Power encryption database fine-grained access control method based on quantum key

Abstract

The embodiment of the invention provides a power encryption database fine-grained access control method based on a quantum key, and relates to the technical field of quantum communication. The access control method comprises the following steps: performing identity authentication on a data user applying for data access; after the data user passes the identity verification, verifying the user attribute of the data user, and issuing a dynamic access token; after identity verification and attribute verification, establishing a QKD channel between the data center and the data user, and generating a quantum key; the data center defines an access strategy according to the user attribute corresponding to the plaintext; encrypting a plaintext and an access strategy through the generated quantum key to obtain a ciphertext; storing the ciphertext in a distributed database of the data center; verifying whether the user attribute of the data user is consistent with the access strategy in the ciphertext according to the access token; under the condition of consistency, the data center distributes the secret key to the data user through the QKD channel; and the data user decrypts the ciphertext according to the distributed key to obtain a plaintext.

Description

Technical Field

[0001] This invention relates to the field of quantum communication technology, and more specifically to a fine-grained access control method for an electric power encryption database based on quantum keys. Background Technology

[0002] With the rapid development of information technology, data security has become a core concern across various industries. Traditional database security mechanisms primarily rely on classical cryptographic algorithms (such as RSA and AES) and role-based access control (RBAC). However, with the increasing sophistication of network attacks, especially the rapid development of quantum computing technology, traditional encryption algorithms face the risk of being cracked, and their security is no longer sufficient to meet the high standards of modern data protection. Quantum Key Distribution (QKD), as a key technology in the field of quantum communication, utilizes fundamental principles of quantum mechanics (such as the no-cloning theorem and measurement collapse) to provide information-theoretic security guarantees for key distribution, possessing the potential to resist quantum computing attacks. QKD technology can significantly improve the security of encrypted communication and address the quantum threats that traditional encryption algorithms may face. However, QKD still faces many challenges in practical applications, including key generation efficiency, stability over long distances, and the difficulty of integration with existing systems.

[0003] Attribute-based encryption (ABE) is an advanced encryption technology that achieves fine-grained access control through encryption methods based on user attributes. ABE offers high flexibility and scalability, dynamically adjusting access permissions based on user roles, permissions, or other contextual attributes, making it particularly suitable for multi-level security protection scenarios in large-scale distributed systems. However, research on the combination of QKD and ABE is relatively weak, especially in large-scale database systems. Seamlessly integrating the quantum-secure key distribution of QKD with the fine-grained access control of ABE remains a pressing technical challenge. Furthermore, inadequate authentication and admission mechanisms also limit the overall security of database systems. Therefore, developing an efficient and secure fine-grained access control method for databases, combining the advantages of QKD and ABE and incorporating innovative authentication mechanisms, has become a key research focus. Summary of the Invention

[0004] The purpose of this invention is to provide a fine-grained access control method for a quantum key distribution (QKD)-based encrypted power database. This method deeply integrates QKD's quantum-secure key distribution with ABE's encryption and decryption processes. Through ABE's attribute management and access policies, a flexible access control mechanism is designed to ensure that sensitive data in the database is only accessible to users meeting specific conditions. By combining QKD and ABE technologies, an efficient and secure fine-grained database access control system is constructed, balancing security and performance. Multi-layered authentication and dynamic admission mechanisms are introduced to prevent unauthorized access and enhance the system's defense capabilities against internal threats and external attacks.

[0005] To achieve the above objectives, embodiments of the present invention provide a fine-grained access control method for a quantum key-based power encryption database, the access control method comprising: Authenticate the identity of users requesting access to the data; After identity verification, the user attributes of the data user are verified, and a dynamic access token is issued. After identity verification and attribute verification, a QKD channel is established between the data center and the data user to generate a quantum key; The data center defines access policies based on the user attributes corresponding to the plaintext. The plaintext and access policy are encrypted using the generated quantum key to obtain the ciphertext; The encrypted text is stored in a distributed database in the data center; Based on the access token, verify whether the user attributes of the data user are consistent with the access policy in the ciphertext; Under consistent conditions, the data center distributes the key to the data user through the QKD channel; The data user decrypts the ciphertext using the distributed key to obtain the plaintext.

