Data access control method and device based on semantic support, and medium

Abstract

Disclosed in the present application are a data access control method and device based on semantic support, and a medium. The method comprises: a data provider establishing an ontology model of data semantics on the basis of ontology knowledge of each piece of distributed data source data, and uploading the ontology model to a blockchain network; providing rule information of the data source data, and writing a distributed data source data address and the rule information into a smart contract on the blockchain network, wherein the rule information is used for representing an access control policy for the distributed data source data; receiving a data access request uploaded by a data access end by means of the blockchain network, and acquiring authorization information for the data access request on the basis of the rule information in the smart contract; and if it is determined that the authorization information indicates that access is allowed, on the basis of a data access method corresponding to the ontology model, acquiring fine-grained data corresponding to the data access request, encrypting the fine-grained data, and then sending same to the data access end.

Description

Data access control method, device and medium based on semantic support

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on November 9, 2023, with application number 202311492798.1 and invention name “A data access control method, device and medium based on semantic support”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of data access control, and in particular to a data access control method, device, and medium based on semantic support. Background Art

[0003] Access control is a crucial technology for ensuring data security. It grants subjects access to objects based on predefined access authorization policies and controls the process by which subjects use these permissions, thereby enabling authorized access to system resources. Current general access control models primarily address data access authorization, preventing unauthorized access by legitimate users and ensuring authorized access to data within a secure and controllable environment. Attribute-based access control methods are widely used in open and distributed systems due to their flexibility and applicability.

[0004] However, as the scale and complexity of systems increase, the number of attributes and policies involved also increases. This complicates policy management when using attribute-based access control for data access control. The system needs to process a large number of attributes and rules, which increases the difficulty of policy maintenance. Furthermore, the lack of consideration for the semantic characteristics of the data itself leads to low access control accuracy. Furthermore, different departments, applications, or services may define different policies for the same data during use, leading to inconsistent access control behavior and making it difficult to maintain policy consistency.

[0005] Summary of the Invention

[0006] In order to solve the above technical problems, one or more embodiments of the present application provide a data access control method, device and medium based on semantic support.

[0007] One or more embodiments of the present application adopt the following technical solutions:

[0008] One or more embodiments of the present application provide a data access control method based on semantic support, the method comprising:

[0009] The data provider builds an ontology model of data semantics based on the ontology knowledge of each distributed data source and uploads the ontology model to the blockchain network;

[0010] The data provider provides rule information of the data source data, and writes the distributed data source data address and the rule information into the smart contract of the blockchain network; wherein the rule information is used to represent the access control policy of the distributed data source data;

[0011] The data provider receives a data access request uploaded by the data access client through the blockchain network, and obtains authorization information for the data access request based on the rule information in the smart contract;

[0012] If the data provider determines that the authorization information allows access, it obtains fine-grained data corresponding to the data access request based on the data access method of the ontology model, encrypts the fine-grained data, and sends it to the data access terminal.

[0013] Optionally, in one or more embodiments of the present application, the data provider establishes an ontology model of data semantics based on the ontology knowledge of each distributed data source data, and uploads the ontology model to the blockchain network, specifically including:

[0014] Acquire ontological elements of each distributed data source data; wherein the ontological elements include: access control concepts, access control rules and data source mapping rules;

[0015] Determining, based on the application scenarios corresponding to the distributed data source data, the attributes of the distributed data source data and the relationships between the distributed data source data;

[0016] Performing reasoning verification on the ontology elements, the attributes, and the relationships based on a preset ontology reasoning method, and determining the ontology knowledge of each of the distributed data source data if the verification passes; wherein the preset ontology reasoning method is defined based on the ontology reasoning rules in the blockchain network rule library;

[0017] The ontology knowledge is standardized according to a preset ontology modeling language to obtain an ontology model of data semantics; wherein the preset ontology modeling language includes: network ontology language OWL, resource description framework language RDF;

[0018] The ontology model is uploaded to the blockchain network to update the public knowledge ontology library within the blockchain network.

