A blockchain-based access control method in mobile edge cloud cooperation

Abstract

This invention proposes a blockchain-based access control method for mobile edge-cloud collaboration. The steps are as follows: initializing protocol parameters within the mobile edge network domain; generating the master key and public key of the edge-cloud collaboration system; generating public / private key pairs for the cloud server, edge server, and terminal members; terminal members register their identities, obtain attribute permission parameters, and write them into the blockchain; after successful registration, resource providers share data and set attribute sets and access control policies for accessing the resource; resource visitors access resources within the domain; if the required resource is not found within the domain, the visitor requests a signature from the local edge server and obtains the signature to access the resource across domains. This invention employs hidden attribute authentication technology, ensuring that attributes are not leaked during transmission, thus more effectively and securely protecting personal privacy information. Simultaneously, the protocol, combined with blockchain technology, ensures resistance to collusion attacks, making access control more flexible, efficient, and practical.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a blockchain-based access control method for mobile edge-cloud collaboration. Background Technology

[0002] The rapid development of 5G, big data, and artificial intelligence technologies in recent years has propelled cloud computing to its peak. Cloud computing has brought numerous benefits to companies and enterprises in terms of computing power, scale, interoperability, and centralization. However, with the development of cloud computing and the massive increase in edge nodes and data volume, the shortcomings of cloud computing have become increasingly apparent. Therefore, edge-cloud collaboration has become a new technological trend. The combination of edge computing and cloud computing can provide high-capacity, high-bandwidth, and low-latency data sharing technologies for various scenarios. However, due to the complex and diverse nature of resource sharing, frequent resource access, and large resource transmission volumes, the privacy and data security of end users are seriously challenged.

[0003] Secure access control for data is a key technology for ensuring secure data sharing among terminal members. It limits the scope or sensitivity of data accessed by a data acquirer through certain conditions, ensuring users can access data within their legal permissions and prohibiting unauthorized operations. In edge cloud collaborative environments, access control remains a crucial technology for ensuring secure data access. However, existing access control technologies suffer from cumbersome and inefficient terminal member authentication processes, difficulty in timely updating user permissions, and vulnerability to data tampering during sharing, making them unsuitable for mobile edge cloud collaborative scenarios. This paper proposes a blockchain-based access control protocol for secure data sharing in mobile edge cloud collaborative scenarios. This protocol protects terminal user privacy through identity authentication based on hidden attributes. Simultaneously, leveraging the traceability, provability, and authenticability of blockchain, it achieves dynamic, fine-grained, and cross-domain access control, making the identity authentication process more lightweight and reliable. Furthermore, this solution combines identity authentication and attribute authentication to achieve a dual authentication mechanism, further enhancing the security of secure data access control.

[0004] Currently, there is no research on blockchain-based access control protocols for mobile edge-cloud collaboration scenarios, and a series of challenging issues need to be addressed, including the lack of precedents for cross-domain access control. Summary of the Invention

[0005] To address the technical problems of existing access control methods, such as easy leakage of terminal member privacy, low efficiency of authentication processes, and difficulty in implementing cross-domain access control, this invention proposes a blockchain-based access control method for mobile edge-cloud collaboration. This method employs access control technology that hides attributes, not only achieving resource access control but also ensuring that the attributes and identity information of terminal members are not leaked. It also reduces the computational and communication overhead for terminal members. Combined with blockchain technology, this not only improves the efficiency of verifying terminal member identities but also prevents collusive attacks by unauthorized terminal members.

[0006] To achieve the above objectives, the technical solution of this invention is implemented as follows: a blockchain-based access control method for mobile edge-cloud collaboration, comprising the following steps:

[0007] Step 1: Initialization of access control protocol parameters in the edge-cloud collaborative system: generation of public / private key pairs for the cloud server CS, each edge server, and each terminal member;

[0008] Step 2: Distribution of Attribute Permissions to Terminal Members:

[0009] A) The cloud server CS broadcasts all attributes of the access system resources and their attribute serial numbers to each terminal member;

[0010] B) Terminal members calculate the intermediate parameters required for registration based on their own attributes and send the intermediate parameters to the cloud server CS;

[0011] C) After receiving messages from each terminal member, the cloud server CS verifies the validity of the parameters and the legitimacy of each terminal member's identity. If the verification is successful, the cloud server CS determines the number of terminal member attributes and calculates the attribute permission parameters and signature. Then, it sends its public key, signature, and attribute permission parameters to each terminal member.

[0012] D) After receiving the message sent by the cloud server CS, each terminal member calculates the attribute permissions, and then verifies the identity of the cloud server CS and the correctness of the attribute permissions. If the verification is successful, each terminal member obtains the attribute permissions and attribute permission parameter set corresponding to the attribute, and the attribute permissions of each terminal member are successfully distributed.

[0013] E) The cloud server CS calculates the encryption parameters and sends them to each edge server. After receiving the encryption parameters, each edge server calculates the set of attribute permissions for all attributes.

[0014] F) The cloud server CS divides the edge server and mobile terminal into different security domains based on their IPs and establishes a blockchain for each security domain. The public information of each terminal member in the security domain is written into the blockchain. The edge server runs the blockchain program of its domain and can obtain the block information of any terminal member under its jurisdiction.

[0015] Step 3: Storage of shared resources:

[0016] G) Resource sharers set the attribute set and access control policy of the resource, and use the access control policy to encrypt the shared resource to obtain ciphertext; resource sharers upload their public key and the information of the shared resource to the local edge server. After receiving the message, the local edge server writes it into the blockchain and stores the message in the consortium data index database list at the same time.

[0017] Step 4: Access control for shared resources within the domain and access control for shared resources outside the domain.

[0018] Furthermore, the method for implementing access control for shared resources within the domain is as follows:

[0019] H) Resource requesters calculate the access parameters and access signature required to access resources and send the access parameters, access signature, and access permission information to the local edge server.

[0020] I) Upon receiving a message from a resource requester, the local edge server verifies the validity of the parameters, the identity of the resource requester, and the attribute permission parameters.

[0021] J) After verification, the local edge server searches for resources based on the keywords provided by the resource requester and compares the access permissions of the resources with those of the resource requester. Once the target resource is found, the local edge server calculates the request parameters and request signature and sends them to the resource requester.

[0022] K) After receiving the message from the local edge server, the resource requester verifies the request parameters and the identity of the local edge server. If the verification is successful, the resource requester obtains the shared resources.

[0023] Furthermore, the method for access control of the shared resources outside the domain is as follows:

[0024] L) Resource users calculate the access parameters and signatures required to access resources, and send the access parameters, access signatures, their own access permissions, and keyword information to the local edge server.

[0025] After receiving the message from the resource requester, the local edge server verifies the validity of the access parameters, the identity of the terminal member, and the attribute permission parameters.

[0026] N) After successful verification, the local edge server searches for the resource corresponding to the keyword, the access permissions of the resource, and the edge server outside the domain to which the resource belongs. Then, it calculates the request signature and sends the request signature and the address of the edge server outside the domain to the resource requester.

[0027] O) After receiving the message from the local edge server, the resource requester calculates the parameters of the request signature and verifies the validity of the message. After successful verification, the resource requester sends the resource request parameter information to the edge server outside the domain.

[0028] P) After receiving the resource request parameter message from the resource requester, the edge server outside the domain verifies the request parameters, the identity of the resource requester, the request signature of the edge server where the resource requester is located, and the attribute permission parameters of the resource requester.

[0029] Q) After successful verification, the edge server outside the domain provides a link to the shared resources to the resource requester.

[0030] Furthermore, the method for generating the public / private key pairs of the cloud server CS, each edge server, and each terminal member in step one is as follows:

[0031] Generate the system's master key (MSK) and public key (PK) using the master key generation function; input the system's public key (PK), master key (MSK), and terminal member u. i,t Identity identifier and terminal member u i,t attribute set Using key generation function Output terminal members' private keys Then calculate the public key. Then the public / private key pair of the terminal member is

[0032] Cloud server CS selects a random positive integer Used as the private key, and used to calculate the public key PK. CS =SK CS g1, then the public / private key pair of the cloud server CS is (PK CS SK CS );

[0033] Each edge server E i Randomly select a positive integer Used as the private key, and used to calculate the public key.

[0034] Where g1 is a generator of the additive group G1. Let represent the set of integers of order q, where q is the prime order of the additive group G1, and 1≤i≤N, 1≤t≤n, where n is the number of terminal members in the domain, and N is the number of edge servers in the system.

