Data security access control method based on Falcon anti-quantum signature and block chain

Abstract

The invention discloses a Falcon anti-quantum signature and block chain-based data security access control method, and relates to the technical field of data security, and the method comprises the following steps: S1, a trusted agent TA issues a global public parameter set Params of a system; s2, an access user Ui joins a system, and obtains a digital certificate Cerdei and a certificate hash through a trusted agent TA; s3, the access user Ui obtains the authorization token through the authorization verification node; s4, the access user Ui accesses and obtains target data in the cloud server through the authorization token, wherein the target data is encrypted data uploaded to the cloud server by the data owner DOj; according to the method, a Falcon anti-quantum digital signature algorithm is adopted in the processes of identity registration, access authorization and access token issuing, and it is ensured that an access control system is still kept safe and reliable in a future quantum computing environment. The token signature cannot be forged, the access process can be verified, and a long-term effective anti-quantum security guarantee is provided for a cross-domain and multi-node access scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a data security access control method based on Falcon anti-quantum signature and block chain. BACKGROUND

[0002] In typical scenarios such as government data sharing, industrial internet, internet of things access, and cloud services, a large number of users and devices need to frequently initiate data access requests, and the access content often involves sensitive information and key business. Once the access process is subjected to forgery, tampering, or unauthorized operation, it will directly threaten the system security and data integrity. Therefore, realizing accurate authorization of the access subject and traceability of the access process is the core requirement of the current data security system. Existing solutions usually rely on centralized authentication and access control components, and lack cross-node verifiable mechanisms. At the same time, traditional RSA, elliptic curve cryptography ECC, and other signature systems will face failure risks in a quantum computing environment, making it difficult to meet the requirements of long-term security in the future.

[0003] With the increasing number of access subjects and data types, traditional access control mechanisms gradually expose their deficiencies in dynamic authorization, permission update, and revocation. Static authorization methods based on access control lists ACL or role-based access control RBAC are difficult to adapt to the rapid changes in access requirements, and access tokens rely heavily on centralized verification, which can be misused once leaked. In addition, the permission revocation process often relies on manual synchronization or reconstruction of policy structures, which is inefficient in propagation and difficult to isolate malicious access subjects in a large-scale system in a timely manner. In the face of quantum threats, cross-domain access, and complex system environments, there is an urgent need for a new access control method that integrates anti-quantum signature, blockchain tamper-proof features, and efficient verifiable data structures to realize authorized verifiability, rapid permission revocation, and full-process traceable high-security data access system.

[0004] Although existing research has proposed various role-based permission, attribute policy, blockchain storage, and token verification solutions in the field of data sharing and access control, there are still obvious limitations. First, mainstream access control systems generally rely on traditional digital signature algorithms or centralized authentication servers, lack anti-quantum capabilities, and once quantum computing becomes practical, existing signature and token mechanisms will face a systematic failure risk. Second, many current solutions only focus on the authorization process itself and lack efficient permission revocation and access subject anomaly detection mechanisms; when users have malicious behavior or access permissions change, new policies need to be issued or data structures need to be rebuilt, which cannot achieve immediate isolation and fine-grained revocation. The above deficiencies indicate that in large-scale data access and cross-domain sharing scenarios, it is necessary to build a new access control method that integrates anti-quantum signature, verifiable authorization structure, and on-chain traceable mechanism, thereby achieving a better balance between security, efficiency, and manageability. SUMMARY

[0005] The application aims to solve the above problems by designing a data security access control method based on Falcon anti-quantum signature and block chain.

[0006] The application achieves the above-mentioned purposes by the following technical solutions:

[0007] A data security access control method based on Falcon anti-quantum signature and block chain, comprising:

[0008] S1, a trusted agent TA publishes a global public parameter set Params of the system;

[0009] S2, an access user U i joins the system and obtains a digital certificate through the trusted agent TA and a certificate hash ;

[0010] S3, the access user U i obtains an authorization token through an authorized verification node;

[0011] S4, the access user U i accesses the target data in the cloud server through the authorization token, and the target data is encrypted data uploaded to the cloud server by a data owner DO j .

