Data fine-grained access control method, system, equipment and medium

Abstract

The invention discloses a data fine-grained access control method, system and device and a medium, mainly relates to the technical field of access control, and is used for solving the problems of identity and attribute separation, low strategy updating efficiency and insufficient auditing capability in the existing scheme. Comprising the steps that a data user generates a distributed digital identity document containing at least one role attribute through a distributed digital identity system, and the distributed digital identity document is subjected to uplink storage after being audited by a registration mechanism; the data provider generates an ABE private key according to the main public key and an access control strategy, encrypts the ABE private key by using the DID public key of the data user, and sends the encrypted ABE private key to the data user; the data user obtains an ABE private key by using the DID private key; decrypting the ABE ciphertext on the block chain by using the ABE private key to obtain a symmetric key; and obtaining the original data in the trusted data space through symmetric key decryption.

Description

Technical Field

[0001] This application relates to the field of access control technology, and in particular to a method, system, device and medium for fine-grained data access control. Background Technology

[0002] With the acceleration of digital transformation, the value of cross-institutional data sharing in fields such as healthcare and finance is becoming increasingly prominent. Trusted data spaces, as a new paradigm of data collaboration, enable the compliant flow of data elements through standardized interfaces and security protocols. However, with numerous participants and complex business scenarios in data spaces, achieving fine-grained access control in an open environment has become a key challenge.

[0003] In existing technologies, mainstream solutions employ a centralized access control system combined with symmetric encryption. For example, medical institutions distribute keys to partners through a unified platform, and data users decrypt and share data using these keys. This type of solution has significant drawbacks: a) Rigid permissions: Once keys are distributed, it is difficult to dynamically adjust permissions (e.g., restricting a department to access specific medical records only during surgery); b) Identity dependency: Reliance on a centralized identity management system leads to challenges in identity verification during cross-institutional collaboration; c) Security risks: Centralized key storage makes the system vulnerable to attacks, and it is impossible to trace abnormal access behavior.

[0004] Some improvement solutions attempt to introduce Attribute-Based Encryption (ABE) technology to achieve conditional access through policy expressions. However, these solutions still have the following problems: Separation of identity and attributes: User attributes are not bound to decentralized identities, posing a risk of forged permissions; Inefficient policy updates: Policy changes require re-encrypting all data, failing to meet real-time requirements; Insufficient auditing capabilities: The lack of a trusted evidence storage mechanism makes it difficult to verify the compliance of historical accesses. Summary of the Invention

[0005] This application provides a method, system, device, and medium for fine-grained data access control to address the problems of existing solutions, such as the separation of identity and attributes, inefficient policy updates, and insufficient auditing capabilities.

[0006] Firstly, this application provides a method for fine-grained data access control, the method comprising: The data provider generates a master private key and a master public key for attribute-based encryption, and defines a set of spatial role attributes for the trusted data space; generates a symmetric key to encrypt the original data in the trusted data space, and generates an access control policy containing role attribute constraints; uses the master private key to encrypt the symmetric key, obtains the ABE ciphertext, and stores it on the blockchain. Data users generate a distributed digital identity document containing at least one role attribute through the distributed digital identity system, and store it on the blockchain after being reviewed by the registration authority; the distributed digital identity document contains a DID public key and a DID private key; The data provider generates an ABE private key based on the master public key and access control policy, encrypts the ABE private key using the data user's DID public key, and sends the encrypted ABE private key to the data user. Data users use the DID private key to obtain the ABE private key; they use the ABE private key to decrypt the ABE ciphertext on the blockchain to obtain the symmetric key; and they use the symmetric key to decrypt and obtain the original data in the trusted data space.

[0007] In one implementation of this application, the data provider generates a master private key and a master public key for attribute-based encryption, specifically including: Obtain the security parameter K; Choose a composite-order bilinear mapping based on the safety parameter k; Based on a composite order bilinear mapping, the master private key and master public key are output.

[0008] In one implementation of this application, the spatial role attribute set consists of several role attributes, and the role attributes include at least one of the following: organizational attributes, job attributes, and time-limited attributes.

[0009] In one implementation of this application, generating an access control policy that includes role attribute constraints specifically includes: Access control policies containing role attribute constraints can be obtained through a preset interface; the access control policies support "AND", "OR" and "threshold" operations.