[0035] Furthermore, the method for distributing attribute permissions to terminal members in step two is as follows:

[0036] (1) All attributes of cloud server CS broadcast access system resources and their corresponding serial numbers {(A1,S1),(A2,S2),...,(A R ,S R )} to each terminal member; where A v S is the v-th attribute used to access system resources. v Represents attribute A v The attribute sequence number, 1≤v≤R, R∈N * N represents the number of network attributes. * Represents positive integers;

[0037] (2) Possesses a set of attribute sequences terminal member u i,t Randomly select a positive integer Calculate intermediate parameter o i,t =γ i,t g1,θ i,t,1 =γ i,t H1(a i,t,1 g1,θ i,t,2 =γ i,t H1(a i,t,2 g1,...,θ i,t,r =γ i,t H1(a i,t,r g1, β i,t =γ i,t PK CS , and φ i,t =H2(β) i,t Terminal member u i,t Send message Give it to cloud server CS; where a i,t,v For terminal member u i,t The vth attribute, and a i,t,k <a i,t,k+1 1≤k<r, r≤R is the terminal member u i,t The number of attributes, a positive integer γ i,t ≠1, θ i,t,1 ,θ i,t,2 ,...,θ i,t,r η i,t β i,t φ i,t and o i,t All represent terminal member u i,tThe intermediate parameters required for registration are: g1 is the generator of the additive group G1, 1≤i≤N, 1≤t≤n, n is the number of terminal members in the domain, and N is the number of edge servers in the system; PK CS This is the public key for the cloud server CS. Indicates terminal member u i,t private key, For terminal member u i,t The public key; It is a hash function, and || is the concatenation operator;

[0038] (3) The cloud server CS receives the terminal member u i,t Message sent Then, calculate the hash value β. i ' ,t =H2(β) i,t And verify equation β. i ' ,t =φ i,t and Does the equation hold true? If so, the cloud server CS calculates the intermediate parameters. and ; Cloud server CS comparison intermediate parameters and θ i,t,k Determine if the values ​​are equal to those of the terminal member u. i,t What attributes does it have; then the cloud server CS is for the terminal member u i,t Each attribute a i,t,k Randomly select a positive integer Computed property a i,t,k The corresponding attribute permission parameter χ i,t,k =t i,t,k CS i,t and signature The cloud server CS will send the message {PK CS ,δ i,t ,(χ i,t,1 ,χ i,t,2 ,...χ i,t,r )} Sent to registered terminal member u i,t ; where χ i,t,k For terminal member u i,t The attribute permission parameter for the k-th attribute, SK CS For the private key of the cloud server CS, δ i,t It is a terminal member u i,t The signature required for registration, e(·), is a computable bilinear mapping function;

[0039] (4) Terminal member u i,t Received message {PK} from cloud server CS CS ,δ i,t,(χ i,t,1 ,χ i,t,2 ,...χ i,t,r After that, calculate the attribute permission T for each attribute. i,t,1 =γ i,t -1 χ i,t,1 =t t,1 g1,T i,t,2 =γ i,t -1 χ i,t,2 =t i,t,2 g1,...,T i,t,r =γ i,t -1 χ i,t,r =t i,t,r g1 and intermediate parameter μ i,t =H2(T i,t,1 ||T i,t,2 ||...||T i,t,r Terminal member u i,t Verify equation e(δ) i,t PK CS )=e(μ i,t If the equation (g1, g1) holds true, then the terminal member u... i,t Successfully registered and retrieved each of its attributes a i,t,k Corresponding attribute permission T i,t,k and attribute permission parameter set π i,t ={χ i,t,1 ,χ i,t,2 ,...,χ i,t,r}; where T i,t,1 ,T i,t,2 ,...,T i,t,r Indicates terminal member u i,t Attribute permissions, μ i,t This represents the intermediate variables required to verify the identity of a cloud server (CS).

[0040] (5) The cloud server CS uses the positive integer it selects. For each edge server E i Calculate encryption parameters Encrypt parameters Send to edge server E i Each edge server E i Received encrypted parameters Then, compute attribute permissions Then edge server E i Get the attribute permission set Eaw for all attributes t,k ={T i,t,1 ,T i,t,2 ,...,Ti,t,R};in, For edge server E i public key, For edge server E i The private key;

[0041] (6) The cloud server CS is divided into different security domains based on the IPs of the edge server and terminal members, and a blockchain is established for each security domain. The public information of each terminal member in that security domain is written into the blockchain; when the edge server E i A terminal member u i,t After successful registration, the cloud server CS will store the public key of the terminal member. Attribute permission parameter set π i,t and edge server E i Information composed of public keys A new block is written into the blockchain; the information blocks of all terminal members in a security domain constitute the blockchain of a security domain.

[0042] (7) Edge Server E i Run the blockchain program within this domain to obtain the information of any terminal member u under its jurisdiction. i,t information of the block

[0043] Furthermore, the method for storing shared resources in step three is as follows:

[0044] 1) Terminal member u i,j According to shared resource m i,j Setting the security level for accessing shared resources m i,j attribute set and access control policies Attribute set The corresponding attribute permission set is The set of attribute permission parameters corresponding to the attribute permission set is Among them, attr i,j,m Indicates shared resource m i,j The m-th attribute, T i,j,m The attribute attr i,j,m The corresponding attribute permissions, χ i,j,m For attribute permissions T i,j,m The corresponding attribute permission parameters are 1≤j≤n, where n is the number of terminal members within the domain;

[0045] 2) Terminal member u i,j Use attribute permission sets Attribute permissions and access control policies Encrypted shared resources m i,j And obtain encrypted data Then terminal member u i,j Use its public key encrypted data Attribute permission parameter set Shared resources m i,j Keywords, access control policies Composition of messages Uploaded to the local edge server E i ;

[0046] 3) Local edge server E i Received message Then, the message is written to the blockchain; edge server E i Each shared resource is written as a block to the local data sharing blockchain, and the message is simultaneously... Stored in the Alliance Data Index Database list d all ;in, For the local edge server E i The access address.

[0047] Furthermore, the method for access control of shared resources within the domain is as follows:

[0048] S1: Resource demander u i,t Calculate hash value and access signature Include your access permissions information and the keywords for the resources you are accessing. Send to the local edge server E i ;in, Indicates terminal member u i,t private key, For terminal member u i,t The public key; π i,t Represents the set of attribute permission parameters, o i,t Indicates terminal member u i,t The intermediate parameters for registration calculation; and 1≤t≠j≤n; It is a hash function, || is the concatenation operator, H3:{0,1} * →G1 is a hash function, and g1 is the generator of the additive group G1;

[0049] S2: Local edge server E i Received message Then, calculate the hash value. And verify the hash value Check if they are equal; if the hash values ​​are equal, calculate and verify the equation. Check if the equation holds true. If it does, then verify the attribute permission parameter set π.i,t Messages on the blockchain platform of cloud server CS Are the attribute permission parameters consistent? χ t,r These are attribute permission parameters;

[0050] S3: If terminal member u i,t If authentication is successful, the local edge server E i According to terminal member u i,t The system searches for data resources using provided keywords and determines the access permissions and terminal members of the searched data resources. i,t Based on the access permission comparison results, select terminal member u. i,t Shared resources with access permissions Local edge server E i Select a random number Calculate intermediate request parameters and request for signature and information Send to terminal member u i,t ;in, For edge server E i public key, For edge server E i The private key;

[0051] S4: Terminal member u i,t Received message Then, calculate and verify the two equations. and Whether it is true or false; if both equations are true, then the terminal member u i,t Calculate the ciphertext data And through its attribute permissions and access control policies Decryption yields plaintext information; γ i,t For terminal member u i,t A randomly selected positive integer.

[0052] Furthermore, the method for access control of the inter-domain shared resources is as follows:

[0053] S11, Resource Demander u i,t Calculate hash value and access signature And their access permission information, keywords for accessing data, etc. Send to the local edge server E i Where 1≤t≠j≤n, H3:{0,1} * →G1 is the hash function, g1 is the generator of the additive group G1; H2(·) is the hash function;

[0054] S12, Local Edge Server E i Received message Then, calculate the hash value. And verify Check if they are equal. If they are equal, calculate and verify the equation. Check if the equation holds true. If it does, then verify the attribute permission parameter set π. i,t Blockchain platform with cloud server CS Are the attribute permission parameters consistent?

