Directory authorization method and device, processor and electronic device

Abstract

This application discloses a directory authorization method and apparatus, processor, and electronic device, relating to the field of blockchain technology. The method comprises: obtaining a transaction request (one) for uploading a target file; obtaining a target user's target identity key through a distributed storage node (one) based on the target digital identity ID; obtaining the target user's directory permission credentials through a distributed storage node (one) based on the target identity key, assembling the directory permission credentials into a target transaction message, and uploading it to a blockchain node; and upon receiving a signal (one) at the distributed storage node (one), indicating that the target user has access rights to the directory in the target file. This application addresses the problem in related technologies of a lack of a clear method for a target user to obtain directory permissions for a target file, resulting in relatively low efficiency in obtaining directory permissions.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and more specifically, to a method and apparatus for directory authorization, a processor, and an electronic device. Background Art

[0002] Blockchain's decentralized storage technology is a peer-to-peer distributed file transfer system. By sharding files and enabling multi-point concurrent transmission, it saves storage space and improves the transmission efficiency of distributed file systems. However, this also presents new challenges in terms of access security. In a decentralized environment, data files are sharded and stored on storage nodes in different locations. There is no mature solution for how users can obtain directory access permissions for target files.

[0003] There is no clear method for a target user to obtain directory permissions for a target file in the related art, resulting in a relatively low efficiency in obtaining directory permissions. Currently, no effective solution has been proposed. Summary of the Invention

[0004] The main purpose of this application is to provide a directory authorization method and device, processor and electronic device to solve the problem in the related art that there is no clear method for how the target user obtains the directory permissions of the target file, resulting in relatively low efficiency in obtaining directory permissions.

[0005] To achieve the above-mentioned purpose, according to one aspect of the present application, a method for directory authorization is provided. The method comprises: obtaining a transaction request for uploading a target file, wherein the transaction request at least includes: a target digital identity ID of a target user, wherein the target user is the user to be authorized with access rights to the directory in the target file; obtaining a target identity key of the target user through a distributed storage node based on the target digital identity ID; obtaining a directory permission certificate of the target user through a distributed storage node based on the target identity key, assembling the directory permission certificate into a target transaction message, and uploading the message to a blockchain node; wherein the blockchain node updates a directory permission table based on the directory permission certificate and returns a signal indicating that the directory permission table update is complete to the distributed storage node; when the distributed storage node receives the signal, it indicates that the target user has access rights to the directory in the target file.

[0006] Furthermore, based on the target digital identity ID, obtaining the target identity key of the target user through a distributed storage node 1 includes: based on the target digital identity ID, obtaining identity attribute information and public key parameters through the distributed storage node 1, wherein the identity attribute information is composed of the target digital identity ID; obtaining a master key based on the public key parameters and the identity attribute information; and calculating the target identity key based on the master key and the identity attribute information.

[0007] Furthermore, calculating the target identity key based on the master key and the identity attribute information includes: obtaining a directory tree of the target file, wherein the directory tree includes: a root node, a leaf node, and a non-leaf node; calculating a target polynomial for each non-leaf node based on the identity attribute information; calculating a secret parameter value for each target user through the leaf node based on the target polynomial and the master key; and calculating a target identity key for the target user based on the secret parameter value.

[0008] Furthermore, the directory authority certificate is expressed as: ,in, The directory permission credentials for the target user. is the target digital identity of the target user, , k is the number of target users who have access rights to the directory in the target file, Cid is the target storage address information of the target file, D is the target identity key, and Deadline is the validity period of the credential.

[0009] Furthermore, before obtaining the target identity key of the target user through a distributed storage node 1 based on the target digital identity ID, the method also includes: after the distributed storage node 1 receives the transaction request 1, generating initial storage address information of the target file, and encrypting the initial storage address information to obtain the target storage address information of the target file.

[0010] Furthermore, when the distributed storage node 1 receives the signal 1, indicating that the target user has access rights to the directory in the target file, the method also includes: performing block processing on the target file through the distributed storage node 1 to obtain target data blocks; and storing the target data blocks to multiple distributed storage nodes 2.

[0011] Furthermore, after storing the target data block to multiple distributed storage nodes 2, the method also includes: obtaining a transaction request 2 for querying the target file, wherein the transaction request 2 at least includes: the digital identity ID of the querying user who queries the target file and the target storage address information of the target file; judging whether the querying user has access rights to the directory in the target file based on the digital identity ID of the querying user; if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user; verifying the target identity key of the querying user through a preset algorithm on the distributed storage node 1; if the verification is successful, obtaining the target file based on the target storage address information of the target file.

[0012] Furthermore, if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user includes: if the querying user has access rights to the directory in the target file, obtaining the directory permission certificate of the querying user; and obtaining the target identity key of the querying user based on the directory permission certificate.

[0013] Furthermore, the preset algorithm is in the form of: ,in, is the preset algorithm, z is the query user, is the target identity key of the querying user, is the target polynomial, e is the bijective function, g is the generator of the multiplication cycle algorithm G, S is a randomly selected 256-bit prime number, is a random number.

