A high-security access control method and system based on blockchain

Abstract

The present invention discloses a high-security access control method and system based on blockchain, the method comprising: registering a user through a certificate issuing authority in a blockchain alliance chain organization, setting attribute information of an access right level for the user, and the user having a unique user identification; the user initiates a resource access request, and the user is double-signed according to a double signature mechanism; the blockchain alliance chain performs double verification according to the double signature; after the double verification is passed, responding to the access request and allowing the user to access. The system consists of a blockchain user layer, a blockchain interface layer, a blockchain core layer, and a blockchain infrastructure layer. Through the invented method and system, the stability and security of access control can be improved, the flexibility and scalability of access control can be improved, and public auditability and security can also be enhanced.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a high-security level access control method and system based on blockchain. Background Art

[0002] Traditional access control technology deploys access control policies on centralized servers and databases, and third-party organizations provide centralized access control services. However, centralized access control has many problems. For example, single-point access control may have the risk of single-point failure. Once a centralized server fails, the entire system will be difficult to operate normally, and the response information of ongoing requests or completed requests may be lost instantly. Secondly, blindly trusting third-party organizations may bring major security issues. If a third-party organization privately modifies, leaks, or even deletes important resource data or user information, the resource owner or user cannot obtain early warnings in time or make timely remedies. This may cause huge economic losses to resource owners and users, seriously endanger their account security, and also make resource owners and users lose trust in third-party organizations. It is difficult and impossible for centralized access control to make the access control execution process completely open and transparent and accept user supervision.

[0003] Blockchain technology has the characteristics of decentralization, high transparency, and high security. There is no third-party organization in the blockchain network, and all nodes participate in the maintenance of the ledger. The failure of one node will not affect the normal operation of the entire system. However, most of the existing blockchain-based access control methods are based on public chains. All information on the blockchain is completely public and anyone has access rights. Therefore, its data privacy and reading and storage performance are poor, and its nodes are difficult to add or revoke flexibly.

[0004] Therefore, how to solve the shortcomings of traditional centralized access control, such as single-point attacks, distrust, and difficulty in auditing and tracing, and how to improve the performance limitations of public chains and poor data privacy, have become technical problems that need to be solved urgently. Summary of the invention

[0005] In order to solve the above technical problems, the present invention adopts blockchain alliance chain technology to open multiple channels in the alliance chain. The data inside each channel is isolated from each other. Multiple organizations are opened in each channel. Multiple alliance chain nodes are deployed in each organization. Each organization has a CA (Certificate Authority) to issue digital certificates to users. Decentralized blockchain technology can effectively solve problems such as single point failures in centralized access control methods. When a node in the blockchain fails, the remaining normal nodes can replace the failed node without affecting the normal operation of the entire system. The specific technical solution is as follows:

[0006] On the one hand, the present invention provides a high-security access control method based on blockchain, the method comprising the following steps:

[0007] Registering a user through a certificate issuing authority in a blockchain alliance chain organization, setting attribute information of an access right level for the user, and the user having a unique user identification;

[0008] The user initiates a resource access request, and the user is double-signed according to the double-signature mechanism;

[0009] The blockchain consortium chain performs double verification based on the double signature;

[0010] After both double verifications are passed, the access request is responded to and the user's access is allowed.

[0011] Furthermore, the double signature is specifically:

[0012] The user first signs the user identification and access permission level attribute information of the user with a private key; and then signs the initiated access request transaction proposal with a private key.

[0013] Furthermore, the double verification is specifically:

[0014] After receiving the access request, the verification node in the blockchain alliance verifies the validity of the user's identity and the legitimacy of the access request transaction proposal in turn, where the user's identity includes user identification and access permission level attribute information;

[0015] After the verification is passed, the system chain code pre-installed in the channel is called, and the system chain code then verifies the consistency of the user ID and access permission level attribute information of the user, and then verifies the user's access permission to the resource according to the latest access control policy in the account book.