[0055] S13, if terminal member u i,t If authentication is successful, the local edge server E i According to terminal member u i,t The provided keywords are listed in the federated index database. all Search for shared resources and their access permissions corresponding to the keywords in the search query, assuming they match the terminal member u. i,t The required shared resources belong to an edge server outside the domain E. t Terminal member u i,t The edge server E of this domain i The local edge server E signs the messages it sends. i Calculate request signature And request signature and off-domain edge servers E t IP address Passed to terminal member u i,t ;

[0056] S14, Terminal Member u i,t Received from an external edge server E i Message sent Then, calculate the intermediate parameters. And verify Is it true? If true, then terminal member u i,t Based on IP address Accessing the edge server E outside the domain t and the message Send to the edge server E outside the domain t ;

[0057] S15, External Edge Server E t Received message Then, through hash value Verification message Whether the hash value is correct, and by calculating the equation. Whether it is true or not, to verify the external edge server E iCheck if the request signature is correct. If both equations are true, then the edge server E outside the domain... t Verify attribute permission parameter set π i,t Messages on the blockchain platform of cloud server CS Are the attribute weight parameters consistent?

[0058] S16, if terminal member u i,t Verification was successful, and its access permissions are compatible with the off-domain edge server E. t Access permissions for related resources within the management domain are granted by providing corresponding encrypted resource links.

[0059] Furthermore, in step (3), the formula... The verification method is as follows:

[0060]

[0061] In step (4), the equation e(δ) is used. i,t PK CS )=e(μ i,t The verification method for g1, g1) is as follows:

[0062]

[0063] In step S2, the formula is as follows The verification method is as follows:

[0064]

[0065] In step S4, etc. The verification method is as follows:

[0066]

[0067] Furthermore, in step S12, the formula is... The verification method is as follows:

[0068]

[0069] Step S14, Equation The verification method is as follows:

[0070]

[0071] In step S15, the formula is as follows: The verification method is as follows:

[0072]

[0073] Compared with existing technologies, the beneficial effects of this invention are as follows: 1) Privacy protection of mobile terminals: In edge-cloud collaborative wireless network environments, the privacy of mobile terminals is easily leaked. This invention proposes an access control technology based on hidden attributes, which not only achieves the purpose of resource access control but also ensures that the attributes and identity information of terminal members are not leaked; 2) Cross-domain access control: The application background of edge-cloud protocols is relatively complex, and terminal members sharing resources may be distributed in different security domains. This invention supports cross-domain access control of resources; 3) Dynamic access control: Mobile terminals may frequently join or leave application systems. Terminal members that leave need to update their resource access permissions in a timely manner. This invention adopts a region-based access control approach. 4) Fine-grained access control: Resource access permissions for terminal members are implemented by combining the attribute permissions they possess. The same set of permissions can be combined in different ways to set multiple resource access permissions, achieving fine-grained resource access right settings; 5) Resistance to collusion attacks: Traditional attribute-based access control technologies are difficult to resist collusion attacks. This invention uses blockchain-based access control technology, writing each user's attributes into the blockchain. Utilizing the immutability of the blockchain, it ensures that no two terminal users can combine their attributes to access the data resources of any unauthorized terminal user. This invention makes information resource sharing in edge-cloud collaborative scenarios more flexible, efficient, and practical, possessing significant research value and commercial application value. Attached Figure Description

[0074] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0075] Figure 1 This is a schematic diagram of the process of the present invention.

[0076] Figure 2 This is a schematic diagram of hierarchical group key negotiation in Embodiment 1 of the present invention. Detailed Implementation

[0077] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0078] Addressing the challenges of data confidentiality, integrity, and leak resistance in complex mobile edge-cloud collaborative environments where secure communication between mobile terminals involves complex scenarios, and considering the inherent complexity and randomness of communication environments due to the arbitrariness of mobile terminals accessing the internet anytime and anywhere, this invention proposes a blockchain-based access control protocol for mobile edge-cloud collaboration. Figure 1 As shown, secure access control for shared data in an edge-cloud collaborative environment is implemented. First, within the edge-cloud collaborative system, the cloud server and edge server randomly select positive integers, then calculate their private keys and use the generator of an additive group to calculate their public keys. Terminal members use their identity identifiers and attribute sets to generate their private keys using a key generation function and use the generator to calculate their public keys. Second, the cloud server (CS) broadcasts attributes and attribute sequence numbers to each terminal member. Terminal members calculate the parameters and signatures required for identity verification based on the attributes. The cloud server (CS) verifies the terminal member's identity and attributes; if verification is successful, attribute permissions are granted to the terminal member. Then, terminal members set the attribute set and access control policy for the resource, and encrypt the resource to obtain ciphertext data according to the attribute permissions and access policy. Then, the ciphertext data, attribute permission parameter set, access policy, keywords and other information are uploaded to the local edge server. Terminal members can apply to the local edge server for access to resources according to their own attribute permissions. If the local edge server does not have the resource required by the terminal member, the terminal member first applies for a signature from the local edge server, and then applies to the inter-domain server for access to the resource after obtaining the signature. While the system is running, terminal members can apply to join or add access permissions, or revoke permissions or leave the system. The cloud server will dynamically update the access permissions of the terminal members.

[0079] 1. The theoretical basis and related definitions involved in this invention

[0080] 1.1 Bilinear Mapping Problem

[0081] Definition 1. Bilinear mapping: Let G1 be an additive group on an elliptic curve, and G2 be a multiplicative group on an elliptic curve. The additive group G1 and the multiplicative group G2 have the same order q, where, Let be a safety parameter, and g1 be a generator of the additive group G1, i.e., G1 = g1. Computing the discrete logarithms over the additive group G1 and the multiplicative group G2 is difficult. e is a efficiently computable bilinear mapping, i.e., e: G1 × G1 → G2. The bilinear mapping e satisfies the following properties:

[0082] Property 1. Bilinearity: For any two elements μ, ν∈G1 and any two positive integers in the additive group G1, the bilinearity is determined by the bilinearity of ... There is the equation e(aμ,bν)=e(μ,ν) ab Established. Among them, Let q represent the set of integers of order q.

[0083] Property 2. Non-degeneracy: There exist generators ω, ρ ∈ G1 such that e(ω, ρ) ≠ 1.

[0084] Property 3. Computability: There exists an efficient algorithm that can compute e(ω,ρ) for generators ω,ρ∈G1.

[0085] Reasoning 1. For all generators ρ1, ρ2, ω∈G1, we have e(ρ1+ρ2,ω)=e(ρ1,ω)e(ρ2,ω).

[0086] 1.2 Computational Complexity Problem

[0087] Definition 1. Discrete Logarithm Problem (DLP): For any two points Y, Q ∈ G1 on an elliptic curve, where Y = aQ, If a < q, and a and Q are given, point Y can be easily computed. However, if points Y and Q are given, a cannot be computed in efficient polynomial time.

[0088] Definition 2. Inverse Diffie-Hellman Problem (ICDH): Given g1, ag1, and abg1, for parameters... Calculate (aba)g1.

[0089] Example 1

[0090] In complex data sharing environments, terminal members need to undergo identity authentication before attribute permission distribution. However, during authentication, the privacy information of terminal members is easily leaked due to the mobile edge-cloud collaborative network environment. For security reasons, terminal members need to protect their personal identity privacy during authentication. During data sharing, the confidentiality, integrity, and anti-leakage of shared information must also be ensured, requiring only terminal members who comply with access policies to obtain shared resources. To address this application background, this invention proposes a blockchain-based access control method for mobile edge-cloud collaborative scenarios, such as... Figure 1As shown, the steps are as follows: ① The edge-cloud collaboration system first initializes, generating public / private key pairs for the cloud server (CS), edge server, and terminal members respectively; ② Attribute permissions are distributed to terminal members within the edge-cloud collaboration system: Before data sharing, terminal members first perform identity authentication with hidden attributes, ensuring their privacy information is not leaked while authenticating their identity. After successful authentication, attribute permissions are distributed to legitimate terminal members; ③ Secure resource storage: Terminal members set the resource's attribute set and access control policy according to the resource's confidentiality level, and then use attribute permissions and access control policies to encrypt the resource to obtain ciphertext data and upload it to the local edge server; ④ Intra-domain resource access control: Terminal members request the target resource from the local server according to their attribute permissions; ⑤ Inter-domain resource access control: If the target resource is not available within the domain, the terminal member first requests a request signature from the local edge server, and then requests access to the target resource from the edge server in the other domain according to the request signature and attribute permission parameters. A schematic diagram of the access control of the entire edge-cloud collaboration system is shown below. Figure 2 As shown, the specific steps of the present invention are as follows:

[0091] Step 1: Initialization of access control protocol parameters in the edge-cloud collaborative system: generation of public / private key pairs for cloud server CS, each edge server, and each terminal member.