[0014] To achieve the above-mentioned purpose, according to another aspect of the present application, a directory authorization device is provided. The device comprises: a first acquisition unit, configured to acquire a transaction request for uploading a target file, wherein the transaction request at least includes: a target digital identity ID of a target user, wherein the target user is the user to be authorized with access rights to a directory in the target file; a calculation unit, configured to obtain a target identity key of the target user through a distributed storage node based on the target digital identity ID; an assembly unit, configured to obtain a directory permission certificate of the target user through a distributed storage node based on the target identity key, assemble the directory permission certificate into a target transaction message, and upload the message to a blockchain node, wherein the blockchain node updates a directory permission table based on the directory permission certificate and returns a signal indicating that the directory permission table update is complete to the distributed storage node; and a determination unit, configured to indicate that the target user has access rights to the directory in the target file when the distributed storage node receives the signal.

[0015] Furthermore, the calculation unit includes: a first calculation module, used to obtain identity attribute information and public key parameters through the distributed storage node one based on the target digital identity ID, wherein the identity attribute information is composed of the target digital identity ID; a second calculation module, used to obtain a master key based on the public key parameters and the identity attribute information; and a third calculation module, used to calculate the target identity key based on the master key and the identity attribute information.

[0016] Furthermore, the third calculation module includes: an acquisition submodule, used to obtain the directory tree of the target file, wherein the directory tree includes: a root node, a leaf node and a non-leaf node; a first calculation submodule, used to calculate the target polynomial of each non-leaf node based on the identity attribute information; a second calculation submodule, used to calculate the secret parameter value of each target user through the leaf node based on the target polynomial and the master key; and a third calculation submodule, used to calculate the target identity key of the target user based on the secret parameter value.

[0017] Furthermore, the directory authority certificate is expressed as: ,in, The directory permission credentials for the target user. is the target digital identity of the target user, , k is the number of target users who have access rights to the directory in the target file, Cid is the target storage address information of the target file, D is the target identity key, and Deadline is the validity period of the credential.

[0018] Furthermore, the device also includes: a generation unit, which is used to generate initial storage address information of the target file based on the target digital identity ID, before obtaining the target identity key of the target user through a distributed storage node, and after the distributed storage node receives the transaction request, and encrypt the initial storage address information to obtain the target storage address information of the target file.

[0019] Furthermore, the device also includes: a processing unit, which is used to, when the distributed storage node 1 receives the signal 1, indicate that the target user has access rights to the directory in the target file, and then perform block processing on the target file through the distributed storage node 1 to obtain target data blocks; and a storage unit, which is used to store the target data blocks to multiple distributed storage nodes 2.

[0020] Furthermore, the device also includes: a second acquisition unit, used to obtain a transaction request two for querying the target file after storing the target data block in multiple distributed storage nodes two, wherein the transaction request two includes at least: the digital identity ID of the querying user who queries the target file and the target storage address information of the target file; a judgment unit, used to judge whether the querying user has access rights to the directory in the target file based on the digital identity ID of the querying user; a second acquisition unit, used to obtain the target identity key of the querying user if the querying user has access rights to the directory in the target file; a verification unit, used to verify the target identity key of the querying user through a preset algorithm in the distributed storage node one; and a third acquisition unit, used to obtain the target file based on the target storage address information of the target file if the verification is successful.

[0021] Furthermore, the second acquisition unit includes: a first acquisition module, used to obtain the directory permission certificate of the query user if the query user has access rights to the directory in the target file; and a second acquisition module, used to obtain the target identity key of the query user based on the directory permission certificate.

[0022] Furthermore, the preset algorithm is in the form of: ,in, is the preset algorithm, z is the query user, is the target identity key of the querying user, is the target polynomial, e is the bijective function, g is the generator of the multiplication cycle algorithm G, S is a randomly selected 256-bit prime number, is a random number.

[0023] In order to achieve the above-mentioned objective, according to one aspect of the present application, a processor is provided, wherein the processor is configured to run a program, wherein the program executes any one of the above-mentioned directory authorization methods when running.

[0024] To achieve the above objectives, according to one aspect of the present application, an electronic device is provided, which includes one or more processors and a memory, wherein the memory is used to store a method for implementing any one of the above directory authorizations by the one or more processors.

[0025] The present application adopts the following steps: obtaining a transaction request for uploading a target file, wherein the transaction request includes at least: a target digital identity ID of a target user, wherein the target user is the user to be authorized to access the directory in the target file; obtaining the target identity key of the target user through a distributed storage node based on the target digital identity ID; obtaining the directory permission certificate of the target user through a distributed storage node based on the target identity key, assembling the directory permission certificate into a target transaction message, and uploading it to a blockchain node; wherein the blockchain node updates the directory permission table based on the directory permission certificate and returns a signal indicating that the directory permission table update is complete to the distributed storage node; when the distributed storage node receives the signal, it indicates that the target user has access to the directory in the target file, thereby solving the problem in the related art of how the target user has no clear method for obtaining directory permissions for the target file, resulting in relatively low efficiency in obtaining directory permissions. By obtaining the corresponding target identity key through the target digital identity ID of the target user, and obtaining the directory permission certificate of the target user through the target identity key, the target user obtains the directory permission of the target file, thereby achieving the effect of improving the efficiency of obtaining directory permissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0027] Figure 1 This is a flowchart of a directory authorization method provided in accordance with an embodiment of the present application;

[0028] Figure 2 is a schematic diagram of an optional directory tree provided according to an embodiment of the present application;

[0029] Figure 3 is a schematic diagram of the format of an optional target data block provided according to an embodiment of the present application;

[0030] Figure 4 is a flowchart of an optional directory authorization method provided according to an embodiment of the present application;

[0031] Figure 5 is a schematic diagram of an optional directory authorization system provided according to an embodiment of the present application;

[0032] Figure 6 is a schematic diagram of an optional distributed storage node provided according to an embodiment of the present application;

[0033] Figure 7 is a schematic diagram of an optional blockchain node provided according to an embodiment of the present application;

[0034] Figure 8 is a schematic diagram of a directory authorization device provided according to an embodiment of the present application;

[0035] Figure 9 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0037] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0038] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0039] The present invention will be described below in conjunction with preferred implementation steps. Figure 1 is a flowchart of a directory authorization method provided according to an embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0040] Step S101: Obtain a transaction request 1 for uploading a target file, wherein the transaction request 1 at least includes: a target digital identity ID of a target user, wherein the target user is a user for whom access rights to a directory in the target file are to be authorized.