[0010] In one implementation of this application, after encrypting the symmetric key with the master private key to obtain the ABE ciphertext and storing it on the blockchain, the method further includes: Record the blockchain metadata generated during the process of putting ABE ciphertext on the chain; the blockchain metadata includes at least: on-chain storage address, access policy hash, and encrypted timestamp.

[0011] Secondly, this application provides a fine-grained data access control system, the system comprising: The data provider generates the master private key and master public key for attribute-based encryption and defines the spatial role attribute set of the trusted data space; generates a symmetric key to encrypt the original data in the trusted data space and generates an access control policy containing role attribute constraints; and uses the master private key to encrypt the symmetric key to obtain the ABE ciphertext and store it on the blockchain. The data user is responsible for generating a distributed digital identity document containing at least one role attribute through the distributed digital identity system, and storing it on the blockchain after being reviewed by the registration authority; wherein, the distributed digital identity document contains a DID public key and a DID private key; The data provider generates an ABE private key based on the master public key and access control policy, encrypts the ABE private key using the data user's DID public key, and sends the encrypted ABE private key to the data user. The data user uses the DID private key to obtain the ABE private key; uses the ABE private key to decrypt the ABE ciphertext on the blockchain to obtain the symmetric key; and uses the symmetric key to decrypt and obtain the original data in the trusted data space.

[0012] In one implementation of this application, the data provider includes a generation component. Used to obtain the security parameter K; Choose a composite-order bilinear mapping based on the safety parameter k; Based on a composite order bilinear mapping, the master private key and master public key are output.

[0013] In one implementation of this application, the data provider includes a strategy component. This is used to obtain access control policies containing role attribute constraints through a preset interface; the access control policies support "AND", "OR", and "threshold" operations.

[0014] Thirdly, this application provides a fine-grained data access control device, the device comprising: processor; And memory, on which executable code is stored, which, when executed, causes the processor to perform a fine-grained data access control method as described above.

[0015] Fourthly, this application provides a non-volatile computer storage medium storing computer instructions thereon, which, when executed, implement a fine-grained data access control method as described above.

[0016] As can be seen from the above technical solutions, this application has the following advantages: I. A trusted binding between identity and attributes has been achieved: This application completely solves the problem of the separation between identity and attributes in traditional schemes by deeply coupling Distributed Digital Identity (DID) documents with Attribute-Based Encryption (ABE). After the role attributes of the data user are verified by the registration authority, they are written into the blockchain for notarization, and their DID public key serves as a unique identifier, forming a cryptographic binding with the attribute set. When the data provider uses the DID public key to encrypt the ABE private key, a three-layer verification chain of "identity-attribute-key" is effectively established: the ABE private key can only be obtained by decrypting with the DID private key, and the ABE private key strictly matches the role attribute constraints in the access control policy. This mechanism fundamentally eliminates the possibility of attribute forgery, because tampering with attributes requires simultaneously breaching the immutability of the blockchain notarization, the asymmetric encryption protection of the DID key pair, and the logical verification of the ABE policy—a triple defense.

[0017] II. Support for dynamic policy updates: Traditional ABE schemes require re-encrypting all data when policies change. This application achieves lightweight policy updates through a hybrid encryption architecture of "symmetric key + ABE". Specifically, (1) the original data is always stored encrypted with a symmetric key, and policy changes only require updating the ABE ciphertext (i.e., the ciphertext of the encrypted symmetric key); (2) the blockchain's smart contract can trigger an automated ABE ciphertext re-encryption process, and the data provider only needs to submit the new policy, which is then processed by the network nodes under the master public key in parallel computation; (3) the design of using DID public key encryption to transmit the ABE private key allows the new policy to be pushed to authorized users immediately without waiting for the key to be redistributed. This architecture reduces the computational complexity of policy updates from O(n) (data volume related) to O(1) (fixed cost), meeting the needs of real-time permission adjustments in scenarios such as medical care and finance.

[0018] III. Constructing a verifiable audit and evidence storage system: This application strengthens auditing capabilities through a dual-proofing mechanism of the blockchain: (1) all DID identity documents and their attribute change records are recorded on the blockchain in the form of transactions, forming a complete identity evolution log; (2) each ABE encrypted access behavior (including decryption requests, key acquisition, etc.) generates a verifiable certificate containing a timestamp, operator DID, and policy hash, which is written into the immutable ledger through a smart contract. During auditing, the encrypted version sequence on the blockchain can be traced to verify whether the access at any historical moment complies with the policy rules in effect at that time. In particular, since the symmetric key is always protected by the ABE encrypted key, even the data provider cannot unilaterally tamper with the access record, ensuring the non-repudiation of the audit data. This design upgrades compliance verification from traditional post-event sampling inspection to full, automated in-process recording. Attached Figure Description

[0019] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of a fine-grained data access control method provided in an embodiment of this application.

