A social network information access and sharing method based on blockchain

Abstract

A method for social network information access and sharing based on blockchain solves the problems of privacy leakage, insecure user data access, and low efficiency in access control and data availability. The system generates a social relationship graph SRG; the data owner encrypts and uploads the ciphertext; customizes the access control policy; inputs the original request OAR, improves the OAR based on the information in the PIP, and generates the RAAR; the policy judgment is returned; if the judgment result is "PERMIT", the data accessor decrypts the ciphertext. Through blockchain technology, the information access process is made public and transparent, business fraud is prevented, and accountability is pursued. Hierarchical access control is introduced on the traditional attribute-based access control model. Through the access control method based on hierarchical relationships and attributes, the social network information sharing process is optimized, the sharing efficiency is improved, and secure sharing is achieved. More fine-grained authorized access is achieved to avoid illegal use of data during information sharing and access.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain, and in particular to a social network information access and sharing method based on blockchain. Background Art

[0002] With the rapid development of blockchain technology, it is an inevitable trend to apply blockchain technology to all walks of life. The traceability and non-repudiation of blockchain can solve the problem of finding the source of problems in network information release, realize data source query and false information accountability; decentralized blockchain does not require any trusted third party to realize direct transactions between the two parties, realize data sharing between networks, and solve the problem of relying on centralized platforms in data sharing; publishing information and access processes to the blockchain can effectively supervise the access and release process and make it open and transparent.

[0003] In the context of network security, access control has been more widely used as an important security support technology. An important feature is that it clearly defines and limits the access operations that information system users can perform on resources, so it can effectively provide confidentiality and integrity protection for information resources. Access control is to control access to key resources by allowing or limiting access capabilities in some way to prevent intrusion by illegal users or damage caused by careless operations of legitimate users. Although traditional encryption mechanisms can use encryption technology to protect the security of information, traditional encryption mechanisms can only perform one-to-one encryption, that is, information encrypted with a public key can only be decrypted with the corresponding private key. Therefore, traditional encryption mechanisms can only ensure the confidentiality of information, but cannot achieve flexible and fine-grained access control.

[0004] InterPlanetary File System, IPFS is a decentralized file-sharing platform that identifies files by their content. It relies on a distributed hash table (DHT) to retrieve file locations and node connection information. Since IPFS uses content identifiers to identify, verify, and transfer blocks and files, it is particularly suitable for use with blockchain. In fact, the root hash of a file's Merkle DAG can be sent to the blockchain using transactions, so as not to bloat the latter. At the same time, retrieving a file from IPFS does not require any information other than the hash. This is different from file-sharing systems that do not rely on cryptographic hashes as content identifiers, as they require an additional name resolution system to obtain files whose hashes are in the blockchain. Summary of the invention

[0005] Based on the above background, the present invention provides a social network information access and sharing method based on blockchain, and designs an access control method RABAC based on hierarchical relationships and attributes in social network scenarios. For hierarchical access control, users can share and access data more quickly, conveniently and efficiently. For attribute access control, users can share and access data in a more fine-grained manner. RABAC has the advantages of these two types of access control.

[0006] The specific plan is as follows:

[0007] 1. An access control method based on hierarchical relationships and attributes of blockchain, comprising:

[0008] 1) Generate a social relationship graph SRG based on the relationship between each user;

[0009] 2) The system generates a default social relationship access control policy, and only friends at the first level of the relationship can access the data published by the user;

[0010] 3) The data owner uploads the data to be shared. The data owner first encrypts the data with his own public key to obtain the ciphertext M, and then uploads the ciphertext M to IPFS;

[0011] 4) The data owner formulates an access control policy based on hierarchical relationships and attributes. If the user does not formulate one, the system generates a default access control policy and then sends it to PAP for storage and management;

[0012] 5) The data accessor sends an original access request OAR to the policy enforcement point PEP;

[0013] 6) PEP requests relationship and attribute information from PIP to populate OAR;

[0014] 7) After receiving the access request, the PIP organizes the current attribute set and social relationship graph related information and then sends it to the PEP;

[0015] 8) PEP constructs an access request RAAR based on hierarchical relationships and attributes according to the returned relationship and attribute information, and sends it to PDP;

[0016] 9) PDP receives RAAR and calls the policy judgment function, and sends an access policy request to PAP to trigger a policy judgment event;