[0041] Specifically, when uploading a target file, the user who has the access authority for the directory in the target file is authorized. Then the transaction request for uploading the target file needs to include the target digital identity ID of the target user.

[0042] Step S102: Obtain the target identity key of the target user through the distributed storage node 1 according to the target digital identity ID.

[0043] Specifically, after the distributed storage node receives the upload transaction request, the distributed storage node generates a target identity key of the target user according to the target digital identity ID.

[0044] In step S103, based on the target identity key, the directory permission certificate of the target user is obtained through the distributed storage node 1, the directory permission certificate is assembled into a target transaction message, and uploaded to the blockchain node, wherein the blockchain node updates the directory permission table based on the directory permission certificate and returns a signal 1 to the distributed storage node 1 indicating that the directory permission table update is completed.

[0045] Specifically, based on the target identity key, distributed storage node 1 generates a directory permission credential for the target user, assembles the directory permission credential into a target transaction message, and then sends the target transaction message to the blockchain node. The blockchain node receives the target transaction message, updates the directory permission table based on the directory permission credential, and broadcasts the target permission table to the entire network for consensus. The blockchain node feeds back a signal indicating the directory permission table update is complete to distributed storage node 1.

[0046] Step S104: When the distributed storage node 1 receives the signal 1, it indicates that the target user has the access authority to the directory in the target file.

[0047] To sum up, the target user's target digital identity ID is used to obtain the corresponding target identity key, and the target user's directory permission certificate is obtained through the target identity key, which enables the target user to obtain directory access rights to the target file and improves the efficiency of obtaining directory permissions.

[0048] Optionally, in the directory authorization method provided in the embodiment of the present application, obtaining the target identity key of the target user through a distributed storage node one based on the target digital identity ID includes: obtaining identity attribute information and public key parameters through a distributed storage node one based on the target digital identity ID, wherein the identity attribute information consists of the target digital identity ID; obtaining a master key based on the public key parameters and the identity attribute information; and calculating the target identity key based on the master key and the identity attribute information.

[0049] Specifically, represents the target digital identity ID, then the identity attribute information is , is a random number, g is the generator of the multiplication cyclic group G, and the public key parameter PK is expressed as: , where e represents the bilinear map function, The master key Mk is expressed as: Finally, the target identity key is calculated based on the above master key and identity attribute information. Through the above steps, the target identity keys of all target users can be accurately obtained.

[0050] Optionally, in the directory authorization method provided in an embodiment of the present application, calculating the target identity key based on the master key and identity attribute information includes: obtaining a directory tree of the target file, wherein the directory tree includes: a root node, a leaf node, and a non-leaf node; calculating the target polynomial for each non-leaf node based on the identity attribute information; calculating the secret parameter value of each target user through the leaf node based on the target polynomial and the master key; and calculating the target identity key of the target user based on the secret parameter value.

[0051] Specifically, the target identity key is calculated based on the master key and identity attribute information. Figure 2 The following is a schematic diagram of the directory tree of the target file. Figure 2 In the equation, r is the root node, also called the parent node, x1 and x2 are non-leaf nodes, z1 and z2 are leaf nodes, also representing target users. Figure 2 It is just a simple schematic diagram.

[0052] Step 1: For the non-leaf nodes x in the directory tree, calculate the target polynomial for each non-leaf node ;

[0053] Step 1.1: For non-leaf nodes x, set the polynomial The order of , making ,in, Indicates the number of attributes of the directory tree T node x, where the attributes include identity attribute information;

[0054] Step 1.2: For the root node r of the directory tree, the polynomial of the root node r is , where the polynomial of the root node r can also be obtained by adding the target polynomials of all non-leaf nodes, so after calculating the polynomial of the root node, the target polynomial can be calculated;

[0055] Step 1.3 According to ,set up , calculate the non-leaf node x ;

[0056] Step 2: Calculate the secret parameter value of the target user through each leaf node z: ;

[0057] Step 3: Repeat the above steps until you get the target identity keys of all target users Through the above steps, the target identity key collection of all target users is accurately obtained, preparing for the subsequent calculation of the target permission credentials.

[0058] Optionally, in the directory authorization method provided in the embodiment of the present application, the directory permission credential is represented as follows: ,in, Directory permission credentials for the target user. The target digital identity of the target user, , k is the number of target users who have access rights to the directory in the target file, Cid is the target storage address information of the target file, D is the target identity key, and Deadline is the validity period of the credential.

[0059] Specifically, Indicates target users The directory permission credentials are in the form of: The directory permission credentials are used to authorize the target user to have directory access rights to the target file.