[0019] Optionally, in one or more embodiments of the present application, before uploading the ontology model to the blockchain network, the method further includes:

[0020] The data provider sends identity authentication information to the blockchain network; wherein the identity authentication information includes: a data provider identifier and a data provider identity certificate;

[0021] The blockchain network performs identity authentication on the data provider based on the data provider identity certificate to obtain an authentication result;

[0022] The data provider receives the authentication result to determine whether to upload the ontology model to the blockchain network based on the authentication result.

[0023] Optionally, in one or more embodiments of the present application, the data provider provides rule information of the data source data, and writes the distributed data source data address and the rule information into the smart contract of the blockchain network, specifically including:

[0024] The data provider determines the access rights of the ontology model based on the resource type corresponding to the ontology model;

[0025] Based on the access rights, establishing rule logic of access conditions and access results corresponding to the ontology model;

[0026] The rule logic is defined based on a preset semantic rule language, and rule information of the data source data is provided to write the distributed data source data address and the corresponding rule information into the smart contract of the blockchain network; wherein the preset semantic rule language is SWRL.

[0027] Optionally, in one or more embodiments of the present application, before the data provider receives the data access request uploaded by the data access terminal through the blockchain network, the method further includes:

[0028] The data access terminal sends identity authentication information to the blockchain network; wherein the identity authentication information includes: a data access terminal identifier and a data access terminal identity certificate;

[0029] The blockchain network performs identity authentication on the data access terminal based on the data access terminal identity certificate to obtain an authentication result;

[0030] If it is determined that the authentication is successful, the blockchain network sends the data access request uploaded by the data access end to the data provider end.

[0031] Optionally, in one or more embodiments of the present application, obtaining authorization information of the rule information in the smart contract for the data access request specifically includes:

[0032] The blockchain network obtains attribute information in the data access request; wherein the attribute information includes: identity information of the data access end, request resource information, and timestamp information;

[0033] The blockchain network traverses the rule information in the public knowledge ontology library to obtain rule information that matches the attribute information;

[0034] The blockchain network determines whether the attribute information satisfies the access conditions in the matching rule information, so as to return the authorization information of the data access request to the data provider.

[0035] Optionally, in one or more embodiments of the present application, before acquiring fine-grained data corresponding to the data access request based on the data access mode of the ontology model, the method further includes:

[0036] Based on the ontology model, performing data structure conversion on each of the distributed data source data to obtain standard distributed data source data;

[0037] Determining neighborhood concepts and inter-concept relationships of the standard distributed data source data according to the ontology model, so as to determine mapping rules of the standard distributed data source based on the neighborhood concepts and inter-concept relationships;

[0038] Based on the mapping rules, the standard distributed data source and the ontology knowledge of the standard distributed data source are mapped to integrate the data of each distributed data source to obtain a virtual knowledge graph.

[0039] Optionally, in one or more embodiments of the present application, obtaining fine-grained data corresponding to the data access request based on the data access method of the ontology model, encrypting the fine-grained data and sending it to the data access terminal specifically includes:

[0040] generating a query instruction corresponding to the data access request based on a preset query language;

[0041] Calling the query interface of the virtual knowledge graph to send the query instruction to the virtual knowledge graph based on the query interface, obtaining data corresponding to the data access request according to the mapping of the virtual knowledge graph, and aggregating and generating fine-grained data;

[0042] The fine-grained data is encrypted based on a preset encryption method, so as to transmit the encrypted fine-grained data to the data access end based on the blockchain network.

[0043] One or more embodiments of the present application provide a data access control device based on semantic support, the device comprising: a memory for storing computer program instructions and a processor for executing program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to execute any of the methods described above.

[0044] One or more embodiments of the present application provide a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to execute any of the above-described methods.

