A Trust-Based Cross-Domain Access Control Method for the Internet of Things

Abstract

The invention belongs to the field of Internet of Things access control, and particularly relates to a trust-based cross-domain access control method for the Internet of Things, which includes building a blockchain main chain platform and initializing it; writing chain codes on the main chain platform using golang, including resource information management chain code, trust management chain code, access request chain code, and attribute management chain code, installing the chain codes into the blockchain and initializing them; blockchain platforms in different Internet of Things domains need to select proxy nodes to join the main chain; users send user registration requests to the attribute authentication agency, obtain the attribute values of the users, and the attribute authentication agency uploads them to the blockchain; users upload resources to the IPFS network to obtain a storage address Addr, and upload the resource information and access policies to the main chain; users send request messages to the proxy nodes, initiate access requests through the main blockchain, and calculate and update the trust values based on the access results; the invention improves the reliability of the entire access control process.

Description

Technical Field

[0001] The invention belongs to the field of Internet of Things access control, and particularly relates to a trust-based cross-domain access control method for the Internet of Things. Background Art

[0002] With the continuous development of Internet of Things technology, the number of devices in the Internet of Things is also increasing continuously, and a large amount of data is generated during the interaction between devices and the environment, devices and devices, and devices and users. These data may come from different industries and platforms, and there are certain differences between different industries and different platforms. This difference makes it difficult for data to flow between each other, resulting in a data island. The data in each field is stored in isolation, which cannot reflect the value of the data and is a great waste. Traditional access control relies on a centralized institution to process, making it difficult to ensure the fairness and transparency of the entire process. Moreover, static access control methods cannot dynamically adjust authorization policies according to changes in the network. There is an urgent need for a more efficient dynamic access control method to achieve an open and transparent data access control method.

[0003] Access control technology can prevent unauthorized access and improper use, and is an important technology for protecting data security. Currently, the mainstream access control solutions are divided into Role Based Access Control (RBAC), Capability Based Access Control (CapAC), and Attributes Based Access Control (ABAC). Traditional access control solutions rely on a trusted third party to make decisions, which means that all permission allocations are carried out by this trusted entity, leading to problems such as single point of failure and low transparency in the entire system. The characteristics of blockchain, such as decentralization, immutability, and traceability, can excellently serve as the trusted third party in Internet of Things access control, providing a trusted computing environment for access control in the Internet of Things. At the same time, as a blockchain jointly managed by multiple institutions, the transaction confirmation time and transactions per second of the consortium chain are quite different from those of private chains and public chains. It has higher requirements for security and performance, and there are no transaction fees, making it more suitable for the Internet of Things system. Summary of the Invention

[0004] In order to solve the problems of centralization of access control, dynamic granting of permissions in the Internet of Things, and low storage capacity in the blockchain, the present invention proposes a trust-based cross-domain access control method for the Internet of Things, which specifically includes the following steps:

[0005] S1. Build a blockchain main chain platform based on the Hyperledger Fabric framework and initialize the blockchain network. The initialization includes creating certificates for users in the network.

[0006] S2. Write chain codes in golang on the main chain platform, including resource information management chain code, trust management chain code, access request chain code, and attribute management chain code. Install the chain codes onto the blockchain and initialize them.

[0007] S3. Blockchain platforms in different Internet of Things domains need to select proxy nodes to join the main chain.

[0008] S4. Users send user registration requests to the attribute authentication agency, obtain the user's attribute values, and the attribute authentication agency uploads them to the blockchain.

[0009] S5. Users upload resources to the IPFS network to obtain a storage address Addr, and then upload the resource information and access policies to the main chain.

[0010] S6. Users send request messages to the proxy nodes. The request messages include resource ids and operation attributes. After receiving the request messages, the proxy nodes initiate access requests through the main blockchain and calculate and update the trust values based on the access results.

[0011] Furthermore, the policy management chain code is used to implement the upload of users' resource information and the access policies set by users for the resources. This chain code includes the following interfaces:

[0012] The AddPolicy() interface is used to add new resource information and corresponding access policies to the blockchain.

[0013] The UpdatePolicy() interface is used to receive the resource id and the corresponding new access policy, and use the new access policy to overwrite the old one to achieve the effect of updating the access control policy.

[0014] The DeletePolicy() interface is used to delete the resource information and the corresponding access control policies stored in the blockchain.

[0015] The QueryPolicy() interface is used to implement the function of searching for the corresponding access policy using the resource id as an index.

