Data access control method, device and equipment based on blockchain

Abstract

The embodiment of the present application provides a data access control method, device and equipment based on blockchain, the method comprising: a first device receives a data request message sent by a second device, the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier; the first device obtains transaction information corresponding to the transaction identifier in the blockchain node, and the transaction information is generated by the blockchain node according to the access policy corresponding to the first data and the attribute information of the second device; when the first device determines that the second device has the right to access the first data according to the transaction information, the first device obtains the first data and sends the first data to the second device. The security of IoT data is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data access control method, device and equipment based on blockchain. Background Art

[0002] The Internet of Things includes multiple IoT devices. IoT devices can generate various IoT data during operation, and the IoT data may include user privacy data.

[0003] Smart service devices can obtain IoT data and provide smart services to users through IoT data. However, in actual applications, smart service devices usually obtain users' IoT data in a forced manner, for example, obtaining users' IoT data without the users' knowledge, or providing users with a protocol policy for obtaining IoT data, and users must agree to the protocol policy before smart services can be provided to users. In the above process, smart service devices can easily obtain users' IoT data, resulting in low security of IoT data. Summary of the invention

[0004] The present application provides a data access control method, device and equipment based on blockchain to improve the security of IoT data.

[0005] In a first aspect, an embodiment of the present application provides a data access control method based on blockchain, the method comprising:

[0006] The first device receives a data request message sent by the second device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier;

[0007] The first device obtains transaction information corresponding to the transaction identifier in the blockchain node, where the transaction information is generated by the blockchain node according to the access policy corresponding to the first data and the attribute information of the second device;

[0008] When the first device determines, according to the transaction information, that the second device has the authority to access the first data, the first device acquires the first data and sends the first data to the second device.

[0009] In a possible implementation manner, the transaction information includes at least one of the following information: request information, first signature information, and indication information, wherein:

[0010] The request information includes the resource location of the first data, the policy identifier of the access policy, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0011] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0012] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0013] In a possible implementation manner, when the first device determines, according to the transaction information, that the second device has permission to access the first data, the first device acquires the first data, including:

[0014] The first device obtains indication information from the transaction information;

[0015] When the first device determines, according to the indication information, that the second device has the permission to access the first data, the first device acquires the first data.

[0016] In a possible implementation manner, the first device acquiring the first data includes:

[0017] The first device determines an identifier of the first data according to the policy identifier;

[0018] The first device obtains the first data according to the identifier of the first data.

[0019] In a possible implementation manner, the first device acquires the first data according to the identifier of the first data, including:

[0020] If the identifier of the first data exists in the data table of the first device, the first device obtains the first data from the data table;

[0021] If the identifier of the first data does not exist in the data table of the first device, the first device obtains the first data from the Internet of Things device.

[0022] In a possible implementation manner, the data request message further includes second signature information, where the second signature information is obtained by encrypting the transaction identifier by the second device using an encryption key; before the first device obtains the first data, the following further includes:

[0023] The first device obtains a first hash value of the transaction identifier;

[0024] The first device decrypts the second signature information by using the verification key corresponding to the encryption key to obtain a second hash value;

[0025] The first device determines that the first hash value is the same as the second hash value.

[0026] In a possible implementation manner, the first device sending the first data to the second device includes:

[0027] The first device decrypts the encrypted session key using a private key corresponding to the public key to obtain the session key;

[0028] The first device encrypts the first data using the session key;

[0029] The first device sends the encrypted first data to the second device.

[0030] In a second aspect, the present application embodiment provides a data access control method based on blockchain, including:

[0031] The second device sends request information and first signature information to the blockchain node, where the request information and the first signature information are used by the blockchain node to generate transaction information and a transaction identifier;

[0032] The second device obtains the transaction identifier in the blockchain node;

[0033] The second device sends a data request message to the first device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier;

[0034] When the first device determines, according to the transaction information, that the second device has the authority to access the first data, the second device receives the first data sent by the first device.

[0035] In a possible implementation manner, the transaction information includes at least one of the following information: request information, first signature information, and indication information, wherein:

[0036] The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0037] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0038] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0039] In a possible implementation, the request message further includes second signature information, wherein the second signature information is obtained by encrypting the transaction identifier by the second device using an encryption key.

[0040] In a third aspect, the present application embodiment provides a data access control method based on blockchain, including:

[0041] The blockchain node receives the request information and the first signature information sent by the second device, where the request information is used to request to obtain the first data;

[0042] The blockchain node generates a transaction identifier and transaction information according to the request information and the first signature information;

[0043] The blockchain node receives a query request sent by the first device, where the query request includes the transaction identifier;

[0044] The blockchain node sends the transaction information corresponding to the transaction identifier to the first device, and the transaction information is used by the first device to determine whether to send the first data to the second device.

[0045] In a possible implementation manner, the transaction information includes at least one of the following information: the request information, the first signature information, and indication information, wherein:

[0046] The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0047] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0048] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0049] In a possible implementation, the blockchain node generates transaction information according to the request information and the first signature information, including:

[0050] The blockchain node obtains the access policy corresponding to the policy identifier;

[0051] The blockchain node obtains attribute information of the second device;

[0052] The blockchain node generates the indication information according to the attribute information of the second device and the access policy;

[0053] The blockchain node determines that the transaction information includes the request information, the first signature information and the indication information.

[0054] In a possible implementation manner, before the blockchain node generates a transaction identifier and transaction information according to the request information and the first signature information, the further step includes:

[0055] The blockchain node verifies the validity of the request information according to the request information and the first signature information;

[0056] The blockchain node determines that the request information is valid.

[0057] In a possible implementation manner, the first signature information is obtained by encrypting a hash value of the request information by the second device using an encryption key;

[0058] The blockchain node verifies the validity of the request information according to the request information and the first signature information, including:

[0059] The blockchain node obtains a first hash value of the request information;

[0060] The blockchain node decrypts the first signature information using the verification key corresponding to the encryption key to obtain a second hash value;

[0061] If the first hash value is the same as the second hash value, the blockchain node determines that the request information is valid; if the first hash value is different from the second hash value, the blockchain node determines that the request information is invalid.

[0062] In a fourth aspect, an embodiment of the present application provides a data access control device based on blockchain, comprising: a receiving module, a processing module and a sending module, wherein:

[0063] The receiving module is used to receive a data request message sent by the second device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier;

[0064] The processing module is used to obtain transaction information corresponding to the transaction identifier in the blockchain node, where the transaction information is generated by the blockchain node according to the access policy corresponding to the first data and the attribute information of the second device;

[0065] The processing module is further configured to obtain the first data when it is determined according to the transaction information that the second device has the authority to access the first data;

[0066] The sending module is used to send the first data to the second device.