[0045] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0046] Based on the ontological knowledge of each data source in each distributed data source, a data semantics ontology model is established. This allows for the definition of access rules based on ontology, avoiding the ambiguity inherent in traditional access methods and making the call access process more reliable and accurate. The established ontology model is uploaded to the blockchain, where smart contracts are defined and uploaded to the blockchain based on the rules of the data source data. This facilitates policy management and maintenance and makes access control policies more flexible and scalable. The data access method corresponding to the ontology model enables semantically supported fine-grained data queries, achieving unified access to data from different data sources. Furthermore, the blockchain-based distributed query process enables efficient processing of large-scale data collections and access requests. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments described in the present application. For those skilled in the art, other drawings can be obtained based on these drawings without inventive work. In the drawings:

[0048] FIG1 is a flow chart of a data access control method based on semantic support provided by an embodiment of the present application;

[0049] FIG2 is a schematic diagram of an ontology knowledge update process provided by an embodiment of the present application;

[0050] FIG3 is a schematic diagram of the internal structure of a data access control device based on semantic support provided in an embodiment of the present application;

[0051] FIG4 is a schematic diagram of the internal structure of a non-volatile storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] Embodiments of the present application provide a data access control method, device, and medium based on semantic support.

[0053] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0054] As shown in FIG1 , one or more embodiments of the present application provide a data access control method based on semantic support, which specifically includes the following steps:

[0055] S101: The data provider establishes an ontology model of data semantics based on the ontology knowledge of each distributed data source data, and uploads the ontology model to the blockchain network.

[0056] In order to facilitate the support of semantic reasoning, implement data access control based on semantic support, improve the accuracy and reliability of access control, and avoid the ambiguity and vagueness problems that may exist in traditional access control, the data provider in the embodiment of the present application, that is, the data owner, will establish an ontology model of data semantics based on the ontology knowledge of each distributed data source data, and upload the established ontology model to the blockchain, so that the purpose of distributed processing of large-scale data sets and access requests can be achieved based on the ontology model on the blockchain. By putting the ontology model on the chain, the distributed advantages of the blockchain are fully utilized, and the scalability and reliability of data access control are improved.

[0057] Specifically, in one or more embodiments of the present application, the data provider establishes an ontology model of data semantics based on the ontology knowledge of the data from each distributed data source, and uploads the ontology model to the blockchain network, which specifically includes the following process:

[0058] First, ontology elements of each distributed data source are obtained. It should be noted that ontology elements include access control concepts, access control rules, and data source mapping rules. Then, based on the application scenarios corresponding to each distributed data source, the attributes of each distributed data source and the relationships between them are determined. The ontology elements, attributes, and these relationships are then reasoned and verified using a pre-set ontology reasoning method. If verification passes, the ontology knowledge of the distributed data source data is determined. It should be noted that the pre-set ontology reasoning method is defined based on the ontology reasoning rules in the blockchain network rule base. After obtaining the ontology knowledge, it is standardized using a pre-set ontology modeling language to obtain an ontology model of the data semantics. It should be noted that pre-set ontology modeling languages ​​include Web Ontology Language (OWL) and Resource Description Framework (RDF). The ontology model is then uploaded to the blockchain network to update the public knowledge ontology library within the blockchain network. In addition, it should be noted that the construction of ontology knowledge is an iterative process. In practical applications, it needs to be modified and improved multiple times according to actual conditions. In the process of building the ontology model, ontology editing tools such as Protégé tools can be used to assist in the creation and management of the ontology.