[0006] Optionally, the identity of data users requesting access to data is authenticated, including: Obtain the user identifier and timestamp of the data user; The hash value of the user's identifier and timestamp is calculated using the SHA3 hash function; A signature is generated using a lattice-based signature algorithm based on the hash value of the user identifier and the timestamp. The signature is verified.

[0007] Optionally, after authentication, the user attributes of the data user are verified, and a dynamic access token is issued, including: Verify the user attributes of the data users and issue attribute certificates; The user attributes are verified using a zero-knowledge proof protocol based on the attribute certificate. Upon successful verification, a dynamic access token is issued to the data user.

[0008] Optionally, after authentication and attribute verification, a QKD channel is established between the data center and the data user to generate a quantum key, including: The data center generates a 128-bit high-entropy random number using a quantum random number generator. Obtain the channel loss and noise values ​​of the QKD channel between the data center and the data user; Polarization correction is performed on the QKD channel based on phase drift prediction using machine learning. Determine whether the channel loss value is less than a first threshold and / or whether the noise value is less than a second threshold; When the value is less than the first threshold and / or the second threshold, a shared key is generated in the QKD channel by negotiating the high-entropy random number using the first protocol. When the value is greater than or equal to the first threshold and / or the second threshold, a second protocol is used to negotiate and generate a shared key in the QKD channel based on the high-entropy random number. Obtain the bit error rate and adaptive threshold of the QKD channel; Determine whether the bit error rate of the quantum bit is less than the adaptive threshold; When the value is less than a certain threshold, the shared key is secure. The shared key is subjected to LDPC error correction and Toeplitz matrix privacy amplification to generate a quantum key; The quantum key is divided into a first key and a second key.

[0009] Optionally, the data center defines access policies based on the user attributes corresponding to the plaintext, including: Generate the public key and master key based on the bilinear mapping; Based on the user attributes corresponding to the plaintext, define the access policy and generate the LSSS matrix.

[0010] Optionally, the plaintext and access policy are encrypted using the generated quantum key to obtain ciphertext, including: Select random values ​​to generate a shared vector; An intermediate encryption key is generated based on the access policy, random value, and parameters in the public key and master key in the LSSS matrix. Generate an encryption key based on the first key and the intermediate encryption key; The plaintext is encrypted using the random value, the shared vector, and the encryption key to obtain the ciphertext.

[0011] Optionally, the encrypted text is stored in a distributed database in the data center, including: The ciphertext is fragmented and reconstructed; The data center generates an HMAC value based on the ciphertext reconstructed from the fragments, the second key, and the hash function; The HMAC value and ciphertext are sent to a distributed database to form the final ciphertext packet; The distributed database reassembles the fragmented ciphertext in the received final ciphertext packet. The concatenated ciphertext is recalculated based on the second key to obtain a new HMAC value; The new HMAC value is compared with the HMAC value in the final ciphertext packet. If they match, it indicates that the ciphertext has not been tampered with, and the distributed database stores the final ciphertext packet.

[0012] Optionally, the data user decrypts the ciphertext using the distributed key to obtain the plaintext, including: The trusted attribute issuing authority generates a private key based on the user attributes and obtains the ciphertext from the data center; Determine whether the user attributes satisfy the access policy in the ciphertext; When the conditions are met, the intermediate encryption key is obtained; The encryption key is recovered based on the intermediate encryption key; The ciphertext is decrypted using the encryption key to obtain the plaintext.

[0013] Optionally, the access control method further includes: Access logs are recorded based on the blockchain; The data in the logs is fed into the LSTM model, and the anomaly score of the time series data is obtained based on the LSTM model. Determine whether the abnormal score is greater than the third threshold; An alert is triggered when the value exceeds the third threshold.

[0014] Optionally, an access policy is defined based on the user attributes corresponding to the plaintext, and an LSSS matrix is ​​generated, including: Filter the linearly correlated rows in the LSSS matrix and delete the linearly correlated rows; Filter the attributes in the LSSS matrix whose sharing weight is always zero or that cannot be used for decryption, and delete the rows corresponding to the attributes; The rank of the LSSS matrix is ​​reduced by elementary column transformations to obtain an optimized LSSS matrix.

