considered anomalous in one supply chain may be normal in another.

2. Methodology: The ICBAC Framework

The paper proposes ICBAC (Intelligent Contract-Based Access Control), a framework integrating permissioned blockchain (Hyperledger Fabric) with Federated Learning (FL) and game-theoretic client selection.

2.1 Architecture

ICBAC is structured into two primary layers:

Blockchain Layer: Built on Hyperledger Fabric, utilizing a multi-channel architecture where each channel ( $C_i$ ) represents a distinct supply chain context with its own participants, assets, and trust boundaries. This ensures isolation and selective data sharing.
AI Layer: Deploys a dedicated AI agent ( $AI_i$ ) for each channel to monitor participant behavior and detect anomalies locally.

2.2 Core Components

Smart Contracts: Three specialized contracts enforce access control:
- Asset Management ( $SC_{AM}$ ): Handles asset creation and updates.
- Basic Access Control ( $SC_{BAC}$ ): Manages baseline permissions via LeastPrivilege and dynamically adjusted ExtraPrivilege sets, allowing for the promotion or demotion of user privileges.
- Permission Revoke List ( $SC_{PRL}$ ): Maintains a list of participants flagged as anomalous. When an AI agent detects suspicious behavior, the participant is added to the PRL, and subsequent access requests are marked as "Pending" pending administrative review.
AI-Based Anomaly Detection: Each channel trains a lightweight temporal model on local behavioral sequences (feature vectors including identity, operation type, frequency, and timing). The model predicts normal behavior; deviations exceeding a threshold trigger an anomaly flag.
Federated Learning (FL): AI agents collaboratively improve their anomaly detection models by sharing model updates (parameters) rather than raw data. The framework employs Federated Averaging (FedAvg) for aggregation.

2.3 Game-Theoretic Client Selection

To address the heterogeneity of supply chains and the instability of global FL, ICBAC introduces a Hedonic Coalition Formation mechanism for client selection:

Preference-Based: Each AI agent declares a list of "friends" (trusted/compatible partners) without revealing the underlying criteria.
Stability: The mechanism uses Tarjan's algorithm to identify Strongly Connected Components (SCCs) in the preference graph.
Guarantees: This approach ensures core stability (no group of agents has an incentive to deviate) and strategy-proofness (agents cannot benefit from misreporting preferences).
Outcome: Channels form stable, small-scale coalitions for FL, ensuring that aggregation occurs only among behaviorally compatible participants, thereby mitigating the "client drift" common in non-IID settings.

3. Key Contributions

The paper outlines four primary contributions:

Blockchain-Based Access Control for SCM: A multi-channel framework on Hyperledger Fabric that reflects heterogeneous supply chain contexts.
AI-Driven Dynamic Access Revocation: Integration of per-channel AI agents for real-time anomaly detection and automated, context-aware permission revocation via smart contracts.
Privacy-Preserving Federated Learning: A mechanism allowing collaborative model improvement without raw data exchange.
Game-Theoretic Client Selection: A hedonic coalition formation mechanism that ensures stable, strategy-proof, and privacy-preserving FL coalitions.

4. Experimental Results

Experiments were conducted on a Hyperledger Fabric testbed using the DataCoSupplyChain dataset (180,000+ records).

Blockchain Performance: ICBAC demonstrated latency and throughput comparable to state-of-the-art static frameworks (MedTrace, AccessChain, ProChain). While read operations showed a marginal increase in latency (approx. 18.6% reduction in throughput compared to ProChain in one specific test) due to dynamic permission checks, statistical analysis (t-tests) indicated no significant difference in most performance metrics.
Anomaly Detection (FL):
- IID vs. Non-IID: The framework was tested under both Independent and Identically Distributed (IID) and Non-IID data distributions.
- Coalition Efficacy: Preference-based coalitions formed by the proposed mechanism consistently outperformed random coalitions and all-inclusive federations, particularly in Non-IID settings. They achieved faster convergence and higher F1-scores with lower loss.
- Privacy: FL coalitions achieved zero privacy leakage (no raw data shared), whereas centralized models trained on aggregated data exhibited measurable leakage (0.15–0.53).
- Accuracy: Under IID conditions, FL performance approached that of centralized models. Under Non-IID conditions, while centralized models maintained higher accuracy, FL models maintained strong performance while preserving privacy.

5. Significance and Claims

The paper claims that ICBAC offers a practical and scalable solution for dynamic, privacy-preserving access control in decentralized supply chain ecosystems. Its significance lies in bridging the gap between the transparency of blockchain and the adaptability of AI, specifically addressing the limitations of static policies in the face of insider threats.

The authors emphasize that the framework is uniquely suited for competitive environments where organizations cannot share data but need to benefit from collective intelligence. By using hedonic coalition formation, ICBAC ensures that collaboration is stable and strategy-proof without requiring the disclosure of sensitive collaboration criteria.

The paper modestly acknowledges limitations, noting that performance in Non-IID FL scenarios is lower than in centralized settings and that read operations incur slight overhead. Future work is proposed to address heterogeneous data aggregation and to extend the framework to fully independent cross-blockchain scenarios using cross-chain interoperability protocols.