A digital asset permission control method and system based on authorization code and authorization tree

Abstract

The application provides a digital asset permission control method and system based on authorization codes and authorization trees, utilizes a tree structure, generates different branch structures according to different requirements, divides use permissions in this way, verifies authorization token permissions by calling an authorization code use method in a smart contract, if the authorization code of the next level node is within the permission range of the authorization token, the next level node uses the corresponding digital asset, if the authorization code is not within the permission range of the authorization token, the authorization period ends, whether the authorization is terminated is checked, if the authorization is terminated, the authorization period ends. The application makes the data use method various, the use scene rich, and ensures that the data is used in a standard manner.

Description

Technical Field

[0001] This invention belongs to the field of blockchain technology and relates to a method and system for controlling digital asset permissions based on authorization codes and authorization trees. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Digital asset misuse and theft refer to the use of digital assets without the authorization of their owner. Therefore, the public and society have placed higher demands on the accuracy, privacy, security, and the owner's right to know regarding digital assets. However, existing blockchain-based solutions only serve a recording function and cannot guarantee the unauthorized use of digital assets by the owner, nor can they ensure the owner's controllable management of digital assets. The owner's control over digital assets is related to the security and privacy of the digital assets and the owner's own interests. How to ensure the regulated use of digital assets within the scope of the permissions granted by the owner is a pressing problem that needs to be solved.

[0004] Digital asset licensing for commercial purposes carries the risk of user privacy violations. If the use of digital assets by authorized users cannot be managed technically, the rights of the owner may be harmed. Adopting secure and reliable licensing methods, and setting usage permissions and scope for digital assets during the licensing process, can strengthen the owner's control over digital assets. However, existing blockchain-based solutions merely use the blockchain as a database, simply storing authorization records in the distributed ledger. They fail to achieve controllable management of digital asset permissions from the blockchain's underlying layer, only enabling post-event traceability, and cannot provide pre-event or in-event control. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes a digital asset access control method and system based on authorization codes and authorization trees. This method enables controllable management of authorized digital assets from the blockchain layer, allowing the owner to be aware of and control the use of digital assets after authorization.

[0006] According to some embodiments, the present invention adopts the following technical solution:

[0007] A digital asset access control method based on authorization codes and authorization trees includes the following steps:

[0008] Authorization tokens are generated based on smart contracts, and the corresponding authorization codes are stored in digital asset objects.

[0009] Pass the authorization code to the next level node;

[0010] The authorization token's permissions are verified by calling the authorization code usage method in the smart contract. If the authorization code of the next-level node is within the authorization token's permission range, the next-level node uses the corresponding digital asset; if the authorization code is not within the authorization token's permission range, the authorization period ends.

[0011] Check if authorization has been terminated. If authorization has been terminated, the authorization period ends. If authorization has not been terminated, determine whether to re-authorize. If authorization is re-authorized, generate the corresponding authorization token. If authorization is not re-authorized, re-verify the authorization token permissions by calling the authorization code usage method in the smart contract.

[0012] When authorization is terminated, the permissions of the next-level node are revoked, and the authorization cycle ends.

[0013] As an alternative implementation, the authorization token is generated by calling the authorization method in the smart contract when the authorization action is initiated.

[0014] As an alternative implementation, the authorization token includes an authorization code, recipient address, parent node, child node, token creator, and the content of the granted permissions.

[0015] As an alternative implementation, the authorization code is generated by a smart contract using the transaction's hash value, the recipient's name, and the asset ID.

[0016] As an alternative implementation, the authorization code is stored as an identifier of the authorization token in the digital asset object in the state library.

[0017] As an alternative implementation method, before using digital assets, it is necessary to verify whether the number of times the authorization code has been used is within the limit of the number of times the authorization token can be used, as well as the type of authorized operation and the validity period.

[0018] As an alternative implementation, each node is a parent node and / or a child node. The parent node is used to initiate transactions to transfer digital assets to the child node / next-level node. When the child node / next-level node uses the digital assets, it needs to verify the authorization code with the attributes in the authorization token of the parent node, and can perform secondary authorization to transfer the corresponding digital asset usage rights to the next-next-level node.

[0019] As an alternative implementation, when the child node / next-level node grants secondary authorization, the authorization authority shall not exceed the authority range of the parent node's authorization token.