[0092] Assuming each edge server and its managed terminal members constitute a security domain, there are N domains D in the edge-cloud collaborative system. i (1≤i≤N), each domain has n terminal members, i.e., domain D i By edge server E i (1≤i≤N) and the set U of its governed terminal members i ={u i,1 ,u i,2 ,...,u i,n The domain D is composed of} i The set of identities of terminal members is represented as For terminal member u i,t The identity identifier, 1≤t≤n.

[0093] Based on the requirements for accessing system resources, the cloud server defines all attributes for accessing system resources, and assigns all attributes to a sequence Aseq = A1|A2|...|A R The attribute set corresponding to these attribute sequences is Aset = {A1, A2, ..., A...} j A j+1 ,...,A R}, where A j <A j+1 (j<R), R∈N *This indicates the number of attributes required to access all system resources. Each terminal member u... i,t The set of sequence attributes (1≤t≤n) is represented as The corresponding attribute sequence is Where, r∈N * r≤R and a i,t,r-1 <a i,t,r u i,t E represents the i-th edge server in the edge-cloud collaborative system. i The t-th terminal member of the management domain, a i,t,r Indicates that it belongs to terminal device u i,t The r-th attribute.

[0094] The method for generating public / private key pairs among cloud server CS, edge servers, and terminal members is as follows:

[0095] Inputting the security parameter λ, the edge-cloud protocol system uses the master key generation function Setup(1) λ Generate the system master key (MSK) and public key (PK). This is used for key generation of terminal members in the edge-cloud collaborative system, inputting the system's public key (PK), master key (MSK), and terminal member's key (u). i,t identity information and terminal member u i,t attribute set Using key generation function Output terminal members' private keys Then calculate the public key.

[0096] Cloud server CS selects a random positive integer Used as the private key, and used to calculate the public key PK. CS =SK CS g1;

[0097] Each edge server E in the edge-cloud protocol system i Randomly select a positive integer Used as the private key, and used to calculate the public key. The system's common parameters are Where g1 is a generator of the additive group G1. Let represent the set of integers of order q, where q is the prime order of the additive group G1. KeyGen() represents the key generation algorithm, where 1 ≤ i ≤ N, 1 ≤ t ≤ n, n is the number of terminal members in the domain, and N is the number of edge servers in the system. For terminal member u i,t private key, For terminal member u i,t public key, For terminal member u i,tIdentity identifier, These are three hash functions.

[0098] Step 2: Distribute the attribute permissions of terminal members.

[0099] To prevent unauthorized terminal members from participating in resource sharing, only authorized terminal members are allowed to participate in encrypted information storage and access information resources. This invention employs a hidden attribute authentication method, authenticating terminal members within the domain before resource sharing to prevent unauthorized users from participating. Each terminal member interacts with the cloud server (CS) to generate attribute permissions corresponding to each attribute.

[0100] This invention implements attribute-based identity authentication, possessing the functions of traditional identity authentication while protecting personal privacy. Furthermore, it matches access based on attribute permissions, allowing terminal members with different attribute permissions to access data of varying sensitivity, thus preventing the leakage of sensitive information. The specific implementation method for distributing attribute permissions to terminal members is as follows:

[0101] (1) All attributes of cloud server CS broadcast access system resources and their corresponding serial numbers {(A1,S1),(A2,S2),...,(A R ,S R For each terminal member, A v S is the v-th attribute used to access system resources. v Represents attribute A v The corresponding attribute sequence number, 1≤v≤R, R∈N * N represents the number of network attributes. * Represents a positive integer.

[0102] (2) Possesses a set of attribute sequences terminal member u i,t Randomly select a positive integer Then calculate the intermediate parameter o. i,t =γ i,t g1,θ i,t,1 =γ i,t H1(a i,t,1 g1,θ i,t,2 =γ i,t H1(a i,t,2 g1,...,θ i,t,r =γ i,t H1(a i,t,r g1, β i,t =γ i,t PK CS , and φ i,t =H2(β) i,t Then the terminal member ui,t Send message Give it to cloud server CS; where a i,t,k <a i,t,k+1 positive integer γ i,t ≠1, θ i,t,1 ,θ i,t,2 ,...,θ i,t,r η i,t β i,t φ i,t and o i,t All represent terminal member u i,t intermediate parameters required for registration, o i,t Used for later terminal member authentication, g1 is the generator of the additive group G1, 1≤t≤n, 1≤k<r, r≤R is the terminal member u i,t The number of attributes, a i,t,v For terminal member u i,t The vth attribute, Indicates terminal member u i,t The private key; It is a hash function, and || is the concatenation operator.

[0103] (3) The cloud server CS receives the terminal member u i,t Message sent Then, calculate the hash value β. i ' ,t =H2(β) i,t ), and verify the equation. If the equation does not hold true, it indicates that the terminal member u is invalid. i,t Registration failed due to invalid identity. If the equation is true, it means that the terminal member u... i,t Identity valid. Intermediate parameters for cloud server CS computation. Cloud server CS compares intermediate parameters and θ i,t,k Whether the values ​​of (1≤k≤r) are equal can determine the terminal member u. i,t What attributes does it have? Then, the cloud server CS provides the terminal member u... i,t Each attribute a i,t,k Randomly select a positive integer Computed property a i,t,k The corresponding attribute permission parameter χ i,t,k =t i,t,k CS i,t and signature Then the cloud server CS will send message {PK CS ,δ i,t ,(χ i,t,1 ,χ i,t,2 ,...χ i,t,r)} Sent to registered terminal member u i,t ; where χ i,t,k For terminal member u i,t The permission parameter for the k-th attribute, δ i,t It is a terminal member u i,t The signature required for registration, e(·), is a computable bilinear mapping function.

[0104] Among them, the equation The verification method is as follows:

[0105]

[0106] (4) Terminal member u i,t Received message {PK} from cloud server CS CS ,δ i,t ,(χ i,t,1 ,χ i,t,2 ,...χ i,t,r After that, calculate the attribute permission T for each attribute. i,t,1 =γ i,t -1 χ i,t,1 =t t,1 g1,T i,t,2 =γ i,t -1 χ i,t,2 =t i,t, 2g1,...,T i,t,r =γ i,t -1 χ i,t,r =t i,t,r g1 and intermediate parameter μ i,t =H2(T i,t,1 ||T i,t,2 ||...||T i,t,r Then, terminal member u i,t By verifying the equation e(δ) i,t PK CS )=e(μ i,t To verify the identity information and attributes a of the cloud server CS, we need to determine if g1, g1) is true. i,t,k Corresponding attribute permission T i,t,k Is this correct? If the equation is false, it means the cloud server CS identity is invalid, and the terminal member u... i,t Re-register. If the equation holds true, then terminal member u i,t Each of its attributes a can be obtained i,t,k Corresponding attribute permission T i,t,k and attribute permission parameter set π i,t ={χ i,t,1 ,χ i,t,2 ,...,χi,t,r At this time, each terminal member u i,t Successfully registered and obtained the attribute permissions corresponding to each attribute; among them, T i,t,1 ,T i,t,2 ,...,T i,t,r Indicates terminal member u i,t Attribute permissions, μ i,t This represents the intermediate variable required to verify the identity of the cloud server (CS).

[0107] Among them, the equation e(δ) i,t PK CS )=e(μ i,t The verification method for g1, g1) is as follows:

[0108]

[0109] (5) The cloud server CS uses the positive integer it previously selected. For each edge server E i Calculate encryption parameters Encrypt parameters Send to edge server E i Each edge server E i Received encrypted parameters Then, compute attribute permissions Then edge server E i It can obtain attribute permissions for all attributes in the edge-cloud collaborative system, i.e., edge server E. i The set of attribute permissions (Eaw) that can access all system attributes t,k ={T i,t,1 ,T i,t,2 ,...,T i,t,R}.in, For edge server E i public key, For edge server E i The private key.

[0110] (6) The cloud server CS divides the edge server and terminal members into different security domains based on their IPs, and establishes a blockchain for each security domain, writing the public information of each terminal member in that security domain into the blockchain. When the edge server E i A terminal member u i,t After successful registration, the cloud server CS will store the public key of the terminal member. Attribute permission parameter set π i,t and edge server E i Information composed of public keys A new block is written into the blockchain. The information blocks of all terminal members in a security domain constitute the blockchain of a security domain.

