Domain access control method based on blockchain capability token

Abstract

The present invention provides a domain access control method based on blockchain capability tokens, and directly sends a data access request to a second user terminal through a first user terminal, analyzes the data access request, determines to allocate a corresponding capability token and a token sending strategy to the first user terminal, pre-processes the capability token to form a token data packet, and returns it to the first user terminal; activates the capability token through the first user terminal, thereby accessing the data storage block corresponding to the second user terminal in the blockchain; and adjusts the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal; the above method directly allocates capability tokens through interactive communication between different user terminals without setting up a centralized authentication service terminal, so that the user terminals can access the blockchain efficiently and ensure continuous and stable access to the blockchain.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain data management, and in particular to a domain access control method based on blockchain capability tokens. Background Art

[0002] As a data storage technology with high confidentiality and stability, blockchain has been widely used in the field of data storage. The existing blockchain data access mechanism is based on a centralized authentication service terminal, which has absolute access management authority to the blockchain. When any user terminal needs to access the data stored in the blockchain by other user terminals, it needs to send an access request to the authentication service terminal first. Only when the authentication service terminal confirms the access request can the corresponding user terminal obtain the permission to access the blockchain. The above method strongly relies on a single authentication service terminal. Once the authentication service terminal is invaded or fails, all user terminals will not be able to access the blockchain. At the same time, the historical access records of user terminals to the blockchain cannot be saved, so it is impossible to ensure continuous and stable access to the blockchain, reducing the flexibility of data access to the blockchain. Summary of the invention

[0003] In view of the defects of the prior art, the present invention provides a domain access control method based on blockchain capability tokens, which does not set a centralized authentication service terminal to manage access to the blockchain, but directly sends a data access request to the second user terminal through a first user terminal, analyzes the data access request, determines to allocate a corresponding capability token and a token sending strategy to the first user terminal, pre-processes the capability token to form a token data packet, and returns it to the first user terminal; activates the capability token through the first user terminal, thereby accessing the data storage block corresponding to the second user terminal in the blockchain; and then adjusts the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal; the above method directly allocates capability tokens through interactive communication between different user terminals without setting up a centralized authentication service terminal, so that user terminals can efficiently access the blockchain and ensure continuous and stable access to the blockchain.

[0004] The present invention provides a domain access control method based on blockchain capability tokens, which comprises the following steps:

[0005] Step S1, when a first user terminal sends a data access request to a second user terminal, the second user terminal queries the user terminal list block of the blockchain according to the data access request to determine the legitimacy of the data access request; based on the above determination result, determine whether to further obtain the data information that the first user terminal expects to access according to the data access request;

[0006] Step S2, selecting a matching capability token and its sending strategy from the capability token interval of the blockchain according to the data information that the first user terminal expects to access; preprocessing the capability token according to the sending strategy to generate a corresponding token data packet;

[0007] Step S3, returning the token data packet to the first user terminal through the second user terminal, so that the first user terminal obtains the corresponding capability token from the token data packet; after activating the capability token through the first user terminal, using the successfully activated capability token to access the data storage block corresponding to the second user terminal in the blockchain;

[0008] Step S4: adjusting the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal.

[0009] Further, in step S1, when the first user terminal sends a data access request to the second user terminal, the second user terminal queries the user terminal list block of the blockchain according to the data access request, and judging the legitimacy of the data access request specifically includes:

[0010] When the first user terminal sends a data access request to the second user terminal, the second user terminal obtains the terminal identity information of the first user terminal from the data access request;

[0011] The second user terminal uses the terminal identity information as a reference to query the user terminal list block of the blockchain to determine whether the terminal identity information exists in the user terminal list block. If so, the data access request is judged to be a legal data access request; if not, the data access request is judged to be an illegal data access request.

[0012] Furthermore, in step S1, determining whether to further obtain the data information that the first user terminal expects to access according to the data access request according to the above judgment result specifically includes:

[0013] When it is determined that the data access request is an illegal data access request, directly destroying the data access request through the second user terminal;

[0014] When it is determined that the data access request is a legitimate data access request, the data access request is analyzed and processed by the second user terminal to determine the type of data that the first user terminal expects to access; wherein the data type refers to whether the data that the first user terminal expects to access is text code data or image data.