[0021] Figure 2 This is a schematic diagram of the internal structure of a fine-grained data access control system provided in an embodiment of this application.

[0022] Figure 3 This is a schematic diagram of the internal structure of a fine-grained data access control device provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.

[0025] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0026] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0027] The embodiment provides a method for fine-grained data access control, such as Figure 1As shown in the embodiments of this application, the method mainly includes the following steps: Step 110: The data provider generates a master private key and a master public key for attribute-based encryption, and defines a set of spatial role attributes for the trusted data space; generates a symmetric key to encrypt the original data in the trusted data space, and generates an access control policy containing role attribute constraints; uses the master private key to encrypt the symmetric key to obtain the ABE ciphertext and stores it on the blockchain.

[0028] In some embodiments, the data provider generates a master private key and a master public key for attribute-based encryption, specifically including: Obtain the security parameter K; Choose a composite-order bilinear mapping based on the safety parameter k; Based on a composite order bilinear mapping, the master private key and master public key are output.

[0029] The spatial role attribute set consists of several role attributes, and the role attributes must include at least one of the following: organizational attributes, job attributes, and time-limited attributes.

[0030] Specifically, generating access control policies that include role attribute constraints includes: Access control policies containing role attribute constraints can be obtained through a preset interface; the access control policies support "AND", "OR" and "threshold" operations.

[0031] After encrypting the symmetric key with the master private key to obtain the ABE ciphertext and storing it on the blockchain, the method also includes: Record the blockchain metadata generated during the process of putting ABE ciphertext on the chain; the blockchain metadata includes at least: on-chain storage address, access policy hash, and encrypted timestamp.

[0032] Based on the above description, this step achieves fine-grained data access control by combining Attribute Base Encryption (ABE) with blockchain technology, bringing the following practical benefits: First, the master private key and master public key generated based on a composite order bilinear mapping provide higher security, resisting quantum computing attacks, while supporting complex access policy logic (such as "AND", "OR", and "threshold" operations), making permission management more flexible. Second, the hybrid encryption architecture of encrypting the original data with a symmetric key and encrypting the symmetric key with ABE ensures both high efficiency in data encryption and fine-grained access control through ABE, avoiding the overhead of re-encrypting all data in traditional solutions. The design of the spatial role attribute set (including organizational, job, and time-related attributes) enables access control to accurately reflect the permission requirements in actual business scenarios. Storing the ABE ciphertext on the blockchain and recording relevant metadata (such as on-chain address, policy hash, and timestamp) not only ensures the immutability of the ciphertext but also provides a reliable traceability basis for subsequent audits. The entire solution maintains strong encryption while balancing performance and security requirements through a reasonable architecture design, making it suitable for distributed scenarios that require fine-grained permission management.

[0033] Step 120: The data user generates a distributed digital identity document containing at least one role attribute through the distributed digital identity system, and stores it on the blockchain after being reviewed by the registration authority.

[0034] The distributed digital identity document contains the DID public key and the DID private key.

[0035] Based on the above description, this step generates a Distributed Digital Identity (DID) document and stores it on the blockchain through a decentralized digital identity system, offering the following practical advantages: First, the use of an asymmetric encryption mechanism for the DID public and private keys ensures the security of identity authentication. The private key is independently kept by the user, avoiding the single point of failure risk of traditional centralized identity management systems. Second, the binding of role attributes to the DID document is verified by the registration authority before being uploaded to the blockchain, ensuring the authenticity of attribute information and preventing identity forgery through the immutability of the blockchain. The distributed digital identity document stored on the blockchain not only possesses global uniqueness but also enables cross-system interoperability, simplifying the identity authentication process across multiple platforms. Furthermore, since the generation and management of the DID document are entirely based on a decentralized mechanism, users have complete control over their own identity data, meeting privacy protection requirements. The entire process ensures identity credibility while also considering system scalability and user autonomy.

[0036] Step 130: The data provider generates an ABE private key based on the master public key and access control policy, encrypts the ABE private key using the data user's DID public key, and sends the encrypted ABE private key to the data user.

