CN107103252A - Data access control method based on block chain - Google Patents

Abstract

The invention discloses a block chain-based data access control method, relates to the technical field of block chain data management and control, and solves the problem of poor controllability of data access and areas in the prior art due to the limitations of control authority design and block data storage structure. Block size and other technical issues. The present invention mainly includes that all user data can only be accessed by the user and the agent, any third party who wants to access the user data must send a request through the agent, and proceed as an agent; the access log of all user data can only be accessed by the agent and the user, Any third party wishing to access the logs must make the request through the proxy, acting as the proxy. The invention is used to design a data sharing and access control system in a big data environment.

Description

Blockchain-based data access control method

technical field

The invention relates to the technical field of block chain data management and control, in particular to a data access control method based on block chain.

Background technique

The era of big data puts forward higher requirements for data sharing and data security. In the traditional mode, there are basically no accompanying protection measures because of sharing, or the data is too tightly managed to limit sharing. In addition, there is redundancy in the blockchain data of the prior art.

Contents of the invention

In view of the above prior art, the purpose of the present invention is to provide a data access control method based on block chain, which solves the problem of poor controllability of data access and block Huge and other technical issues.

In order to achieve the above object, the technical scheme adopted in the present invention is as follows:

Blockchain-based user data access control methods, including

After registering information processing in the blockchain, set the restriction conditions for each user's data access request to only receive the user's own access request or the proxy access request that meets the user's set permissions, and set the third-party user (organization or other user) only through Proxies issue user data access requests and access user data only as a proxy.

In the above method, the registration information processing in the blockchain includes the following steps:

Step 1. After the user and the third-party user successfully register in the blockchain, the user's public key, private key, shared key and predefined access rights list are generated, and the third-party user's public key, private key, shared key and Pre-defined access rights list, and also generate the agent's public key, private key, shared key and predefined access rights list, then the user and the agent exchange their respective public keys and shared keys, and third-party users interact with the agent correspondingly public key and shared secret;

Step 2. The agent calculates the public key of the agent, the user and the third-party user and the predefined access list to obtain the hash value of the third-party user public key, the user public key and the agent public key, and then

The hash value of the user public key and the proxy public key is sequentially taken as the first index of the first storage tuple that sequentially includes the user public key, the proxy public key, the user's predefined access permission list and the first pointer,

Taking the hash value of the proxy public key and the user public key sequentially as the second index of the second storage tuple that sequentially includes the proxy public key, the user public key, the proxy predefined access permission list and the second pointer,

Take the hash value of the third-party user public key and proxy public key sequentially as the third storage tuple that sequentially contains the third-party user public key, proxy public key, third-party user predefined access permission list and third pointer index,

At the same time, take the hash value of the proxy public key and the third-party user public key sequentially as the fourth element of the fourth storage tuple containing the proxy public key, the third-party user public key, the proxy predefined access permission list and the fourth pointer. index;

Step 3. Initiate an information storage request to the request pool, and store all storage tuples and their corresponding indexes in the blockchain when a threshold number of consensus and processing nodes reach a consensus.

In the above method, it also includes that the user shares data through an agent that satisfies the authority set by the user, which includes the following steps:

Step 1. The user encrypts the data with the user's shared key and attaches the user's predefined access rights list. After signing, the encrypted data is obtained, and the encrypted data is sent to the agent;

Step 2. After the agent successfully checks the user's identity, it generates an encrypted data sharing request according to the first index and sends the encrypted data sharing request to the request pool;

Step 3. Use the consensus and processing nodes to find out the first storage tuple stored in the blockchain according to the first index, and then perform the first type of voting consensus verification according to the registration information of users and agents. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted data is stored in the distributed hash table network under the blockchain, and then the user's predefined access permission list in step 1 is updated, and a pointer to the encrypted data is stored at the same time.

In the above method, the third-party user accesses user data as a proxy, including the following steps:

Step 1. The agent writes the third-party user's signature data and predefined access permission list in the user data access request, ends with the agent's signature data, and then sends the access request to the request pool;

Step 2. Use the consensus and processing nodes to find out the first storage tuple stored in the blockchain according to the first index, and then perform the second type of voting consensus verification according to the registration information of users and agents. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted data stored in the distributed hash table network under the blockchain is returned to the agent;

Step 3. The encrypted data is decrypted by the proxy through the user's shared key, and then the decrypted data is re-encrypted using the third-party user's shared key, and the re-encrypted data is sent to the third-party user after signing.