[0015] Through the above technical solution, this invention provides a fine-grained access control method for an encrypted power database based on quantum key distribution. The method involves authenticating the data user requesting access, verifying the user's attributes after authentication, issuing a dynamic access token, establishing a QKD channel between the data center and the data user, generating a quantum key, defining an access policy based on the user attributes corresponding to the plaintext, encrypting the plaintext and access policy using the generated quantum key to obtain ciphertext, and storing the ciphertext in the data center's distributed database. Based on the access token, the method verifies whether the data user's attributes match the access policy in the ciphertext. If they match, the data center distributes a key to the data user through the QKD channel, and the data user decrypts the ciphertext using the distributed key to obtain the plaintext. This invention deeply integrates the quantum-secure key distribution of QKD with the encryption and decryption process of ABE. Through the attribute management and access policies of ABE, a flexible access control mechanism is designed to ensure that sensitive data in the database is only accessible to users who meet specific conditions. By combining QKD and ABE technologies, an efficient and secure fine-grained database access control system is constructed, balancing security and performance. It introduces multi-layered identity authentication and dynamic admission mechanisms to prevent unauthorized access and enhance the system's defense capabilities against internal threats and external attacks.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a fine-grained access control method for a quantum key-based power encryption database according to one embodiment of the present invention; Figure 2 This is a flowchart illustrating the process of authenticating data users according to one embodiment of the present invention; Figure 3 This is a flowchart illustrating the issuance of a dynamic access token according to one embodiment of the present invention; Figure 4 This is a flowchart of a quantum key generation process according to one embodiment of the present invention; Figure 5 This is a flowchart defining an access policy according to one embodiment of the present invention; Figure 6 This is a flowchart illustrating the process of obtaining encrypted text according to one embodiment of the present invention; Figure 7 This is a flowchart illustrating one embodiment of the present invention for storing encrypted text in a distributed database; Figure 8 This is a flowchart illustrating the process of obtaining plaintext according to one embodiment of the present invention; Figure 9 This is a flowchart illustrating the recording of access logs according to one embodiment of the present invention; Figure 10 This is a flowchart of generating an LSSS matrix according to one embodiment of the present invention. Detailed Implementation

[0018] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0019] In the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0020] like Figure 1 The diagram shows a flowchart of a fine-grained access control method for a quantum key-based power encryption database according to one embodiment of the present invention. Figure 1 In this context, the access control method may include: In step S1, the identity of the data user requesting access to the data is authenticated; In step S2, after authentication, the user attributes of the data user are verified and a dynamic access token is issued; In step S3, after identity verification and attribute verification, a QKD channel is established between the data center and the data user, and a quantum key is generated; In step S4, the data center defines access policies based on the user attributes corresponding to the plaintext; In step S5, the plaintext and access policy are encrypted using the generated quantum key to obtain the ciphertext; In step S6, the ciphertext is stored in the distributed database of the data center; In step S7, based on the access token, it is verified whether the user attributes of the data user are consistent with the access policy in the ciphertext; In step S8, if there is consistency, the data center distributes the key to the data user through the QKD channel; In step S9, the data user decrypts the ciphertext using the distributed key to obtain the plaintext.

[0021] In Figure 1In the method shown, step S1 can be used to authenticate the data user requesting access to the data. To ensure that only legitimate data users can obtain the data, it is necessary to authenticate the data user requesting access. The specific method for authentication can be of various forms known to those skilled in the art. In one example of the present invention, it may include, for example... Figure 2 The steps are shown. Specifically: In step S11, the user identifier and timestamp of the data user are obtained; In step S12, the hash value of the user's identifier and timestamp is calculated using the SHA3 hash function; In step S13, a signature is generated based on the hash value of the user identifier and the timestamp using a lattice-based signature algorithm; In step S14, the signature is verified.

[0022] In Figure 2 In the method shown, step S11 can be used to obtain the user identifier and timestamp of the data user. Step S12 can be used to calculate the hash value of the user identifier and timestamp of the data user using the SHA3 hash function. Based on the obtained hash value, a signature is generated according to the hash value of the user identifier and timestamp using the lattice-based signature algorithm in step S13. In step S14, the signature is verified by a trusted identity authentication center to ensure the authenticity of the data user's identity.