[0015] Further, in step S2, according to the data information that the first user terminal expects to access, selecting a matching capability token from the capability token interval of the blockchain and its sending strategy specifically include:

[0016] When the data that the first user terminal expects to access is text code data, a capability token matching the terminal identity information of the second user terminal is selected from the capability token interval of the blockchain, and a first sending strategy is assigned to the capability token, so as to send the capability token according to the first sending strategy;

[0017] When the data that the first user terminal expects to access is image data, a capability token that matches the terminal identity information of the second user terminal is selected from the capability token interval of the blockchain, and a second sending strategy is assigned to the capability token, so that the capability token is sent according to the second sending strategy; wherein the sending period of the first sending strategy is less than the sending period of the second sending strategy.

[0018] Further, in the step S2, preprocessing the capability token according to the sending strategy to generate a corresponding token data packet specifically includes:

[0019] When sending the capability token in accordance with the first sending strategy, performing encryption preprocessing on the capability token to generate a corresponding token data packet;

[0020] When the capability token is sent using the second sending strategy, the capability token is pre-processed with double encryption to generate a corresponding token data packet.

[0021] Further, in step S3, returning the token data packet to the first user terminal through the second user terminal so that the first user terminal obtains the corresponding capability token from the token data packet specifically includes:

[0022] The token data packet is directed back to the first user terminal through the second user terminal, and the token data packet is decrypted by the first user terminal to obtain the capability token contained therein.

[0023] Further, in step S3, after the capability token is activated by the first user terminal, using the successfully activated capability token to access the data storage block corresponding to the second user terminal in the blockchain specifically includes:

[0024] Performing a signing operation on the capability token through the first user terminal, when the signing key corresponding to the signing operation is correct, the activation of the capability token is successful; when the signing key corresponding to the signing operation is incorrect, the activation of the capability token fails;

[0025] The first user terminal uses the successfully activated capability token to open the data storage block corresponding to the second user terminal in the blockchain, thereby accessing the data storage block.

[0026] Further, in the step S4, adjusting the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal specifically includes:

[0027] Obtain the duration of the first user terminal's current access to the data storage block. If the access duration is less than the life cycle of the capability token currently held by the first user terminal, keep the capability state of the capability token currently held by the first user terminal unchanged; otherwise, terminate the capability state of the capability token currently held by the first user terminal; wherein the capability state refers to the validity of the capability token to open the data storage block.

[0028] Compared with the prior art, the domain access control method based on blockchain capability tokens does not set up a centralized authentication service terminal to manage access to the blockchain, but directly sends a data access request to the second user terminal through the first user terminal, analyzes the data access request, determines to allocate the corresponding capability token and token sending strategy to the first user terminal, pre-processes the capability token to form a token data packet, and returns it to the first user terminal; activates the capability token through the first user terminal, thereby accessing the data storage block corresponding to the second user terminal in the blockchain; and then adjusts the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal; the above method directly allocates capability tokens through interactive communication between different user terminals without setting up a centralized authentication service terminal, so that user terminals can access the blockchain efficiently and ensure continuous and stable access to the blockchain.

[0029] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0030] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 A flowchart of the domain access control method based on blockchain capability tokens provided by the present invention. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] See also Figure 1 , is a flow chart of a domain access control method based on blockchain capability tokens provided by an embodiment of the present invention. The domain access control method based on blockchain capability tokens comprises the following steps:

[0035] Step S1, when a first user terminal sends a data access request to a second user terminal, the second user terminal queries the user terminal list block of the blockchain according to the data access request to determine the legitimacy of the data access request; based on the above determination result, determine whether to further obtain the data information that the first user terminal expects to access according to the data access request;

[0036] Step S2, selecting a matching capability token and its sending strategy from the capability token interval of the blockchain according to the data information that the first user terminal expects to access; preprocessing the capability token according to the sending strategy to generate a corresponding token data packet;

[0037] Step S3, returning the token data packet to the first user terminal through the second user terminal, so that the first user terminal obtains the corresponding capability token from the token data packet; after activating the capability token through the first user terminal, the data storage block corresponding to the second user terminal in the blockchain is accessed using the successfully activated capability token;

[0038] Step S4: adjusting the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal.