[0016] Furthermore, the verification of the user's identity validity and the legitimacy of the access request transaction proposal is specifically as follows:

[0017] The verification node in the alliance chain verifies whether the user identity is valid based on the user's certificate information, and verifies whether the private key signature of the access request transaction proposal is issued by the user based on the private key signature of the access request transaction proposal.

[0018] Furthermore, the user's access rights to the resource are verified according to the latest access control policy in the account book, specifically,

[0019] The system chain code combines the user's access permission level attribute information with the latest access control policy in the account book to verify whether the user's permission level is within the scope of the access control policy.

[0020] Furthermore, in the double verification, if one of the items fails to pass the verification, the verification failure result information is returned to the user's client and the user's access request is rejected.

[0021] Furthermore, when the user is an administrator or a user with modification authority, the access control policy can be adjusted and modified according to different application scenarios and business needs. The modified access control policy will be automatically uploaded to the chain and the account status will be updated.

[0022] Furthermore, multiple channels are opened in the blockchain alliance system, the data within each channel is isolated from each other, multiple organizations are opened in each channel, multiple alliance chain nodes are deployed in each organization, and each organization has a certificate authority that issues digital certificates to the users.

[0023] Furthermore, the method also includes access control auditing to record the specific operations of the user. When the user performs operations involving system security, the node will call the system chain code to issue an early warning message to prompt the administrator or staff.

[0024] On the other hand, the present invention also provides a high-security access control system based on blockchain, the system consists of a blockchain user layer, a blockchain interface layer, a blockchain core layer and a blockchain infrastructure layer, wherein:

[0025] The blockchain user layer is mainly composed of administrators and registered users of each organization, and can perform client operations;

[0026] The blockchain interface layer includes interfaces for obtaining user keys and certificates, creating channels, uploading data to the blockchain, and querying blocks;

[0027] The blockchain core layer includes core blockchain functions such as block data management, member management, channel management, and smart contract management;

[0028] The blockchain infrastructure layer is composed of two major functions: resource control of the physical layer and virtual layer required to build the blockchain-based access control bottom layer.

[0029] The high-security access control method and system based on blockchain of the present invention have the following beneficial effects:

[0030] (1) The present invention adopts distributed ledger technology. When a node in the system fails, it does not affect the normal operation of the entire system, effectively avoiding the occurrence of single point attacks and other failures, and improving the stability and security of access control;

[0031] (2) The present invention enables users to master the management and use rights of resources, stores access control policies in the alliance chain, and isolates multi-channel data, which not only ensures the openness and transparency of data but also ensures the privacy of user resources. The present invention is based on smart contracts and can realize automatic and reliable execution of access control without the participation of third-party administrators in supervision. All access control execution processes are open and transparent, and cannot be modified or deleted, which facilitates auditing and tracing.

[0032] (3) The present invention allows users with access control modification permissions to adjust access control policies in a timely manner according to different application scenarios and business requirements, thereby improving the flexibility and scalability of access control;

[0033] (4) The present invention adopts a double signature mechanism. When a user initiates an access request, he first signs his identity and access permission attribute information, and then signs the access request transaction proposal with a private key. The signature verification is also double-verified. First, the verification node verifies the user's identity and transaction proposal signature, and then the chain code verifies the user's identity and attribute information. The double signature mechanism further enhances the security and reliability of the system.

[0034] (5) The present invention also adopts access control audit technology and adds an audit module to the chain code. When performing operations designed to be safe, the chain code will automatically issue an early warning, thereby enhancing public auditability and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without inventiveness.

[0036] Figure 1 A flowchart of a high-security access control method based on blockchain provided in Embodiment 1 of the present invention;

[0037] Figure 2 Another flow chart of a high-security level access control method based on blockchain provided in Embodiment 2 of the present invention;

[0038] Figure 3 A schematic diagram of a high-security access control system based on blockchain provided in Embodiment 3 of the present invention;

[0039] Figure 4 A schematic diagram of the specific structure of a high-security access control system based on blockchain provided in Example 4 of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. It should be pointed out that the described embodiment is only a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0041] Embodiment 1

[0042] Embodiment 1 of the present invention provides a flowchart of a high-security access control method based on blockchain, such as Figure 1 As shown, the method comprises the following steps:

[0043] Step S101, registering a user in a blockchain alliance chain organization through a certificate issuing authority, setting attribute information of an access authority level for the user, and the user having a unique user identifier;

[0044] First, you need to add a user, that is, you first need to use CA (Certificate Authority) to register the user. When registering, you need to set an access level attribute value for the user, and then add the user to the organization of the alliance chain to become a legal member of the organization. The user certificate issued by the organization CA includes the main certificate type, user public key and the certificate validity period of the user public key. The method of generating a user certificate through CA is:

[0045] CertU=Req(UID|attr_access)

[0046] Where UID is the unique identifier of the user (usually the user name), attr_access is the user's access permission level attribute, and Req() is the registration request.

[0047] Step S102, the user initiates a resource access request, and the user is double-signed according to the double-signature mechanism;

[0048] When a user wants to access a resource and initiates an access request to the server, the user ID and access permission level attribute information will first be signed with a private key. The signing method is:

[0049] Sig=UID|h(attr_access)|Sigprku (UID|h(attr_access)

[0050] Here, UID is the unique identifier of the user, h() is a hash calculation function, which is the SHA256 function in the present invention, and attr_access is the user's access permission level attribute information, which is the process of the user's private key signature;

[0051] The user will then use the private key to sign the access request transaction proposal, and the client will forward the transaction proposal to the authentication node.

[0052] Step S103, the blockchain alliance chain performs double verification according to the double signature;

[0053] The authentication node first checks the user certificate to confirm that the certificate is issued by the organization's CA. When the verification node receives a verification request from the client node, the verification node authenticates the client request as follows:

[0054]

[0055] After the verification is passed, the node will verify the signature of the access request transaction proposal to verify that the access request transaction proposal was initiated by the user. When the above verification is passed, the node will call the system chain code, which will query the user's access permission level based on the user certificate, and then perform a consistency check with the information signed by the user's private key.

[0056] When all the above verifications are passed, the system chaincode will query the latest access control policy stored in the blockchain ledger to determine whether the user's access permission level meets the access control policy. The attributes in the access control policy can be set by the user according to the business scenario, such as access level restrictions and access time restrictions. If the access time restriction is added, the chaincode will also determine whether the request is within the specified access time based on the timestamp of the transaction proposal.

[0057] Step S104: after both double verifications are passed, respond to the access request and allow the user to access.

[0058] If one of the items fails the verification, the verification failure result information is returned to the user's client and the user's access request is rejected.

[0059] Users or administrators with permission to modify access control policies can modify the access control policies. The modified access control policies will be automatically uploaded to the chain and the ledger status will be updated. When nodes make access control decisions, they will execute the decisions based on the latest access control policies.

[0060] To facilitate openness and transparency, the present invention also records access control policy modification records in the system chain code, which is equivalent to an access control policy modification log, which can be viewed and supervised by administrators or users with viewing permissions. However, the log cannot be tampered with or deleted and can only be consulted, thereby enhancing the transparency and security of the system.

[0061] To facilitate auditing and accountability, the present invention records all access control-related operations to form a high-security access control audit log based on blockchain. The recorded content mainly includes which user performed what operation at what time. Administrators can obtain the latest audit log in real time, and when certain users perform operations designed to ensure system security, the node will automatically call the chain code to issue an early warning message to remind administrators or staff that a user is currently performing operations involving system security, and please pay attention and handle them in time.

[0062] Embodiment 2

[0063] Embodiment 2 of the present invention provides another flow chart of a high-security level access control method based on blockchain, which is specifically a specific method flow chart of Embodiment 1, such as Figure 2 As shown, the method comprises the following steps:

[0064] Step S201, registering a user through a certificate issuing authority in a blockchain alliance chain organization, setting attribute information of an access right level for the user, and the user having a unique user identifier;

[0065] Step S202: The user initiates a resource access request. The user first signs the user ID and access permission level attribute information with a private key, and then signs the initiated access request transaction proposal with a private key.