[0020] A digital asset access control system based on authorization codes and authorization trees, comprising:

[0021] Nodes are configured to generate authorization tokens based on transactional digital assets through smart contracts, store the corresponding authorization codes in the digital asset state database, and pass the authorization codes to the next level node;

[0022] The authorization verification module is configured to verify the permissions of the authorization token by calling the authorization code usage method in the smart contract. If the authorization code of the next-level node is within the permission range of the authorization token, the next-level node uses the corresponding digital asset; if the authorization code is not within the permission range of the authorization token, the authorization period ends.

[0023] The authorization verification module is configured to check whether the parent node has terminated authorization. If authorization is terminated, the authorization period ends. If authorization is not terminated, it determines whether to re-authorize. If authorization is re-authorized, the generated authorization token is received again. If authorization is not re-authorized, the authorization token permissions are verified again by calling the authorization code usage method in the smart contract.

[0024] The authorization termination module is configured to revoke the permissions of the next-level node when authorization is terminated, and the authorization cycle ends.

[0025] A computer-readable storage medium storing a plurality of instructions adapted for loading by a processor of a terminal device and executing steps in the method.

[0026] A terminal device includes a processor and a computer-readable storage medium, the processor being configured to implement instructions; the computer-readable storage medium being configured to store a plurality of instructions adapted to be loaded by the processor and executed in accordance with the steps of the method described therein.

[0027] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0028] This invention uses authorization codes to connect the entire process of authorizing the use of digital assets. Blockchain not only stores authorization information, data usage records, and usage scenarios, but also enables control over digital assets from the underlying chain level.

[0029] This invention utilizes a tree structure, which allows for a single authorization and multi-party participation, to generate different branch structures based on different needs. This divides usage permissions, making data usage methods diverse and application scenarios rich, while ensuring the standardized use of data.

[0030] Once the owner terminates the authorization, all authorizations on the authorization tree branch are revoked, enabling the owner of digital assets to achieve controllable management of digital assets through the underlying blockchain.

[0031] This invention enables the use of digital assets in various scenarios, ensuring the safe and compliant use of digital assets while allowing the owner to manage digital assets, truly realizing "data for my use". Attached Figure Description

[0032] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0033] Figure 1 This is a schematic diagram of the authorization token structure;

[0034] Figure 2 This is a schematic diagram of the authorization tree structure;

[0035] Figure 3 This is a flowchart of the authorization code transfer process. Detailed Implementation

[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0037] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0038] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0039] Example 1

[0040] This provides a digital asset access control method based on authorization codes and authorization trees, such as... Figure 3 As shown, it includes the following steps:

[0041] Step 201: The transaction initiator generates an authorization token through a smart contract;

[0042] Step 202: The authorization token is stored in the digital asset object in the state database, identified by the authorization code;

[0043] Step 203: The parent node passes the authorization code to the child node;

[0044] Step 204: Verify the authorization token's permissions by calling the authorization code usage method in the smart contract; if the child node's authorization code is within the authorization token's permission range, proceed to step 205; if the child node's authorization code is not within the authorization token's permission range, proceed to step 208, the authorization period ends.

[0045] Step 205: Child nodes use the corresponding digital assets;

[0046] Step 206: Check if the parent node has terminated the authorization. If the authorization has been terminated, the authorization period ends; if the authorization has not been terminated, proceed to step 207.

[0047] Step 207: Does the node need to re-authorize? If it does, proceed to step 201; otherwise, proceed to step 204.

[0048] Step 208: When the parent node terminates authorization, it revokes the permissions of the child node, and the authorization cycle ends.

[0049] It is important to note that in the above process, a child node can also be a parent node, meaning that secondary authorization can be performed downwards.

[0050] like Figure 2 As shown, the authorization code AutxID is passed between nodes using digital assets, and a tree structure is formed through continuous sub-authorization between nodes.

[0051] When node A initiates a transaction to transfer digital assets to node B, a unique authorization token for that digital asset is generated through a smart contract. This authorization token, identified by an authorization code, is stored in the digital asset's state database. Node A then passes the authorization code corresponding to the authorization token to node B, creating a tree-branch structure between A and B. The authorization code specifies the operation type (Ops) that node B can perform on the data, as well as the number of times it can be used and its validity period. When using the digital asset, node B needs to verify the authorization code against the attributes in A's authorization token, checking whether the operation type specified by the authorization code matches the operation type in the authorization token, and whether the number of uses exceeds the authorized limits, etc.

