Abstract: To address resource constraints of terminal devices, distributed cross-domain trust, and dynamic access policies in large-scale Internet of things (IoT) environments, we propose a lightweight access control mechanism based on blockchain and fog computing. The mechanism adopts a layered architecture of on-chain trusted state maintenance, fog-side real-time authorization, and terminal-side lightweight identity response. High-complexity operations in attribute-based encryption (ABE), including key generation, policy matching, encryption, and decryption, are offloaded to fog nodes, while terminals only perform physical unclonable function (PUF) response generation and SHA-256 hashing. To support fine-grained and trusted cross-domain access, a hybrid authorization framework combining ciphertext-policy ABE (CP-ABE) and key-policy ABE (KP-ABE) is designed, where CP-ABE expresses resource-level access policies and KP-ABE supplements user-level resource permissions. Device identity hashes, policy states, and revocation events are recorded on a Hyperledger Fabric consortium blockchain, forming a trusted identity chain that combines PUF-based physical uniqueness with on-chain state consistency. In addition, a short-lived cross-domain access token and a challenge-hash-based verification method are introduced for cross-domain authentication and lightweight outsourced decryption verification. Security analysis shows that the mechanism satisfies identity authentication, session establishment, data confidentiality, collusion resistance, replay resistance, and unforgeability of cross-domain credentials. Prototype experiments show that, with five attributes, CP-ABE encryption and decryption take approximately 13.3 ms and 5.5 ms, respectively, and the data access path latency is approximately 18 ms. The results demonstrate that the proposed mechanism can support fine-grained, auditable, and cross-domain access control for resource-constrained IoT scenarios.