[0066] Step S203: After receiving the access request, the verification node in the blockchain alliance verifies the validity of the user's identity and the legitimacy of the access request transaction proposal in turn. The user's identity includes the user ID and access permission level attribute information. If the verification is successful, the process proceeds to step S204. Otherwise, if the verification fails, the verification failure result information is returned to the user's client, and the user's access request is rejected.

[0067] Step S204, calling the system chain code pre-installed in the channel, the system chain code then verifies the consistency of the user ID and access permission level attribute information of the user, and then verifies the user's access permission to the resource according to the latest access control policy in the account book; whether the verification is successful, if it is successful, proceed to step S205, otherwise it fails, then the verification failure result information is returned to the user's client, and the user's access request is rejected.

[0068] Step S205: respond to the access request and allow the user to access.

[0069] Embodiment 3

[0070] Embodiment 3 of the present invention provides a schematic diagram of a high-security access control system structure based on blockchain, such as Figure 3 As shown, the control system includes the system consisting of a blockchain user layer 11, a blockchain interface layer 12, a blockchain core layer 13 and a blockchain infrastructure layer 14, wherein:

[0071] The blockchain user layer 11 is mainly composed of administrators and registered users of each organization, and can perform client operations;

[0072] The blockchain interface layer 12 includes interfaces for obtaining user keys and certificates, creating channels, uploading data to the blockchain, and querying blocks;

[0073] The blockchain core layer 13 includes core blockchain functions such as block data management, member management, channel management, and smart contract management;

[0074] The blockchain infrastructure layer 14 is composed of two major functions: resource control of the physical layer and virtual layer required to build the blockchain-based access control bottom layer.

[0075] Embodiment 4

[0076] Embodiment 4 of the present invention provides a schematic diagram of a specific structure of a high-security access control system based on blockchain, which is specifically the specific structure of the control system in Embodiment 3, such as Figure 4 As shown,

[0077] (1) High-security access control method based on blockchain User layer 11

[0078] The blockchain user layer mainly includes user authentication, access control configuration, and viewing access control logs and security audit logs.

[0079] (2) High-security access control method interface layer based on blockchain 12

[0080] In addition to being an interface for the blockchain application layer, the blockchain interface layer also provides functions such as data uploading, key management, user authentication, channel creation, data encryption, data decryption, and connectivity testing for the data sharing platform.

[0081] (3) High-security access control method core layer based on blockchain 13

[0082] The blockchain core layer provides core functions at the blockchain level for the high-security access control method based on blockchain, mainly including member management, such as member authentication, registration, authorization, monitoring, account management, key verification, logging and auditing functions; block management, such as block packaging, block verification, block synchronization, block storage and other functions; transaction management, such as transaction request, transaction verification, transaction on-chain and other functions; consensus management, such as sorting service, endorsement service, pluggable consensus, etc.; smart contract management, such as container support, contract container, queue management, chain code management, key code creation and other functions.

[0083] (4) High-security access control method infrastructure layer based on blockchain 14

[0084] The blockchain basic layer provides the resource support and management required for the operation of the blockchain core system for the high-security access control method based on blockchain, including computing resources, storage resources, network resources, etc., as well as virtual management, load balancing, resource monitoring, public cloud, private cloud and container cloud.

[0085] In summary, the present invention enhances user interaction configurability and scalability by adding the user concept, and the user certificate is issued and registered by a digital certificate issuing authority; to enhance the security level, the present invention adopts a user dual private key signature mechanism; the present invention uses a smart contract to record all modification records of the access control policy, which is equivalent to its modification log, but the log cannot be modified or deleted. The high-security access control method and system based on blockchain disclosed in the present invention has the following beneficial effects:

[0086] (1) The present invention adopts distributed ledger technology. When a node in the system fails, it does not affect the normal operation of the entire system, effectively avoiding the occurrence of single point attacks and other failures, and improving the stability and security of access control;

[0087] (2) The present invention enables users to master the management and use rights of resources, stores access control policies in the alliance chain, and isolates multi-channel data, which not only ensures the openness and transparency of data but also ensures the privacy of user resources. The present invention is based on smart contracts and can realize automatic and reliable execution of access control without the participation of third-party administrators in supervision. All access control execution processes are open and transparent, and cannot be modified or deleted, which facilitates auditing and tracing.