[0023] Step S2 can be used to verify the user attributes of the data user after authentication and issue a dynamic access token. The specific method for issuing the dynamic access token can be of various forms known to those skilled in the art. In one example of the present invention, it may include, for example... Figure 3 The steps are shown. Specifically: In step S21, the user attributes of the data user are verified and an attribute certificate is issued; In step S22, the user attributes are verified using a zero-knowledge proof protocol based on the attribute certificate; In step S23, if the verification is successful, a dynamic access token is issued to the data user.

[0024] In Figure 3 In the method shown, step S21 can be used to verify the user attributes of the data user and issue an attribute certificate through a trusted attribute issuing authority. Step S22 can be used to verify the user attributes based on the attribute certificate using a zero-knowledge proof protocol. Step S23 can be used to issue a dynamic access token to the data user upon successful verification; the dynamic access token serves as the credential for the data user's access permissions.

[0025] Step S3 can be used to establish a QKD channel between the data center and the data user after authentication and attribute verification, and to generate a quantum key. The specific method for generating the quantum key can be of various forms known to those skilled in the art. In one example of the present invention, it may include, for example... Figure 4 The steps are shown. Specifically: In step S31, the data center generates a 128-bit high-entropy random number using a quantum random number generator; In step S32, the channel loss and noise values ​​of the QKD channel between the data center and the data user are obtained; In step S33, the QKD channel is polarization corrected based on the phase drift predicted by machine learning. In step S34, it is determined whether the channel loss value is less than a first threshold and / or whether the noise value is less than a second threshold; In step S35, when the value is less than the first threshold and / or the second threshold, a shared key is generated in the QKD channel by negotiating a high-entropy random number using the first protocol. In step S36, when the value is greater than or equal to the first threshold and / or the second threshold, a shared key is generated in the QKD channel by negotiating a high-entropy random number using the second protocol. In step S37, the bit error rate and adaptive threshold of the QKD channel are obtained; In step S38, it is determined whether the bit error rate of the read qubit is less than the adaptive threshold; In step S39, the shared key is secure if the value is less than a certain threshold. In step S40, LDPC error correction and Toeplitz matrix privacy amplification are performed on the shared key to generate a quantum key; In step S41, the quantum key is divided into a first key and a second key.

[0026] In Figure 4In the method shown, step S31 can be used to generate a 128-bit high-entropy random number in the data center using a quantum random number generator, which is used as a one-time password for communication. Step S32 can be used to obtain the channel loss value and noise value of the QKD channel between the data center and the data user. Step S33 can be used to perform polarization correction on the QKD channel based on phase drift prediction by machine learning. The polarization correction is adjusted by a servo motor to reduce the bit error rate of the qubits. Step S34 can be used to determine whether the channel loss value is less than a first threshold and / or whether the noise value is less than a second threshold. Step S35 can be used to negotiate and generate a shared key in the QKD channel using a first protocol based on the high-entropy random number when the noise value is less than the first threshold and / or the second threshold. Step S36 can be used to negotiate and generate a shared key in the QKD channel using a second protocol based on the high-entropy random number when the noise value is greater than or equal to the first threshold and / or the second threshold. In steps S34 to S36, different protocols are selected to negotiate and generate the shared key based on the channel loss value and the noise value. In one example of this invention, the first protocol can be the BB84 protocol. Under the BB84 protocol, the data center sends a single photon, encoded as a polarization state, and the data user randomly measures and negotiates to generate a shared key, suitable for low-loss scenarios. The second protocol can be the E91 protocol. The E91 protocol uses entangled photon pairs and detects channel eavesdropping through Bell's inequality. If the loss exceeds a set threshold, key security can be confirmed. In one example of this invention, the first threshold for channel loss can be 50 dB, and the second threshold for noise can be 0.1. When the first threshold is less than 50 dB and the second threshold is less than 0.1, the shared key is negotiated and generated using the BB84 protocol; otherwise, the shared key is negotiated and generated using the E91 protocol. The generated shared key may still have discrepancies, therefore further processing is required. During error correction, to prevent information leakage, the amount of information that may be obtained by eavesdroppers is evaluated and controlled. Step S37 can be used to obtain the qubit error rate and adaptive threshold of the QKD channel. Step S38 can be used to determine whether the qubit error rate is less than the adaptive threshold. Step S39 can be used to confirm the security of the shared key if the value is less than a certain threshold. If the value is greater than a certain threshold, the current shared key is discarded, and a new shared key is generated. Step S40 can be used to perform LDPC error correction and Toeplitz matrix privacy amplification on the shared key to generate a quantum key. To enable co-encryption with ABE in subsequent steps, the quantum key is divided into a first key and a second key in step S41. The first key is used to protect the ABE encryption key, and the second key is used for session encryption, ensuring unified key management.