[0037] Based on the above description, this step, by generating an ABE private key through the data provider and encrypting its transmission using the data user's DID public key, achieves the following practical benefits: First, the ABE private key generated based on the master public key and access control policies strictly adheres to preset attribute permission constraints, ensuring that only users meeting specific role attributes can obtain decryption capabilities, thus eliminating the possibility of unauthorized access. Second, using the DID public key to encrypt the ABE private key utilizes the inherent confidentiality of asymmetric encryption and achieves a strong binding between the key and digital identity through the blockchain identity system, eliminating the need for an additional secure channel during key distribution. This design ensures key transmission security while avoiding the complexity of certificate management in traditional PKI systems. Throughout the entire process, the data provider never accesses the data user's DID private key, adhering to the principle of least privilege and ensuring the user's complete control over their decryption rights, providing a verifiable key transmission mechanism for fine-grained access control.

[0038] Step 140: The data user uses the DID private key to obtain the ABE private key; uses the ABE private key to decrypt the ABE ciphertext on the blockchain to obtain the symmetric key; and uses the symmetric key to decrypt and obtain the original data in the trusted data space.

[0039] Based on the above description, this step achieves a secure and controllable data access process through a layered decryption mechanism: First, the data user obtains the ABE private key by decrypting with the DID private key. This step ensures that only legitimate identity holders can enter the subsequent decryption process, preventing unauthorized access at the source. Second, the design of using the ABE private key to decrypt the ABE ciphertext on the blockchain to obtain the symmetric key leverages the fine-grained access control advantages of attribute-based encryption while ensuring the verifiability of key distribution records through the immutability of the blockchain. Finally, the architecture of using the symmetric key to decrypt the original data forms a triple security barrier of "DID identity authentication - ABE permission verification - symmetric key decryption" while ensuring decryption efficiency. Throughout the process, keys are strictly separated at each stage (DID private key is stored locally, ABE private key is temporarily obtained, and symmetric key is used for immediate decryption). This not only conforms to the security principle of minimizing the attack surface but also avoids security risks that may be introduced by human intervention through the natural connection of cryptographic mechanisms, providing an auditable end-to-end decryption solution for the trusted data space.

[0040] As can be seen from the foregoing description, this embodiment has the following advantages over the prior art: Attribute-based flexible authorization: Utilizing Attribute-Based Encryption (ABE), data providers can define granular access policies (e.g., "only cardiologists from top-tier hospitals can access this service in 2024"), whereas traditional RBAC requires predefined fixed roles, making it difficult to adapt to temporary collaboration needs (e.g., cross-hospital consultations). Dynamic permission adjustment: Policy changes do not require re-encrypting all data; only the policy expression needs to be updated, meeting real-time business needs (e.g., temporary data access during sudden outbreaks of epidemics).

[0041] Decentralized identity authentication combined with DID: Data users submit verifiable credentials (VCs) through distributed digital identities (DIDs), avoiding reliance on centralized identity management systems and solving the problem of cross-institutional mutual recognition. To prevent identity forgery, DIDs are bound to on-chain evidence storage, ensuring the authenticity of attributes (e.g., "doctor qualifications" must be certified by an authoritative institution before being recorded on the blockchain).

[0042] Enhanced data security and privacy protection: Dual encryption mechanisms, symmetric encryption (efficient) protects raw data (such as medical images), with keys accessible only to authorized users; ABE encryption (flexible) protects the symmetric key, ensuring that only users who meet the policy requirements can decrypt it; key separation management, with the symmetric key held by the data provider and the ABE private key distributed to users, reducing the risk of centralized leakage.

[0043] Enhanced resistance to attacks: Decentralized storage, encrypted keys and access records are stored on the blockchain to avoid the risk of single point of failure or tampering by centralized permission servers; controllable key lifecycle, supporting time constraints (such as "valid for 72 hours only") to prevent long-term permission abuse.

[0044] Supports cross-domain collaboration: Standardized DID and VC enable mutual recognition of identities between different institutions, eliminating the need to repeatedly build permission systems; Blockchain provides audit and traceability capabilities, recording all data access behavior on the chain for easy compliance review.

[0045] Automated permission revoke: If a user's attributes become invalid (e.g., a doctor leaves the company), the DID registry can revoke the VC and automatically block subsequent access, whereas traditional solutions require manual key revoke.