[0059] It should be noted that ontology is a formalized knowledge representation method that describes the semantic information of data and the meaning of access policies by defining entities, attributes, and relationships. In the embodiments of this application, ontology knowledge is first used to model data semantics, thereby defining the data's structure, attributes, and relationships as concepts, properties, and relationships within the ontology. This allows for a more accurate representation of the data's meaning and semantic relationships. Furthermore, access rights and policies are also represented as concepts and attributes within the ontology, including user roles, access conditions, and operational permissions. This facilitates comparison and reasoning between the context of the request and the data and rights defined in the ontology model when making data requests, achieving precise access control. As shown in Figure 2, in a specific application scenario of this application, the ontology knowledge of distributed data sources acquired by the data provider is obtained through the following process: First, ontology elements are determined, that is, the elements and scope of the ontology are clarified, and the access control concepts, access control rules, and data source mapping rules that need to be represented and described are determined. Then, attributes and rules are defined, that is, attributes and relationships are defined for each entity based on the actual application scenario. It should be understood that an entity refers to a subject, resource, or other entity related to access control. Attributes describe the characteristics, properties, or status of an entity, including object attributes and data attributes. Object attributes describe the relationships between entities. They are usually used to represent complex relationships between entities, such as hierarchical relationships, association relationships, and composite relationships. For example, "parent" is an object attribute that associates a person entity with its parent entity. Data attributes describe the characteristics or attribute values ​​of an entity and are usually used to represent a specific attribute or characteristic of an entity. The value of a data attribute can be a specific data type, such as a string, a number, a date, etc. For example, define user attributes such as user name, department, role, etc.; and resource attributes such as name, type, etc. At the same time, define the relationship between attributes and entities, such as attributes owned by users, attributes owned by resources, etc. The relationship can be a one-to-one, one-to-many, or many-to-many association relationship.

[0060] Furthermore, in order to ensure the reliability and security of data access, in one or more embodiments of the present application, before uploading the ontology model to the blockchain network, the method further includes:

[0061] The data provider sends authentication information to the blockchain network; it should be noted that this authentication information includes the data provider's identifier and identity certificate. The blockchain network then authenticates the data provider based on the identity certificate in the identity information, obtaining an authentication result. The data provider then receives this authentication result and, based on it, determines whether to upload the ontology model to the blockchain network, enabling subsequent distributed automated access based on the blockchain. By requiring the data provider to provide authentication information, the blockchain network can verify the authenticity and legitimacy of the data provider. This approach effectively prevents unauthorized or malicious entities from uploading data to the blockchain, thereby ensuring the overall security of data within the blockchain network.

[0062] S102: The data provider provides rule information of the data source data, and writes the distributed data source data address and the rule information into the smart contract of the blockchain network; wherein the rule information is used to represent the access control policy of the distributed data source data.

[0063] Since most existing access control methods are centralized, it is difficult for the data provider to scale when processing large-scale data sets and access requests, and the processing efficiency is low. In traditional distributed environments, due to the increase in system scale and complexity in attribute-based access control methods, the number of attributes and policies involved will also increase, which makes policy management complicated. The system needs to process a large number of attributes and rules, which increases the difficulty of policy maintenance. Secondly, during use, different departments, applications or services may define different policies for the same data, which leads to inconsistent access control behavior. That is to say, in large-scale data sets and access requests, since the data is distributed in different data sources or services, there are different data definitions and access policies between them, and there is a lack of unified standards, making the policy management and maintenance process more difficult. Therefore, in order to facilitate the management of access control policies, the data provider in the embodiment of the present application provides a rule language for data source data, so that the distributed data source data address and rule information are written into the smart contract of the blockchain network. It should be noted that the rule information is used to represent the access control policy of each data in the distributed data source.

[0064] Specifically, in one or more embodiments of the present application, the data provider provides rule information for each data source data, and writes the distributed data source data address and rule information into the smart contract of the blockchain network, which specifically includes the following process:

[0065] First, the data provider determines the access rights for the ontology model based on the resource type corresponding to the ontology model. This means first determining which resource data within the data provider requires protection, as well as the permission and operation types for each resource type. For example, resource A may require administrator-level access, while resource B may require user-level access. Based on the determined access rights, rule logic is then established for the access conditions and access results corresponding to the ontology model. This rule logic is then defined using a predefined semantic rule language, providing rule information for the data source data. This allows the distributed data source data address and corresponding rule information to be written into the blockchain network's smart contract. It should be noted that the predefined semantic rule language is SWRL. SWRL rules consist of an antecedent and a consequence, describing access conditions and outcomes through logical relationships. The antecedent of the SWRL rule defines the conditions for the access request, which can include user identity, role, attributes, and other contextual information. For example, the antecedent might require that a specific user belongs to a specific role, or that the time of the request falls within a specific range. The consequence of the SWRL rule defines the outcome of the access request, which can be either granted or denied access, as well as other related actions or prompts. For example, the conclusion portion can be the result of granting access or denying access.