[0027] Step S4 can be used to define access policies in the data center based on the user attributes corresponding to the plaintext. The specific method for defining the access policy can take many forms known to those skilled in the art. In one example of the present invention, it may include, for example... Figure 5 The steps are shown. Specifically: In step S51, a public key and a master key are generated according to the bilinear mapping; In step S52, an access policy is defined based on the user attributes corresponding to the plaintext, and an LSSS matrix is ​​generated.

[0028] In Figure 5 In the method shown, step S51 can be used to generate a public key and a master key based on a bilinear mapping. The ABE system is initialized, generating the public key and master key. Step S52 defines the access policy based on the user attributes corresponding to the plaintext, generating an LSSS matrix. Each row of the matrix corresponds to an attribute, and each column represents the different shares participating in the sharing. To reduce encryption overhead, the LSSS matrix also needs to be optimized using a compression algorithm during generation. The specific method for generating the LSSS matrix can be of various forms known to those skilled in the art. In one example of the present invention, it may include, for example... Figure 10 The steps are shown. Specifically: In step S521, linearly correlated rows in the LSSS matrix are filtered out and deleted. In step S522, attributes in the LSSS matrix whose sharing weight is always zero or cannot be used for decryption are filtered out, and the corresponding rows of the attributes are deleted. In step S523, the rank of the LSSS matrix is ​​reduced by elementary column transformation to obtain the optimized LSSS matrix.

[0029] Step S5 can be used to encrypt the plaintext and access policy using the generated quantum key to obtain ciphertext. The specific method for obtaining the ciphertext can be of various forms known to those skilled in the art. In one example of the invention, it may include, for example... Figure 6 The steps are shown. Specifically: In step S61, a random value is selected to generate a shared vector; In step S62, an intermediate encryption key is generated based on the access policy, random value, and parameters in the public key and master key in the LSSS matrix; In step S63, an encryption key is generated based on the first key and the intermediate encryption key; In step S64, the plaintext is encrypted using a random value, a shared vector, and an encryption key to obtain ciphertext.

[0030] Quantum security is ensured by encrypting the plaintext using a first key combined with an encryption key. After obtaining the ciphertext, it needs to be stored. Step S6 can be used to store the ciphertext in a distributed database of the data center. In one example of the invention, this may include, for example... Figure 7 The steps are shown. Specifically: In step S71, the ciphertext is fragmented and reconstructed; In step S72, the data center generates an HMAC value based on the ciphertext reconstructed from the fragments, the second key, and the hash function; In step S73, the HMAC value and ciphertext are sent to the distributed database to form the final ciphertext packet; In step S74, the distributed database concatenates the fragmented ciphertext in the received final ciphertext packet. In step S75, the concatenated ciphertext is recalculated based on the second key to obtain a new HMAC value; In step S76, the new HMAC value is compared with the HMAC value in the final ciphertext packet. If they match, it indicates that the ciphertext has not been tampered with, and the final ciphertext packet is stored in the distributed database.

[0031] Step S71 involves fragmenting and reconstructing the ciphertext to prevent single-point leakage. Step S72 generates an HMAC value based on the reconstructed ciphertext, the second key, and a hash function. Step S73 sends the HMAC value and the ciphertext to the distributed database to form the final ciphertext packet. Step S74 reassembles the fragmented ciphertext in the received final ciphertext packet in the distributed database. Step S75 recalculates the reassembled ciphertext using the second key to obtain a new HMAC value. Step S76 compares the new HMAC value with the HMAC value in the final ciphertext packet. If they match, it indicates the ciphertext has not been tampered with, and the distributed database stores the final ciphertext packet. If they do not match, it means the data may have been modified or forged during transmission; verification fails, and the data is discarded.

[0032] Step S7 can be used to verify whether the user attributes of the data user are consistent with the access policy in the ciphertext based on the access token. Step S8: If consistent, the data center distributes the key to the data user through the QKD channel and encrypts the first key with the second key to prevent replay attacks.