[0060] Optionally, in the directory authorization method provided in the embodiment of the present application, before obtaining the target identity key of the target user through the distributed storage node one based on the target digital identity ID, the method also includes: after the distributed storage node one receives the transaction request one, generating the initial storage address information of the target file, and encrypting the initial storage address information to obtain the target storage address information of the target file.

[0061] Specifically, upon receiving a transaction request, the distributed storage node generates initial storage address information for the target file, then encrypts the initial storage address information to obtain the target storage address information for the target file. Through these steps, the target storage address information for the target file is obtained. When storing the target file, the target file is accurately stored in the corresponding location based on the target storage address information.

[0062] Optionally, in the directory authorization method provided in an embodiment of the present application, when distributed storage node one receives signal one, indicating that the target user has access rights to the directory in the target file, the method also includes: dividing the target file into blocks through distributed storage node one to obtain target data blocks; and storing the target data blocks to multiple distributed storage nodes two.

[0063] Specifically, after receiving the signal, the distributed storage node 1 divides the target file into blocks. Indicates the data format of the target data block (for example, Figure 3 Format diagram of the target data block shown in the figure), in form: , where M is the target data block, is the master key, u is the identity attribute information, Cid represents the content address information, Through the above steps, the target data is divided into blocks and the distributed storage of the target file is completed.

[0064] Optionally, in the directory authorization method provided in the embodiment of the present application, after storing the target data block to multiple distributed storage nodes 2, the method also includes: obtaining a transaction request 2 for target file query, wherein the transaction request 2 includes at least: the digital identity ID of the querying user who queries the target file and the target storage address information of the target file; based on the digital identity ID of the querying user, determining whether the querying user has access rights to the directory in the target file; if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user; at the distributed storage node 1, verifying the target identity key of the querying user through a preset algorithm; if the verification is successful, obtaining the target file based on the target storage address information of the target file.

[0065] Specifically, the process for querying a target file is as follows: the querying user initiates transaction request 2 to decentralized storage node 1, requesting the target file. Transaction request 2 includes the querying user's digital ID and the target storage address of the target file. The querying user's digital ID is uploaded to the blockchain node, where it determines whether the querying user has access rights. If the querying user does, the target ID key of the querying user is returned to decentralized storage node 1. Decentralized storage node 1 then verifies the target ID key using a pre-set algorithm. Once verification is successful, the target file is returned to the querying user. Using the target ID key, the querying user can accurately determine whether the target user has access rights to the target file directory.

[0066] Optionally, in the directory authorization method provided in an embodiment of the present application, if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user includes: if the querying user has access rights to the directory in the target file, obtaining the directory permission certificate of the querying user; and obtaining the target identity key of the querying user based on the directory permission certificate.

[0067] Specifically, when the querying user has access rights, the directory authority certificate of the querying user is obtained, and the target identity key of the querying user is obtained from the directory authority certificate. The target identity key of the querying user is accurately obtained through the directory authority certificate of the querying user.

[0068] Optionally, in the directory authorization method provided in the embodiment of the present application, the preset algorithm is in the form of: ,in, is the preset algorithm, z is the query user, To query the user's target identity key, is the target polynomial, e is the bijective function, g is the generator of the multiplication cycle algorithm G, S is a randomly selected 256-bit prime number, is a random number.

[0069] Specifically, the target identity key of the querying user is input into a preset algorithm. If the preset algorithm returns true, it means that the verification is successful. If the verification is successful, the target file is returned to the querying user. The target identity key is verified by the preset algorithm, further ensuring the security of the target file.

[0070] It should be noted that after the target file is stored, it is supported to add users with access rights to the directory in the target file. The method is consistent with the above method and will not be repeated here.

[0071] The directory authorization method provided by the embodiment of the present application obtains a transaction request for uploading a target file, wherein the transaction request includes at least: a target digital identity ID of a target user, wherein the target user is the user to be authorized to access the directory in the target file; based on the target digital identity ID, obtains the target user's target identity key through a distributed storage node; based on the target identity key, obtains the target user's directory permission certificate through a distributed storage node, assembles the directory permission certificate into a target transaction message, and uploads it to a blockchain node; wherein the blockchain node updates the directory permission table based on the directory permission certificate and returns a signal to the distributed storage node indicating that the directory permission table update is complete; when the distributed storage node receives the signal, it indicates that the target user has access to the directory in the target file, thereby solving the problem in the related art that there is no clear method for the target user to obtain the directory permission of the target file, resulting in a relatively low efficiency in obtaining the directory permission. The target digital identity ID of the target user is used to obtain the corresponding target identity key, and the target user's directory permission certificate is obtained through the target identity key, thereby enabling the target user to obtain the directory permission of the target file, thereby achieving the effect of improving the efficiency of obtaining the directory permission.

[0072] like Figure 4 As shown, this is a flowchart of an optional directory authorization method provided according to an embodiment of the present application.

[0073] Phase 1: Upload file data

[0074] Step S401: Initiate a transaction request for uploading a file through the client;

[0075] Step S402: After receiving the transaction request 1, the transaction processing module of the distributed storage node 1 generates target storage address information;

[0076] Step S403: Perform directory authorization processing: obtain the target identity key and directory permission certificate through the target user's target digital identity ID, assemble the directory permission certificate into a target transaction message, and upload it to the blockchain node;

[0077] Step S404: The transaction processing module of the blockchain node receives the target transaction message, parses the target transaction message, executes the smart contract, and updates the blockchain directory permission table;

[0078] Step S405: The blockchain node starts the transaction consensus mechanism and broadcasts the directory permission table to the entire network.