In the above method, the pointer of the encrypted data points to the hash value of the encrypted data of the user, and points to a key-value pair in the distributed hash table network under the block chain.

Blockchain-based log access control methods, including

After registering the information processing in the blockchain, set the restriction condition of each user data access log access request to only accept the proxy access log access request or the user access log access request that meets the proxy setting authority, and set the third-party user (block Chain storage organization) only issues access requests for user data access logs through agents and only accesses user data access logs as an agent.

In the above method, the registration information processing in the blockchain includes the following steps:

Step 1. After the user and the third-party user successfully register in the blockchain, the user's public key, private key, shared key and predefined access rights list are generated, and the third-party user's public key, private key, shared key and Pre-defined access rights list, and also generate the agent's public key, private key, shared key and predefined access rights list, then the user and the agent exchange their respective public keys and shared keys, and third-party users interact with the agent correspondingly public key and shared secret;

Step 2. The agent calculates the public key of the agent, the user and the third-party user and the predefined access list to obtain the hash value of the third-party user public key, the user public key and the agent public key, and then

The hash value of the user public key and the proxy public key is sequentially taken as the first index of the first storage tuple that sequentially includes the user public key, the proxy public key, the user's predefined access permission list and the first pointer,

Taking the hash value of the proxy public key and the user public key sequentially as the second index of the second storage tuple that sequentially includes the proxy public key, the user public key, the proxy predefined access permission list and the second pointer,

Take the hash value of the third-party user public key and proxy public key sequentially as the third storage tuple that sequentially contains the third-party user public key, proxy public key, third-party user predefined access permission list and third pointer index,

At the same time, take the hash value of the proxy public key and the third-party user public key sequentially as the fourth element of the fourth storage tuple containing the proxy public key, the third-party user public key, the proxy predefined access permission list and the fourth pointer. index;

Step 3. Initiate an information storage request to the request pool, and store all storage tuples and their corresponding indexes in the blockchain when a threshold number of consensus and processing nodes reach a consensus.

In the above method, the third-party user accesses the access log through a proxy, including the following steps:

Step 1. The agent encrypts the access log with the agent's shared key, appends the agent's predefined access permission list, and ends with the agent's signature data to obtain the encrypted access log, generate an access log access request, and send the access log access request to the request pool ;

Step 2. Use the consensus and processing nodes to find out the second storage tuple stored in the blockchain according to the second index, and then perform the third type of voting consensus verification according to the registration information of the agent and the user. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted access log is stored in the distributed hash table network under the blockchain, and then the agent's predefined access permission list in step 1 is updated, and a pointer to the encrypted access log is stored at the same time.

In the above method, it also includes that the user accesses the access log through an agent, which includes the following steps:

Step 1. The agent writes the user's predefined access permission list in the access request of the access log, ends with the agent's signature data, and then sends the access request to the request pool;

Step 2. Use the consensus and processing nodes to find out the second storage tuple stored in the blockchain according to the second index, and then perform the fourth type of voting consensus verification according to the registration information of the agent and the user. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted access log stored in the distributed hash table network under the blockchain is returned to the agent;

Step 3: The agent returns the encrypted access log to the user.

In the above solution, it also includes the user changing the data access permission, which includes the following steps:

Step 1. The agent writes the user's redefined access permission list in the access request of the access log, ends with the agent's signature data, and then sends the access request to the request pool;

Step 2. Use the consensus and processing nodes to find out the first storage tuple stored in the blockchain according to the first index, and then perform the fifth type of voting consensus verification according to the registration information of users and agents. When the threshold number of consensus and processing nodes When consensus is reached, the predefined access rights list is updated to a redefined access rights list and stored in the blockchain.

In the above method, the pointer of the encrypted access log is a hash value pointing to the encrypted access log of the user, pointing to a key-value pair in the distributed hash table network under the block chain.

Compared with prior art, the beneficial effect of the present invention:

By recording the access control authority and the pointer to the access log on the blockchain, the data owner can not only control other parties' access to the data, track who is using the data, but also change the access authority of the data at any time;

The present invention also encrypts and stores the data and access records to the data in the distributed hash table storage facility under the chain, and only records the pointer to the encrypted data in the block, so as to reduce the size of the block in the block chain and to improve efficiency.

Description of drawings

Fig. 1 is a schematic diagram of a module of the present invention.

detailed description

All features disclosed in this specification, or steps in all methods or processes disclosed, may be combined in any manner, except for mutually exclusive features and/or steps.