[0067] In a possible implementation manner, the transaction information includes at least one of the following information: request information, first signature information, and indication information, wherein:

[0068] The request information includes the resource location of the first data, the policy identifier of the access policy, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0069] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0070] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0071] In a possible implementation manner, the processing module is specifically used to:

[0072] Obtaining instruction information from the transaction information;

[0073] When it is determined according to the indication information that the second device has the permission to access the first data, the first device obtains the first data.

[0074] In a possible implementation manner, the processing module is specifically used to:

[0075] Determining an identifier of the first data according to the policy identifier;

[0076] The first data is acquired according to the identifier of the first data.

[0077] In a possible implementation manner, the processing module is specifically used to:

[0078] If the identifier of the first data exists in the data table of the first device, acquiring the first data from the data table;

[0079] If the identifier of the first data does not exist in the data table of the first device, the first data is obtained in the Internet of Things device.

[0080] In a possible implementation manner, the data request message further includes second signature information, where the second signature information is obtained by encrypting the transaction identifier by the second device using an encryption key; and the processing module is used to:

[0081] Obtaining a first hash value of the transaction identifier;

[0082] Decrypting the second signature information using the verification key corresponding to the encryption key to obtain a second hash value;

[0083] It is determined that the first hash value is the same as the second hash value.

[0084] In a possible implementation manner, the processing module is further configured to decrypt the encrypted session key using a private key corresponding to the public key to obtain the session key; and encrypt the first data using the session key;

[0085] The sending module is used to send the encrypted first data to the second device.

[0086] In a fifth aspect, an embodiment of the present application provides a data access control device based on blockchain, comprising: a sending module, a processing module and a receiving module, wherein:

[0087] The sending module is used to send request information and first signature information to the blockchain node, and the request information and the first signature information are used by the blockchain node to generate transaction information and a transaction identifier;

[0088] The processing module is used to obtain the transaction identifier in the blockchain node;

[0089] The sending module is further used to send a data request message to the first device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier;

[0090] The receiving module is used for receiving the first data sent by the first device when the first device determines, according to the transaction information, that the second device has the authority to access the first data.

[0091] In a possible implementation manner, the transaction information includes at least one of the following information: request information, first signature information, and indication information, wherein:

[0092] The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0093] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0094] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0095] In a possible implementation, the request message further includes second signature information, wherein the second signature information is obtained by encrypting the transaction identifier by the second device using an encryption key.

[0096] In a sixth aspect, an embodiment of the present application provides a data access control method based on blockchain, including: a receiving module, a processing module and a sending module, wherein:

[0097] The receiving module is used to receive request information and first signature information sent by the second device, where the request information is used to request to obtain the first data;

[0098] The processing module is used to generate a transaction identifier and transaction information according to the request information and the first signature information;

[0099] The receiving module is further configured to receive a query request sent by the first device, wherein the query request includes the transaction identifier;

[0100] The sending module is used to send the transaction information corresponding to the transaction identifier to the first device, and the transaction information is used by the first device to determine whether to send the first data to the second device.

[0101] In a possible implementation manner, the transaction information includes at least one of the following information: the request information, the first signature information, and indication information, wherein:

[0102] The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0103] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0104] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0105] In a possible implementation manner, the processing module is specifically used to:

[0106] Obtaining the access policy corresponding to the policy identifier;

[0107] Acquire attribute information of the second device;

[0108] generating the indication information according to the attribute information of the second device and the access policy;

[0109] Determine that the transaction information includes the request information, the first signature information, and the indication information.

[0110] In a possible implementation manner, before the processing module generates the transaction identifier and the transaction information according to the request information and the first signature information, the processing module is further configured to:

[0111] Verifying the validity of the request information according to the request information and the first signature information;

[0112] It is determined that the request information is valid.

[0113] In a possible implementation manner, the first signature information is obtained by encrypting a hash value of the request information by the second device using an encryption key; and the processing module is specifically configured to:

[0114] Obtaining a first hash value of the request information;

[0115] Decrypting the first signature information using the verification key corresponding to the encryption key to obtain a second hash value;

[0116] If the first Hash value is the same as the second Hash value, it is determined that the request information is valid; if the first Hash value is different from the second Hash value, it is determined that the request information is invalid.

[0117] In a seventh aspect, an embodiment of the present application provides a data access control device based on blockchain, characterized in that it includes:

[0118] Memory, used to store programs;

[0119] A processor is used to execute the program stored in the memory. When the program is executed, the processor is used to execute the method as described in any one of the first aspects.

[0120] In an eighth aspect, an embodiment of the present application provides a data access control device based on blockchain, characterized in that it includes:

[0121] Memory, used to store programs;

[0122] A processor is used to execute the program stored in the memory. When the program is executed, the processor is used to execute the method as described in any one of the second aspects.

[0123] In a ninth aspect, an embodiment of the present application provides a data access control device based on blockchain, characterized in that it includes:

[0124] Memory, used to store programs;

[0125] A processor is used to execute the program stored in the memory. When the program is executed, the processor is used to execute the method as described in any one of the third aspects.

[0126] In a tenth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute the method as described in any one of the first aspects above.

[0127] In the eleventh aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute the method described in any one of the second aspects above.

[0128] In the twelfth aspect, an embodiment of the present application provides a computer-readable storage medium, including instructions, which, when executed on a computer, enables the computer to execute the method described in any one of the third aspects above.

[0129] The data access control method, device and equipment based on blockchain provided by the embodiment of the present application, when the second device needs to obtain the first data in the first device, the second device first sends the request information and the first signature information to the blockchain node, and the blockchain can verify the validity of the request information according to the first signature information. When it is determined that the request information is valid, the blockchain node can judge whether the second device has the authority to access the first data according to the attribute information and access policy of the second device, and generate transaction information, and the transaction information includes indication information, and the indication information indicates whether the second device has the authority to access the first data. The second device can obtain the transaction identifier in the blockchain node and send a data request message including the transaction identifier to the first device. The first device can obtain the transaction information corresponding to the transaction identifier in the blockchain node, and judge whether the second device has the authority to access the first data according to the transaction information. When it is determined that the second device has the authority to access the first data, the first data is sent to the second device. In the above process, the access control of the Internet of Things data can be performed through the blockchain node to prevent devices without access rights from obtaining the Internet of Things data, thereby improving the security of Internet of Things data access. BRIEF DESCRIPTION OF THE DRAWINGS

[0130] Figure 1A A schematic diagram of a system architecture provided for an embodiment of the present application;

[0131] Figure 1B Another schematic diagram of a system structure provided in an embodiment of the present application;

[0132] Figure 2 A schematic diagram of a process flow of a method for maintaining a routing table provided in an embodiment of the present application;

[0133] Figure 3 A flowchart of a method for maintaining a resource directory provided in an embodiment of the present application;

[0134] Figure 4 A flowchart of a data access control method based on blockchain provided in an embodiment of the present application;

[0135] Figure 5 A flowchart of another blockchain-based data access control method provided in an embodiment of the present application;

[0136] Figure 6 A schematic diagram of the structure of a blockchain-based data access control device provided in an embodiment of the present application;

[0137] Figure 7 A schematic diagram of the structure of another blockchain-based data access control device provided in an embodiment of the present application;

[0138] Figure 8 A schematic diagram of the structure of another blockchain-based data access control device provided in an embodiment of the present application;

[0139] Fig. 9 A schematic diagram of the hardware structure of a blockchain-based data access control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0140] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0141] To facilitate understanding, first Figure 1A-1B The system architecture involved in the embodiments of the present application is described.