[0033] Step S9 can be used by a data user to decrypt the ciphertext using the distributed key to obtain the plaintext. The specific method for obtaining the plaintext can be of various forms known to those skilled in the art. In one example of the present invention, it may include, for example... Figure 8 The steps are shown. Specifically: In step S81, the trusted attribute issuing authority generates a private key based on the user attributes and obtains the ciphertext from the data center; In step S82, it is determined whether the user attributes satisfy the access policy in the ciphertext; In step S83, if the conditions are met, the intermediate encryption key is obtained; In step S84, the encryption key is recovered based on the intermediate encryption key; In step S85, the ciphertext is decrypted using the encryption key to obtain the plaintext.

[0034] To prevent access logs from being tampered with, this access control method also includes, for example: Figure 9 The steps shown are for recording access logs, specifically: In step S91, access logs are recorded according to the blockchain; In step S92, the data in the log is fed into the LSTM model, and the anomaly score of the time series data is obtained based on the LSTM model. In step S93, it is determined whether the abnormal score is greater than the third threshold; In step S94, an early warning is triggered when the value exceeds the third threshold.

[0035] In Figure 9 In the method shown, step S91 records access logs based on the blockchain. Step S92 can be used to feed the data in the logs into an LSTM model, obtain anomaly scores for the time-series data based on the LSTM model, and obtain anomaly scores by learning and fitting normal behavior patterns through the LSTM model. This score reflects the degree of deviation between the currently observed data and the normal pattern expected by the model. Step S93 can be used to determine whether the anomaly score is greater than a third threshold. Step S94 can be used to trigger an alert when it is greater than the third threshold. By learning from historical normal time-series data through the LSTM model, long-term dependency characteristics and complex time-series changes of the data can be effectively captured, thereby improving the accuracy and real-time performance of anomaly detection. By using blockchain technology to record tamper-proof access logs, combined with an LSTM-based anomaly detection mechanism, access behavior can be monitored in real time, enhancing the system's security audit capabilities and regulatory compliance.

[0036] Through the above technical solution, this invention provides a fine-grained access control method for an encrypted power database based on quantum key distribution. The method involves authenticating the data user requesting access, verifying the user's attributes after authentication, issuing a dynamic access token, establishing a QKD channel between the data center and the data user, generating a quantum key, defining an access policy based on the user attributes corresponding to the plaintext, encrypting the plaintext and access policy using the generated quantum key to obtain ciphertext, and storing the ciphertext in the data center's distributed database. Based on the access token, the method verifies whether the data user's attributes match the access policy in the ciphertext. If they match, the data center distributes a key to the data user through the QKD channel, and the data user decrypts the ciphertext using the distributed key to obtain the plaintext. This invention deeply integrates the quantum-secure key distribution of QKD with the encryption and decryption process of ABE. Through the attribute management and access policies of ABE, a flexible access control mechanism is designed to ensure that sensitive data in the database is only accessible to users who meet specific conditions. By combining QKD and ABE technologies, an efficient and secure fine-grained database access control system is constructed, balancing security and performance. It introduces multi-layered identity authentication and dynamic admission mechanisms to prevent unauthorized access and enhance the system's defense capabilities against internal threats and external attacks.

[0037] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0038] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0039] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0040] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0041] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0042] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0043] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0044] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0045] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A fine-grained access control method for an electricity encryption database based on quantum key distribution, characterized in that, The access control method includes: Authenticate the identity of users requesting access to the data; After identity verification, the user attributes of the data user are verified, and a dynamic access token is issued. After identity verification and attribute verification, a QKD channel is established between the data center and the data user to generate a quantum key; The data center defines access policies based on the user attributes corresponding to the plaintext. The plaintext and access policy are encrypted using the generated quantum key to obtain the ciphertext; The encrypted text is stored in a distributed database in the data center; Based on the access token, verify whether the user attributes of the data user are consistent with the access policy in the ciphertext; Under consistent conditions, the data center distributes the key to the data user through the QKD channel; The data user decrypts the ciphertext using the distributed key to obtain the plaintext.