[0079] Step S406: The blockchain node feeds back a signal indicating that the directory permission table has been updated to the distributed storage node. The distributed storage node executes the file segmentation strategy to process and store the file in segments.

[0080] Step S407: Return the success status of uploading the file data to the client.

[0081] Phase 2: File Directory Authorization

[0082] Step S408: Initiate a file directory authorization request through the client;

[0083] Step S409: Distributed storage node 1 performs file directory authorization: obtains the target identity key and directory permission certificate through the target digital identity ID of the target user, assembles the directory permission certificate into a target transaction message, and uploads it to the blockchain node;

[0084] Step S410: The transaction processing module of the blockchain node receives the target transaction message, parses the target transaction message, executes the smart contract, and updates the blockchain directory permission table;

[0085] Step S411: Start the transaction consensus mechanism and broadcast the directory permission table to the entire network;

[0086] Step S412: The blockchain node feeds back a signal indicating that the directory permission table update is complete to the distributed storage node 1, and the directory authorization is completed.

[0087] Phase 3: Accessing file data

[0088] Step S413: Target user B sends a distributed data file query request to distributed storage node 1 via the client;

[0089] Step S414: Distributed storage node 1 uploads the digital identity ID of target user B to the blockchain node;

[0090] Step S415: If the target user meets the access conditions, the target user key of target user B is returned;

[0091] Step S416: The target user key is verified by a preset algorithm at the distributed storage node one. If the preset algorithm returns true, the data file information is obtained; otherwise, the query request is rejected.

[0092] Step S417: Return the query data file to the target user client to complete the transaction.

[0093] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0094] The present application also provides a directory authorization device. It should be noted that the directory authorization device of the present application can be used to execute the directory authorization method provided in the present application. The following describes the directory authorization device provided in the present application.

[0095] Figure 5 Schematic diagram of a directory authorization device according to an embodiment of the present application. Figure 5 As shown, the device includes: a first acquisition unit 501, a calculation unit 502, an assembly unit 503 and a determination unit 504.

[0096] A first acquiring unit 501 is configured to acquire a transaction request 1 for uploading a target file, wherein the transaction request 1 includes at least: a target digital identity ID of a target user, wherein the target user is a user for whom access rights to a directory in the target file are to be authorized;

[0097] The calculation unit 502 is used to obtain the target identity key of the target user through the distributed storage node 1 according to the target digital identity ID;

[0098] Assembly unit 503 is configured to obtain the target user's directory permission certificate from distributed storage node 1 based on the target identity key, assemble the directory permission certificate into a target transaction message, and upload the message to the blockchain node. The blockchain node updates the directory permission table based on the directory permission certificate and returns a signal indicating that the directory permission table update is complete to distributed storage node 1.

[0099] The determining unit 504 is configured to determine that, when the distributed storage node 1 receives the signal 1, the target user has access rights to the directory in the target file.

[0100] The directory authorization device provided in the embodiment of the present application obtains a transaction request 1 for uploading a target file through a first acquisition unit 501, wherein the transaction request 1 at least includes: a target digital identity ID of a target user, wherein the target user is a user to be authorized with access rights to a directory in a target file; a calculation unit 502 obtains a target identity key of the target user through a distributed storage node 1 based on the target digital identity ID; an assembly unit 503 obtains a directory permission certificate of the target user through a distributed storage node 1 based on the target identity key, assembles the directory permission certificate into a target transaction message, and uploads it to a blockchain node, wherein the blockchain node updates a directory permission table based on the directory permission certificate, and returns a signal 1 to the distributed storage node 1 indicating that the directory permission table update is complete; when the distributed storage node 1 receives the signal 1, the determination unit 504 indicates that the target user has access rights to the directory in the target file, thereby solving the problem in the related art that there is no clear method for how the target user obtains the directory permission of the target file, resulting in relatively low efficiency in obtaining directory permissions. The target user's target digital identity ID is used to obtain the corresponding target identity key, and the target user's directory permission certificate is obtained through the target identity key, so that the target user can obtain the directory access rights of the target file, thereby achieving the effect of improving the efficiency of obtaining directory permissions.

[0101] Optionally, in the directory authorization device provided in the embodiment of the present application, the computing unit 502 includes: a first computing module, used to obtain identity attribute information and public key parameters through a distributed storage node 1 based on the target digital identity ID, wherein the identity attribute information consists of the target digital identity ID; a second computing module, used to obtain a master key based on the public key parameters and the identity attribute information; and a third computing module, used to calculate the target identity key based on the master key and the identity attribute information.

[0102] Optionally, in the directory authorization device provided in the embodiment of the present application, the third calculation module includes: an acquisition sub-module, used to obtain the directory tree of the target file, wherein the directory tree includes: a root node, a leaf node and a non-leaf node; a first calculation sub-module, used to calculate the target polynomial of each non-leaf node based on the identity attribute information; a second calculation sub-module, used to calculate the secret parameter value of each target user through the leaf node based on the target polynomial and the master key; and a third calculation sub-module, used to calculate the target identity key of the target user based on the secret parameter value.

[0103] Optionally, in the directory authorization device provided in the embodiment of the present application, the directory authority credential is represented as follows: ,in, Directory permission credentials for the target user. The target digital identity of the target user, , k is the number of target users who have access rights to the directory in the target file, Cid is the target storage address information of the target file, D is the target identity key, and Deadline is the validity period of the credential.

