A permission management method suitable for twin applications

Abstract

The present invention belongs to the field of digital twin technology, specifically a permission management method adapted to twin applications. The method proposed in the present invention includes creating a unique identity identifier of a twin, performing twin identity key verification based on the unique identity identifier of each twin; enabling twins of different identities to access data content of corresponding permissions; encrypting the transmitted twin data content, and encrypting the key of the encrypted data content; decrypting the obtained encryption key and encrypted data content; and forwarding data packets using the twin as a data storage node. The permission management method adapted to twin applications of the present invention can effectively set security rules for twin applications and access policies for application data, and realize the authentication of twin identities and the confidentiality, integrity and efficiency of the data transmission process.

Description

Technical Field

[0001] The present invention belongs to the technical field of digital twins, and specifically relates to a permission management method adapted to twin applications. Background Art

[0002] Digital twin technology is a technology that makes full use of data from physical models, sensors, and other data and maps them to virtual space to form digital expressions. It has very wide applications in manufacturing and the Internet of Things. Through digital twin technology, the parameters of physical entities can be provided to simulate the operating effects in virtual space, and data collection and intelligent analysis can be performed, thereby improving efficiency and reducing costs for actual operations in physical space.

[0003] Common digital twin applications include:

[0004] 1. Digital design in the automotive, aerospace and other industrial fields uses digital twin technology to create product twins, conduct simulations in virtual space, and achieve feedback design, iterative innovation and continuous optimization;

[0005] 2. Smart city: building a digital city twin to preview the interactive operation of environment, infrastructure, population, land and other elements in the digital world;

[0006] 3. Smart healthcare combines digital twin technology with medical technology to achieve dynamic monitoring, simulation and emulation of human body operation mechanisms and medical equipment, improve medical diagnosis efficiency and optimize medical equipment supervision.

[0007] The digital twin mechanism breaks down the barriers between cyberspace and physical space, and realizes the virtual-real combination of physical objects. With the popularization of the concept of digital twins in various fields, the application scenarios of digital twin technology have become more extensive. At the same time, twin communication involves massive and complex data, which requires a good mechanism to transmit, store and maintain these data. On the one hand, the communication of twins needs to ensure the security, reliability and confidentiality of data during transmission. On the other hand, twins inherit the relationship between physical objects. The inheritance, association or mutual exclusion relationship between objects poses a challenge to the efficient transmission of data.

[0008] Therefore, it is necessary to perform a series of permission management, encryption processing and data authentication on the data in digital twin technology to effectively authenticate the user's identity. Summary of the invention

[0009] The purpose of the present invention is to propose a data permission management method that is suitable for twin applications and ensures the integrity and confidentiality of twin data and efficient and fast data transmission.

[0010] The permission management method adapted to twin applications proposed in the present invention includes creating a unique identity of the twin, verifying the twin identity key based on the unique identity of each twin; enabling twins with different identities to access data content with corresponding permissions; encrypting the transmitted twin data content and encrypting the key of the encrypted data content; decrypting the obtained encryption key and encrypted data content; forwarding data packets using the twin as a data storage node; the specific steps are:

[0011] (1) Create a unique twin identity:

[0012] The data is named using a hierarchical content ID based on a Merkle tree. The twin data is hierarchically named according to the hierarchical relationship of the physical entity. The name is sent when requesting data to obtain the corresponding data.

[0013] In the present invention, a data hash algorithm based on a hash tree is used to divide the data into blocks of fixed size and obtain hash values ​​based on a certain hash algorithm, and then hash the hash values ​​after combining them in pairs, forming a binary tree structure from bottom to top, and its root node is the content hash of the data;

[0014] (2) Generate identity keys through adaptive encryption algorithms, maintain the twin identity, and ensure secure data transmission; the twin that owns the data and the twin that has access to the data will have corresponding encryption and decryption keys;

[0015] (3) Generate content keys through an adapted encryption algorithm and encrypt the twin data content;

[0016] (4) Encrypt the content key using the identity key;

[0017] (5) When a twin application requests a certain twin data, it sends the hierarchical content ID of the data, and the twin application that owns the data will send the encrypted data packet to the requesting twin;

[0018] (6) When the twin that requests data receives a data packet, it first uses its own identity key to decrypt it and obtain the content key. If the identity key does not match, it means that it has no permission to access the data packet, and it cannot obtain the content key, that is, it cannot obtain the decrypted data content. On the contrary, if the identity key matches, the corresponding content key can be obtained, and the data packet can be decrypted to obtain the complete data content.