2. The access control method according to claim 1, characterized in that, Authenticating data users who request access to data includes: Obtain the user identifier and timestamp of the data user; The hash value of the user's identifier and timestamp is calculated using the SHA3 hash function; A signature is generated using a lattice-based signature algorithm based on the hash value of the user identifier and the timestamp. The signature is verified.

3. The access control method according to claim 1, characterized in that, After identity verification, the user attributes of the data user are verified, and a dynamic access token is issued, including: Verify the user attributes of the data users and issue attribute certificates; The user attributes are verified using a zero-knowledge proof protocol based on the attribute certificate. Upon successful verification, a dynamic access token is issued to the data user.

4. The access control method according to claim 1, characterized in that, After identity verification and attribute verification, a QKD channel is established between the data center and the data user, and a quantum key is generated, including: The data center generates a 128-bit high-entropy random number using a quantum random number generator. Obtain the channel loss and noise values ​​of the QKD channel between the data center and the data user; Polarization correction is performed on the QKD channel based on phase drift prediction using machine learning. Determine whether the channel loss value is less than a first threshold and / or whether the noise value is less than a second threshold; When the value is less than the first threshold and / or the second threshold, a shared key is generated in the QKD channel by negotiating the high-entropy random number using the first protocol. When the value is greater than or equal to the first threshold and / or the second threshold, a second protocol is used to negotiate and generate a shared key in the QKD channel based on the high-entropy random number. Obtain the bit error rate and adaptive threshold of the QKD channel; Determine whether the bit error rate of the quantum bit is less than the adaptive threshold; When the value is less than a certain threshold, the shared key is secure. The shared key is subjected to LDPC error correction and Toeplitz matrix privacy amplification to generate a quantum key; The quantum key is divided into a first key and a second key.

5. The access control method according to claim 4, characterized in that, The data center defines access policies based on the user attributes corresponding to the plaintext, including: Generate the public key and master key based on the bilinear mapping; Based on the user attributes corresponding to the plaintext, define the access policy and generate the LSSS matrix.

6. The access control method according to claim 5, characterized in that, The plaintext and access policy are encrypted using the generated quantum key to obtain the ciphertext, which includes: Select random values ​​to generate a shared vector; An intermediate encryption key is generated based on the access policy, random value, and parameters in the public key and master key in the LSSS matrix. Generate an encryption key based on the first key and the intermediate encryption key; The plaintext is encrypted using the random value, the shared vector, and the encryption key to obtain the ciphertext.

7. The access control method according to claim 6, characterized in that, Storing the ciphertext in a distributed database in the data center includes: The ciphertext is fragmented and reconstructed; The data center generates an HMAC value based on the ciphertext reconstructed from the fragments, the second key, and the hash function; The HMAC value and ciphertext are sent to a distributed database to form the final ciphertext packet; The distributed database reassembles the fragmented ciphertext in the received final ciphertext packet. The concatenated ciphertext is recalculated based on the second key to obtain a new HMAC value; The new HMAC value is compared with the HMAC value in the final ciphertext packet. If they match, it indicates that the ciphertext has not been tampered with, and the distributed database stores the final ciphertext packet.

8. The access control method according to claim 6, characterized in that, The data user decrypts the ciphertext using the distributed key to obtain the plaintext, including: The trusted attribute issuing authority generates a private key based on the user attributes and obtains the ciphertext from the data center; Determine whether the user attributes satisfy the access policy in the ciphertext; When the conditions are met, the intermediate encryption key is obtained; The encryption key is recovered based on the intermediate encryption key; The ciphertext is decrypted using the encryption key to obtain the plaintext.

9. The access control method according to claim 1, characterized in that, The access control method further includes: Access logs are recorded based on the blockchain; The data in the logs is fed into the LSTM model, and the anomaly score of the time series data is obtained based on the LSTM model. Determine whether the abnormal score is greater than the third threshold; An alert is triggered when the value exceeds the third threshold.

10. The access control method according to claim 5, characterized in that, Based on the user attributes corresponding to the plaintext, define the access policy and generate the LSSS matrix, including: Filter the linearly correlated rows in the LSSS matrix and delete the linearly correlated rows; Filter the attributes in the LSSS matrix whose sharing weight is always zero or that cannot be used for decryption, and delete the rows corresponding to the attributes; The rank of the LSSS matrix is ​​reduced by elementary column transformations to obtain an optimized LSSS matrix.

Images