[0017] 10) PAP fills the relevant access control policies into the access control policy set and then sends it to PDP;

[0018] 11) PDP determines RAAR based on the access control policy set and obtains the final decision result;

[0019] 12) PEP execution judgment results;

[0020] 13) PEP sends the decision result to the proxy re-encryption agency;

[0021] 14) If the judgment result is "PERMIT", the data owner needs to use his own private key SKo and the data accessor's public key PKv to generate the conversion symmetric key CK and send it to the proxy re-encryption agency;

[0022] 15) The proxy re-encryption mechanism needs to retrieve the encrypted file from IPFS and use the conversion key CK to convert the ciphertext Mo into the ciphertext Mv that can be decrypted by the data accessor's private key SKv. In this process, the proxy re-encryption mechanism only plays the role of ciphertext conversion and cannot obtain the plaintext;

[0023] 16) The proxy re-encrypts the file Mv and sends it to the data accessor;

[0024] 17) Only the visitor who has the data accessor private key SKv can decrypt and complete the secure sharing of data.

[0025] 2. The above method may optionally further include:

[0026] The social graph represents a global map of all users and how they are connected in a social network, where users are nodes and the relationships between users are edges. Typically, granting access rights to an access user depends on whether there is a specific relationship or a specific relationship sequence between the access user and the target user owner. Users can choose from predefined policy vocabularies and formulate authorization policies based on the relationship path type and number of hops in the social graph, making the policy language more flexible.

[0027] The set U contains all users in an OSN. Each user is associated with some basic information, which is regarded as the user's attributes. We use U = {α1, α2, …, αk} to represent the (finite) set of relation types supported in OSN. The semantics of each relation type is defined as Users Ua and Ub are in an αi relationship, so it can be written as (Ua,Ub)∈αi.

[0028] 3. The above method may optionally further include:

[0029] Policy Information Point (PIP): manages the subject, resources, operations, environmental attributes and social relationship information;

[0030] Policy Administration Point (PAP): manages access control policy rules and provides policy query services;

[0031] Policy enforcement point PEP: transforms the original access request OAR into an access request RAAR based on hierarchical relationships and attributes according to the relationship and attribute information provided by PIP, and executes the judgment result;

[0032] Policy Decision Point (PDP): Makes authorization decisions for RAAR based on the access control policy provided by PAP;

[0033] 4. The above method may optionally further include:

[0034] When extracting user attributes, multiple description angles can be included, including subject attributes, object attributes, operation attributes, and environmental attributes;

[0035] 5. The above method may optionally further include:

[0036] The social graph model supports multiple relationships and has a hierarchical structure. Generally speaking, different relationships have different authorization sizes for data that can be accessed. Family-related relationships, such as spouses and parents, are generally considered stronger than professional relationships such as colleagues. When the owner allows others with a certain relationship to view one of his resources, people with a closer relationship to the owner should also be able to access the resource.

[0037] The present invention proposes a social network information access and sharing method based on blockchain, which combines blockchain with smart contracts, proxy re-encryption, access control, IPFS file sharing platform and other technologies to optimize the social network information sharing process, improve sharing efficiency, realize the secure sharing of social network information, realize more fine-grained authorized access, avoid illegal use of data and other behaviors during information sharing and access, realize open and transparent information access process, prevent business fraud and hold accountable. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Diagram of access control method based on hierarchical relationship and attributes

[0039] Figure 2 OSN model diagram

[0040] Figure 3 Social relationship hierarchy

[0041] Figure 4 Method execution flow chart DETAILED DESCRIPTION

[0042] Existing online social networks suffer from privacy leakage and insecure user data access due to centralized data management mechanisms, as well as low efficiency in access control and data availability of distributed social networks.

[0043] In order to solve the above problems, in this method, a hierarchical relationship and attribute-based access control method is designed, such as Figure 1 shown.

[0044] Using blockchain as a carrier for access control and using on-chain and off-chain data storage methods has the following benefits:

[0045] The traceability of blockchain technology ensures the ownership of data.

[0046] The consensus algorithm and ledger characteristics of the blockchain are used to reduce the malicious behavior of malicious nodes and improve the quality of data.

[0047] The openness and transparency of blockchain provides a trusted transaction environment.

[0048] Using IPFS's off-chain storage greatly alleviates the pressure of storing data on the chain.