[0039] The beneficial effects of the above technical solution are as follows: the domain access control method based on blockchain capability tokens does not set up a centralized authentication service terminal to manage access to the blockchain, but directly sends a data access request to the second user terminal through the first user terminal, analyzes the data access request, determines to allocate the corresponding capability token and token sending strategy to the first user terminal, pre-processes the capability token to form a token data packet, and returns it to the first user terminal; activates the capability token through the first user terminal, thereby accessing the data storage block corresponding to the second user terminal in the blockchain; and then adjusts the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal; the above method directly allocates capability tokens through interactive communication between different user terminals without setting up a centralized authentication service terminal, so that user terminals can access the blockchain efficiently and ensure continuous and stable access to the blockchain.

[0040] Preferably, in step S1, when the first user terminal sends a data access request to the second user terminal, the second user terminal queries the user terminal list block of the blockchain according to the data access request, and judging the legitimacy of the data access request specifically includes:

[0041] When the first user terminal sends a data access request to the second user terminal, the second user terminal obtains the terminal identity information of the first user terminal from the data access request;

[0042] The second user terminal uses the terminal identity information as a reference to query the user terminal list block of the blockchain to determine whether the terminal identity information exists in the user terminal list block. If so, the data access request is judged to be a legal data access request; if not, the data access request is judged to be an illegal data access request.

[0043] The beneficial effect of the above technical solution is: when the first user terminal sends a data access request to the second user terminal, it will add its own terminal identity information to the data access request. When the second user terminal receives the data access request, it will extract the terminal identity information therein, and then match the terminal identity information with the user terminal list block of the blockchain. In this way, it can be determined whether the first user terminal is a legal terminal, and then further determine whether the data access request is a legal data access request, thereby preventing illegal terminals from obtaining access to the relevant data of the second user terminal.

[0044] Preferably, in step S1, determining whether to further obtain the data information that the first user terminal expects to access according to the data access request according to the above judgment result specifically includes:

[0045] When it is determined that the data access request is an illegal data access request, directly destroying the data access request through the second user terminal;

[0046] When it is determined that the data access request is a legitimate data access request, the second user terminal analyzes and processes the data access request to determine the type of data that the first user terminal expects to access; wherein the data type refers to whether the data that the first user terminal expects to access is text code data or image data.

[0047] The beneficial effects of the above technical solution are: different types of data require different access times. For example, the access time required for text code data is longer than the access time required for image data. When the data access request sent by the first user terminal is a legitimate data access request, the type of data that the first user terminal expects to access is further determined. This ensures that subsequent targeted access to different types of data can be performed, thereby improving the efficiency of data access.

[0048] Preferably, in step S2, according to the data information that the first user terminal wants to access, selecting a matching capability token from the capability token interval of the blockchain and its sending strategy specifically include:

[0049] When the data that the first user terminal expects to access is text code data, a capability token matching the terminal identity information of the second user terminal is selected from the capability token interval of the blockchain, and a first sending strategy is assigned to the capability token, so as to send the capability token according to the first sending strategy;

[0050] When the data that the first user terminal expects to access is image data, a capability token that matches the terminal identity information of the second user terminal is selected from the capability token interval of the blockchain, and a second sending strategy is assigned to the capability token, so that the capability token is sent according to the second sending strategy; wherein the sending period of the first sending strategy is less than the sending period of the second sending strategy.

[0051] The beneficial effect of the above technical solution is: through the above method, the capability tokens for text code data and image data can be sent differently, wherein the sending period of the first sending strategy is smaller than the sending period of the second sending strategy, thereby effectively balancing the load of sending the capability token to the first user terminal and ensuring that the capability token is safely delivered to the first user terminal.