The present invention will be further described below in conjunction with accompanying drawing:

In the block chain-based data access control method, it is necessary to store the permission list for accessing user data in the block chain, and also need to store the permission list for accessing user data logs. When a user shares data, after passing the verification, the user's public key, the agent's public key, the access rights set by the user, and the pointer to the user's data are recorded in the blockchain as the verification basis and index when other parties access the user's data , and user data will be encrypted and stored in the distributed hash table under the chain. When other parties, such as institutions, access user data, they must send a request through a proxy. After the proxy obtains the data, it first decrypts it and then encrypts it and sends it to the institution. The agent also needs to record the organization name, time, and operations performed during this visit in the log, and record the public key of the accessed user, the public key of the agent, the access rights set by the agent, the pointer to the access log, and the time Into the blockchain, as the verification basis and index when accessing the log, and the log records are also encrypted and stored in the distributed hash table under the chain.

Based on the blockchain data access control method, all user data can only be accessed by the user and the agent (the agent needs to meet the permissions set by the user), any third party who wants to access user data must send a request through the agent, and proceed as an agent ;

All user data access logs can only be accessed by agents and users (users need to meet the permissions set by the agent), any third party who wants to access the logs must send a request through the agent, and proceed as an agent;

The index used to store verification and control information on the blockchain is generated by the joint hash operation of the user's public key, the agent's public key and other metadata;

The verification and control information stored on the blockchain includes but is not limited to (user's public key, agent's public key, user-set access rights, pointer to user data) tuples and (accessed user's public key, agent's public key, access permissions set by proxy, pointer to access log) tuple;

The pointer is a hash value pointing to encrypted user data or encrypted log data, which points to a key-value pair in the off-chain distributed hash table;

The data stored in the distributed hash table includes user data and access logs, specifically user data encrypted by a shared key and signed by a user or access logs encrypted by a shared key and signed by an agent.

Example 1

1. User registration. After the user registers successfully, generate the public key PUKu, private key PRKu, shared key SKu and predefined access rights list Alu; agent generation generates public key PUKa, private key PRKa, shared key SKa and predefined access rights list Ala; other After the institution or user registers successfully, generate public key PUKo, private key PRKo, shared key SKo and predefined access authority list ALo. Users exchange public keys and shared secrets with agents; organizations exchange public keys and shared secrets with agents.

2. Consensus and processing nodes process user registration information. The agent calculates according to its own information PUKa, Ala user registration information PUKu, Alu, institution registration information PUKo, Alo,

Take the hash value of (PUKu, PUKa) as the index Iu of the storage tuple (PUKu, PUKa, ALu, Pu) (P represents the hash value of encrypted user data, which is empty at this time);

Take the hash value of (PUKa, PUKu) as the index Ia of the storage tuple (PUKa, PUKu, ALa, Pa);

Take the hash value of (PUKo, PUKa) as the index Io of the storage tuple (PUKo, PUKa, ALo, Po);

Take the hash value of (PUKa, PUKo) as the index Ia of the storage tuple (PUKa, PUKo, ALa, Pa). Then the storage request is sent to the request pool, and the information is stored in the block after 3 or more consensus nodes reach a consensus.

3. Users share data. The user encrypts the data with the shared key SKu and attaches the access list alu to the signature and sends it to the agent. After the agent checks the user's identity successfully, it generates a request according to the index Iu and sends it to the request pool. The consensus and processing nodes look up the blockchain storage tuples (PUKu, PUKa, ALu, Pu) according to the index Iu, and vote based on whether PKUu and PKUa are the same. After 3 or more consensus nodes reach a consensus, the encrypted The data is stored in the off-chain DHT network D(Pu), the access permission list alu is updated in the block and the pointer Pu pointing to the encrypted data is stored (Pu is also the hash value of encrypted user data).

4. Access to data by institutions or other users. The agent requests data on behalf of the institution, and the agent includes the signature data of the institution, the access authority Alo applied by the institution in the request, appends the digital signature of the agent itself at the end, and sends the request to the consensus and processing node in the request pool to find the block according to the index Iu The tuples (PUKu, PUKa, ALu, Pu) stored in the chain, and vote according to whether PKUu, PKUa are the same and whether Alo belongs to ALu. After 3 or more consensus and processing nodes reach a consensus, they will return to the agent Encrypted data D(Pu) stored in the DHT network. The agent decrypts the data with the shared key SKu, and then encrypts and signs the data with the shared key SKo and sends it back to the agency.