[0066] S103: The data provider receives a data access request uploaded by the data access client through the blockchain network, and obtains authorization information for the data access request based on the rule information in the smart contract.

[0067] After the data access policy and data-related information are written into the smart contract and deployed to the blockchain in step S102, the data provider in this application can receive data access requests uploaded by the data access client based on the blockchain network and obtain the authorization information for the data access request in the rule language of the smart contract to implement distributed automatic access decisions. Data access requests are automatically processed through the rule language in the smart contract without manual intervention, greatly improving the efficiency and automation of data access.

[0068] Furthermore, in order to ensure the legitimacy of the identity of the data access terminal and improve the reliability and security of data access, in one or more embodiments of the present application, before the data provider receives the data access request uploaded by the data access terminal through the blockchain network, the method also includes the following process to implement identity verification for the data access terminal:

[0069] First, the data access terminal sends authentication information to the blockchain network. It should be noted that this authentication information includes a data access terminal identifier and a data access terminal identity certificate. The blockchain network then authenticates the data access terminal based on the data access terminal identity certificate, obtaining an authentication result. If the data access terminal passes authentication, the blockchain network can forward the data access request uploaded by the data access terminal to the data provider.

[0070] Specifically, in one or more embodiments of the present application, obtaining authorization information for a data access request from a rule language in a smart contract specifically includes: the blockchain network obtaining attribute information in the data access request. It should be noted that the attribute information includes the identity information of the data access endpoint, the requested resource information, and a timestamp. The blockchain network then traverses the rule information in the public knowledge ontology repository to obtain rule information that matches the attribute information. The blockchain network then determines whether the attribute information satisfies the access conditions in the matching rule information and returns authorization information for the data access request to the data provider.

[0071] That is, in a certain application scenario of this application, the blockchain uses smart contracts to authorize data access requests from data access terminals. Based on the knowledge stored in the rule base of the smart contract, the attribute information in the data access request from the data access terminal is matched with rules. The attribute information in the access request may include the identity information of the requesting data access terminal, the requested resource information, timestamp information, etc. This attribute information is used to determine the subsequent access rights. Based on the attribute information in the access request, the inference engine is used to analyze and process it. When the inference engine is used for processing, the inference engine first loads the ontology knowledge defined in step S101 above. Then, when an access request is received, the inference engine automatically traverses the rule files in the rule base to find a rule that matches the current access request. The inference engine checks whether the attribute information of the access request meets the rule preconditions based on the rule preconditions and returns authorization information. The authorization information includes permission to access rights and denial of access rights, and the authorization information is stored in the blockchain.

[0072] S104: If the data provider determines that the authorization information allows access, it obtains fine-grained data corresponding to the data access request based on the data access method of the ontology model, encrypts the fine-grained data, and sends it to the data access terminal.

[0073] After determining the authorization information based on the above step S103, if the data provider determines that the authorization information determined by the blockchain network is to allow access, then the data provider can obtain the fine-grained data corresponding to the data access request according to the data access method corresponding to the ontology model defined in the blockchain network in the above step S101, and then encrypt the obtained fine-grained data and send it to the data access end to realize the distributed automatic access process.

[0074] Furthermore, in order to perform more refined division and classification of data, provide more specific and detailed information, and implement fine-grained management of data, in one or more embodiments of the present application, before obtaining fine-grained data corresponding to a data access request based on the data access method of the ontology model, the method further includes the following process:

[0075] First, data from each distributed data source is transformed based on the ontology model to obtain standard distributed data source data, thereby achieving data consistency. Next, the neighborhood concepts and inter-concept relationships of the standard distributed data source data are determined based on the ontology model. Mapping rules for the standard distributed data source are then determined based on the neighborhood concepts and inter-concept relationships. Based on the mapping rules, the ontology knowledge of the standard distributed data source is mapped to the standard distributed data source, integrating the data from each distributed data source to form a virtual knowledge graph. This distributed data source integration utilizes ontology-based data access (OBDA) technology to integrate data from the distributed data sources into a virtual knowledge graph, achieving unified query and access. This allows users to query and analyze the entire virtual knowledge graph using the same query language and query interface, simplifying access and operation of distributed data sources. It should be noted that OBDA consists of three components: ontology, data source, and mapping. Compared to traditional information management systems, OBDA provides users with more than just a simple data structure; it instead provides a semantically rich description. Ontologies express the neighborhood concepts and inter-concept relationships involved in the data source, providing a unified conceptual view of the information to be managed.