[0012] The application has the beneficial effects that: in the process of identity registration, access authorization and access token issuance, the Falcon anti-quantum digital signature algorithm is adopted, so that the access control system still maintains safety and reliability in the future quantum computing environment. The token signature cannot be forged, and the access process can be verified, thereby providing long-term effective anti-quantum security protection for cross-domain and multi-node access scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 is a flowchart of a data security access control method based on Falcon anti-quantum signature and block chain of the application;

[0014] Figure 2 is a structure diagram of the system;

[0015] Figure 3 is a security data access control flowchart of the access user. DETAILED DESCRIPTION

[0016] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will be combined with the accompanying drawings to make a clear and complete description of the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations.

[0017] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative labor are within the scope of protection of the present application.

[0018] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0019] In the description of the present application, it should be understood that the terms "upper", "lower", "inner", "outer", "left", "right", etc. indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship commonly placed when the product of the present application is used, or the orientation or positional relationship commonly understood by those skilled in the art, which is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the indicated device or element must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application.

[0020] In addition, the terms "first", "second", etc. are only used for differentiation in description, and cannot be understood as indicating or implying relative importance.

[0021] In the description of the present application, it should also be noted that, unless otherwise explicitly specified and limited, the terms "provided", "connected" and the like should be understood broadly, for example, "connected" can be fixedly connected, or detachably connected, or integrally connected; can be mechanically connected, or electrically connected; can be directly connected, or indirectly connected through an intermediate medium, or the internal communication of two elements. For those of ordinary skill in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0022] The specific embodiments of the present application will be described in detail below in combination with the accompanying drawings.

[0023] As Figure 1 , Figure 2 , Figure 3As shown, a data security access control method based on Falcon anti-quantum signature and block chain, comprising:

[0024] S1, the trusted agent TA publishes the global public parameter set Params of the system; specifically including:

[0025] S101, the trusted agent TA obtains the security parameters set by the system administrator ;

[0026] S102, the trusted agent TA sets the lattice related parameters according to the security parameters , the related parameters include modulus q, ring dimension n and finite field , and constructs a polynomial ring on the finite field , wherein x is a formal variable in the polynomial ring, is the nth power of x;

[0027] S103, the trusted agent TA generates a key pair according to the related parameters by executing the key generation function of Falcon signature algorithm , which is represented as: , wherein is represented as the key generation function of Falcon, is the lattice vector dimension, and the key pair is used for subsequent certificate issuance and identity authentication;

[0028] S104, the trusted agent TA establishes a Verkle tree structure for authorization and policy verification, and selects a finite field and a bilinear mapping group, the trusted agent TA selects two elliptic curve cyclic groups and , each with order , generator and , and defines the pairing mapping: ; the trusted agent TA defines the security hash function of the system: and the key derivation function ; the trusted agent TA randomly selects key parameters , calculates the generated parameters: and , and takes and as the public base point of Verkle tree commitment and verification;

[0029] S105, the trusted agent TA publishes the system parameters ;

[0030] S106, N authorization verification nodes AVN are deployed in the system Generating key pair according to system parameters , denoted as: , and the public key is returned to the trusted agent TA, wherein, is denoted as the key generation function of KZG commitment, is the authorized verification node AVN j The public key in the Verkle tree authorization verification is used to verify the commitment and path proof of the access policy node. is the corresponding private key, which is used for policy signature and authorization result generation; each authorized verification node AVN returns its public key to the TA for registration;

[0031] S107, the trusted agent TA collects the public keys of the N authorized verification nodes AVN , and forms the global public parameter set Params of the system in combination with the system parameters, denoted as: , wherein is denoted as the public key of all authorized verification nodes AVN;

[0032] S108, the trusted agent TA publishes the global public parameter set Params of the system in the system, and the global public parameter set Params is loaded by all network nodes, which is used for subsequent identity registration, credential issuance, access token generation and Verkle tree authorization verification process of the system, to ensure that all entities operate under a unified security system.

[0033] S2, the access user U i joins the system and obtains digital credentials and credential hashes through the trusted agent TA; specifically including:

[0034] S201, the access user U i performs Falcon signature algorithm to generate a signature key pair according to the global public parameter set Params, denoted as: ;

[0035] S202, the access user U i locally generates its own identity and attribute information, including identity identifier , attribute set (such as role, access level, organization to which it belongs, etc.) and timestamp ; and constructs a registration information set , wherein, is the identity identifier, is the public key of the access user U i , is a set of attributes, is a timestamp;

[0036] S203, access user U i uses the private key signs the registration information set to obtain an anti-quantum signature , denoted as: and sends the registration request to the trusted agent TA through a secure channel;