5. Blockchain storage institution access records. The agent encrypts the access record with the shared key SKa, adds the access permission list Ala set by the agent, adds its own digital signature at the end, and sends it to the request pool. The consensus and processing nodes look up the tuples (PUKa, PUKu, ALa, Pa) stored in the blockchain according to the index Ia, and vote based on whether PUKa and PUKu are the same. After 3 or more consensus and processing nodes reach a consensus , store the encrypted access records in the off-chain DHT network D(Pl). Update the access authority list Ala and the pointer Pl pointing to the encrypted log in the block (Pl is also the hash value of the encrypted log).

6. Use of User Tracking Data. The agent sends a request on behalf of the user, including the access permission Alu applied by the user, and sends it to the request pool after adding its own digital signature at the end. The consensus and processing node looks up the tuples (PUKa, PUKu, ALa, Pa) stored in the blockchain according to the index Ia in the request, and votes based on whether PKUa, PKUu are the same and whether Alu belongs to ALa. After the consensus and processing nodes reach a consensus, the encrypted log D(Pl) stored in the DHT network is returned to the agent. The agent then returns encrypted logs to the user.

7. User changes data access rights. The agent sends out a request on behalf of the user, including the access right Alu that the user wants to change, and adds its own digital signature at the end and sends it to the request pool. The consensus and processing nodes look up the tuples (PUKu, PUKa, ALu, Pu) stored in the blockchain according to the index Iu in the request, and vote based on whether PKUu and PKUa are the same. After 3 or more consensus nodes reach a consensus , deposit the new Alu into the block.

8. The encrypted communication between the blockchain and the distributed hash table storage facility under the chain can be realized by mixing public and private key systems and symmetric key systems.

9. The agent in the figure is a logical entity that can exist in a distributed manner on the network. In order to further ensure data security, the realization of the services it provides is based on secure multi-party computing technology.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto, any changes or substitutions that can be easily imagined by those skilled in the art within the technical scope disclosed in the present invention, All should be covered within the protection scope of the present invention.

Claims (10)