[0076] Specifically, in one or more embodiments of the present application, obtaining fine-grained data corresponding to a data access request based on a data access method of an ontology model, encrypting the fine-grained data and sending it to a data access terminal specifically includes:

[0077] First, a query instruction corresponding to the data access request is generated according to the preset query language SPARQL. Then the query interface of the virtual knowledge graph is called to send the query instruction to the virtual knowledge graph based on the query interface, and the data corresponding to the data access request is obtained according to the mapping of the virtual knowledge graph, and fine-grained data is generated by aggregation. It should be noted that SPARQL is a query language for querying RDF data. By using the SPARQL query language, a query can be sent directly to the virtual knowledge graph to obtain data that meets specific conditions. SPARQL queries can include operations such as pattern matching, attribute filtering, and relationship queries to achieve fine-grained data query and analysis. After obtaining the fine-grained data, in order to improve the security of data transmission, in the embodiment of the present application, the data provider end encrypts the fine-grained data obtained by the query based on a preset encryption method, so as to transmit the encrypted fine-grained data to the data access end based on the blockchain network.

[0078] As shown in Figure 3, an internal structure diagram of a data access control device based on semantic support is provided in an embodiment of the present application. As can be seen from Figure 3, the device includes: a memory for storing computer program instructions and a processor for executing program instructions, wherein, when the computer program instructions are executed by the processor, the device is triggered to execute any of the above-mentioned methods.

[0079] As shown in Figure 4, an internal structure diagram of a non-volatile storage medium is provided in an embodiment of the present application. As can be seen from Figure 4, in one or more embodiments of the present application, a non-volatile storage medium stores computer-executable instructions 401, and the computer-executable instructions 401 can: execute any of the methods described above.

[0080] The technical solutions protected by this application are not limited to the above-mentioned embodiments. It should be noted that the combination of the technical solutions of any one embodiment with the technical solutions of one or more other embodiments falls within the scope of protection of this application. Although this application has been described in detail above using general descriptions and specific embodiments, it is obvious to those skilled in the art that modifications or improvements can be made based on this application. Therefore, these modifications or improvements made without departing from the spirit of this application fall within the scope of protection claimed in this application.

Claims

1. A data access control method based on semantic support, wherein: The method comprises: The data provider establishes an ontology model of data semantics based on the ontology knowledge of each distributed data source data, and uploads the ontology model to the blockchain network; The data provider provides rule information of the data source data, and writes the distributed data source data address and the rule information into the smart contract of the blockchain network; wherein the rule information is used to represent the access control policy of the distributed data source data; The data provider receives a data access request uploaded by the data access terminal through the blockchain network, and obtains authorization information of the rule information in the smart contract for the data access request; If the data provider determines that the authorization information allows access, it obtains fine-grained data corresponding to the data access request based on the data access method of the ontology model, encrypts the fine-grained data and sends it to the data access terminal.

2. A data access control method based on semantic support according to claim 1, wherein: The data provider establishes an ontology model of data semantics based on the ontology knowledge of each distributed data source data, and uploads the ontology model to the blockchain network, specifically including: Acquire ontological elements of each distributed data source data; wherein the ontological elements include: access control concepts, access control rules and data source mapping rules; Determining, based on the application scenarios corresponding to the distributed data source data, the attributes of the distributed data source data and the relationships between the distributed data source data; The ontology elements, the attributes and the relationships are reasoned and verified based on a preset ontology reasoning method, and if the verification passes, the ontology knowledge of each of the distributed data source data is determined; wherein the preset ontology reasoning method is defined based on the ontology reasoning rules in the blockchain network rule library; The ontology knowledge is standardized according to a preset ontology modeling language to obtain an ontology model of data semantics; wherein the preset ontology modeling language includes: network ontology language OWL, resource description framework language RDF; The ontology model is uploaded to the blockchain network to update the public knowledge ontology library within the blockchain network.