[0037] S204, the trusted agent TA judges whether the access user U i has been registered, if yes, the request is rejected; otherwise, it enters S205;

[0038] S205, the trusted agent TA verifies the correctness of the anti-quantum signature , and if the verification is passed, the trusted agent TA generates a digital credential i for the access user U , denoted as: and calculates the credential hash , denoted as: ; the correctness of the anti-quantum signature is verified by the trusted agent TA, specifically: calculating the hash , denoted as: and verifying the correctness of the anti-quantum signature through ;

[0039] S206, the trusted agent TA calls the distributed identity management smart contract DID Contract on the blockchain, writes the registration information , and completes the on-chain registration of the access user U i ;

[0040] S206', the plurality of authorized verification nodes AVN verify through the consensus mechanism, if the verification is passed, the authorized verification nodes AVN call the distributed identity management smart contract DID Contract to update the user credential state to "valid", and store the credential hash and the issuance record on the chain, and then enter S207; the verification through the consensus mechanism is specifically: the authorized verification nodes AVN verify the consistency of and the signature of the trusted agent TA, and check the validity of the public key i of the access user U ;

[0041] S207, the trusted agent TA returns the issued digital credential and the credential hash to the access user Ui ;

[0042] S208, Access User U i Verify digital credentials After verifying its correctness, Stored in the local security module, accessible to user U i Obtaining a legitimate identity and verifiable credentials within the system can be used for subsequent access requests and authorization verification.

[0043] S3, Access User U i Obtain the authorization token through the authorization verification node; specifically including:

[0044] S301, Access User U i Generate a random challenge value With current timestamp ,in The bit length of the security parameter;

[0045] S302, Access User U i According to digital credentials Random challenge value and current timestamp Construct the access request information Req, represented as: Then use the private key to generate a signature. , represented as: and request information Send the request to the adjacent authorized verification node (AVN) for access verification;

[0046] S303: The authorized verification node AVN verifies the legality of the request information based on the registration information in the blockchain. If the verification is successful, the process proceeds to S304. Specifically, the authorized verification node AVN verifies whether the request information meets the legality conditions. If it does, the verification passes; otherwise, it fails and the process ends. The legality conditions include conditions 1, 2, 3, and 4. Condition 1 is using the access user U... i public key Verify signature Is this condition met? Condition 2 is the challenge value. Has it appeared in the local request cache? Condition 3 is a timestamp. Whether it is within the system's allowed time window; Condition 4 is using access user U i Digital credentials verify Whether it is valid or not; if all four conditions are true, then the validity condition is met; otherwise, it is not met.

[0047] S304, Authorized Verification Node AVN based on index Data owner DO from the blockchain j Published access policy , verify whether to access the user U through condition 5 and condition 6 i Satisfy the access policy , if yes, go to S305; otherwise, reject the access request; condition 5 is the policy digest hash ; condition 6 is whether the attribute set of the access user U i is true Verify whether it is true; if both condition 5 and condition 6 are yes, the access policy is satisfied ; otherwise, the access policy is not satisfied ;

[0048] S305, the authorized verification node AVN constructs an authorization token , and calls the data access control smart contract on the blockchain to record , and then returns the authorization token to the access user U through a secure channel i , and the authorized verification node AVN calls the data access control smart contract on the blockchain to record , so as to realize the tamper-proof storage of the authorization record; the construction of the authorization token is as follows: the leaf node set of the Verkle tree is defined as: , wherein represents the set of registered users, is the authorization information of the user, and each internal node stores a node vector of multiple leaf nodes , which is represented as: , wherein, ; the node vector is constructed into an interpolation polynomial , which satisfies , the KZG commitment of the node vector is calculated , which is represented as: , for the current access user U i , the leaf node index and the leaf value are , the authorized verification node AVN constructs a polynomial , which is represented as: , and generates an evaluation proof , which is represented as: ; then the authorization token is constructed , which is represented as: , wherein, is the hash value of the authorized access user U k , is a randomly selected secret parameter;

[0049] S306, access user U i After receiving, the authorization token is stored in the local security module for verifying its access authority and legitimacy.