[0142] Figure 1A A schematic diagram of a system architecture provided for an embodiment of the present application. Figure 1A, including IoT devices, aggregation nodes, gateways, blockchain networks and intelligent service devices. Among them, one gateway and one aggregation node can correspond to multiple IoT devices. The aggregation node can discover IoT devices and send the address information of IoT devices to the gateway device so that the gateway can build a routing table for IoT devices. The gateway can also store the device information (also called resource information) of each IoT device. For example, the device information may include the data type (also called resource type, rt (resource type)) that the IoT device can provide, interface information (id, interface description) and maximum data volume estimate (se, size estimate). The maximum data volume estimate is used to indicate the amount of data that the IoT device can generate within a preset time. The gateway device can also store the data generated by each IoT device.

[0143] The blockchain network includes multiple blockchain nodes. Smart service devices can obtain data generated by IoT devices (hereinafter referred to as IoT data) through blockchain nodes and provide smart services to users based on IoT data. In the process of smart service devices obtaining IoT data through blockchain nodes, blockchain nodes can authenticate the identity of smart service devices and determine whether smart service devices have the authority to access IoT data through access policies and attribute information of smart service devices, thereby ensuring the security of IoT data.

[0144] Figure 1B Another system structure diagram provided in the embodiment of the present application. Figure 1A Based on the system structure shown, please refer to Figure 1B ,The IoT devices can be smart home IoT devices and smart office IoT devices. The smart service devices can be ,equipment of emergency service providers, regulatory agencies, research institutions, and service providers based on IoT data.

[0145] To facilitate understanding, the concepts involved in this application are introduced.

[0146] IoT network: Also known as a local IoT network, each local IoT network can include one or more IoT devices, aggregation nodes, and gateways. The aggregation node is connected to the gateway, and the function of the aggregation node is similar to that of a network coordinator. As an interface to the external environment, the gateway can access any resource within the local IoT network. The gateway can have its own public Internet Protocol (IP) address, and the gateway can also be connected to the cloud so that smart service devices can access IoT data through the cloud. The gateway manages all available information within the IoT network. For example, the gateway can maintain routing tables, resource tables, and data tables. Each network represents an environment equipped with IoT smart devices, such as a home, office, or school. For example, see Figure 1B , smart home IoT devices, and their connected aggregation nodes and gateways can constitute an IoT network, and smart office IoT devices, and their connected aggregation nodes and gateways can constitute an IoT network.

[0147] Blockchain network: The blockchain network includes multiple blockchain nodes, which can perform access control on IoT data in the gateway. Blockchain nodes can store attributes (e.g., object attributes, resource attributes, etc.) and access policies. Blockchain nodes can determine whether a device has access to data based on the attributes and access policies. That is, the access control of IoT data by blockchain nodes can be called attribute-based access control (ABAC). Blockchain networks can be implemented in Hyperledger Fabric.

[0148] IoT devices: IoT devices can be devices in smart homes, smart office systems, etc. IoT devices can generate IoT devices during operation. For example, IoT devices can include thermometers, pressure sensors, humidity sensors, light sensors, wearable devices, etc. IoT data can include temperature, pressure, humidity, images, audio, etc.

[0149] Smart service equipment: Smart service equipment can provide smart services to users through IoT data. For example, smart service equipment can be medical monitoring equipment, which can obtain IoT data provided by the user's wearable device and provide smart medical services to the user based on the IoT data. Smart service equipment can be security equipment, which can obtain IoT data such as temperature collected by temperature sensors, humidity collected by humidity sensors, and smoke concentration collected by smoke sensors, and determine whether the indoor environment is safe and whether an alarm is required based on the IoT data.

[0150] Attributes: The attributes involved in the embodiments of the present application include object attributes, resource attributes, environment attributes, and behavior attributes. Attributes may include: attribute name, attribute value, and attribute type. Attribute names may be represented by strings. Attribute values ​​may be any type of data, such as strings, numbers, dates, etc.

[0151] Attributes can be expressed as follows: Where name is the attribute name, t is the attribute type, and val is the attribute value. In actual applications, you can access attribute values ​​using the dot operator (.). For example, you can use access One attribute The set of all possible values ​​of can be expressed as: Among them, M i yes The total number of possible values. The object attributes, resource attributes, environment attributes and behavior attributes involved in the embodiments of the present application are described below.

[0152] Object attributes: Object attributes can refer to the attributes of an object (e.g., data owner and data requester). The data owner can be the owner of the IoT device, and the data requester can be the owner of the smart service device. Object attributes can include the organization, title, level, etc. to which the object belongs. Object data can also include the attributes of the device (e.g., IoT device, smart service device, etc.). The attributes of the device can include the type of device, the device's identification, the location of the device, the object to which it belongs, and other information. The collection of object attributes is represented as in, is the object attribute, N Sub The total number of object properties.

[0153] Resource attributes: Resource attributes can refer to the attributes of data that an IoT device can provide. For example, resource attributes can include the name, type, identifier, etc. of IoT data. The collection of object attributes is represented as in, is the resource attribute, N Res The total number of resource attributes.

[0154] Environmental attributes: Environmental attributes can include information such as time and location. The set of environmental attributes is expressed as in, is the environmental attribute, N Env The total number of resource attributes.

[0155] Behavior attributes: Behavior attributes can refer to the operations that an object (e.g., data owner and data requester) is allowed to perform. For example, behavior attributes can include read operations, write operations, delete operations, update operations, etc. The set of behavior attributes is represented as in, Behavior attribute N Act is the total number of behavior attributes.

[0156] Access policy: Access policy can be a rule for accessing IoT data. Each type of IoT data has its corresponding access policy. That is, the access policy can refer to the smart service devices with which attributes IoT data can be accessed. Optionally, the access policy can be represented by an attribute expression, and the attribute indicated by the attribute expression is: the attribute of the smart device that is allowed to access the IoT data.