[0111] (7) Edge Server E i Run the blockchain program within this domain to obtain the information of any terminal member u under its jurisdiction. i,t Block information

[0112] Step 3: Secure storage of shared resources:

[0113] Resource sharers set the attribute set and access control policy for the shared resource, then encrypt the shared resource using the access control policy to obtain ciphertext. The resource sharer then uploads their public key and the relevant information of the shared resource to their local edge server. Upon receiving the message, the local edge server writes it to the blockchain and simultaneously stores the message in the consortium data index database list. The process is as follows:

[0114] (1) Terminal member u i,j First, based on shared resource m i,j Set the security level to access this shared resource m i,j attribute set and access control policies for accessing the shared resource. Attribute set The corresponding attribute permission set is The set of attribute permission parameters corresponding to the attribute permission set is Among them, attr i,j,m Indicates shared resource m i,j The m-th attribute, T i,j,m The attribute attr i,j,m The corresponding attribute permissions, χ i,j,m For attribute permissions T i,j,m The corresponding attribute permission parameters are 1≤j≤n, where n is the number of terminal members within the domain;

[0115] (2) Terminal member u i,j Use attribute permission sets Attribute permissions and access control policies Encrypted shared resources m i,j And obtain encrypted data Then terminal member u i,j public key encrypted data Set of attribute permission parameters for accessing shared resources Shared resources m i,j Keywords, access control policies Composition of messages Uploaded to the local edge server Ei , 1≤i≤N, where N represents the number of edge servers in the system.

[0116] (3) Local edge server E i Received message Then, the message is written to the blockchain. Edge server E i Each shared resource is written as a block to the local data sharing blockchain, and the message is simultaneously... Stored in the Alliance Data Index Database list d all ,in, For edge server E i The access address.

[0117] Step 4: Access control for shared resources within the domain:

[0118] The method is as follows: If the required shared resource is located on a local edge server, the terminal member can use their own attribute permissions to request access to the target shared resource from the local edge server. The specific steps are as follows:

[0119] (1) Resource demanders u i,t Calculate the hash value for (1≤t≠j≤n) and access signature Then, the information required to request the resource. Send to the local edge server E i ; where π i,t Represents the set of attribute permission parameters, o i,t This represents the intermediate variables required to request resources.

[0120] (2) Local edge server E i Received message Then, calculate the hash value. And verify the hash value Are they equal? ​​If the equation is not true, it means the information has been tampered with or u i,t Invalid identity, edge server E i Deny service. If the equation is true, calculate and verify the equation. Check if the equation holds true. If it does, then verify the attribute permission parameter set π. i,t Messages on the blockchain platform of cloud server CS Are the attribute permission parameters consistent? If the equation does not hold, the edge server E... i To terminal member u i,t Insufficient permission to send attribute information.

[0121] Among them, the equation The verification method is as follows:

[0122]

[0123] (3) If terminal member u i,t If authentication is successful, the local edge server E i According to terminal member u i,t The system searches for relevant data resources using the provided keywords, and then determines the access permissions and terminal members based on the searched data resources. i,t Compare access permissions and select terminal member u i,t Shared resources with access permissions Local edge server E i Select a random number Calculate intermediate request parameters and request for signature and information Send to terminal member u i,t .

[0124] (4) Terminal member u i,t Received message Then, calculate and verify the two equations. and Does it hold true? If both equations hold true, then the terminal member u... i,t Calculate the ciphertext data And through its attribute permissions and access control policies Decrypt to obtain plaintext information. If the two equations do not hold true, the terminal member u... i,t Discard the information and re-request resources.

[0125] Among them, the equation The verification method is as follows:

[0126]

[0127] Step 5: Access control for shared resources between domains:

[0128] The method is as follows: If the target resource is located on an inter-domain edge server, the terminal member can use its own attribute permission parameters to request a signature from the local edge server. After obtaining the signature, the terminal member requests access to the shared resource from the inter-domain edge server. The process is as follows:

[0129] (1) Resource demanders u i,t Calculate the hash value for (1≤t≠j≤n) As access parameters and access signature And their access permission information, keywords for accessing data, etc. Send to the local edge server E i; where H2(·) is the hash function.

[0130] (2) Local edge server E i Received message Then, calculate the hash value. And verify Whether they are equal indicates that the information has been tampered with or the terminal member u has been compromised. i,t Invalid identity, edge server E i Deny service. If the equations are equal, calculate and verify the equations. Check if the equation holds true. If it does, then verify the attribute permission parameter set π. i,t Blockchain platform with cloud server CS Are the attribute permission parameters consistent? If the equation does not hold, the edge server E... i To terminal member u i,t Insufficient permission to send attribute information.

[0131] Among them, the equation The verification method is as follows:

[0132]

[0133] (3) If terminal member u i,t If authentication is successful, the local edge server E i According to u i,t The provided keywords are listed in the federated index database. all Search for the shared resources and access permissions corresponding to the keyword in the search results, assuming they match the terminal member u. i,t The required shared resources belong to an edge server outside the domain E. t Terminal member u i,t The edge server E of this domain i The edge server E of this domain signs the messages it sends. i Calculate request signature And request signature and off-domain edge servers E t IP address Passed to terminal member u i,t .

[0134] (4) Terminal member u i,t Received from the local edge server E i Message sent Then, calculate the intermediate parameters. And verify Does it hold true? If the equation does not hold true, the terminal member u... i,t Discard the information and re-request access to the resource. If successful, terminal member ui,t Based on IP address Access the edge server E outside the domain t and the message Send to the edge server E outside the domain t .

[0135] Equation The verification method is as follows:

[0136]

[0137] (5) Edge server outside the domain E t Received message Afterwards, through Verification message Whether the hash value is correct, and by calculating the equation. Whether it is true or not, to verify the external edge server E i Check if the request signature is correct. If the equation does not hold, the external edge server E... t Denial of service. If both equations are true, then the edge server E outside the domain... t Verify attribute permission parameter set π i,t Messages on the blockchain platform of cloud server CS Are the attribute weight parameters consistent?

[0138] Equation The verification method is as follows:

[0139]

[0140] (6) If terminal member u i,t Verification was successful, and its access permissions are compatible with the off-domain edge server E. t Access permissions for related resources within the management domain are granted by providing corresponding encrypted resource links.

[0141] The steps of this invention are as follows: initializing protocol parameters within the mobile edge network domain, generating the master key and public key of the edge-cloud collaborative system, generating public / private key pairs for the cloud server, edge server, and terminal members, terminal members registering their identities and obtaining attribute permissions, and after successful registration, resource providers sharing data and setting attribute sets and access control policies for accessing the resource, and resource visitors accessing resources within the domain. If the required resource is not available within the domain, the resource visitor first applies for a signature on the local edge server, obtains the signature, and then accesses the resource across domains. Simultaneously, the cloud server synchronously updates the terminal members' attribute permission parameters and other information. This invention employs hidden attribute authentication technology, hiding entity attributes through parameters to prevent attribute leakage during transmission, thereby more effectively and securely protecting personal privacy information. Furthermore, the protocol incorporates blockchain technology, writing entity attribute sets into blocks and utilizing the immutability of blockchain transactions to ensure the protocol's resistance to collusion attacks, making access control more flexible, efficient, and practical.

[0142] Example 2: A blockchain-based access control protocol in a mobile edge-cloud collaboration scenario, such as... Figure 1 As shown, a specific embodiment is provided to illustrate the content and implementation method of the present invention. The details introduced in this embodiment are not intended to limit the scope of the claims, but rather to aid in understanding the specific implementation method of the present invention. Those skilled in the art should understand that various modifications, variations, or substitutions to the steps of the preferred embodiment are possible without departing from the spirit and scope of the present invention and its appended claims. Therefore, the present invention should not be limited to the content disclosed in the preferred embodiment and the accompanying drawings.

[0143] In this embodiment, for ease of illustration, it is assumed that each edge server and the terminals it governs constitute a security domain, and there are 5 domains D in the edge-cloud collaborative system. i (1≤i≤5), each domain has 10 terminal members, i.e., domain D i By edge server E i (1≤i≤5) and the set U of its governed terminal members i ={u i,1 ,u i,2 ,...,u i,10 The domain's terminal members' identity set is represented as follows: Based on the requirements for accessing system resources, the cloud server defines all attributes for accessing system resources, and defines an attribute sequence Aseq = A1|A2|A3 according to the importance of all attributes. The attribute set corresponding to these attribute sequences is Aset = {A1, A2, A3}, where A... j <A j+1 (j < 3). Each terminal device u i,t The set of sequence attributes (1≤t≤10) is represented as The corresponding attribute sequence is The steps of this invention are as follows:

[0144] Step 1: Initialization of access control protocol parameters in the edge-cloud collaborative system: generation of public / private key pairs for cloud server CS, each edge server, and each terminal member.