[0052] Preferably, in step S2, preprocessing the capability token according to the sending strategy to generate a corresponding token data packet specifically includes:

[0053] When the capability token is sent using the first sending strategy, the capability token is encrypted and pre-processed to generate a corresponding token data packet;

[0054] When the capability token is sent using the second sending strategy, the capability token is pre-processed with double encryption to generate a corresponding token data packet.

[0055] The beneficial effect of the above technical solution is: through the above method, in different situations for accessing text code data or image data, the capability token is subjected to one-time encryption preprocessing or double encryption preprocessing, which can ensure that the capability token will not be stolen during transmission.

[0056] Preferably, in step S3, returning the token data packet to the first user terminal through the second user terminal so that the first user terminal obtains the corresponding capability token from the token data packet specifically includes:

[0057] The token data packet is directed back to the first user terminal through the second user terminal, and the token data packet is decrypted by the first user terminal to obtain the capability token contained therein.

[0058] The beneficial effect of the above technical solution is: through the above method, it can ensure that the token data packet is sent to the first user terminal in a directional manner, effectively avoiding the loss of the token data packet.

[0059] Preferably, in step S3, after the capability token is activated by the first user terminal, using the successfully activated capability token to access the data storage block corresponding to the second user terminal in the blockchain specifically includes:

[0060] Performing a signing operation on the capability token through the first user terminal, when the signature key corresponding to the signature operation is correct, the activation of the capability token is successful; when the signature key corresponding to the signature operation is incorrect, the activation of the capability token fails;

[0061] The first user terminal uses the successfully activated capability token to open the data storage block corresponding to the second user terminal in the blockchain, thereby accessing the data storage block.

[0062] The beneficial effect of the above technical solution is: through the above method, the first user terminal performs a signature operation on the capability token (such as performing an electronic signature key matching operation on the capability token, etc.) to activate the capability token, thereby providing the first user terminal with corresponding signature authentication for data access in the blockchain again, thereby maximizing the security of data access to the blockchain.

[0063] Preferably, in step S4, adjusting the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal specifically includes:

[0064] Obtain the duration of the first user terminal's current access to the data storage block. If the access duration is less than the life cycle of the capability token currently held by the first user terminal, keep the capability state of the capability token currently held by the first user terminal unchanged; otherwise, terminate the capability state of the capability token currently held by the first user terminal; wherein the capability state refers to the validity of the capability token to open the data storage block.

[0065] The beneficial effect of the above technical solution is: through the above method, the duration of the data access of the first user terminal on the blockchain can be limited, so as to avoid the first user terminal continuously accessing the data of the blockchain for a long time and occupying more data access bandwidth, which affects the smoothness and efficiency of the overall data access of the blockchain.

[0066] It can be seen from the contents of the above embodiments that the domain access control method based on blockchain capability tokens does not set a centralized authentication service terminal to manage access to the blockchain, but directly sends a data access request to the second user terminal through the first user terminal, analyzes the data access request, determines to allocate the corresponding capability token and token sending strategy to the first user terminal, and pre-processes the capability token to form a token data packet, and returns it to the first user terminal; activates the capability token through the first user terminal, thereby realizing access to the data storage block corresponding to the second user terminal in the blockchain; and then adjusts the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal; the above method directly allocates capability tokens through interactive communication between different user terminals without setting up a centralized authentication service terminal, so that user terminals can efficiently access the blockchain and ensure continuous and stable access to the blockchain.