[0104] Optionally, in the directory authorization device provided in the embodiment of the present application, the device also includes: a generation unit, which is used to generate initial storage address information of the target file based on the target digital identity ID, before obtaining the target identity key of the target user through the distributed storage node, and after the distributed storage node receives the transaction request, and encrypt the initial storage address information to obtain the target storage address information of the target file.

[0105] Optionally, in the directory authorization device provided in the embodiment of the present application, the device also includes: a processing unit, which is used to, when distributed storage node one receives signal one, indicate that the target user has access rights to the directory in the target file, and then perform block processing on the target file through distributed storage node one to obtain target data blocks; a storage unit, which is used to store the target data blocks to multiple distributed storage nodes two.

[0106] Optionally, in the directory authorization device provided in the embodiment of the present application, the device also includes: a second acquisition unit, used to obtain a transaction request two for target file query after storing the target data block in multiple distributed storage nodes two, wherein the transaction request two includes at least: the digital identity ID of the querying user who queries the target file and the target storage address information of the target file; a judgment unit, used to judge whether the querying user has access rights to the directory in the target file based on the digital identity ID of the querying user; a second acquisition unit, used to obtain the target identity key of the querying user if the querying user has access rights to the directory in the target file; a verification unit, used to verify the target identity key of the querying user through a preset algorithm on the distributed storage node one; and a third acquisition unit, used to obtain the target file based on the target storage address information of the target file if the verification is successful.

[0107] Optionally, in the directory authorization device provided in an embodiment of the present application, the second acquisition unit includes: a first acquisition module, used to obtain the directory permission certificate of the querying user if the querying user has access rights to the directory in the target file; and a second acquisition module, used to obtain the target identity key of the querying user based on the directory permission certificate.

[0108] Optionally, in the directory authorization device provided in the embodiment of the present application, the preset algorithm is in the form of: ,in, is the preset algorithm, z is the query user, To query the user's target identity key, is the target polynomial, e is the bijective function, g is the generator of the multiplication cycle algorithm G, S is a randomly selected 256-bit prime number, is a random number.

[0109] The directory authorization device includes a processor and a memory. The above-mentioned first acquisition unit 501, calculation unit 502, assembly unit 503 and determination unit 504 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0110] The processor contains a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and directory access rights can be authorized by adjusting kernel parameters.

[0111] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0112] like Figure 6 As shown, according to the optional directory authorization system provided in the embodiment of the present application, the above-mentioned system includes a client 1, a distributed storage node 2, and a blockchain node 3. Client 1: mainly responsible for initiating smart contract deployment requests, distributed storage transaction requests, distributed storage query requests, etc. Distributed storage node 2: that is, a decentralized storage node, responsible for receiving file read and write requests from client 1, performing distributed file read and write, and storing transaction information in the blockchain node. Blockchain node 3: a node that completes functions such as transaction broadcasting, transaction execution, transaction verification, consensus and storage, and has the general characteristics of a blockchain.

[0113] like Figure 7 As shown in the structural diagram of an optional distributed storage node provided in an embodiment of the present application, the distributed storage node includes: a communication module 21, a directory authorization and authentication module 22, a DAG module 23, and a Chunk module 24. The communication module 21 is responsible for communicating with the outside world. The directory authorization and authentication module 22 is responsible for performing directory authorization processing on distributed storage messages. The DAG module 23 and the Chunk module 24 are used for processing target files in chunks.

[0114] like Figure 8As shown in the structural diagram of the optional blockchain node provided in the embodiment of the present application, the above-mentioned blockchain node includes a communication module 31, a transaction processing module 32, a smart contract module 33 and a consensus verification module 34. Communication module 31: Responsible for the communication interaction between each node, completing general blockchain node communication information, including transaction information broadcast, consensus-related information, block synchronization information, network status information, etc. Transaction processing module 32: Responsible for receiving transaction requests, generating a unique transaction identifier, assembling the transaction unique identifier, contract unique identifier and call parameters into a message, and broadcasting it to other nodes in the blockchain. Smart contract module 33: Responsible for receiving transaction requests from communication module 31 and executing transaction requests. Consensus verification module 34: Responsible for consensus processing of received transaction requests. If consensus is reached, the smart contract module 33 is called to execute the smart contract and finally form a record.

[0115] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes a directory authorization method when the program is running.

[0116] like Figure 9 As shown, an embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and capable of running on the processor. When the processor executes the program, the following steps are implemented: obtaining a transaction request one for uploading a target file, wherein the transaction request one includes at least: a target digital identity ID of a target user, wherein the target user is a user to be authorized with access rights to a directory in the target file; obtaining a target identity key of the target user through a distributed storage node one based on the target digital identity ID; obtaining a directory permission certificate of the target user through a distributed storage node one based on the target identity key, assembling the directory permission certificate into a target transaction message, and uploading it to a blockchain node, wherein the blockchain node updates a directory permission table based on the directory permission certificate, and returns a signal one to the distributed storage node one indicating that the directory permission table update is completed; when the distributed storage node one receives the signal one, it indicates that the target user has access rights to the directory in the target file.