[0145] Assuming each edge server and its managed terminal members constitute a security domain, there are 5 domains D in the edge-cloud collaborative system. i (1≤i≤5), each domain has 10 terminal members, i.e., domain D i By edge server E i (1≤i≤5) and the set U of its governed terminal members i ={u i,1 ,u i,2 ,...,u i,10 The domain's terminal members' identity set is represented as follows: Based on the requirements for accessing system resources, the cloud server defines all attributes for accessing system resources, and defines an attribute sequence Aseq = A1|A2|A3 according to the importance of all attributes. The attribute set corresponding to these attribute sequences is Aset = {A1, A2, A3}, where A... j <A j+1 (j < 3). Each terminal member u i,t The set of sequence attributes (1≤t≤10) is represented as The corresponding attribute sequence is in, u i,t A terminal member belonging to the i-th edge server in this edge-cloud collaborative system, where t represents terminal member u. i,t It is an edge server E i The t-th terminal in the management domain, where r represents attribute a t,r Belongs to terminal member u i,t The r-th attribute.

[0146] The method for generating public / private key pairs among cloud server CS, edge servers, and terminal members is as follows:

[0147] Key generation for terminal members in the edge-cloud collaborative system requires inputting the system public key PK, master key MSK, and terminal member u. i,t identity information and terminal member u i,t attribute set Using key generation function Output terminal members' private keys Then calculate the public key. Cloud server CS selects a random positive integer Used as the private key, and used to calculate the public key PK. CS =SK CS g1; Each edge server within the system E i Randomly select a positive integer Used as the private key, and used to calculate the public key. The system's common parameters are Where g1 is a generator of the additive group G1. Let represent the set of integers of order q, where q is the prime order of the additive group G1. KeyGen() represents the key generation algorithm, where 1 ≤ i ≤ 5, 1 ≤ t ≤ 10, 5 is the number of terminal members within the domain, and 10 is the number of edge servers in the system. For terminal member u i,t private key, For terminal member u i,t public key, For terminal member u i,t Identity identifier, There are three hash functions, {0,1} * Represents a set of digit strings of arbitrary length consisting of binary 0s and 1s.

[0148] Step 2: Attribute permission distribution.

[0149] To prevent unauthorized terminal members from participating in resource sharing, only authorized terminal members are allowed to participate in encrypted information storage and access information resources. This invention employs a hidden attribute authentication method, authenticating terminal members within the domain before resource sharing to prevent unauthorized users from participating. Each terminal member interacts with the cloud server (CS) to generate attribute permissions corresponding to each attribute.

[0150] This invention implements attribute-based identity authentication, possessing the functions of traditional identity authentication while protecting personal privacy. Furthermore, it matches access based on attribute permissions, allowing terminal members with different attribute permissions to access data of varying sensitivity, thus preventing the leakage of sensitive information. The specific implementation method for distributing attribute permissions to terminal members is as follows:

[0151] (1) The cloud server broadcasts all attributes of the access system resources and their corresponding sequence numbers {(A1,S1),(A2,S2),.(A3,S3)} to each terminal member, where A v (1≤v≤3) represents the v-th attribute used to access system resources, S v Represents attribute A v The corresponding attribute sequence number, where 3 indicates the number of network attributes.

[0152] (2) The set of attribute sequences possessed mobile terminal member u i,t(1≤t≤10) Randomly select a positive integer Then calculate the intermediate parameter o. i,t =γ i,t g1,θ i,t,1 =γ i,t H1(a i,t,1 g1,θ i,t,2 =γ i,t H1(a i,t,2 g1,θ i,t,3 =γ i,t H1(a i,t,3 g1, β i,t =γ i,t PK CS , and φ i,t =H2(β) i,t Then the terminal member u i,t Send message Give it to cloud server CS; where a i,t,j <a i,t,j+1 (1≤j<3), positive integer γ i,t ≠1, θ i,t,1 ,θ i,t,2 ,θ i,t,3 η i,t β i,t φ i,t and o i,t Indicates terminal member u i,t The intermediate variables required for registration are: g1, a generator of the additive group G1; and a. i,t,v For terminal member u i,t The vth attribute, Indicates terminal member u i,t The private key; H1(·) is the hash function, and || is the concatenation symbol.

[0153] (3) The cloud server CS receives the terminal member u i,t Message sent Then, calculate the hash value β. i ' ,t =H2(β) i,t And verify equation β. i ' ,t =φ i,t and Does this hold true? If so, calculate the intermediate parameters for the cloud server CS. and Cloud server CS compares intermediate parameters and θ i,t,k Whether the values ​​of (1≤k≤3) are equal can determine the terminal member u. i,t What attributes does it have? Then, the cloud server CS provides the terminal member u...i,t Each attribute a i,t,k (1≤k≤3) Randomly select a positive integer Computed property a i,t,k The corresponding permission parameter χ i,t,k =t i,t,k CS i,t and calculate the signature. Then the cloud server CS will send message {PK CS ,δ i,t ,(χ i,t,1 ,χ i,t,2 χ i,t,3 Send to registered terminal member u i,t ; where χ i,t,k For terminal member u i,t The permission parameter for the k-th attribute, δ i,t It is a terminal member u i,t The signature required for registration, e(·) is a computable bilinear mapping function, and H2(·) is a hash function.

[0154] Among them, the equation The verification method is as follows:

[0155]

[0156] (4) Terminal member u i,t (1≤t≤10) Received message {PK} from cloud server CS CS ,δ i,t ,(χ i,t,1 ,χ i,t,2 ,χ i,t,3 After that, calculate the attribute permission T for each attribute. i,t,1 =γ i,t -1 χ i,t,1 =t t,1 g1,T i,t,2 =γ i,t -1 χ i,t,2 =t i,t, 2g1,T i,t,3 =γ i,t -1 χ i,t,3 =t i,t,3 g1 and parameter μ i,t =H2(T i,t,1 ||T i,t,2 ||T i,t,3 Then, terminal member u i,t By verifying the equation e(δ) i,t PK CS )=e(μ i,tTo verify the identity information and attributes a of the cloud server CS, we need to determine if g1, g1) is true. i,t,k The attribute permissions T corresponding to (1≤k≤3) i,t,k Is (1≤k≤3) correct? If this equation holds, then the terminal member u... i,t Each of its attributes a can be obtained i,t,k The attribute permissions T corresponding to (1≤k≤3) i,t,k (1≤k≤3) and the set of permission parameters π i,t ={χ i,t,1 ,χ i,t,2 ,χ i,t,3 At this time, each mobile terminal u i,t Successfully registered and obtained the attribute permissions corresponding to each attribute; among them, T i,t,1 ,T i,t,2 ,T i,t,3 Indicates terminal member u i,t Attribute permissions, μ i,t Represents the intermediate variable required to verify the identity of the cloud server CS, and e(·) is a computable bilinear mapping function;

[0157] Among them, the equation e(δ) i,t PK CS )=e(μ i,t The verification method for g1, g1) is as follows:

[0158]

[0159] (5) The cloud server CS uses all the positive integers it has previously selected. For each edge server E t (1≤t≤N) Calculate the encryption parameters Encrypt parameters Send to each edge server E t Each edge server E t receive Then, compute attribute permissions Then E t It can obtain attribute permissions for all attributes in the edge-cloud collaborative system, i.e., E t Eaw is a set of attribute permissions that can access all system attributes. t,k ={T i,t,1 ,T i,t,2 ,T i,t,3}.in, For edge server E t public key, For edge server E t The private key. t represents any edge server between 1 and N.

[0160] (6) The cloud server CS is divided into different security domains based on the IPs of the edge server and mobile terminal members. A blockchain is established for each security domain, and the public information of each terminal member in that security domain is written to the blockchain. When the edge server E... i A terminal member u i,t (1≤t≤10) After successful registration, the cloud server CS will store the public key information of the terminal member. Permission parameter information π i,t and edge server E i public key information A new block is written into the blockchain. The information blocks of all terminal members in a security domain constitute the blockchain of a security domain.

[0161] (7) Edge Server E i Running a blockchain program within this domain allows access to any terminal member u under its jurisdiction. i,t Block information (1≤t≤10)

[0162] Step 3: Secure Resource Storage

[0163] Resource sharers set the attribute set and access control policy for the shared resources, then encrypt the shared resources using the access control policy to obtain ciphertext. The resource sharers then upload their public key and resource-related information to a local edge server. Upon receiving the message, the local edge server writes it to the blockchain and simultaneously stores the message in the consortium data index database list. The process is as follows:

[0164] (1) Terminal member u i,j First, based on shared resource m i,j Set the security level to access this shared resource m i,j attribute set and access control policies for accessing the shared resource. Attribute set The corresponding attribute permission set is The set of attribute permission parameters corresponding to the attribute permission set is in, Represents resource m i,j The m-th attribute, T i,j,m Indicate attr i,j,m The corresponding attribute permissions.