[0019] (7) For the twin that obtains the data packet, it can act as a storage node and forward the data packet, that is, forward its data packet to other twins that request the data; following the path optimal algorithm, the undecrypted data packet can be sent directly to the twin with the next request, and the decrypted data packet needs to be encrypted again before it can be forwarded.

[0020] The permission management method adapted to twin applications described in the present invention realizes the process of twin identity authentication, data encryption transmission and data decryption, and can effectively set the security rules for twin applications and the access policy for application data. The twin data reading permission can be fine-grainedly segmented, and the twin identity authentication can be efficiently realized to ensure the integrity and confidentiality of the twin data. Through a certain path optimization algorithm, a suitable twin can be selected to forward data packets, thereby making data transmission more efficient and fast. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a diagram of the twin data naming format of the permission management method adapted to twin applications described in the present invention.

[0022] Figure 2 It is a diagram showing that the twin described in the present invention can be used as a data storage node and that twins of different identities can access data content with corresponding permissions.

[0023] Figure 3 It is a diagram of obtaining the complete content of a data packet during the twin data transmission process described in the present invention.

[0024] Figure 4 It is a diagram of data content and key encryption transmission of the permission management method adapted to twin applications described in the present invention. DETAILED DESCRIPTION

[0025] The following is a further detailed description of the permission management method adapted to twin applications proposed in the present invention in conjunction with the accompanying drawings.

[0026] First, we will introduce the naming method of data in twins. Based on the hierarchical relationship between the twins' corresponding entities in the physical world and considering the importance of verifying data integrity, a hierarchical content ID based on a Merkle tree is used to name and address data. Figure 1 , which means that in a certain namespace, the data in a certain dataset will have a corresponding hash representation, such as / FDU / CS / Lab1 / student / hash-value represents a certain data in the student dataset of a laboratory in the School of Computer Science at Fudan University. The hash value is the last item of the hierarchical content ID. Therefore, the previous ID can be represented as: / FDU / CS / Lab1 / student / kDmcj73H1V.

[0027] The data generated by the twin data owner can be stored locally or transferred to other twins for storage. When other twins request data, they will decide whether to send the data packet and what kind of data packet to send according to the permissions. Twin data can be stored in multiple twins. When a twin requests data, the data will be obtained through the optimal distance or other suitable path algorithms. The twin data owner grants different access rights to twins of different identities according to different data types. Reference Figure 2 For example, the twin / FDU / CS / Lab1 / student has two types of data, / FDU / CS / Lab1 / student / kDmcj73H1V and / FDU / CS / Lab1 / student / jcMdk37HV7, which are respectively allowed to be viewed by twins with identities A, C, and B. When twins A and C request the / FDU / CS / Lab1 / student / kDmcj73H1V data, they can obtain the plaintext content, and when twin B requests the data, it can only obtain the ciphertext. However, if twin A is closer to B at this time or the matching algorithm is optimal, the data packet can be obtained from B. It can be seen that the present invention can ensure the confidentiality and efficiency of data during the twin data transmission process.

[0028] Figure 3 It is a diagram of obtaining the complete content of a data packet in the twin data transmission process described in the present invention. When a twin requests physical space data, the permission management method adapted to the twin application described in the present invention will be used to determine whether the twin has the right to access the data. If the permission is met, the corresponding complete data will be received; if the permission is not met, an encrypted data packet will be received, and the plain text cannot be viewed. The twin can forward the data packet to other twins.

[0029] Figure 4 Schematic diagram of data and key encryption transmission of the rights management method proposed by the present invention. Figure 4 , Twin 2 requests the data of Twin 1. Twin 1 will encrypt the data content through the content key CK to form an encrypted data packet E-Data. Twin 1 will use an asymmetric encryption algorithm to generate an identity encryption key EK and an identity decryption key DK for encryption and decryption of the content key CK. The content key CK will be encrypted through the EK generated by Twin 1 to generate an encrypted content key E-CK. Twin 2 will request the DK of Twin 1 through its own twin identity. When the identity of Twin 3 meets the access rules, E-CK can be decrypted through DK to obtain CK, and then the encrypted data content E-Data will be decrypted to obtain the complete data. Otherwise, the plaintext data will not be obtained, but only an encrypted data packet.