[0117] Optionally, obtaining the target identity key of the target user through a distributed storage node one based on the target digital identity ID includes: obtaining identity attribute information and public key parameters through a distributed storage node one based on the target digital identity ID, wherein the identity attribute information consists of the target digital identity ID; obtaining a master key based on the public key parameters and the identity attribute information; and calculating the target identity key based on the master key and the identity attribute information.

[0118] Optionally, calculating the target identity key based on the master key and identity attribute information includes: obtaining a directory tree of the target file, wherein the directory tree includes: a root node, a leaf node, and a non-leaf node; calculating the target polynomial of each non-leaf node based on the identity attribute information; calculating the secret parameter value of each target user through the leaf node based on the target polynomial and the master key; and calculating the target identity key of the target user based on the secret parameter value.

[0119] Optionally, directory permission credentials are expressed as: ,in, Directory permission credentials for the target user. The target digital identity of the target user, , k is the number of target users who have access rights to the directory in the target file, Cid is the target storage address information of the target file, D is the target identity key, and Deadline is the validity period of the credential.

[0120] Optionally, before obtaining the target identity key of the target user through the distributed storage node 1 based on the target digital identity ID, the method also includes: after the distributed storage node 1 receives the transaction request 1, generating initial storage address information of the target file, and encrypting the initial storage address information to obtain the target storage address information of the target file.

[0121] Optionally, when distributed storage node one receives signal one, indicating that the target user has access rights to the directory in the target file, the method also includes: dividing the target file into blocks through distributed storage node one to obtain target data blocks; and storing the target data blocks to multiple distributed storage nodes two.

[0122] Optionally, after storing the target data blocks in multiple distributed storage nodes 2, the method further includes: obtaining a transaction request 2 for target file query, wherein the transaction request 2 includes at least: the digital identity ID of the querying user who queries the target file and the target storage address information of the target file; judging whether the querying user has access rights to the directory in the target file based on the digital identity ID of the querying user; if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user; verifying the target identity key of the querying user through a preset algorithm at the distributed storage node 1; if the verification is successful, obtaining the target file based on the target storage address information of the target file.

[0123] Optionally, if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user includes: if the querying user has access rights to the directory in the target file, obtaining the directory permission certificate of the querying user; and obtaining the target identity key of the querying user based on the directory permission certificate.

[0124] Optionally, the preset algorithm is in the form of: ,in, is the preset algorithm, z is the query user, To query the user's target identity key, is the target polynomial, e is the bijective function, g is the generator of the multiplication cycle algorithm G, S is a randomly selected 256-bit prime number, The device in this article can be a server, PC, PAD, mobile phone, etc.

[0125] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: obtaining a transaction request for uploading a target file, wherein the transaction request at least includes: a target digital identity ID of a target user, wherein the target user is a user for whom access rights to the directory in the target file are to be authorized; obtaining a target identity key of the target user through a distributed storage node based on the target digital identity ID; obtaining a directory permission certificate of the target user through a distributed storage node based on the target identity key, assembling the directory permission certificate into a target transaction message, and uploading it to a blockchain node, wherein the blockchain node updates a directory permission table based on the directory permission certificate, and returns a signal indicating that the directory permission table update is complete to the distributed storage node; when the distributed storage node receives the signal, it indicates that the target user has access rights to the directory in the target file.

[0126] Optionally, obtaining the target identity key of the target user through a distributed storage node one based on the target digital identity ID includes: obtaining identity attribute information and public key parameters through a distributed storage node one based on the target digital identity ID, wherein the identity attribute information consists of the target digital identity ID; obtaining a master key based on the public key parameters and the identity attribute information; and calculating the target identity key based on the master key and the identity attribute information.

[0127] Optionally, calculating the target identity key based on the master key and identity attribute information includes: obtaining a directory tree of the target file, wherein the directory tree includes: a root node, a leaf node, and a non-leaf node; calculating the target polynomial of each non-leaf node based on the identity attribute information; calculating the secret parameter value of each target user through the leaf node based on the target polynomial and the master key; and calculating the target identity key of the target user based on the secret parameter value.

[0128] Optionally, directory permission credentials are expressed as: ,in, Directory permission credentials for the target user. The target digital identity of the target user, , k is the number of target users who have access rights to the directory in the target file, Cid is the target storage address information of the target file, D is the target identity key, and Deadline is the validity period of the credential.

[0129] Optionally, before obtaining the target identity key of the target user through the distributed storage node 1 based on the target digital identity ID, the method also includes: after the distributed storage node 1 receives the transaction request 1, generating initial storage address information of the target file, and encrypting the initial storage address information to obtain the target storage address information of the target file.

[0130] Optionally, when distributed storage node one receives signal one, indicating that the target user has access rights to the directory in the target file, the method also includes: dividing the target file into blocks through distributed storage node one to obtain target data blocks; and storing the target data blocks to multiple distributed storage nodes two.

[0131] Optionally, after storing the target data blocks in multiple distributed storage nodes 2, the method further includes: obtaining a transaction request 2 for target file query, wherein the transaction request 2 includes at least: the digital identity ID of the querying user who queries the target file and the target storage address information of the target file; judging whether the querying user has access rights to the directory in the target file based on the digital identity ID of the querying user; if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user; verifying the target identity key of the querying user through a preset algorithm at the distributed storage node 1; if the verification is successful, obtaining the target file based on the target storage address information of the target file.

[0132] Optionally, if the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user includes: if the querying user has access rights to the directory in the target file, obtaining the directory permission certificate of the querying user; and obtaining the target identity key of the querying user based on the directory permission certificate.

