Skip to main content

Permissioning

A permissioned network enables node permissioning and account permissioning, allowing only specified nodes and accounts to access the network.

Permissioning is not privacy

In peer-to-peer networks, node permissioning enforces rules on nodes you control.

Permissioning requires a distributed network of trust across the network where participants agree to follow the rules. One bad actor can decide not to follow the rules. Nodes can take action to prevent the bad actor from adding to the chain but they cannot prevent the bad actor from allowing access to the chain.

Besu also implements privacy.

Node permissioning​

Use node permissioning to restrict access to known participants only.

Node Permissioning

Account permissioning​

Use account permissioning to:

  • Enforce onboarding or identity requirements.
  • Suspend accounts.
  • Restrict the actions an account can perform.

Account Permissioning

Specify permissioning​

You can specify permissioning locally or onchain.

Local​

Local permissioning works at the node level. Each node in the network has a permissions configuration file.

Local permissioning affects your node but not the rest of the network. Use local permissioning to restrict use of your node (that is, the resources under your control). For example, customers are able to access your node.

Local permissioning does not require coordination with the rest of the network and you can act immediately to protect your node. Your rules are not enforced in blocks produced by other nodes.

Onchain (Deprecated)​

caution

Onchain permissioning is deprecated in Besu version 24.12.0 and later. Please read this blog post for more context on the rationale behind this decision as well as alternative options.

Onchain permissioning works through a smart contract on the network. Specifying permissioning onchain enables all nodes to read and update permissioning configuration from one location.

Onchain permissioning requires coordination to update the rules. The network might not be able to act immediately (for example, the smart contract might enforce a minimum number of votes before changing permissioning rules).

When you update onchain permissioning, the update applies across the network and new blocks abide by the updated rules. For example, blocked accounts can no longer add transactions to the chain.

The following diagram illustrates applying local and onchain permissioning rules.

Permissioning Flow