[0030] The present invention has been deployed on a small scale. Data transmission is achieved by using a named data network. First, several data twins are deployed to monitor in real time whether there are twins requesting data owned by the twin. At the same time, twins are deployed to request data and send the hierarchical content ID of the data. Experiments have shown that the encrypted data packet of the data can be received. At the same time, the twin will also request the identity decryption key DK and the content key CK. The plain text of the data content can be obtained within the scope of permission, otherwise it cannot be decrypted. It can be seen that this solution can ensure the integrity and confidentiality of the data.

Claims

1. A permission management method adapted to twin applications, characterized in that: This includes creating a unique identity for the twin, verifying the twin identity key based on the unique identity of each twin, and enabling twins with different identities to access data content with corresponding permissions; Encrypt the transmitted twin data content and the key of the encrypted data content; decrypt the obtained encryption key and encrypted data content; forward the data packet using the twin as a data storage node; The specific steps are: (1) Create a unique twin identity: The data is named using a hierarchical content ID based on the Merkle tree. The twin data is hierarchically named according to the hierarchical relationship of the physical entity. The name is sent when requesting data to obtain the corresponding data. (2) Generate identity keys through adaptive encryption algorithms, maintain the twin identity, and ensure secure data transmission; the twin that owns the data and the twin that has access to the data will have corresponding encryption and decryption keys; (3) Generate content keys through an adapted encryption algorithm and encrypt the twin data content; (4) Encrypt the content key using the identity key; (5) When a twin application requests a certain twin data, it sends the hierarchical content ID of the data, and the twin application that owns the data will send the encrypted data packet to the requesting twin; (6) When the twin that requests data receives a data packet, it first uses its own identity key to decrypt it and obtain the content key. If the identity key does not match, it means that it has no permission to access the data packet, and it cannot obtain the content key, that is, it cannot obtain the decrypted data content. On the contrary, if the identity key matches, the corresponding content key can be obtained, and the data packet can be decrypted to obtain the complete data content. (7) For the twin that obtains the data packet, it acts as a storage node and forwards the data packet, that is, forwards its data packet to other twins that request the data; following the path optimal algorithm, the undecrypted data packet is directly sent to the twin with the next request, and the decrypted data packet needs to be encrypted again before it can be forwarded.

2. The permission management method adapted to twin applications according to claim 1 is characterized in that: The data generated by the twin data owner is stored locally or transmitted to other twins for storage; when other twins request data, whether to send a data packet and what type of data packet to send are determined according to the permissions; the twin data is stored in multiple twins, and when a twin requests data, the data is obtained through the optimal distance or other suitable path algorithm; the twin data owner grants different access rights to twins of different identities according to different data types.

3. The permission management method adapted to twin applications according to claim 1 is characterized in that: When a twin requests physical space data, the permission management method adapted to the twin application is used to determine whether the twin has the right to access the data. If the permission is met, the corresponding complete data is received; If the permissions do not match, an encrypted data packet is received and the plain text cannot be viewed. The twin forwards the data packet to other twins.

4. The permission management method adapted to twin applications according to claim 1 is characterized in that: The data and key transmission process is as follows: there are two twins, the data request twin is responsible for sending the data name request data packet, and the data owner twin is responsible for encrypting and sending the data; the data owner uses the content key CK to encrypt the data content to form an encrypted data packet E-Data, and then uses the asymmetric encryption algorithm to generate the identity encryption key EK and the identity decryption key DK, which are used to encrypt and decrypt the content key. The content key CK is encrypted by the EK generated by the data owner twin to generate an encrypted content key E-CK; the data request twin requests DK through its own key. When the identity of the data request twin meets the access rules, E-CK is decrypted through DK to obtain the content key CK, and then the encrypted data content E-Data is decrypted to obtain the complete data.

Images