[0165] (2) Terminal member u i,j Use attribute permission sets Attribute permissions and access control policies Encrypted shared resources m i,j And obtain encrypted data Then terminal member u i,jPublic key information encrypted data Minimal set of permissions to access this data Data m i,j Keywords, access control policies Uploaded to local edge server E i .

[0166] (3) Local Edge Server E i Received message Write the message to the blockchain. Local edge server E i Each piece of shared data is written as a block to the local data-sharing blockchain. Simultaneously, the message... Stored in the Alliance Data Index Database list d all ,in For edge server E i The access address.

[0167] Step 4: Intra-domain resource access control. The method is as follows: If the target resource is located on the local edge server, terminal members can use their own attribute permissions to request access to the resource from the local edge server. The specific steps are as follows:

[0168] (1) Resource demanders u i,t Calculate the hash value for (1≤t≠j≤10) and signature Then, they will provide their access permission information and keywords for accessing data. Send to local edge server E i ; where π i,t This represents the set of permission parameters.

[0169] (2) Local Edge Server E i Received message Then, calculate the hash value. And verify Are they equal? ​​If not, check the local edge server E. i Deny service; if the equation is true, calculate and verify the equation. Check if the equation holds true. If it does, then verify the permission parameter set π. i,t With the cloud service platform CS blockchain platform Are the permission parameters consistent?

[0170] Among them, the equation The verification method is as follows:

[0171]

[0172] (3) If terminal member ui,t If authentication is successful, the local edge server E i According to terminal member u i,t The provided data keywords are used to search for relevant data resources, and the search is based on the access permissions of the searched resources and the terminal members. i,t Comparison of access permissions, select terminal member u i,t Resources with access permissions Local edge server E i Select a random number Calculate intermediate parameters and signature and information Send to terminal member u i,t .

[0173] (4) Terminal member u i,t Received message Then, calculate and verify the two equations. and Does it hold true? If both equations hold true, then the terminal member u... i,t Calculate the ciphertext data And through its attribute permissions and access control policies Decryption yields plaintext information.

[0174] Among them, the equation The verification method is as follows:

[0175]

[0176] Step 5: Inter-domain resource access control. The method is as follows: If the target resource is located on an inter-domain edge server, the terminal member can use its own attribute permissions to request a signature from the local edge server. After obtaining the signature, the terminal member requests access to the resource from the inter-domain edge server. The process is as follows:

[0177] (1) Resource demanders u i,t Calculate the hash value for (1≤t≠j≤10) and signature And their access permission information, keywords for accessing data, etc. Send to local edge server E i ; where H2(·) is the hash function.

[0178] (2) Local Edge Server E i Received message Then, calculate the hash value. And verify Check if they are equal. If the equation is not true, the local edge server E... iDeny service; if the equation is true, calculate and verify the equation. Check if the equation holds true. If it does, then verify the permission parameter set π. i,t With cloud server CS blockchain platform Are the attribute permission parameters consistent?

[0179] Among them, the equation The verification method is as follows:

[0180]

[0181] (3) If terminal member u i,t If authentication is successful, then the local edge server E i According to terminal member u i,t The provided data keywords are listed in the federated index database. all Search for the data resources and access permissions corresponding to this keyword in the search results, assuming they match the terminal member u. i,t The external edge server of the required data resources is E. t Terminal member u i,t Local edge server E i The local edge server E signs the messages it sends. i Calculate signature And and off-domain edge server E t IP address Passed to terminal member u i,t .

[0182] (4) Terminal member u i,t Received from local edge server E i Message sent Then, calculate the parameters. And verify Is it true? If true, then terminal member u i,t according to Access the external edge server E t and the message Send to external edge server E t .

[0183] (5) Off-domain edge server E t Received message Afterwards, through verify Whether the hash value is correct, and by calculating the equation. To verify whether it is true or not, we need to check the local edge server E. i Is the signature correct? If both equations are true, then the off-domain edge server E...t Verify permission parameter set π i,t With the cloud service platform CS blockchain platform Are the attribute weight parameters consistent? If the equation does not hold, the off-domain edge server E... t Returns a message indicating insufficient permission to access the attribute.

[0184] (6) If terminal member u i,t Verification was successful, and its access permissions comply with the requirements of the off-domain edge server E. t Access permissions for related resources within the management domain are granted by providing corresponding encrypted resource links.

[0185] This invention is based on hidden attribute authentication theory and assumes the bilinear Diffie-Hellman (DBDH) decision problem as a security premise. It employs hidden attribute authentication technology to protect personal privacy during the authentication process of resource information sharing. In the distribution of terminal member attribute permissions, in addition to identity authentication, each terminal member also obtains corresponding attribute permissions. Using blockchain-based access control technology, each user's attributes are written to the blockchain. Leveraging the immutability of the blockchain, it ensures that no two terminal users can combine their attributes to access the data resources of any unauthorized terminal user. Furthermore, this invention supports cross-domain access control, providing a feasible solution for collaborative operations between different security domains. This makes information resource sharing in edge-cloud collaborative environments more flexible, efficient, and practical, possessing significant research value and commercial application potential.

[0186] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A blockchain-based access control method for mobile edge-cloud collaboration, characterized in that, The steps are as follows: Step 1: Initialization of access control protocol parameters in the edge-cloud collaborative system: generation of public / private key pairs for the cloud server CS, each edge server, and each terminal member; Step 2: Distribution of Attribute Permissions to Terminal Members: A) The cloud server CS broadcasts all attributes of the access system resources and their attribute serial numbers to each terminal member; B) Terminal members calculate the intermediate parameters required for registration based on their own attributes and send the intermediate parameters to the cloud server CS; C) After receiving messages from each terminal member, the cloud server CS verifies the validity of the parameters and the legitimacy of each terminal member's identity. If the verification is successful, the cloud server CS determines the number of terminal member attributes and calculates the attribute permission parameters and signature. Then, it sends its public key, signature, and attribute permission parameters to each terminal member. D) After receiving the message sent by the cloud server CS, each terminal member calculates the attribute permissions, and then verifies the identity of the cloud server CS and the correctness of the attribute permissions. If the verification is successful, each terminal member obtains the attribute permissions and attribute permission parameter set corresponding to the attribute, and the attribute permissions of each terminal member are successfully distributed. E) The cloud server CS calculates the encryption parameters and sends them to each edge server. After receiving the encryption parameters, each edge server calculates the set of attribute permissions for all attributes. F) The cloud server CS divides the edge server and mobile terminal into different security domains based on their IPs and establishes a blockchain for each security domain. The public information of each terminal member in the security domain is written into the blockchain. The edge server runs the blockchain program of its domain and can obtain the block information of any terminal member under its jurisdiction. Step 3: Storage of shared resources: G) Resource sharers set the attribute set and access control policy of the resource, and use the access control policy to encrypt the shared resource to obtain ciphertext; resource sharers upload their public key and the information of the shared resource to the local edge server. After receiving the message, the local edge server writes it into the blockchain and stores the message in the consortium data index database list at the same time. Step 4: Access control for shared resources within the domain and access control for shared resources outside the domain; The method for implementing access control for shared resources within the domain is as follows: H) Resource requesters calculate the access parameters and access signature required to access the resource and send the access parameters, access signature, and access permission information to the local edge server. I) Upon receiving a message from a resource requester, the local edge server verifies the validity of the parameters, the identity of the resource requester, and the attribute permission parameters; J) After verification, the local edge server searches for resources based on the keywords provided by the resource requester and compares the access permissions of the resources with those of the resource requester. Once the target resource is found, the local edge server calculates the request parameters and request signature and sends them to the resource requester. K) After receiving the message from the local edge server, the resource requester verifies the request parameters and the identity of the local edge server. If the verification is successful, the resource requester obtains the shared resources. The method for access control of the shared resources outside the domain is as follows: L) Resource users calculate the access parameters and signatures required to access resources, and send the access parameters, access signatures, their own access permissions, and keyword information to the local edge server. M) After receiving the message from the resource requester, the local edge server verifies the validity of the access parameters, the identity of the terminal member, and the attribute permission parameters; N) After successful verification, the local edge server searches for the resource corresponding to the keyword, the access permissions of the resource, and the edge server outside the domain to which the resource belongs. Then, it calculates the request signature and sends the request signature and the address of the edge server outside the domain to the resource requester. O) After receiving the message from the local edge server, the resource requester calculates the parameters of the request signature and verifies the validity of the message. After successful verification, the resource requester sends the resource request parameter information to the edge server outside the domain. P) After receiving the resource request parameter message from the resource requester, the edge server outside the domain verifies the request parameters, the identity of the resource requester, the request signature of the edge server where the resource requester is located, and the attribute permission parameters of the resource requester. Q) After successful verification, the edge server outside the domain provides a link to the shared resources to the resource requester.