[0049] Combining hierarchical access control with attribute access control has the following benefits:

[0050] For hierarchical access control, users can share and access data more quickly, conveniently and efficiently. For attribute access control, users can share and access data in a more granular manner. Combining the two types of access control, with complementary advantages and disadvantages, can authorize users more efficiently and flexibly.

[0051] Using smart contracts to execute access control processes has the following benefits:

[0052] Smart contracts can provide a decentralized execution environment for the access control process and implement trusted judgments. Smart contracts will record the access authorization process on the blockchain to ensure transparency and traceability of operations.

[0053] The process of its access control method, such as Figure 4 As shown, including:

[0054] Generate a social relationship graph SRG based on the relationship between each user, such as Figure 2 shown.

[0055] Each user who uses the system will first register in the system and upload the user's basic information. The system will generate a social relationship graph SRG based on the relationships between each user. SRG represents the global mapping of all individual users and how they are connected in OSN, where users are nodes and the relationships between users are edges. Granting access rights to access users depends on whether there is a specific relationship or a specific relationship sequence between the access user and the target user, and specifying access control policies based on this social relationship.

[0056] 2) The data owner uploads the data to be shared. The data owner first encrypts the data with his own public key to obtain the ciphertext M, and then uploads the ciphertext M to IPFS.

[0057] Here, proxy re-encryption technology is used to encrypt with the public key of the data owner, and then the private key of the data owner and the public key of the data accessor generate a converted ciphertext that can be decrypted by the private key of the data accessor. If the user's public key is used for encryption and private key for decryption directly, or the user's symmetric key is used for encryption and decryption directly, there is a risk of key leakage and data sharing is unsafe. This technology is used to avoid this situation.

[0058] The reason for not publishing the data itself to the blockchain network is that the openness of the blockchain network cannot hide the content of the data. And if the data or ciphertext is too large, it will limit the scalability of the blockchain. Storing the ciphertext on IPFS can protect the security of the data and ensure that the blocks are small enough to be quickly synchronized in the distributed network.

[0059] 3) The data owner formulates an access control policy based on hierarchical relationships and attributes, and then sends it to PAP for storage and management. The hierarchical relationship is as follows: Figure 3 shown.

[0060] OSN access control based on user relations uses regular expression notation in its policy specification to represent the path pattern between the access user and the target control user. A graph traversal algorithm with path checking can be used to distinguish the relationship between users in the social relationship graph.

[0061] For access control of hierarchical relationships, the social relationship graph generated by the system supports multiple relationships. For example, "spouse", "family", "friends", "colleagues", "classmates", etc. For social networks, hierarchical authorization of access to these relationships according to importance will improve the access efficiency of users in the system. For example, spouses and parents are generally considered to be stronger than professional relationships such as colleagues. When the owner allows others with a certain relationship to view one of his resources, people with a closer relationship with the owner should also be able to access the resource. Policy formulas can be expressed in the form of "and" using regular expressions. Authorization policies are formulated based on the relationship path type and number of hops in the social graph to make the policy language more flexible.

[0062] For attribute access control, the ABAC access control model is used. This model describes access requests and access control policies based on subjects, resources, operations, environmental attributes, and the relationships between attributes. It has strong expressiveness and high flexibility, meeting the requirements of fine-grainedness and flexibility required for social network data sharing in a distributed environment.

[0063] Users can formulate their own access control policies for hierarchical relationships and attributes in the policy formulation module. Users can select from predefined policy vocabulary and attribute sets to formulate corresponding access control policies. The policy formulation module combines the two policies and outputs them to PAP.

[0064] 4) The data accessor sends an original access request OAR to the policy enforcement point PEP. PEP constructs an access request RAAR based on hierarchical relationships and attributes according to the relationship and attribute information returned by PIP, and sends it to PDP.

[0065] 5) The PDP determines the RAAR based on the access control policy set sent by the PAP and obtains the final decision result.

[0066] When a data accessor wants to obtain data stored in IPFS by a data owner, the system will compare the access control policy formulated by the data owner with the relationship and attribute set of the data accessor. If the access policy is satisfied, the judgment result is "PERMIT". Otherwise, the judgment result is "REFUSE", which directly interrupts the policy judgment, omitting the relationship, attribute and policy query time, thereby improving the efficiency of access control policy judgment.