[0052] During secondary authorization, node B generates an authorization token from the authorization code received from node A via a smart contract. This token is stored as an identifier within the digital asset object in the state repository. By passing node B's authorization code to node C, the access rights to the digital assets from node A are transferred to node C. Node C can also re-authorize based on previous authorizations, completing the transfer of authorization codes and generating an authorization tree structure. When node B and its child node C re-authorize, the granted permissions are limited to the scope of the authorization token granted by the parent node A.

[0053] Node A grants different nodes access to digital assets by generating different authorization codes. Child nodes generate their own authorization tokens and pass the corresponding authorization codes to the next level nodes, forming a tree structure through parent node authorization and authorization of child nodes. The authorization tree structure generated based on authorization codes is as follows: Figure 2As shown in the example, node A acts as the parent node of nodes B, C, and D. Transaction TX generates an authorization token through a smart contract. By sending different authorization codes to nodes B, C, and D, different branch structures are generated according to different usage permissions. Child nodes B, C, and D can also perform secondary authorization based on the authorization code of parent node A.

[0054] When a transaction occurs, Node A can use a smart contract to set restrictions such as the authorized operation type (Ops), usage count (PoNum), and validity period (ValidTime) to prevent the misuse of digital assets. Before use, child nodes will call the authorization code usage method in the smart contract to verify the authorization code against the authorization token permissions. If the validity period expires, the operation permission range is exceeded, or the usage count is exhausted, the smart contract will revoke the granted permissions and delete the branch of the authorization tree from top to bottom. When the parent node revokes the authorization, it deletes all child nodes in its tree structure and revokes the digital asset usage permissions of all nodes on that branch. Through the use of authorization codes and the authorization tree, controllable management of digital assets can be achieved from the blockchain layer, enabling traceability and control before, during, and after transactions.

[0055] In the above process, the authorization token mentioned is generated when the authorization action is initiated by calling the authorization method in the smart contract using the token creator (AutxTokenCreator), the recipient's address (Address), the digital asset, and the granted permissions. The authorization token (AutxToken) includes the authorization code (AutxID), the recipient's address (Address), the parent node, the child node, the token creator (AutxTokenCreator), and the granted permissions (usage count (PoNum), validity period (ValidTime), and authorization type (Ops)). The structure of the authorization token is as follows: Figure 1 As shown.

[0056] The recipient's address specifies the user of the authorization code;

[0057] The parent node represents the party that initiated the authorization action;

[0058] The child node represents the recipient of the authorization code;

[0059] Operation type Ops indicates the type of operation performed on the digital asset;

[0060] Authorization code AutxID, a unique identifier generated based on the transaction.

[0061] The authorization code is generated by a smart contract using the hash value of the transaction (TX), the recipient's address, and the asset ID. The authorization code serves as an identifier for the authorization token and is stored in the digital asset object within a state repository. The state repository's structure is similar to a Merkle tree structure to ensure immutability.

[0062] After the authorization code is generated, it is passed to the user of the digital asset. The user can then use the digital asset legally according to the authorization code usage instructions in the asset contract. Before using the digital asset, it is necessary to verify the number of times the authorization code has been used, the number of times the authorization token has been used, the type of authorized operation, the validity period, and to verify the authorization token's permissions and usage process. When using the authorization code AutxID (TX, ValidTime, Ops, PoCount, Creator, Address), it needs to be compared with the various attributes in the corresponding token AutxToken. If the verification is successful, the digital asset can be used, and the usage process is recorded on the blockchain; if the verification fails, the user has no permission to use the digital asset. Simultaneously, the owner can view the usage of the digital asset through the on-chain records and can revoke the authorization at any time if the permissions are exceeded or the usage limit is reached.

[0063] The authorization code AutxID is a unique identifier generated based on the transaction.

[0064] ValidTime records the valid time of the authorized action;

[0065] Used Count (PoCount) records the number of times the recipient has used the digital asset;

[0066] Operation type Ops defines the usage scenario of the data. For example, if users are given the ability to view digital assets, then users can only view but cannot modify the asset content.

[0067] The creator represents the owner of the digital asset, while the recipient's address specifies the user of the digital asset.