[0157] Optionally, for an attribute type t, the attribute expression (or policy) P corresponding to the attribute type t t It can be expressed as follows: P t :=Exp(E[,E]), where Exp is two Boolean expressions connected by a logical relationship (for example, AND, OR, etc.).

[0158] Optional, The properties can be expressed by Boolean expressions as follows Where Exp is two Boolean expressions connected by a logical relationship (e.g., AND, OR, etc.). ε is the attribute value Or a recursive call of Exp. The recursive call can be a call to other attributes.

[0159] Optionally, the policy expression for each IoT data can be: P = P Sub ANDP Res ANDP Env ANDP Act , where P Sub It can be the policy corresponding to the object attribute, P Res It can be the policy corresponding to the resource attribute, P Env can be the strategy corresponding to the environment attribute, P Art It can be a policy corresponding to the behavior attribute.

[0160] The technical solutions shown in the present application are described below through specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be described repeatedly in different embodiments.

[0161] The gateway maintains routing tables, resource directories, and data tables. To facilitate understanding, the process of maintaining routing tables, resource directories, and data tables by the gateway is first described.

[0162] Figure 2 A flowchart of a method for maintaining a routing table provided in an embodiment of the present application. Figure 2 , the method may include:

[0163] S201. The aggregation node broadcasts a discovery message.

[0164] Optionally, the sink node may periodically broadcast a discovery message, and all IoT devices in the same network as the sink node may receive the discovery message.

[0165] S202. The physical network device sends a response message to the aggregation node.

[0166] Among them, the response message may include the identification and path information of the IoT device.

[0167] Optionally, a physical network device newly added to the Internet of Things may send a response message to the aggregation node. For example, after the Internet of Things device receives the discovery message, if the Internet of Things device has not sent a response message corresponding to the discovery message to the aggregation node before the current moment, the Internet of Things device sends a response message to the aggregation node; if the Internet of Things device has sent a response message corresponding to the discovery message to the aggregation node before the current moment, the Internet of Things device may no longer send a response message to the aggregation node, thus saving signaling overhead.

[0168] Optionally, the path information may be a network address of the IoT device. For example, the path information may be an IP address, a Media Access Control (MAC) address, etc. of the IoT device.

[0169] S203: The IoT device sends the IoT device's identification and path information to the gateway.

[0170] S204: The gateway updates the routing table.

[0171] Optionally, if the current routing table does not include the identification and path information of the IoT device in the response message, the identification and path information of the IoT device are added to the routing table.

[0172] exist Figure 2 In the illustrated embodiment, the above method can be used to conveniently discover IoT devices in the IoT and to timely maintain the path information of the IoT devices.

[0173] Figure 3 A flowchart of a method for maintaining a resource directory provided in an embodiment of the present application. Figure 3 , the method may include:

[0174] S301. The gateway sends a request message to the registration device.

[0175] The request message is used to request resource information.

[0176] Optionally, the registration device can store resource information (also referred to as device information) of the IoT device. For example, after the IoT device joins the IoT, its resource information can be sent to the registration device. Resource information can include information such as the data type (also referred to as resource type, rt (resource type)) that the IoT device can provide, interface information (id, interface description) and maximum data size estimate (se, size estimate).

[0177] The gateway may send a request message to the registered device via a Uniform Resource Identifier (URI). For example, the URI may be . / well-known / core, and the request message may be a GET message.

[0178] S302: The registered device sends resource information to the gateway.

[0179] S303: The gateway updates the resource directory according to the resource information.

[0180] For example, the gateway may update resource information into the current resource directory.

[0181] exist Figure 3 In the illustrated embodiment, the gateway can maintain resources so that the resources in the resource directory are the latest resources.

[0182] The gateway can also obtain IoT data collected by IoT devices from IoT devices in real time or periodically, and store the data collected by IoT devices.

[0183] Next, through Figure 4 The embodiment shown illustrates a data access control method based on blockchain.

[0184] Figure 4 A flowchart of a data access control method based on blockchain provided in an embodiment of the present application. Figure 4 , the method may include:

[0185] S401. The second device sends request information and first signature information to the blockchain node.

[0186] In the embodiment of the present application, the first device may be a gateway, the second device may be an intelligent service device, and the blockchain node may be an endorsement node.

[0187] The data request message is used to request to obtain first data in the first device. The first data may be IoT data.

[0188] Optionally, the request information includes the resource location of the first data, a policy identifier of the access policy, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key.

[0189] For example, the request information Req may be: Req = (resource location, policy identifier, C), where C is the encrypted session key, for example, C = Enc (k, PK Ow ), PK OW It can be the public key of the first device and the second device, and k is the session key. OW The encrypted session key of k.

[0190] First signature information σ It can be expressed as σ=Sig(H(Req),SK Re ), where H(Req) is the hash value of Req, SK Re is the encryption key. That is, the first signature information is obtained by SK Re Information after H(Req) is encrypted.

[0191] S402. The blockchain node generates a transaction identifier and transaction information based on the request information and the first signature information.

[0192] Optionally, the transaction identifier is a unique identifier used to indicate this transaction.

[0193] The blockchain node can generate transaction information in the following manner: the blockchain node obtains the access policy corresponding to the policy identifier and the attribute information of the second device; the blockchain node generates indication information based on the attribute information and the access policy of the second device; the blockchain node determines that the transaction information includes request information, first signature information and indication information.

[0194] The blockchain node can determine whether the second device has the authority to access the first data based on the attribute information and access policy of the second device. If so, the generated indication information indicates that the second device has the authority to access the first data. If not, the generated indication information indicates that the second device does not have the authority to access the first data.

[0195] Optionally, the blockchain node may first verify the validity of the request information based on the first signature information, and only generate the transaction information and transaction identifier after verifying that the request information is valid. This can ensure the security of the transaction.

[0196] S403: The second device obtains a transaction identifier in the blockchain node.

[0197] Optionally, the second device may send a request message to the blockchain node to obtain a transaction identifier. For example, after receiving the request message from the second device, the blockchain node may obtain the transaction identifier most recently generated for the second device and send the transaction identifier to the second device.

[0198] S404: The second device sends a data request message to the first device.

[0199] The data request message is used to request to obtain the first data, and the data request message includes a transaction identifier.

[0200] Optionally, the data request message may further include second signature information, and the second signature information is used by the first device to verify the authenticity of the data request message.

[0201] S405. The first device obtains transaction information corresponding to the transaction identifier in the blockchain node.

[0202] Optionally, the first device may send an acquisition request message to the blockchain node, where the acquisition request message includes a transaction identifier, and the blockchain node sends transaction information corresponding to the transaction identifier to the first device based on the transaction identifier.