[0088] (3) The present invention allows users with access control modification permissions to adjust access control policies in a timely manner according to different application scenarios and business requirements, thereby improving the flexibility and scalability of access control;

[0089] (4) The present invention adopts a double signature mechanism. When a user initiates an access request, he first signs his identity and access permission attribute information, and then signs the access request transaction proposal with a private key. The signature verification is also double-verified. First, the verification node verifies the user's identity and transaction proposal signature, and then the chain code verifies the user's identity and attribute information. The double signature mechanism further enhances the security and reliability of the system.

[0090] (5) The present invention also adopts access control audit technology and adds an audit module to the chain code. When performing operations designed to be safe, the chain code will automatically issue an early warning, thereby enhancing public auditability and security.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A high-security access control method based on blockchain, characterized in that: The method comprises the following steps: Registering a user through a certificate authority in a blockchain alliance chain organization, setting an access authority level attribute information for the user, the user having a unique user identifier, and the unique user identifier being a user certificate issued by the organization CA; The user initiates a resource access request, and the user performs a dual signature according to a dual signature mechanism; The blockchain consortium chain performs double verification based on the double signature; After both double verifications are passed, respond to the access request and allow the user to access; The method to generate a user certificate through CA is: CertU=Req(UID|attr_access); Where UID is the unique identifier of the user, attr_access is the attribute information of the user's access permission level, and Req() is the registration request; The user performs double signing according to the double signing mechanism, including: the user first performs private key signing on the user identification and access permission level attribute information of the user, and then performs private key signing on the initiated access request transaction proposal; The method for private key signing the user identity and access level attribute information is: ； UID is the unique identifier of the user, h() is the hash calculation function, and attr_access is the user's access permission level attribute information; The double verification is specifically: After receiving the access request, the verification node in the blockchain alliance verifies the validity of the user's identity and the legitimacy of the access request transaction proposal in turn, where the user's identity includes user identification and access permission level attribute information; After the verification is passed, the system chain code pre-installed in the channel is called, and the system chain code verifies the consistency of the user ID and access permission level attribute information of the user, and then verifies the user's access permission to the resource according to the latest access control policy in the account book; The verification node verifies the validity of the identity of the user, including: The verification node first checks the user certificate to confirm that the user certificate is issued by the organization's CA. When the verification node receives a verification request from the client node, the verification node authenticates the client request as follows: 。 2. The method according to claim 1, characterized in that The verification of the user's identity validity and the legitimacy of the access request transaction proposal is specifically as follows: The verification node in the alliance chain verifies whether the user identity is valid based on the user's certificate information, and verifies whether the private key signature of the access request transaction proposal is issued by the user based on the private key signature of the access request transaction proposal.

3. The method according to claim 1, characterized in that The user's access rights to the resource are then verified according to the latest access control policy in the account book, specifically, The system chain code combines the user's access permission level attribute information with the latest access control policy in the account book to verify whether the user's permission level is within the scope of the access control policy.

4. The method according to claim 1, characterized in that: In the double verification, if one of the items fails to pass the verification, the verification failure result information is returned to the user's client and the user's access request is rejected.

5. The method according to claim 1, characterized in that: When the user is an administrator or a user with modification authority, the access control policy can be adjusted and modified according to different application scenarios and business needs. The modified access control policy will be automatically uploaded to the chain and the account status will be updated.

6. The method according to claim 1, characterized in that Multiple channels are opened in the blockchain alliance chain, the data within each channel is isolated from each other, multiple organizations are opened in each channel, multiple alliance chain nodes are deployed in each organization, and each organization has a certificate authority that issues digital certificates to the users.

7. The method according to claim 6, characterized in that The method also includes access control auditing to record the specific operations of the user. When the user performs an operation involving system security, the node will call the system chain code to issue an early warning message to prompt the administrator or staff.

Images