1. The user data access control method based on block chain, it is characterized in that, comprising After registering information processing in the blockchain, set the restriction conditions for each user data access request to only receive the user's own access request or proxy access request that meets the user's set permissions, and set third-party users to only issue user data access requests through the proxy And only access user data as a proxy. 2. the block chain-based user data access control method according to claim 1, is characterized in that, in the block chain, registration information processing comprises the following steps: Step 1. After the user and the third-party user successfully register in the blockchain, the user's public key, private key, shared key and predefined access rights list are generated, and the third-party user's public key, private key, shared key and Pre-defined access rights list, and also generate the agent's public key, private key, shared key and predefined access rights list, then the user and the agent exchange their respective public keys and shared keys, and third-party users interact with the agent correspondingly public key and shared secret; Step 2. The agent calculates the public key of the agent, the user and the third-party user and the predefined access list to obtain the hash value of the third-party user public key, the user public key and the agent public key, and then The hash value of the user public key and the proxy public key is sequentially taken as the first index of the first storage tuple that sequentially includes the user public key, the proxy public key, the user's predefined access permission list and the first pointer, Taking the hash value of the proxy public key and the user public key sequentially as the second index of the second storage tuple that sequentially includes the proxy public key, the user public key, the proxy predefined access permission list and the second pointer, Take the hash value of the third-party user public key and proxy public key sequentially as the third storage tuple that sequentially contains the third-party user public key, proxy public key, third-party user predefined access permission list and third pointer index, At the same time, take the hash value of the proxy public key and the third-party user public key sequentially as the fourth element of the fourth storage tuple containing the proxy public key, the third-party user public key, the proxy predefined access permission list and the fourth pointer. index; Step 3. Initiate an information storage request to the request pool, and store all storage tuples and their corresponding indexes in the blockchain when a threshold number of consensus and processing nodes reach a consensus. 3. The block chain-based user data access control method according to claim 2, further comprising the user sharing data through an agent that satisfies the user's set authority, which includes the following steps: Step 1. The user encrypts the data with the user's shared key and attaches the user's predefined access rights list. After signing, the encrypted data is obtained, and the encrypted data is sent to the agent; Step 2. After the agent successfully checks the user's identity, it generates an encrypted data sharing request according to the first index and sends the encrypted data sharing request to the request pool; Step 3. Use the consensus and processing nodes to find out the first storage tuple stored in the blockchain according to the first index, and then perform the first type of voting consensus verification according to the registration information of users and agents. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted data is stored in the distributed hash table network under the blockchain, and then the user's predefined access permission list in step 1 is updated, and a pointer to the encrypted data is stored at the same time. 4. The block chain-based user data access control method according to claim 3, wherein the third-party user performs user data access as an agent, comprising the following steps: Step 1. The agent writes the third-party user's signature data and predefined access permission list in the user data access request, ends with the agent's signature data, and then sends the access request to the request pool; Step 2. Use the consensus and processing nodes to find out the first storage tuple stored in the blockchain according to the first index, and then perform the second type of voting consensus verification according to the registration information of users and agents. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted data stored in the distributed hash table network under the blockchain is returned to the agent; Step 3. The encrypted data is decrypted by the proxy through the user's shared key, and then the decrypted data is re-encrypted using the third-party user's shared key, and the re-encrypted data is sent to the third-party user after signing. 5. The block chain-based user data access control method according to claim 3 or 4, wherein the pointer of the encrypted data is a hash value pointing to the encrypted data of the user, pointing to a distributed hash value under the block chain. A key-value pair in a Greek table network. 6. The log access control method based on block chain, it is characterized in that, comprising After registering information processing in the blockchain, set the restriction condition of each user data access log access request to only receive proxy access log access requests or user access log access requests that meet the proxy setting permissions, and set third-party users to only pass through the proxy Issue an access request to the user data access log and access the user data access log only as a proxy. 7. The log access control method based on block chain according to claim 6, wherein the registration information processing in the block chain comprises the following steps: Step 1. After the user and the third-party user successfully register in the blockchain, the user's public key, private key, shared key and predefined access rights list are generated, and the third-party user's public key, private key, shared key and Pre-defined access rights list, and also generate the agent's public key, private key, shared key and predefined access rights list, then the user and the agent exchange their respective public keys and shared keys, and third-party users interact with the agent correspondingly public key and shared secret; Step 2. The agent calculates the public key of the agent, the user and the third-party user and the predefined access list to obtain the hash value of the third-party user public key, the user public key and the agent public key, and then The hash value of the user public key and the proxy public key is sequentially taken as the first index of the first storage tuple that sequentially includes the user public key, the proxy public key, the user's predefined access permission list and the first pointer, Taking the hash value of the proxy public key and the user public key sequentially as the second index of the second storage tuple that sequentially includes the proxy public key, the user public key, the proxy predefined access permission list and the second pointer, Take the hash value of the third-party user public key and proxy public key sequentially as the third storage tuple that sequentially contains the third-party user public key, proxy public key, third-party user predefined access permission list and third pointer index, At the same time, take the hash value of the proxy public key and the third-party user public key sequentially as the fourth element of the fourth storage tuple containing the proxy public key, the third-party user public key, the proxy predefined access permission list and the fourth pointer. index; Step 3. Initiate an information storage request to the request pool, and store all storage tuples and their corresponding indexes in the blockchain when a threshold number of consensus and processing nodes reach a consensus. 8. The block chain-based log access control method according to claim 7, wherein the third-party user accesses the access log through an agent, comprising the following steps: Step 1. The agent encrypts the access log with the agent's shared key, appends the agent's predefined access permission list, and ends with the agent's signature data to obtain the encrypted access log, generate an access log access request, and send the access log access request to the request pool ; Step 2. Use the consensus and processing nodes to find out the second storage tuple stored in the blockchain according to the second index, and then perform the third type of voting consensus verification according to the registration information of the agent and the user. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted access log is stored in the distributed hash table network under the blockchain, and then the agent's predefined access permission list in step 1 is updated, and a pointer to the encrypted access log is stored at the same time. 9. The block chain-based log access control method according to claim 8, further comprising the user accessing the access log by an agent, comprising the following steps: Step 1. The agent writes the user's predefined access permission list in the access request of the access log, ends with the agent's signature data, and then sends the access request to the request pool; Step 2. Use the consensus and processing nodes to find out the second storage tuple stored in the blockchain according to the second index, and then perform the fourth type of voting consensus verification according to the registration information of the agent and the user. When the threshold number of consensus and processing nodes When a consensus is reached, the encrypted access log stored in the distributed hash table network under the blockchain is returned to the agent; Step 3: The agent returns the encrypted access log to the user. 10. The block chain-based log access control method according to claim 8 or 9, wherein the pointer of the encrypted access log is a hash value pointing to the encrypted access log of the user, and points to the distributed access log under the block chain. A key-value pair in a hashtable network.