[0016] Furthermore, the attribute management chain code receives the user id and the attribute set from the attribute authentication center. The attribute set includes the user's identity, position, and address. This chain code includes the following interfaces:

[0017] The AddAttribute() interface is used to receive the user identity identifier and the attribute set from the attribute authorization agency and store them.

[0018] The UpdateAttribute() interface is used to receive a new set of attributes transmitted by the attribute authorization agency, and overwrite the old ones according to the resource ID and the new set of attributes to achieve the effect of attribute update;

[0019] The DeleteAttribute() interface is used to delete the set of attributes corresponding to the user ID;

[0020] The QueryAttribute() interface is used to obtain the corresponding user attributes from the blockchain according to the identity identifier, and this interface can only be called by the access request chain code.

[0021] Furthermore, the trust management chain code is used to calculate the trust values of different users in different Internet of Things domains, including the TrustCaculate() port, which calculates the direct trust value and the recommended trust value respectively through the access behaviors of the nodes stored in the blockchain, and performs a weighted sum of the direct trust value and the recommended trust value. The resulting comprehensive trust value will be stored on the blockchain as a kind of attribute.

[0022] Furthermore, the access request chain code is used to receive the user's access request, call the access policy and user attributes for matching verification, and call the trust management chain code to update the trust value according to the access result, including the AccessCheck() port, which is used to call the corresponding user attributes and access policy for matching verification according to the user ID and the resource ID, and call the trust management chain code to update the trust value according to the access result.

[0023] Furthermore, the user's attributes include subject attributes, object attributes, operation attributes, and environmental attributes. The subject attributes include the user's ID, role, organization, trust value, and the domain to which the user belongs; the object attributes include the resource ID and the valid time; the operation attributes include three operations: read, write, and execute; the environmental attributes, that is, the context conditions required by the policy, include time, location, and security level.

[0024] Furthermore, the process by which the user requests access to resources in the main chain through the proxy node includes:

[0025] S61: The user sends a request message to the proxy node, and the request message includes the resource ID and the operation attribute;

[0026] S61: The proxy node receives the user's request message, and according to the user ID and the resource ID and operation attribute in the request message, calls the attribute verification chain code to initiate a request for the resource;

[0027] After the attribute management chain code on the blockchain receives a request from a node, it calls the policy management chain code and the attribute management chain code to obtain the access policy and user attributes of the resource and perform verification;

[0028] S63: If the requesting node meets the access policy requirements, return the resource information to the user; if not, return an error.

[0029] S64: Store the access result on the blockchain and call the trust management chain code to update the trust value.

[0030] Furthermore, the process of calculating the trust value includes the following steps:

[0031] Calculate the direct trust value DT based on the user access request behavior stored in the blockchain;

[0032] Obtain the user's access request behavior from the blockchain and calculate the recommended trust value RT;

[0033] Perform a weighted sum of the direct trust value and the recommended trust value to obtain the final trust value T, and update the node attributes with the obtained trust value. The final trust value T is expressed as:

[0034]

[0035] Among them, θ is the adaptive weight. If it is a positive interaction, the value of θ changes exponentially and increases with the increase in the number of interactions; in the case of negative interactions, θ = 1 and T = min(DT ij , T), and setting the value of θ to 1 increases the proportion of the direct trust value; DT ij is the direct trust value of node i for resource j; RT is the recommended trust value of node i.

[0036] Furthermore, according to the recent n access situations of node i to resource j, calculate the direct trust value of the current node. The direct trust value DT ij is expressed as:

[0037]

[0038]

[0039]

[0040] Among them, t represents the current time, is the number of positive interactions after node i interacts with resource j at t q , is the time decay function, is the number of positive interactions after node i interacts with resource j at t q 。

[0041] Further, if the user has interacted with resources in M other domains, the calculation of the recommended trust value of the current user includes:

[0042]

[0043] where N j is the number of successful accesses of user i to resource j, M is the number of different resources accessed by user i, and DT ij is the corresponding direct trust value.