[0046] In addition, this application Figure 2 This application provides a fine-grained data access control system as an embodiment. For example... Figure 2 As shown in the embodiments of this application, the system mainly includes: Data provider 210 is used to generate the master private key and master public key for attribute-based encryption, and to define the spatial role attribute set of the trusted data space; generate a symmetric key to encrypt the original data in the trusted data space, and generate an access control policy containing role attribute constraints; use the master private key to encrypt the symmetric key to obtain the ABE ciphertext and store it on the blockchain. Data provider 210 includes generation components, Used to obtain the security parameter K; Choose a composite-order bilinear mapping based on the safety parameter k; Based on a composite order bilinear mapping, the master private key and master public key are output.

[0047] Data provider 210 includes a strategy component. This is used to obtain access control policies containing role attribute constraints through a preset interface; the access control policies support "AND", "OR", and "threshold" operations.

[0048] Data user 220 is used to generate a distributed digital identity document containing at least one role attribute through the distributed digital identity system, and store it on the blockchain after being reviewed by the registration authority; wherein, the distributed digital identity document contains a DID public key and a DID private key; Data provider 210 is used to generate ABE private key based on master public key and access control policy, encrypt ABE private key using DID public key of data user 220, and send encrypted ABE private key to data user 220. Data user 220 uses the DID private key to obtain the ABE private key; uses the ABE private key to decrypt the ABE ciphertext on the blockchain to obtain the symmetric key; and uses the symmetric key to decrypt and obtain the original data in the trusted data space.

[0049] The above are method embodiments of this application. Based on the same inventive concept, embodiments of this application also provide a fine-grained data access control device. Figure 3 As shown, the device includes: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a fine-grained data access control method as described in the above embodiments.

[0050] Specifically, the server-side data provider generates a master private key and a master public key for attribute-based encryption, and defines a set of spatial role attributes for the trusted data space; it generates a symmetric key to encrypt the original data in the trusted data space, and generates an access control policy containing role attribute constraints; it uses the master private key to encrypt the symmetric key, obtaining ABE ciphertext and storing it on the blockchain; the data user generates a distributed digital identity document containing at least one role attribute through the distributed digital identity system, and stores it on the blockchain after review by the registration authority; the distributed digital identity document contains a DID public key and a DID private key; the data provider generates an ABE private key based on the master public key and the access control policy, encrypts the ABE private key using the data user's DID public key, and sends the encrypted ABE private key to the data user; the data user obtains the ABE private key using the DID private key; decrypts the ABE ciphertext on the blockchain using the ABE private key to obtain the symmetric key; and decrypts the original data in the trusted data space using the symmetric key.

[0051] As described above, this embodiment of the application completely solves the problem of the separation between identity and attributes in traditional solutions by deeply coupling Distributed Digital Identity (DID) documents with Attribute-Based Encryption (ABE). After the role attributes of the data user are verified by the registration authority, they are written into the blockchain for notarization. The DID public key serves as a unique identifier and forms a cryptographic binding with the attribute set. When the data provider uses the DID public key to encrypt the ABE private key, a three-layer verification chain of "identity-attribute-key" is actually established: the ABE private key can only be obtained by decrypting with the DID private key, and the ABE private key strictly matches the role attribute constraints in the access control policy. This mechanism fundamentally eliminates the possibility of attribute forgery, because tampering with attributes requires simultaneously breaking through the three lines of defense: the immutability of the blockchain notarization, the asymmetric encryption protection of the DID key pair, and the logical verification of the ABE policy.

[0052] Traditional ABE schemes require re-encrypting all data when policies change. This application achieves lightweight policy updates through a hybrid encryption architecture of "symmetric key + ABE". Specifically, (1) the original data is always stored encrypted with a symmetric key, and policy changes only require updating the ABE ciphertext (i.e., the ciphertext of the encrypted symmetric key); (2) the blockchain's smart contract can trigger an automated ABE ciphertext re-encryption process, and the data provider only needs to submit the new policy, which is then processed by the network nodes under the master public key in parallel computation; (3) the design of using DID public key encryption to transmit the ABE private key allows the new policy to be pushed to authorized users immediately without waiting for the key to be redistributed. This architecture reduces the computational complexity of policy updates from O(n) (data volume related) to O(1) (fixed cost), meeting the needs of real-time permission adjustments in scenarios such as medical care and finance.