[0203] S406: When the first device determines, based on the transaction information, that the second device has permission to access the first data, the first device obtains the first data.

[0204] The first device may obtain the indication information in the transaction information, and determine whether the second device has the authority to access the first data according to the indication information.

[0205] Optionally, if the value of the indication information is a first value (for example, 0), it is determined that the second device has the authority to access the first data; when the value of the indication information is a second value (for example, 1), it is determined that the second device does not have the authority to access the first data.

[0206] Optionally, the first device may also perform identity authentication on the second device according to the request information and the first signature information in the transaction information. Figure 5 The invention is described in the embodiment shown and will not be described in detail here.

[0207] S407: The first device sends first data to the second device.

[0208] exist Figure 4In the illustrated embodiment, when the second device needs to obtain the first data from the first device, the second device first sends the request information and the first signature information to the blockchain node. The blockchain can verify the validity of the request information based on the first signature information. When the request information is determined to be valid, the blockchain node can determine whether the second device has the authority to access the first data based on the attribute information and access policy of the second device, and generate transaction information. The transaction information includes indication information, and the indication information indicates whether the second device has the authority to access the first data. The second device can obtain the transaction identifier in the blockchain node and send a data request message including the transaction identifier to the first device. The first device can obtain the transaction information corresponding to the transaction identifier in the blockchain node, and determine whether the second device has the authority to access the first data based on the transaction information. When it is determined that the second device has the authority to access the first data, the first data is sent to the second device. In the above process, the access control of the Internet of Things data can be performed through the blockchain node to prevent devices without access rights from obtaining the Internet of Things data, thereby improving the security of Internet of Things data access.

[0209] exist Figure 4 On the basis of the embodiment shown, in order to ensure the security of IoT data, before IoT data transmission, device identity authentication and data encryption can also be performed. Figure 5 The embodiment shown in the figure describes in detail the data access control method based on blockchain. Optionally, the first device may be a gateway, and the second device may be an intelligent service device. Figure 5 In the illustrated embodiment, the first device is a gateway and the second device is an intelligent service device.

[0210] Figure 5 A flowchart of another data access control method based on blockchain provided in an embodiment of the present application. Figure 5 , the method may include:

[0211] S501. The intelligent service device sends request information and first signature information to the blockchain node.

[0212] It should be noted that the execution process of S501 can refer to the execution process of S401, and will not be described in detail here.

[0213] In S501, the smart service device sends to the blockchain node: Req, σ = Sig(H(Req), SK Re ).

[0214] S502. The blockchain node determines the validity of the request information through the first signature information.

[0215] The validity of the request information can be valid or invalid. For example, if the request information is tampered with during transmission, the request information is invalid.

[0216] The blockchain node can determine the validity of the first signature information in the following manner: the blockchain node obtains the first hash value of the request information, and the blockchain node decrypts the first signature information using the verification key corresponding to the encryption key to obtain a second hash value; if the first hash value is the same as the second hash value, the request information is determined to be valid; if the first hash value is different from the second hash value, the request information is determined to be invalid.

[0217] For example, assuming the request information is Req, the first hash value is H(Req). Assuming the first signature information is σ, the verification key corresponding to the encryption key is VK Re , then the second hash value is Ver(σ,VK Re ), where Ver represents decryption. Blockchain nodes can determine whether H(Req) is equal to Ver(σ,VK Re ), if yes, the request information is determined to be valid, otherwise, the request information is determined to be invalid.

[0218] S503. When the blockchain node determines that the request information is valid, the blockchain node generates a transaction identifier and transaction information based on the request information and the first signature information.

[0219] After the blockchain node generates the transaction identifier and transaction information, the blockchain node stores the transaction identifier and the transaction information correspondingly on the blockchain.

[0220] For example, assuming that the transaction identifier is TxID and the transaction information is Tx, the blockchain node stores TxID and Tx on the blockchain in correspondence. Tx = (Req, σ, indication information).

[0221] It should be noted that the process of the blockchain node generating the transaction identifier and transaction information in S503 can be referred to S402 and will not be repeated here.

[0222] S504: The intelligent service device obtains a transaction identifier in the blockchain node.

[0223] S505: The intelligent service device sends a data request message to the gateway, wherein the data request message includes a transaction identifier and a second signature information.

[0224] The second signature information is obtained by encrypting the transaction identifier using the encryption key of the intelligent service device. For example, the second signature information τ=Sig(H(TxID),SK Re ), where SK Re The encryption key.

[0225] In S505, the intelligent service device sends TxID to the gateway, τ = Sig(H(TxID), SK Re ).

[0226] S506: The gateway determines the validity of the data request message.

[0227] The validity of the data request message is valid or invalid. For example, if the data request message is tampered with during transmission, the data request message is invalid.

[0228] The gateway can determine the validity of the data request message in the following manner: the gateway obtains the first hash value of the transaction identifier; decrypts the second signature information using the verification key corresponding to the encryption key to obtain a second hash value; if the first hash value is the same as the second hash value, the data request message is determined to be valid; otherwise, the data request message is determined to be invalid.

[0229] For example, assuming that the transaction identifier is TxID, the first hash value is H(TxID). Assuming that the second signature information is τ, the verification key is VK Re , then the second hash value is Ver(τ, VK Re ). If H(TxID) and Ver(τ,VK Re ) are the same, then the data request message is determined to be valid; otherwise, the data request message is determined to be invalid.

[0230] S507. When the gateway determines that the data request message is valid, the gateway obtains transaction information corresponding to the transaction identifier in the blockchain node.

[0231] It should be noted that the execution process of S507 can refer to the execution process of S405, which will not be described in detail here.

[0232] S508: When the gateway determines, based on the transaction information, that the intelligent service device has permission to access the first data, the first device obtains a session key.

[0233] It should be noted that the process of the gateway determining whether the intelligent service device has the authority to access the first data can be referred to the execution process of S406, which will not be repeated here.

[0234] The first device may obtain the session key in the following manner: the first device obtains the encrypted session key in the transaction information, and the first device decrypts the encrypted session key using a private key corresponding to a public key to obtain the session key.

[0235] For example, assuming the encrypted session key C = Enc(k,PK Ow )k is the session key, PK OW is the public key, then k=Dec(C,DK Ow ), where DKOW For the private key.

[0236] S509: The gateway device obtains first data.

[0237] Optionally, the gateway device may obtain a policy identifier in the transaction information, determine an identifier of the first data according to the policy identifier, and obtain the first data according to the identifier of the first data. If the identifier of the first data exists in the data table of the first device, the first device obtains the first data in the data table; if the identifier of the first data does not exist in the data table of the first device, the first device obtains the first data from the IoT device. For example, when the identifier of the first data does not exist in the data table of the first device, the first device may poll the IoT device to obtain the first data.