[0067] 6) If the judgment result is "PERMIT", the data accessor decrypts the ciphertext to obtain the data that needs to be accessed.

[0068] The data owner needs to use his own private key SKo and the data accessor's public key PKv to generate a conversion symmetric key CK and send it to the proxy re-encryption agency. The proxy re-encryption agency needs to retrieve the encrypted file from IPFS and use the conversion key CK to convert the ciphertext Mo into a ciphertext Mv that can be decrypted by the data accessor's private key SKv. Only the data accessor with the private key SKv can decrypt and complete the secure sharing of data. Even if a malicious node or a node that does not meet the requirements obtains the ciphertext Mo or the ciphertext Mv, it will not be able to obtain the data plaintext because it does not have the data accessor's private key.

Claims

1. An access control method based on the hierarchical relationship and attributes of blockchain, characterized in that: The following steps are involved: 1) Generate a social relationship graph SRG based on the relationship between each user; 2) The system generates a default social relationship access control policy, and only friends at the first level of the relationship can access the data published by the user; 3) The data owner uploads the data to be shared. The data owner first encrypts the data with his own public key to obtain the ciphertext M, and then uploads the ciphertext M to IPFS; 4) The data owner formulates an access control policy based on hierarchical relationships and attributes, and then sends it to PAP for storage and management; 5) The data accessor sends an original access request OAR to the policy enforcement point PEP; 6) PEP requests relationship and attribute information from PIP to populate OAR; 7) After receiving the access request, the PIP organizes the current attribute set and social graph related information and sends it to the PEP; 8) PEP constructs an access request RAAR based on hierarchical relationships and attributes according to the returned relationship and attribute information, and sends it to PDP; 9) PDP receives RAAR's call for policy judgment function and sends access policy request to PAP to trigger policy judgment event; 10) PAP fills the relevant access control policies into the access control policy set and then sends it to PDP; 11) PDP judges RAAR according to the access control policy set and obtains the final decision result; 12) PEP execution judgment results; 13) PEP sends the decision result to the proxy re-encryption agency; 14) If the judgment result is "PERMIT", the data owner needs to use his own private key SKo and the data accessor's public key PKv to generate the conversion symmetric key CK and send it to the proxy re-encryption agency; 15) The proxy re-encryption mechanism needs to retrieve the encrypted file from IPFS and use the conversion key CK to convert the ciphertext Mo into the ciphertext Mv that can be decrypted by the data accessor's private key SKv. In this process, the proxy re-encryption mechanism only plays the role of ciphertext conversion and cannot obtain the plaintext. 16) After the proxy re-encrypts the file, it sends the re-encrypted file Mv to the data accessor; 17) Only the visitor who has the data visitor private key SKv can decrypt and complete the secure sharing of data; among them: Policy Information Point PIP: manages the subject, resources, operations, environmental attributes and social relationship information; Policy Administration Point (PAP): manages access control policy rules and provides policy query services; Policy Enforcement Point PEP: Converts the original access request OAR into an access request RAAR based on hierarchical relationships and attributes according to the relationship and attribute information provided by PIP, and executes the judgment result; Policy Decision Point (PDP): Makes authorization decisions for RAAR based on the access control policy provided by PAP.

2. The method according to claim 1, characterized in that: Also includes: The social graph represents a global map of all users and how they are connected in a social network, where users are nodes and relationships between users are edges; Granting access rights to access users depends on whether there is a specific relationship or a specific relationship sequence between the access user and the target user owner. Users can choose from predefined policy vocabularies and formulate authorization policies based on the relationship path type and number of hops in the social relationship graph; The set U contains all users in an OSN; each user is associated with some basic information, which is regarded as the user's attributes; U = {α1,α2,…,αk} represents a set of relationship types supported in OSN; the semantics of each relationship type is defined as αi U × U; users Ua and Ub are in αi Relationship, written as ( Ua , Ub )∈ αi .

3. The method according to claim 1, characterized in that: Also includes: When extracting user attributes, multiple description angles are included, including subject attributes, object attributes, operation attributes and / or environment attributes.

4. The method according to claim 1, characterized in that: Also includes: The social relationship graph supports multiple relationships and has a hierarchical structure. Different relationships have different authorization sizes for the data that can be accessed. When an owner allows others with whom he has a certain relationship to view one of his resources, people with whom the owner has a closer relationship can also access the resource.

Images