[0053] This application strengthens auditing capabilities through a dual-proofing mechanism of the blockchain: (1) all DID identity documents and their attribute change records are recorded on the blockchain in the form of transactions, forming a complete identity evolution log; (2) each ABE encrypted access behavior (including decryption requests, key acquisition, etc.) generates a verifiable certificate containing a timestamp, operator DID, and policy hash, which is written into the immutable ledger through a smart contract. During auditing, the encrypted version sequence on the blockchain can be traced to verify whether the access at any historical moment complies with the policy rules in effect at that time. In particular, since the symmetric key is always protected by the ABE encrypted key, even the data provider cannot unilaterally tamper with the access record, ensuring the non-repudiation of the audit data. This design upgrades compliance verification from traditional post-event sampling inspection to full, automated in-process recording.

[0054] In addition, embodiments of this application also provide a non-volatile computer storage medium storing executable instructions thereon, which, when executed, implement a fine-grained data access control method as described above.

[0055] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for fine-grained data access control, characterized in that, The method includes: The data provider generates a master private key and a master public key for attribute-based encryption, and defines a set of spatial role attributes for the trusted data space; generates a symmetric key to encrypt the original data in the trusted data space, and generates an access control policy containing role attribute constraints; uses the master private key to encrypt the symmetric key, obtains the ABE ciphertext, and stores it on the blockchain. Data users generate a distributed digital identity document containing at least one role attribute through the distributed digital identity system, and store it on the blockchain after being reviewed by the registration authority; the distributed digital identity document contains a DID public key and a DID private key; The data provider generates an ABE private key based on the master public key and access control policy, encrypts the ABE private key using the data user's DID public key, and sends the encrypted ABE private key to the data user. Data users use the DID private key to obtain the ABE private key; they use the ABE private key to decrypt the ABE ciphertext on the blockchain to obtain the symmetric key; and they use the symmetric key to decrypt and obtain the original data in the trusted data space.

2. The fine-grained data access control method according to claim 1, characterized in that, The data provider generates a master private key and a master public key for attribute-based encryption, specifically including: Obtain the security parameter K; Choose a composite-order bilinear mapping based on the safety parameter k; Based on a composite order bilinear mapping, the master private key and master public key are output.

3. The fine-grained data access control method according to claim 1, characterized in that, The spatial role attribute set consists of several role attributes, and the role attributes must include at least one of the following: organizational attributes, job attributes, and time-limited attributes.

4. The fine-grained data access control method according to claim 1, characterized in that, Generate access control policies that include role attribute constraints, specifically including: The access control policy containing role attribute constraints can be obtained through the preset interface; the access control policy supports "AND", "OR" and "threshold" operations.

5. The fine-grained data access control method according to claim 1, characterized in that, After encrypting the symmetric key with the master private key to obtain the ABE ciphertext and storing it on the blockchain, the method further includes: Record the blockchain metadata generated during the process of putting ABE ciphertext on the chain; the blockchain metadata includes at least: on-chain storage address, access policy hash, and encrypted timestamp.

6. A fine-grained data access control system, characterized in that, The system includes: The data provider generates the master private key and master public key for attribute-based encryption and defines the spatial role attribute set of the trusted data space; generates a symmetric key to encrypt the original data in the trusted data space and generates an access control policy containing role attribute constraints; and uses the master private key to encrypt the symmetric key to obtain the ABE ciphertext and store it on the blockchain. The data user is responsible for generating a distributed digital identity document containing at least one role attribute through the distributed digital identity system, and storing it on the blockchain after being reviewed by the registration authority; wherein, the distributed digital identity document contains a DID public key and a DID private key; The data provider generates an ABE private key based on the master public key and access control policy, encrypts the ABE private key using the data user's DID public key, and sends the encrypted ABE private key to the data user. The data user uses the DID private key to obtain the ABE private key; uses the ABE private key to decrypt the ABE ciphertext on the blockchain to obtain the symmetric key; and uses the symmetric key to decrypt and obtain the original data in the trusted data space.

7. The fine-grained data access control system according to claim 6, characterized in that, Data providers include generating components. Used to obtain the security parameter K; Choose a composite-order bilinear mapping based on the safety parameter k; Based on a composite order bilinear mapping, the master private key and master public key are output.

8. The fine-grained data access control system according to claim 6, characterized in that, Data providers include strategy components. This is used to obtain access control policies containing role attribute constraints through a preset interface; the access control policies support "AND", "OR" and "threshold" operations.

9. A fine-grained data access control device, characterized in that, The device includes: processor; And a memory having executable code stored thereon, which, when executed, causes the processor to perform a fine-grained data access control method as described in any one of claims 1-5.

10. A non-volatile computer storage medium, characterized in that, It stores computer instructions, which, when executed, implement a fine-grained data access control method as described in any one of claims 1-5.

Images