[0238] S510: The gateway encrypts the first data using the session key.

[0239] S511. The gateway sends the encrypted first data to the intelligent service device.

[0240] exist Figure 5 In the illustrated embodiment, when the second device needs to obtain the first data from the first device, the second device first sends the request information and the first signature information to the blockchain node. The blockchain can verify the validity of the request information based on the first signature information. When it is determined that the request information is valid, the blockchain node can determine whether the second device has the authority to access the first data based on the attribute information and access policy of the second device, and generate transaction information. The transaction information includes indication information, and the indication information indicates whether the second device has the authority to access the first data. The second device can obtain the transaction identifier in the blockchain node, and send a data request message including the transaction identifier and the second signature information to the first device. The first device can verify the validity of the data request message based on the second signature information. When it is determined that the data request message is valid, the first device can obtain the transaction information corresponding to the transaction identifier in the blockchain node, and determine whether the second device has the authority to access the first data based on the transaction information. When it is determined that the second device has the authority to access the first data, the session key can be obtained, the first data can be encrypted by the session key, and the encrypted first data can be sent to the second device. In the above process, access control of IoT data can be performed through blockchain nodes to prevent devices without access rights from obtaining IoT data. The validity of the received information is verified before data processing, and IoT data is transmitted in an encrypted manner, thereby improving the security of IoT data access.

[0241] Below, the process of building a blockchain network is introduced: In the process of building a blockchain network, the permissions for devices to join the blockchain can be determined by a high-level organization (such as a hosting service provider). One organization can represent all management agencies. Companies that provide IoT-based services can have their own authorized organizations in the blockchain, and research institutions can also have an authorized organization. The data owner is part of an organization. For example, a smart city can play the role of an organization for all smart home owners in the city. Each organization can have one or more running nodes. Data owners need to have their own running nodes to directly participate in the access control decision-making process of the data. There will be some specialized nodes to perform sorting services. Nodes from different organizations and sorting services together form and run the blockchain.

[0242] The consensus of Hyperledger Fabric depends mainly on endorsement policies, which is because endorsement policies specify the nodes that need to verify whether a transaction is a valid transaction. Data owners can create a configuration transaction in the blockchain to fix the endorsement policy. The endorsement policy and the identities of all endorsing nodes are embedded in this transaction. The endorsement policy establishes a logical channel between the endorsing nodes and the ordering service. In order to be committed in the blockchain, transactions submitted to the channel need to be endorsed by the endorsing nodes of the channel according to the endorsement policy. Different data owners will have different endorsement policies. Therefore, there will be many such channels in Hyperledger.

[0243] Below, the process of creating an attribute is described: During the process of creating an attribute, an attribute can be created by a name, a type, and a set of allowed values. After the attribute is created, the created attribute can be assigned to different entities. Object attributes are created and assigned to specific objects by the attribute manager through the management end. Optionally, resource attributes can be created and assigned to specific resources by the owner of the resource. Environmental attributes and behavioral attributes are common to the entire system and can be created by a regulatory organization. The creation and assignment of attributes is handled by a smart contract function. For example, the name of a smart contract function can be AttributeMgr.

[0244] After an attribute is registered in the blockchain, it will take effect. The device corresponding to the creator can send a transaction request to the blockchain node, which includes a complete attribute. The smart contract function can obtain the attribute to check the semantics and convert it into a json object. In addition to the name, type and value, some additional fields can be added to the json object, such as the creator ID, organization name, etc. During the endorsement, training and verification phases, the json object is written to the key-value pair of the hyperledger, called the state. The problem of attribute conflicts can also be solved. In the prior art, when two different attributes with the same name are created by two different creators, a conflict in the attribute creation process occurs. For example, the administrator attribute of organization A is different from the administrator attribute of organization B. Organizations A and B should be allowed to create administrator attributes at the same time, and the difference between them should be known. The attribute manager solves this problem by creating a unique ID for each attribute before writing it to the state, for example:

[0245]

[0246] in, When storing attributes in the state, The key of the property is stored, and no two properties stored in the state can have the same key. This allows two different creators to create properties with the same name, while preventing the same creator from creating duplicate properties.

[0247] After the attribute is created, the attribute and its value set can be assigned to the appropriate entity, and security measures can be taken to prevent the attribute from being maliciously tampered with. For example, the attribute can be bound to the entity in an encrypted manner. During the attribute assignment process, the attribute publisher adds the attribute to the attribute field of the X.509 attribute certificate (AC) according to the Internet Engineering Task Force (IETF) standard; then the creator constructs the transaction and embeds the certificate in the transaction; then the AttributeMgr smart contract verifies the certificate and converts it into a json object stored in the state; and after the endorsement, sorting, and verification phases, it is stored in the state.

[0248] The following is an introduction to the process of access policy management: Both the IoT data owner and the requester must agree to the access policy. The access policy exists in the state in the form of a key-value pair. For example, the key can be policyID = H(P), H(P) is the hash value of the policy, and the value is the access policy itself. The generation of some access policies needs to rely on meta-policies. For example, meta-policies can be who can modify the policy, delete the policy, the validity period of the access policy, etc. When creating a policy, the meta-policy is included in the blockchain transaction. A smart contract function named PolicyMgr can be responsible for access policy management tasks, such as checking semantics when creating a policy, modifying the policy according to the meta-policy, etc.

[0249] Figure 6 This is a schematic diagram of the structure of a blockchain-based data access control device provided in an embodiment of the present application. The device can be set in a gateway, see Figure 6 The blockchain-based data access control device 10 may include: a receiving module 11, a processing module 12 and a sending module 13, wherein:

[0250] The receiving module 11 is used to receive a data request message sent by the second device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier;

[0251] The processing module 12 is used to obtain transaction information corresponding to the transaction identifier in the blockchain node, where the transaction information is generated by the blockchain node according to the access policy corresponding to the first data and the attribute information of the second device;

[0252] The processing module 12 is further configured to obtain the first data when it is determined according to the transaction information that the second device has the authority to access the first data;

[0253] The sending module 13 is used to send the first data to the second device.

[0254] It should be noted that the device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0255] In a possible implementation manner, the transaction information includes at least one of the following information: request information, first signature information, and indication information, wherein:

[0256] The request information includes the resource location of the first data, the policy identifier of the access policy, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0257] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0258] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0259] In a possible implementation manner, the processing module 12 is specifically configured to:

[0260] Obtaining instruction information from the transaction information;

[0261] When it is determined according to the indication information that the second device has the permission to access the first data, the first device obtains the first data.

[0262] In a possible implementation manner, the processing module 12 is specifically configured to:

[0263] Determining an identifier of the first data according to the policy identifier;

[0264] The first data is acquired according to the identifier of the first data.