2. The blockchain-based access control method for mobile edge-cloud collaboration according to claim 1, characterized in that, The method for generating the public / private key pairs of the cloud server CS, each edge server, and each terminal member in step one is as follows: Generate the system's master key (MSK) and public key (PK) using the master key generation function; input the system's public key (PK), master key (MSK), and terminal members. Identity identifier and terminal members attribute set Using key generation function Output terminal members' private keys t, then calculate the public key. Then the public / private key pair of the terminal member is ; Cloud server CS selects a random positive integer Used as the private key, and used to calculate the public key. Then the public / private key pair of the cloud server CS is ; Each edge server Randomly select a positive integer Used as the private key, and used to calculate the public key. ; in, For addition group generator, Let q be the set of integers of order q, where q is the additive group. The prime order, and N represents the number of terminal members within the domain, and N represents the number of edge servers in the system.

3. The blockchain-based access control method for mobile edge-cloud collaboration according to claim 1, characterized in that, The method for distributing attribute permissions to terminal members in step two is as follows: (1) All attributes of cloud server CS broadcast access system resources and their corresponding serial numbers Give to each terminal member; where, For the first time used to access system resources One attribute, Representing attributes The attribute serial number, Indicates the number of network attributes. Represents positive integers; (2) Possesses a set of attribute sequences terminal members Randomly select a positive integer Calculate intermediate parameters Terminal members Send message Give it to the cloud server CS; among which, For terminal members The vth attribute, and For terminal members The number of attributes, a positive integer. , and All represent terminal members Intermediate parameters required for registration For addition group generator, n is the number of terminal members within the domain, and N is the number of edge servers in the system; This is the public key for the cloud server CS. Indicates terminal member private key, For terminal members The public key; It is a hash function. It is a connector symbol; (3) The cloud server CS receives the terminal member Message sent Then, calculate the hash value. And verify the equation. and Does the equation hold true? If so, the cloud server CS calculates the intermediate parameters. and ; Cloud server CS comparison intermediate parameters and Determine if the values ​​are equal to those of the terminal member. What attributes does it have; and then the cloud server CS is the terminal member. Each attribute Randomly select a positive integer computed properties correspond Attribute permission parameters and signature The cloud server CS will send the message Send to registered terminal members ;in, For terminal members The kth Attribute permission parameters, This is the private key for the cloud server CS. Terminal member The signature required for registration It is a computable bilinear mapping function; (4) Terminal members Received message from cloud server CS Then, calculate the attribute permissions for each attribute. and intermediate parameters Terminal members Verify the equation Whether the equation holds true; if the equation holds true, then the terminal member... Successfully registered and retrieved each of its attributes Corresponding attribute permissions and attribute permission parameter set ;in, Indicates terminal member Attribute permissions, This represents the intermediate variables required to verify the identity of a cloud server (CS). (5) The cloud server CS uses the positive integer it selects. For each edge server Calculate encryption parameters and encrypt parameters Send to edge server Each edge server Received encrypted parameters Then, compute attribute permissions Then the edge server Get the set of attribute permissions for all attributes ;in, For edge servers public key, For edge servers of Private key; (6) The cloud server CS divides the edge server and terminal members into different security domains based on their IPs, and establishes a blockchain for each security domain, writing the public information of each terminal member in that security domain into the blockchain; when the edge server A terminal member After successful registration, the cloud server CS will store the public key of the terminal member. Attribute permission parameter set and edge servers Information composed of public keys A new block is written into the blockchain; the information blocks of all terminal members in a security domain constitute the blockchain of a security domain. (7) Edge server Run the blockchain program within this domain to obtain any terminal members under its jurisdiction. information of the block .

4. The blockchain-based access control method for mobile edge-cloud collaboration according to claim 3, characterized in that, The method for storing shared resources in step three is as follows: 1) Terminal members According to shared resources Setting the security level for accessing shared resources attribute set and access control policies Attribute set The corresponding attribute permission set is The set of attribute permission parameters corresponding to the attribute permission set is ;in , indicating shared resources The m-th attribute, Representing attributes Corresponding attribute permissions, For attribute permissions The corresponding attribute permission parameters, n is the number of terminal members in the domain; 2) Terminal members Use attribute permission sets Attribute permissions and access control policies Encrypted shared resources And obtain the ciphertext number Then terminal members Use its public key encrypted data Attribute permission parameter set Shared resources Keywords, access control policies Composition of messages Uploaded to local edge server ; 3) Local edge server Received message Then, the message is written to the blockchain; edge server Each shared resource is written as a block to the local data sharing blockchain, and the message is simultaneously... Stored in the Alliance Data Index Database List ;in, For local edge servers The access address.

5. The blockchain-based access control method for mobile edge-cloud collaboration according to claim 4, characterized in that, The method for access control of shared resources within the domain is as follows: S1: Resource Requester Calculate hash value and access signature This will include your access permissions and the keywords associated with the resources you are accessing. Send to the local edge server ;in, Indicates terminal member private key, For terminal members The public key; This represents a set of attribute permission parameters. Indicates terminal member The intermediate parameters for registration calculation; and It is a hash function. It is a connector symbol. For hash functions, For addition group Generators; S2: Local edge server Received message Then, calculate the hash value. And verify the hash value Check if they are equal; if the hash values ​​are equal, calculate and verify the equation. Check if the equation is true. If it is true, then verify the set of attribute permission parameters. Messages on the blockchain platform of cloud server CS Are the attribute permission parameters consistent? These are attribute permission parameters; S3: If terminal member If authentication is successful, the local edge server According to terminal members The system searches for data resources using provided keywords and determines the access permissions and terminal members of the searched data resources. Based on the access permission comparison results, select the terminal member. Shared resources with access permissions Local edge server Select a random number Calculate intermediate request parameters , and request for signature and information Send to terminal members ;in, For edge servers public key, For edge servers The private key; S4: Terminal Member Received message Then, calculate and verify the two equations. and Whether it is true or false; if both equations are true, then the terminal member... Calculate the ciphertext data And through its attribute permissions and access control policies Decryption yields plaintext information; For terminal members A randomly selected positive integer.

6. The blockchain-based access control method for mobile edge-cloud collaboration according to claim 4 or 5, characterized in that, The method for access control of inter-domain shared resources is as follows: S11, Resource Requester Calculate hash value and access signature And their access permission information, keywords for accessing data, etc. Send to the local edge server ;in, For hash functions, For addition group Generators; It is a hash function; S12, Local Edge Server Received message Then, calculate the hash value. and verify Check if they are equal. If they are equal, calculate and verify the equation. Check if the equation is true. If it is true, then verify the set of attribute permission parameters. Blockchain platform with cloud server CS Are the attribute permission parameters consistent? S13, If terminal member If authentication is successful, the local edge server... According to terminal members The provided keywords are listed in the federated index database. Search for shared resources and their access permissions corresponding to the keywords in the search results, assuming they match the terminal members. The required shared resources are located on an edge server outside the domain. Terminal members edge servers of this domain The local edge server signs the messages it sends. Calculate request signature And request signature and edge servers outside the domain IP address Passed to terminal members ; S14, Terminal Member Received from an external edge server Message sent Then, calculate the intermediate parameters. and verify Is it valid? If valid, then the terminal member... Based on IP address Accessing edge servers outside the domain and the message Send to an edge server outside the domain ; S15, Off-domain Edge Server Received message Then, the message is verified using the hash value. Whether the hash value is correct, and by calculating the equation. Whether it is true or not, to verify the edge server outside the domain. Check if the request signature is correct. If both equations are true, then the edge server outside the domain... Verify attribute permission parameter set Messages on the blockchain platform of cloud server CS Are the attribute weight parameters in the data the same? To; S16, If terminal member Verification was successful, and its access permissions are compatible with the off-domain edge server. Access permissions for related resources within the management domain are granted by providing corresponding encrypted resource links.

7. The blockchain-based access control method for mobile edge-cloud collaboration according to claim 6, characterized in that, In step (3), the formula is as follows The verification method is as follows: In step (4), the formula is as follows The verification method is as follows: In step S2, the formula is as follows The verification method is as follows: In step S4, etc. The verification method is as follows: 。 8. The blockchain-based access control method for mobile edge-cloud collaboration according to claim 7, characterized in that, In step S12, the formula is... The verification method is as follows: ； Step S14, Equation The verification method is as follows: In step S15, the formula is as follows The verification method is as follows: 。

Images