[0050] S4, access user U i Access the target data in the cloud server through the authorization token, the target data is the encrypted data uploaded to the cloud server by the data owner DO j ; specifically including:

[0051] S401, access user U i Construct a data access request , and obtain the data access request Anti-quantum digital signature at the authorization verification node AVN, expressed as: , ,

[0052] S402, access user U i Send the access information to the cloud server;

[0053] S403, the cloud server verifies whether the authorization verification node AVN's public key is valid, if so, go to S404; otherwise, refuse access;

[0054] S404, the cloud server verifies whether the commitment value and the corresponding evaluation proof are valid, if so, the verification is passed and go to S405; otherwise, refuse access;

[0055] S405, the cloud server retrieves the target data according to the index , and returns the target data to the access user U i , the target data is the encrypted data uploaded to the cloud server by the data owner DO j ; ;

[0056] S406, access user U i Decrypt the encrypted data using the legal session key or the authorization key, expressed as: ;

[0057] S407, if the access user U iOne of the following malicious behaviors exists: multiple submission of invalid tokens; attempt to counterfeit authorization information; abuse access rights; violate the use policy formulated by the data owner DO. The authorized verification node AVN performs the revocation process, that is, updates the Verkle tree; specifically: the authorized verification node AVN updates the corresponding leaf node and parent node commitment, reconstructs the polynomial , recalculates the node commitment , and regenerates the evaluation proof: , the revocation result is recorded on the chain, and the tamper-proof evidence of identity revocation is completed.

[0058] The data owner DO j uploads encrypted data to the cloud server Specifically: the data owner DO j selects a data set to be uploaded , and encrypts it using a symmetric encryption algorithm to obtain confidential data, denoted as: , wherein, is the data encryption key; the data owner DO j formulates an access policy according to business requirements and access control requirements , denoted as: , wherein, represents the allowed operation type, is the policy validity period; the data owner DO j calculates the policy digest hash , and calls the data access control smart contract on the blockchain to register on the chain , completes the tamper-proof publishing of the policy, denoted as the index information of the data.

[0059] The method has the following advantages:

[0060] 1. It has anti-quantum security and long-term trusted verification capability. The Falcon anti-quantum digital signature algorithm is used in the identity registration, access authorization and access token issuance process to ensure that the access control system remains secure and reliable in the future quantum computing environment. Token signature cannot be counterfeited, and access process is verifiable, providing long-term effective anti-quantum security for cross-domain, multi-node access scenarios.

[0061] 2、Identity registration process is credible, transparent and verifiable. User identity credentials are issued by a trusted agent TA using Falcon signature, and the credential hash is recorded in the distributed identity management contract of the blockchain, realizing the full-process traceability and non-tamperability of identity registration. The credential generation does not depend on the local storage of the centralized agency, significantly enhancing the reliability and credibility of the identity registration process. Compared with the traditional centralized identity management mode, this system has quantum security, decentralized credibility and verifiability, providing a reliable identity baseline for large-scale access control environment and supporting traceable verification of subsequent authorization processes.

[0062] 3、Efficient access authorization is realized, and large-scale concurrent environment is supported. The authorization verification node AVN constructs a high-branch access authorization tree through the Verkle tree and the KZG commitment structure, so that the verification complexity and the proof volume of the access authorization remain constant. The visitor only needs to carry a lightweight commitment and evaluation proof to obtain authorization, which greatly improves the authorization efficiency in multi-user and high-concurrency scenarios.

[0063] 4、It has a lightweight verifiable token mechanism, and has strong anti-forgery and anti-replay capabilities. The access token is generated by the AVN based on the Verkle tree commitment, KZG evaluation proof and Falcon digital signature, ensuring that the token cannot be forged, tampered with or replayed. At the same time, the token state is real-time searchable on the chain, so that the cloud server can verify the access permission of the visitor without relying on centralized trust, greatly improving the security of access control.

[0064] 5、Supporting fast and fine-grained permission revocation improves system controllability. When the access visitor has unauthorized or malicious behavior, the authorization verification node AVN can update the authorization state of the corresponding leaf node in the Verkle tree and recalculate its commitment and path proof to realize the immediate revocation of a single access visitor. Without reconstructing the entire policy tree, the revocation propagation speed is fast, especially suitable for real-time risk isolation needs of large systems, greatly improving the processing efficiency in dynamic authorization and permission change scenarios. This mechanism realizes efficient, lightweight and publicly verifiable authorization proof, which is significantly better than the traditional ACL-based access control structure.

[0065] 6、Realize traceable access and on-chain audit mechanism, and the security and management ability is improved significantly. The access authorization result and token state are recorded by the blockchain smart contract, realizing the full life cycle audit, tracking and tamper-proof evidence. The cloud server only needs to verify the on-chain record and Verkle tree commitment to determine whether the access is legal, realizing the transparency, credibility and verifiability of access control, which has good engineering application prospect.