[0265] In a possible implementation manner, the processing module 12 is specifically configured to:

[0266] If the identifier of the first data exists in the data table of the first device, acquiring the first data from the data table;

[0267] If the identifier of the first data does not exist in the data table of the first device, the first data is obtained in the Internet of Things device.

[0268] In a possible implementation manner, the data request message further includes second signature information, where the second signature information is obtained by encrypting the transaction identifier by the second device using an encryption key; and the processing module 12 is further configured to:

[0269] Obtaining a first hash value of the transaction identifier;

[0270] Decrypting the second signature information using the verification key corresponding to the encryption key to obtain a second hash value;

[0271] It is determined that the first hash value is the same as the second hash value.

[0272] In a possible implementation manner, the processing module 12 is further configured to decrypt the encrypted session key using a private key corresponding to the public key to obtain the session key; and encrypt the first data using the session key;

[0273] The sending module 13 is used to send the encrypted first data to the second device.

[0274] It should be noted that the device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0275] Figure 7 A schematic diagram of the structure of another blockchain-based data access control device provided in an embodiment of the present application. The device can be set in an intelligent service device. Figure 7 The data access control device 20 based on blockchain may include: a sending module 21, a processing module 22 and a receiving module 23, wherein:

[0276] The sending module 21 is used to send request information and first signature information to the blockchain node, and the request information and the first signature information are used by the blockchain node to generate transaction information and transaction identification;

[0277] The processing module 22 is used to obtain the transaction identifier in the blockchain node;

[0278] The sending module 21 is further used to send a data request message to the first device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier;

[0279] The receiving module 23 is configured to receive the first data sent by the first device when the first device determines, based on the transaction information, that the second device has the authority to access the first data.

[0280] It should be noted that the device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0281] In a possible implementation manner, the transaction information includes at least one of the following information: request information, first signature information, and indication information, wherein:

[0282] The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0283] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0284] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0285] In a possible implementation, the request message further includes second signature information, wherein the second signature information is obtained by encrypting the transaction identifier by the second device using an encryption key.

[0286] It should be noted that the device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0287] Figure 8 A schematic diagram of the structure of another blockchain-based data access control device provided in an embodiment of the present application. The device can be set in a blockchain node. Figure 8 The data access control device 30 based on blockchain may include: a receiving module 31, a processing module 32 and a sending module 33, wherein:

[0288] The receiving module 31 is used to receive request information and first signature information sent by the second device, where the request information is used to request to obtain the first data;

[0289] The processing module 32 is used to generate a transaction identifier and transaction information according to the request information and the first signature information;

[0290] The receiving module 31 is further used to receive a query request sent by the first device, wherein the query request includes the transaction identifier;

[0291] The sending module 33 is used to send the transaction information corresponding to the transaction identifier to the first device, and the transaction information is used by the first device to determine whether to send the first data to the second device.

[0292] It should be noted that the device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0293] In a possible implementation manner, the transaction information includes at least one of the following information: the request information, the first signature information, and indication information, wherein:

[0294] The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key;

[0295] The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key;

[0296] The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

[0297] In a possible implementation manner, the processing module 32 is specifically configured to:

[0298] Obtaining the access policy corresponding to the policy identifier;

[0299] Acquire attribute information of the second device;

[0300] generating the indication information according to the attribute information of the second device and the access policy;

[0301] Determine that the transaction information includes the request information, the first signature information, and the indication information.

[0302] In a possible implementation manner, before the processing module 32 generates the transaction identifier and the transaction information according to the request information and the first signature information, the processing module 32 is further configured to:

[0303] Verifying the validity of the request information according to the request information and the first signature information;

[0304] It is determined that the request information is valid.

[0305] In a possible implementation manner, the first signature information is obtained by encrypting a hash value of the request information by the second device using an encryption key; and the processing module 32 is specifically configured to:

[0306] Obtaining a first hash value of the request information;

[0307] Decrypting the first signature information using the verification key corresponding to the encryption key to obtain a second hash value;

[0308] If the first Hash value is the same as the second Hash value, it is determined that the request information is valid; if the first Hash value is different from the second Hash value, it is determined that the request information is invalid.

[0309] It should be noted that the device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0310] Fig. 9 A schematic diagram of the hardware structure of a blockchain-based data access control device provided in an embodiment of the present application is shown in FIG. Fig. 9 As shown, the blockchain-based data access control device 40 of this embodiment includes: a processor 41 and a memory 42;

[0311] A memory 42, for storing computer-executable instructions;

[0312] The processor 41 is used to execute the computer-executable instructions stored in the memory to implement the various steps executed by the method for determining the number of clicks on an object in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0313] Optionally, the memory 42 may be independent or integrated with the processor 41 .

[0314] When the memory 42 is independently provided, the blockchain-based data access control device further includes a bus 43 for connecting the memory 42 and the processor 41 .

[0315] Optional, Fig. 9 The blockchain-based data access control device shown may be a first device, a second device, or a blockchain node. For example, the first device may be a gateway, and the second device may be an intelligent service device.

[0316] It should be noted that the device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0317] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the blockchain-based data access control method executed by the blockchain-based data access control device as described above is implemented.

[0318] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0319] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present application.

[0320] It should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented by a hardware processor or implemented by a combination of hardware and software modules in the processor.

[0321] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0322] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0323] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0324] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0325] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data access control method based on blockchain, characterized in that: include: The first device receives a data request message sent by the second device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier; The first device obtains transaction information corresponding to the transaction identifier in the blockchain node, where the transaction information is generated by the blockchain node according to the access policy corresponding to the first data and the attribute information of the second device; When the first device determines, according to the transaction information, that the second device has permission to access the first data, the first device acquires the first data, Obtaining an encrypted session key from the transaction information, where the encrypted session key is obtained by encrypting the session key by the second device using a public key; The first device decrypts the encrypted session key using a private key corresponding to the public key to obtain the session key; The first device encrypts the first data using the session key; The first device sends the encrypted first data to the second device.

2. The method according to claim 1, characterized in that The transaction information includes at least one of the following information: request information, first signature information and indication information, wherein: The request information includes the resource location of the first data, the policy identifier of the access policy, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key; The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key; The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

3. The method according to claim 2, characterized in that When the first device determines, according to the transaction information, that the second device has permission to access the first data, the first device acquires the first data, including: The first device obtains indication information from the transaction information; When the first device determines, according to the indication information, that the second device has the permission to access the first data, the first device acquires the first data.

4. The method according to claim 2, characterized in that: The first device obtains the first data, including: The first device determines an identifier of the first data according to the policy identifier; The first device obtains the first data according to the identifier of the first data.