3. A data access control method based on semantic support according to claim 1, wherein: Before uploading the ontology model to the blockchain network, the method further includes: The data provider sends identity authentication information to the blockchain network; wherein the identity authentication information includes: a data provider identifier and a data provider identity certificate; The blockchain network performs identity authentication on the data provider based on the data provider identity certificate to obtain an authentication result; The data provider receives the authentication result to determine whether to upload the ontology model to the blockchain network based on the authentication result.

4. A data access control method based on semantic support according to claim 1, wherein: The data provider provides the rule information of the data source data, and writes the distributed data source data address and the rule information into the smart contract of the blockchain network, specifically including: The data provider determines the access rights of the ontology model based on the resource type corresponding to the ontology model; Based on the access rights, establishing the rule logic of access conditions and access results corresponding to the ontology model; The rule logic is defined based on a preset semantic rule language, and rule information of the data source data is provided so as to write the distributed data source data address and the corresponding rule information into the smart contract of the blockchain network; wherein the preset semantic rule language is SWRL.

5. A data access control method based on semantic support according to claim 1, wherein: Before the data provider receives the data access request uploaded by the data access terminal through the blockchain network, the method further includes: The data access terminal sends identity authentication information to the blockchain network; wherein the identity authentication information includes: a data access terminal identifier and a data access terminal identity certificate; The blockchain network performs identity authentication on the data access terminal based on the data access terminal identity certificate to obtain an authentication result; If it is determined that the authentication is successful, the blockchain network sends the data access request uploaded by the data access end to the data provider end.

6. A data access control method based on semantic support according to claim 2, wherein: Obtaining authorization information for the data access request in the rule language in the smart contract, specifically including: The blockchain network obtains attribute information in the data access request, wherein the attribute information includes: identity information of the data access end, request resource information, and timestamp information; The blockchain network traverses the rule information in the public knowledge ontology library to obtain the rule information related to the attribute Information matching rule information; The blockchain network determines whether the attribute information satisfies the access conditions in the matching rule information to return the authorization information of the data access request to the data provider.

7. A data access control method based on semantic support according to claim 1, wherein: Before acquiring fine-grained data corresponding to the data access request based on the data access mode of the ontology model, the method further includes: Based on the ontology model, data structure conversion is performed on each of the distributed data source data to obtain standard distributed data source data; Determine the neighborhood concepts and the relationship between concepts of the standard distributed data source data according to the ontology model, so as to determine the mapping rules of the standard distributed data source based on the neighborhood concepts and the relationship between concepts; Based on the mapping rules, the standard distributed data source and the ontology knowledge of the standard distributed data source are mapped to integrate the data of each distributed data source to obtain a virtual knowledge graph.

8. A data access control method based on semantic support according to claim 7, wherein: Acquiring fine-grained data corresponding to the data access request based on the data access mode of the ontology model, encrypting the fine-grained data and sending it to the data access end, specifically includes: generating a query instruction corresponding to the data access request based on a preset query language; Calling the query interface of the virtual knowledge graph to send the query instruction to the virtual knowledge graph based on the query interface, acquiring data corresponding to the data access request according to the mapping of the virtual knowledge graph, and aggregating and generating fine-grained data; The fine-grained data is encrypted based on a preset encryption method, so that the encrypted fine-grained data is transmitted to the data access terminal based on the blockchain network.

9. A data access control device based on semantic support, wherein: The device comprises: A memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to execute any of the methods described in claims 1-8.

10. A non-volatile storage medium storing computer executable instructions, wherein: The computer executable instructions can: execute the method described in any one of claims 1 to 8.

Images