[0133] Optionally, the preset algorithm is in the form of: ,in, is the preset algorithm, z is the query user, To query the user's target identity key, is the target polynomial, e is the bijective function, g is the generator of the multiplication cycle algorithm G, S is a randomly selected 256-bit prime number, is a random number.

[0134] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0135] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0138] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0139] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0140] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0141] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0142] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0143] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A directory authorization method, characterized in that: include: Obtaining a transaction request for uploading a target file, wherein the transaction request includes at least: a target digital identity ID of a target user, wherein the target user is a user for whom access rights to a directory in the target file are to be authorized; According to the target digital identity ID, obtain the target identity key of the target user through the distributed storage node; Obtaining the target user's directory permission credential through distributed storage node one based on the target identity key, assembling the directory permission credential into a target transaction message, and uploading the message to the blockchain node; wherein the blockchain node updates the directory permission table based on the directory permission credential and returns a signal indicating that the directory permission table update is complete to the distributed storage node one; When the distributed storage node 1 receives the signal 1, it indicates that the target user has access rights to the directory in the target file; Wherein, obtaining the target identity key of the target user through the distributed storage node 1 according to the target digital identity ID includes: According to the target digital identity ID, identity attribute information and public key parameters are obtained through the distributed storage node 1, wherein the identity attribute information is composed of the target digital identity ID; Obtaining a master key based on the public key parameters and the identity attribute information; Calculate the target identity key based on the master key and the identity attribute information; Obtain a directory tree of the target file, wherein the directory tree includes: a root node, leaf nodes, and non-leaf nodes; Calculate the target polynomial for each non-leaf node based on the identity attribute information; Obtaining a secret parameter value of each target user through calculation at the leaf node according to the target polynomial and the master key; The target identity key of the target user is calculated based on the secret parameter value.

2. The method according to claim 1, characterized in that The directory permission credentials are expressed as follows: ,in, The directory permission credentials for the target user. is the target digital identity of the target user, , k is the number of target users who have access rights to the directory in the target file, Cid is the target storage address information of the target file, D is the target identity key, and Deadline is the validity period of the credential.

3. The method according to claim 2, characterized in that Before obtaining the target identity key of the target user through a distributed storage node according to the target digital identity ID, the method further includes: After the distributed storage node receives the transaction request, it generates initial storage address information of the target file and encrypts the initial storage address information to obtain target storage address information of the target file.

4. The method according to claim 1, wherein When the distributed storage node 1 receives the signal 1, indicating that the target user has access rights to the directory in the target file, the method further includes: The target file is divided into blocks by the distributed storage node 1 to obtain target data blocks; The target data block is stored in a plurality of distributed storage nodes 2.

5. The method according to claim 4, characterized in that After storing the target data block in the plurality of distributed storage nodes 2, the method further includes: Obtaining a second transaction request for querying the target file, wherein the second transaction request at least includes: a digital identity ID of a querying user for querying the target file and target storage address information of the target file; Determining whether the querying user has access rights to the directory in the target file based on the digital identity ID of the querying user; If the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user; At the first distributed storage node, verifying the target identity key of the querying user using a preset algorithm; If the verification is successful, the target file is obtained according to the target storage address information of the target file.

6. The method according to claim 5, characterized in that If the querying user has access rights to the directory in the target file, obtaining the target identity key of the querying user includes: If the querying user has access rights to the directory in the target file, obtaining the directory permission certificate of the querying user; The target identity key of the querying user is obtained based on the directory authority certificate.

7. The method according to claim 5, characterized in that The preset algorithm is in the form of: ,in, is the preset algorithm, z is the query user, is the target identity key of the querying user, is the target polynomial, e is the bijective function, g is the generator of the multiplication cycle algorithm G, S is a randomly selected 256-bit prime number, is a random number.

8. A directory authorization device, characterized in that: include: A first acquiring unit is configured to acquire a transaction request for uploading a target file, wherein the transaction request includes at least: a target digital identity ID of a target user, wherein the target user is a user for whom access rights to a directory in the target file are to be authorized; a computing unit, configured to obtain a target identity key of the target user through a distributed storage node 1 according to the target digital identity ID; an assembling unit, configured to obtain, based on the target identity key, a directory permission credential of the target user through a first distributed storage node, assemble the directory permission credential into a target transaction message, and upload the message to a blockchain node; wherein the blockchain node updates a directory permission table based on the directory permission credential and returns a signal indicating that the directory permission table update is complete to the first distributed storage node; a determining unit configured to indicate, when the distributed storage node 1 receives the signal 1, that the target user has access rights to the directory in the target file; The device is further configured to obtain identity attribute information and public key parameters through the distributed storage node according to the target digital identity ID, wherein the identity attribute information is composed of the target digital identity ID; obtain a master key according to the public key parameters and the identity attribute information; calculate the target identity key according to the master key and the identity attribute information; obtain a directory tree of the target file, wherein the directory tree includes: a root node, a leaf node, and a non-leaf node; calculate a target polynomial for each non-leaf node according to the identity attribute information; calculate a secret parameter value for each target user through the leaf node according to the target polynomial and the master key; and calculate a target identity key for the target user according to the secret parameter value.

9. A processor, characterized in that: The processor is configured to run a program, wherein the program, when running, executes the directory authorization method according to any one of claims 1 to 6.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the directory authorization method described in any one of claims 1 to 6.

Images