5. The method according to claim 4, characterized in that The first device acquires the first data according to the identifier of the first data, including: If the identifier of the first data exists in the data table of the first device, the first device obtains the first data from the data table; If the identifier of the first data does not exist in the data table of the first device, the first device obtains the first data from the Internet of Things device.

6. The method according to any one of claims 2 to 5, characterized in that: The data request message also includes second signature information, where the second signature information is obtained by encrypting the hash value of the transaction identifier by the second device using an encryption key; Before the first device acquires the first data, the method further includes: The first device obtains a first hash value of the transaction identifier; The first device decrypts the second signature information by using the verification key corresponding to the encryption key to obtain a second hash value; The first device determines that the first hash value is the same as the second hash value.

7. A data access control method based on blockchain, characterized in that: include: The second device sends request information and first signature information to the blockchain node, where the request information and the first signature information are used by the blockchain node to generate transaction information and a transaction identifier; The second device obtains the transaction identifier in the blockchain node; The second device sends a data request message to the first device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier; When the first device determines, based on the transaction information, that the second device has the right to access the first data, obtaining an encrypted session key from the transaction information, where the encrypted session key is obtained by encrypting the session key by the second device using a public key; Decrypting the encrypted session key using the private key corresponding to the public key to obtain the session key; encrypting the first data by using the session key; The second device receives the encrypted first data sent by the first device.

8. The method according to claim 7, characterized in that The transaction information includes at least one of the following information: request information, first signature information and indication information, wherein: The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key; The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key; The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

9. The method according to claim 7 or 8, characterized in that: The request message also includes second signature information, wherein the second signature information is obtained by encrypting the hash value of the transaction identifier by the second device using an encryption key.

10. A data access control method based on blockchain, characterized in that: include: The blockchain node receives the request information and the first signature information sent by the second device, where the request information is used to request to obtain the first data; The blockchain node generates a transaction identifier and transaction information according to the request information and the first signature information; The blockchain node receives a query request sent by the first device, where the query request includes the transaction identifier; The blockchain node sends the transaction information corresponding to the transaction identifier to the first device, and the transaction information is used by the first device to determine whether to send the first data to the second device; the transaction information is also used by the first device to obtain an encrypted session key, and the encrypted session key is obtained by the second device encrypting the session key by using a public key, so that the first device decrypts the encrypted session key by using a private key corresponding to the public key to obtain the session key; the first data is encrypting by the session key to send the encrypted first data to the second device.

11. The method according to claim 10, characterized in that The transaction information includes at least one of the following information: the request information, the first signature information and indication information, wherein: The request information includes the resource location of the first data, a policy identifier, and an encrypted session key, where the encrypted session key is obtained by encrypting the session key by the second device using a public key; The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key; The indication information is used to indicate whether the second device has the permission to access the first data, or does not have the permission to access the first data.

12. The method according to claim 11, characterized in that The blockchain node generates transaction information according to the request information and the first signature information, including: The blockchain node obtains the access policy corresponding to the policy identifier; The blockchain node obtains attribute information of the second device; The blockchain node generates the indication information according to the attribute information of the second device and the access policy; The blockchain node determines that the transaction information includes the request information, the first signature information and the indication information.

13. The method according to any one of claims 10 to 12, characterized in that: Before the blockchain node generates a transaction identifier and transaction information according to the request information and the first signature information, the blockchain node further includes: The blockchain node verifies the validity of the request information according to the request information and the first signature information; The blockchain node determines that the request information is valid.

14. The method according to claim 13, characterized in that The first signature information is obtained by encrypting the hash value of the request information by the second device using an encryption key; The blockchain node verifies the validity of the request information according to the request information and the first signature information, including: The blockchain node obtains a first hash value of the request information; The blockchain node decrypts the first signature information using the verification key corresponding to the encryption key to obtain a second hash value; If the first hash value is the same as the second hash value, the blockchain node determines that the request information is valid; if the first hash value is different from the second hash value, the blockchain node determines that the request information is invalid.

15. A data access control device based on blockchain, characterized in that: include: A receiving module, a processing module and a sending module, wherein: The receiving module is used to receive a data request message sent by the second device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier; The processing module is used to obtain transaction information corresponding to the transaction identifier in the blockchain node, where the transaction information is generated by the blockchain node according to the access policy corresponding to the first data and the attribute information of the second device; The processing module is further configured to obtain the first data when it is determined according to the transaction information that the second device has the authority to access the first data; The sending module is used to send the first data to the second device; The processing module is specifically configured to obtain an encrypted session key from the transaction information, where the encrypted session key is obtained by encrypting the session key by the second device using a public key; decrypt the encrypted session key using a private key corresponding to the public key to obtain the session key; and encrypt the first data using the session key; The sending module is specifically used to send the encrypted first data to the second device.

16. A data access control device based on blockchain, characterized in that: include: A sending module, a processing module and a receiving module, wherein: The sending module is used to send request information and first signature information to the blockchain node, and the request information and the first signature information are used by the blockchain node to generate transaction information and a transaction identifier; The processing module is used to obtain the transaction identifier in the blockchain node; The sending module is further used to send a data request message to the first device, where the data request message is used to request to obtain the first data, and the data request message includes a transaction identifier; The receiving module is used to obtain an encrypted session key from the transaction information when the first device determines that the second device has the authority to access the first data based on the transaction information, the encrypted session key being obtained by the second device encrypting the session key with a public key; decrypting the encrypted session key with a private key corresponding to the public key to obtain the session key; encrypting the first data with the session key; and receiving the encrypted first data sent by the first device.

17. A data access control device based on blockchain, characterized in that: include: A receiving module, a processing module and a sending module, wherein: The receiving module is used to receive request information and first signature information sent by the second device, where the request information is used to request to obtain the first data; The processing module is used to generate a transaction identifier and transaction information according to the request information and the first signature information; The receiving module is further configured to receive a query request sent by the first device, wherein the query request includes the transaction identifier; The sending module is used to send the transaction information corresponding to the transaction identifier to the first device, and the transaction information is used by the first device to determine whether to send the first data to the second device; the transaction information is also used by the first device to obtain an encrypted session key, and the encrypted session key is obtained by the second device encrypting the session key by using a public key, so that the first device decrypts the encrypted session key by using a private key corresponding to the public key to obtain the session key; the first data is encrypting by using the session key to send the encrypted first data to the second device.

18. A data access control device based on blockchain, characterized in that: include: Memory, used to store programs; A processor, configured to execute the program stored in the memory; when the program is executed, the processor is configured to execute the method according to any one of claims 1 to 14.

19. A computer-readable storage medium, characterized in that: The method comprises instructions which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 14.

20. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 14 is implemented.

Images