[0066] The technical solutions of the present application are not limited to the above specific embodiments, and any technical variations made according to the technical solutions of the present application fall within the protection scope of the present application.

Claims

1. A data security access control method based on Falcon quantum-resistant signatures and blockchain, characterized in that, include: S1, Params, the global public parameter set of the Trusted Proxy (TA) publishing system; S2, Access User U i Join the system and obtain digital credentials through a trusted agent (TA). and credential hash ; S3, Access User U i Obtain the authorization token through the authorization verification node; S4, Access User U i Accessing and retrieving target data via an authorization token on a cloud server; the target data belongs to the data owner DO. j Encrypted data uploaded to the cloud server.

2. The data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 1, characterized in that, S1 includes: S101, Trusted Proxy (TA) obtains security parameters ; S102, Trusted Proxy (TA) based on security parameters Define the parameters related to the lattice cipher, including the modulus q, the ring dimension n, and the finite field. And construct a polynomial ring over a finite field. Where x is a formal variable in the polynomial ring. Let x be a power of n; S103, Trusted Proxy (TA) generates a key pair based on relevant parameters. , is represented as: ,in, This is represented as Falcon's key generation function. Represents the dimension of a lattice vector; S104. Trusted Proxy (TA) establishes a Verkle tree structure and selects a finite field. And bilinear mapping group, trusted agent TA chooses two elliptic curve cyclic groups. and Each of the following ranks is The generator is and Define the pairing mapping: Trusted Proxy (TA) defines the system's secure hash function: and key derivation function Trusted Proxy (TA) randomly selects key parameters. Calculate the generation parameters: and and will and As a common basis for Verkle tree commitments and verifications; S105, Trusted Agent TA Publishing System Parameters ; S106. The system deploys N Authorized Verification Nodes (AVNs). Generate a key pair based on system parameters. , is represented as: and the public key Returned to trusted proxy TA, where, This represents the key generation function based on the KZG commitment. AVN for Authorization and Verification Nodes j The public key in the Verkle tree authorization verification is used to verify the commitment and path proof of the access policy node; This is the corresponding private key, used for policy signing and authorization result generation; S107. Trusted Proxy (TA) collects the public keys of N authorized verification nodes (AVN). And combined with system parameters, a global common parameter set Params of the system is formed, which is represented as: ， in This represents the public key of the AVN for all authorized verification nodes; S108, the Trusted Agent (TA) publishes the system's global public parameter set, Params, into the system.

3. The data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 1, characterized in that, S2 includes: S201, Accessing User U i Generate a signature key pair based on the global public parameter set Params. ; S202, Accessing User U i Construct a set of registration information ,in, For identification purposes, For accessing user U i public key, For attribute set, For timestamps; S203, Access User U i Using private key For the registration information set Perform a signature to obtain a quantum-resistant signature. And send the registration request through a secure channel Send to trusted agent TA; S204, Trusted Proxy (TA) determines the access user U i If the user is already registered, the request will be rejected; otherwise, proceed to step S205. S205, Trusted Proxy (TA) Verification of Quantum-Resistant Signatures If the verification of the correctness of the information is successful, then the trusted proxy TA will generate an access user U. i Digital credentials And calculate the credential hash. ; S206. Trusted agent TA invokes the distributed identity management smart contract DID Contract on the blockchain, writes registration information, and completes access for user U. i On-chain registration; S207, Digital Certificates to be Issued by Trusted Agent (TA) With credential hash Returned to the accessing user U i ; S208, Access User U i Verify digital credentials After verifying its correctness, Stored in the local security module.

4. A data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 3, characterized in that, Between S206 and S207, there is also S206', where multiple authorized verification nodes (AVNs) register and verify through a consensus mechanism. If the verification is successful, the authorized verification node (AVN) calls the distributed identity management smart contract (DID Contract) to update the user's credential status to "valid" and sets the credential hash. The issuance record is stored on the blockchain and then proceeds to S207.