[0067] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A domain access control method based on blockchain capability tokens, characterized in that: It includes the following steps: Step S1, when a first user terminal sends a data access request to a second user terminal, the second user terminal queries the user terminal list block of the blockchain according to the data access request to determine the legitimacy of the data access request; based on the above determination result, determine whether to further obtain the data information that the first user terminal expects to access according to the data access request; Step S2, selecting a matching capability token and its sending strategy from the capability token interval of the blockchain according to the data information that the first user terminal expects to access; Preprocessing the capability token according to the sending strategy to generate a corresponding token data packet; Step S3, returning the token data packet to the first user terminal through the second user terminal, so that the first user terminal obtains the corresponding capability token from the token data packet; After activating the capability token through the first user terminal, using the successfully activated capability token to access the data storage block corresponding to the second user terminal in the blockchain; Step S4, adjusting the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal; Among them, in the step S2, according to the data information that the first user terminal expects to access, selecting a matching capability token and its sending strategy from the capability token interval of the blockchain specifically includes: When the data that the first user terminal expects to access is text code data, a capability token matching the terminal identity information of the second user terminal is selected from the capability token interval of the blockchain, and a first sending strategy is assigned to the capability token, so as to send the capability token according to the first sending strategy; When the data that the first user terminal expects to access is image data, a capability token that matches the terminal identity information of the second user terminal is selected from the capability token interval of the blockchain, and a second sending strategy is assigned to the capability token, so that the capability token is sent according to the second sending strategy; wherein the sending period of the first sending strategy is less than the sending period of the second sending strategy.

2. The domain access control method based on blockchain capability token according to claim 1, characterized in that: In step S1, when the first user terminal sends a data access request to the second user terminal, the second user terminal queries the user terminal list block of the blockchain according to the data access request, and judging the legitimacy of the data access request specifically includes: When the first user terminal sends a data access request to the second user terminal, the second user terminal obtains the terminal identity information of the first user terminal from the data access request; The second user terminal uses the terminal identity information as a reference to query the user terminal list block of the blockchain to determine whether the terminal identity information exists in the user terminal list block. If so, the data access request is determined to be a legitimate data access request; If not, the data access request is determined to be an illegal data access request.

3. The domain access control method based on blockchain capability token as claimed in claim 2, characterized in that: In the step S1, determining whether to further obtain the data information that the first user terminal expects to access according to the data access request according to the above judgment result specifically includes: When it is determined that the data access request is an illegal data access request, directly destroying the data access request through the second user terminal; When it is determined that the data access request is a legitimate data access request, the data access request is analyzed and processed by the second user terminal to determine the type of data that the first user terminal expects to access; wherein the data type refers to whether the data that the first user terminal expects to access is text code data or image data.

4. The domain access control method based on blockchain capability token according to claim 1, characterized in that: In step S2, preprocessing the capability token according to the sending strategy to generate a corresponding token data packet specifically includes: When sending the capability token in accordance with the first sending strategy, performing encryption preprocessing on the capability token to generate a corresponding token data packet; When the capability token is sent using the second sending strategy, the capability token is pre-processed with double encryption to generate a corresponding token data packet.

5. The domain access control method based on blockchain capability token according to claim 4 is characterized in that: In step S3, returning the token data packet to the first user terminal through the second user terminal so that the first user terminal obtains the corresponding capability token from the token data packet specifically includes: The token data packet is directed back to the first user terminal through the second user terminal, and the token data packet is decrypted by the first user terminal to obtain the capability token contained therein.

6. The domain access control method based on blockchain capability token according to claim 5, characterized in that: In step S3, after the capability token is activated by the first user terminal, using the successfully activated capability token to access the data storage block corresponding to the second user terminal in the blockchain specifically includes: Performing a signing operation on the capability token through the first user terminal, when the signature key corresponding to the signature operation is correct, the activation of the capability token is successful; when the signature key corresponding to the signature operation is incorrect, the activation of the capability token fails; The first user terminal uses the successfully activated capability token to open the data storage block corresponding to the second user terminal in the blockchain, thereby accessing the data storage block.

7. The domain access control method based on blockchain capability token according to claim 6, characterized in that: In the step S4, adjusting the capability status of the capability token currently held by the first user terminal according to the current data access status of the first user terminal specifically includes: Obtain the duration of the first user terminal's current access to the data storage block. If the access duration is less than the life cycle of the capability token currently held by the first user terminal, keep the capability state of the capability token currently held by the first user terminal unchanged; otherwise, terminate the capability state of the capability token currently held by the first user terminal; wherein the capability state refers to the validity of the capability token to open the data storage block.

Images