[0068] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0069] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0070] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0071] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0072] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0073] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A digital asset access control method based on authorization codes and authorization trees, characterized in that, Includes the following steps: Authorization tokens are generated based on smart contracts, and the corresponding authorization codes are stored in digital asset objects. Pass the authorization code to the next level node; The authorization token's permissions are verified by calling the authorization code usage method in the smart contract. If the authorization code of the next-level node is within the authorization token's permission range, the next-level node uses the corresponding digital asset. If the authorization code is not within the scope of the authorization token's permissions, the authorization period ends; Check whether the authorization has been terminated. If the authorization has been terminated, the authorization period ends. If the authorization has not been terminated, determine whether to re-authorize. If re-authorization is performed, generate the corresponding authorization token. If no further authorization is required, the authorization token permissions will be re-verified by calling the authorization code usage method in the smart contract. When authorization is terminated, the permissions of the next-level node are revoked, and the authorization cycle ends. Before using digital assets, verify the number of times the authorization code and authorization token have been used, as well as the type of authorized operation and the validity period, and verify the permissions and usage process of the authorization token; before using, the child node calls the authorization code usage method in the smart contract to verify the permissions of the authorization code and authorization token. When the valid time expires, the scope of operation permissions is exceeded, or the number of uses is exhausted, the smart contract will revoke the granted permissions and delete the branch of the authorization tree from top to bottom. When a parent node revoks authorization, it deletes all child nodes in its tree structure and revokes the access rights of all nodes on this branch to the digital assets. The authorization code is passed between nodes that use digital assets, and through continuous sub-authorization between nodes, an authorization tree structure is formed.

2. The digital asset access control method based on authorization codes and authorization trees as described in claim 1, characterized in that, The authorization token is generated by calling the authorization method in the smart contract when the authorization action is initiated.

3. A digital asset access control method based on authorization codes and authorization trees as described in claim 1 or 2, characterized in that, The authorization token includes an authorization code, recipient address, parent node, child node, token creator, and the content of the granted permissions.

4. The digital asset access control method based on authorization codes and authorization trees as described in claim 1, characterized in that, The authorization code is generated by a smart contract using the transaction's hash value, the recipient's information, and the asset ID. The authorization code is stored as an identifier for the authorization token in the digital asset object in the state database.

5. The digital asset access control method based on authorization codes and authorization trees as described in claim 1, characterized in that, Each node is a parent node and / or a child node. The parent node is used to initiate transactions to transfer digital assets to the child node / next-level node. When the child node / next-level node uses the digital assets, it needs to verify the authorization code with the attributes in the authorization token of the parent node and can perform secondary authorization to transfer the corresponding digital asset usage rights to the next-level node.

6. The digital asset access control method based on authorization codes and authorization trees as described in claim 1, characterized in that, When a child node / next-level node grants secondary authorization, the authorization permissions shall not exceed the permission range of the parent node's authorization token.

7. A digital asset access control system based on authorization codes and authorization trees, characterized in that, include: Nodes are configured to generate authorization tokens based on transactional digital assets through smart contracts, store the corresponding authorization codes in the digital asset state database, and pass the authorization codes to the next level node; The authorization verification module is configured to verify the permissions of the authorization token by calling the authorization code usage method in the smart contract. If the authorization code of the next-level node is within the permission range of the authorization token, the next-level node uses the corresponding digital asset. If the authorization code is not within the scope of the authorization token's permissions, the authorization period ends; The authorization verification module is configured to check whether the parent node has terminated authorization; if authorization is terminated, the authorization period ends. If the authorization has not been terminated, determine whether to re-authorize. If re-authorization is required, receive the generated authorization token again. If no further authorization is required, the authorization token permissions will be re-verified by calling the authorization code usage method in the smart contract. The authorization termination module is configured to revoke the permissions of the next-level node and end the authorization cycle when authorization is terminated. Before using digital assets, verify the number of times the authorization code and authorization token have been used, as well as the type of authorized operation and the validity period, and verify the permissions and usage process of the authorization token; before using, the child node calls the authorization code usage method in the smart contract to verify the permissions of the authorization code and authorization token. When the valid time expires, the scope of operation permissions is exceeded, or the number of uses is exhausted, the smart contract will revoke the granted permissions and delete the branch of the authorization tree from top to bottom. When a parent node revoks authorization, it deletes all child nodes in its tree structure and revokes the access rights of all nodes on this branch to the digital assets. The authorization code is passed between nodes that use digital assets, and through continuous sub-authorization between nodes, an authorization tree structure is formed.

8. A computer-readable storage medium, characterized in that, It stores multiple instructions adapted for loading by the processor of a terminal device and executing the steps of the method according to any one of claims 1-6.

9. A terminal device, characterized in that, It includes a processor and a computer-readable storage medium, the processor being used to implement various instructions; the computer-readable storage medium being used to store a plurality of instructions adapted to be loaded by the processor and executed in the steps of the method of any one of claims 1-6.

Images