5. A data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 3, characterized in that, S3 includes: S301, Access User U i Generate a random challenge value With current timestamp ,in The bit length of the security parameter; S302, Access User U i According to digital credentials Random challenge value and current timestamp Construct the access request information Req, represented as: Then use the private key to generate a signature. , is represented as: and request information Send the request to the adjacent authorized verification node (AVN) for access verification; S303, The authorized verification node AVN verifies the legality of the request information based on the registration information in the blockchain. After the verification is successful, it proceeds to S304. S304, Authorized Verification Node AVN based on index Reading data from the blockchain from the data owner DO j Published access policies Verify whether user U has access i Satisfy access policy If the conditions are met, proceed to S305; otherwise, deny the access request. S305, Authorized Verification Node AVN constructs authorization token. And call the data access control smart contract on the blockchain to record. Then, the authorization token is sent through a secure channel. Returned to the accessing user U i And authorize the verification node AVN to call the data access control smart contract on the blockchain to record... ; S306, Access User U i Upon receipt, the authorization token will be sent. Stored in a local security module for verification of access permissions and legitimacy.

6. A data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 5, characterized in that, In S303, verifying the legitimacy of the request information specifically involves the authorized verification node AVN verifying whether the request information meets the legitimacy conditions. If it does, the verification passes; otherwise, it fails and the process ends directly. The legitimacy conditions include conditions 1, 2, 3, and 4. Condition 1 is the use of access user U. i public key Verify signature Is this condition met? Condition 2 is the challenge value. Has it appeared in the local request cache? Condition 3 is a timestamp Whether it is within the system's allowed time window; Condition 4 is using access user U i Digital credentials verify Whether it is valid or not; if all four conditions are true, then the validity conditions are met; otherwise, they are not met.

7. A data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 5, characterized in that, In S304, conditions 5 and 6 are used to verify whether user U has been accessed. i Satisfy access policy Condition 5 is a policy digest hash. Is this condition valid? Condition 6 is based on access user U. i attribute set verify Does it meet the condition? If both condition 5 and condition 6 are true, then the access policy is satisfied. Conversely, the access policy is not satisfied. .

8. A data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 5, characterized in that, In S305, the authorized verification node AVN constructs the authorization token. Specifically, the set of leaf nodes in a Verkle tree is defined as follows: ,in This represents the set of registered users. For user authorization information, each internal node stores a node vector of multiple leaf nodes. , is represented as: ,in, ; for node vectors Constructing interpolation polynomials ,satisfy Calculate node vectors KZG's commitment , is represented as: For the current user U i Corresponding leaf node index And leaf value Authorized verification node AVN construct polynomial , is represented as: and generate evaluation proof. , is represented as: Reconstruct the authorization token , is represented as: ,in, For authorized user U k hash value, These are randomly selected secret parameters.

9. A data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 1, characterized in that, S4 includes: S401, Access User U i Constructing a data access request And obtain the data access request at the authorized verification node AVN. Quantum-resistant digital signatures , is represented as: , , S402, Access User U i Access information Send to the cloud server; S403, the cloud server verifies the public key of the authorized verification node AVN. verify If the condition is met, proceed to S404; otherwise, deny access. S404, cloud server via commitment value and corresponding evaluation certificates verify If the condition is met, the verification passes and the process proceeds to S405; otherwise, access is denied. S405, cloud server according to index Retrieve the target data and return it to the accessing user U. i The target data is the data owner DO. j Encrypted data uploaded to the cloud server ; S406, Access User U i Encrypt data using a valid session key or authorization key. Decryption is performed, represented as: ; S407, If accessing user U i The following malicious behaviors have occurred: submitting invalid tokens multiple times; attempting to forge authorization information; abusing access permissions; or violating the usage policies established by the data owner (DO). The authorization verification node AVN executes the revocation process, which involves updating the Verkle tree; specifically, the authorization verification node AVN updates the commitments of the corresponding leaf nodes and parent nodes, and reconstructs the polynomial. Recalculate node commitments And regenerate the evaluation proof: The revocation result will be recorded on the blockchain, completing the immutable evidence storage for identity revocation.

10. A data security access control method based on Falcon quantum-resistant signatures and blockchain according to claim 1, characterized in that, Data owner DO j Encrypted data uploaded to the cloud server Specifically: Data owner DO j Select the data set to be uploaded The confidential data is then encrypted using a symmetric encryption algorithm, as shown below: ,in, Encryption key for the data; Data owner DO j And formulate access policies based on business needs and access control requirements. , is represented as: ,in, Indicates the allowed operation types. The policy's validity period; data owner DO j Compute strategy digest hash And call the data access control smart contract on the blockchain to register on the chain. Complete the tamper-proof release of the strategy. This represents the index information of the data.

Images