[0044] The present invention adds the trust value as an additional attribute to the attribute-based access control process, divides resources according to sensitivity and importance, and calculates the trust value through the user's access behavior to different resources; in the present invention, if a user wants to obtain the access permission of the corresponding resource, the user must meet the corresponding access policy. At the same time, positive access behavior will increase the trust value, while negative access behavior will do the opposite. The functions of policy verification, policy management, attribute management, and trust calculation in the access control model are realized by designing a smart contract on the blockchain. Due to the open and transparent characteristics of the blockchain, the entire access control process is secure and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a schematic flowchart of a trust-based cross-domain access control method for the Internet of Things according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0047] The present invention proposes a trust-based cross-domain access control method for the Internet of Things, which specifically includes the following steps:

[0048] S1. Build a blockchain main chain platform based on the Hyperledger Fabric framework and initialize the blockchain network. The initialization includes creating certificates for users in the network;

[0049] S2. Write chain codes in golang on the main chain platform, including resource information management chain code, trust management chain code, access request chain code, and attribute management chain code. Install the chain codes on the blockchain and initialize them;

[0050] S3. Blockchain platforms in different IoT domains need to select proxy nodes to join the main chain;

[0051] S4. The user initiates a user registration request to the attribute authentication agency, obtains the user's attribute value, and the attribute authentication agency uploads it to the blockchain;

[0052] S5. The user uploads the resource to the IPFS network to obtain the storage address Addr, and then uploads the resource information and access policy to the main chain;

[0053] S6. The user sends a request message to the proxy node. The request message includes the resource ID and operation attributes. After receiving the request message, the proxy node initiates an access request through the main blockchain and calculates and updates the trust value based on the access result.

[0054] The process of this embodiment is as follows Figure 1 , specifically including the following steps:

[0055] Build a blockchain main chain platform based on the Hyperledger Fabric framework and initialize the blockchain network, including creating certificates for users in the network;

[0056] Use Golang to write chaincode on the main chain platform, including resource information management chaincode, trust management chaincode, access request chaincode, and attribute management chaincode, install the chaincode to the blockchain and initialize it;

[0057] Blockchain platforms in different IoT domains need to select proxy nodes to join the main chain;

[0058] The user initiates a user registration request to the attribute authentication agency, obtains his or her attribute value, and the attribute authentication agency uploads it to the blockchain;

[0059] The user uploads the resource to the IPFS network to obtain the storage address Addr, and then uploads the resource information and access policy to the main chain;

[0060] The user first sends a request to the proxy node, including the resource ID and operation attributes. After receiving the message, the proxy node initiates an access request through the main blockchain and calculates and updates the trust value based on the access result.

[0061] Among them, the Inter Planetary File System (IPFS) is a peer-to-peer distributed file system designed to connect all computer devices with the same file system. In terms of addressing, it innovatively adopts content addressing instead of location addressing. IPFS uses a decentralized design to store uploaded files dispersedly in different IPFS nodes, calculates the file fingerprint based on the file content, and stores it in the distributed hash table. Through IPFS, the storage pressure on the blockchain can be greatly alleviated, and the problem of low storage capacity of the blockchain can be solved.

[0062] In this embodiment, chaincodes are written in golang on the Hyperledger Fabric platform, including resource information management chaincode, trust management chaincode, access request chaincode, and attribute management chaincode:

[0063] (1) Resource information chaincode

[0064] The policy management chaincode is used to implement the attribute authentication and storage of users, and add access control policies for the attribute-based access control model to the system. This chaincode includes the following interfaces:

[0065] The AddPolicy() interface is used to add new resource information and corresponding access policies to the blockchain;

[0066] The UpdatePolicy() interface is used to receive the resource id and the corresponding new access policy, and use the new access policy to overwrite the old one to achieve the effect of updating the access control policy;

[0067] The DeletePolicy() interface is used to delete the resource information and the corresponding access control policy stored in the blockchain;

[0068] The QueryPolicy() interface is used to implement the function of searching for the corresponding access policy using the resource id as an index.

[0069] (2) Attribute management chaincode

[0070] The attribute management chaincode receives the user id and the attribute set transmitted from the attribute authentication center. The attributes are mainly the user's identity, position, address, etc. This chaincode includes the following interfaces:

[0071] The AddAttribute() interface is used to receive the user identity identifier and the attribute set from the attribute authorization agency and store them.

[0072] The UpdateAttribute() interface is used to receive the new attribute set transmitted from the attribute authorization agency, and overwrite the old one according to the resource id and the new attribute set to achieve the effect of attribute update.

[0073] The DeleteAttribute() interface is used to delete the attribute set corresponding to the user id.

[0074] The QueryAttribute() interface is used to obtain the corresponding user attributes from the blockchain based on the identity identifier. This interface can only be called by the access request chaincode.

[0075] (3) Trust Management Chaincode

[0076] The trust management chaincode is used to calculate the trust value of each node, including the following ports:

[0077] The TrustCaculate() port calculates the direct trust value and recommended trust value through the node interaction behavior stored in the blockchain, and finally performs a weighted summation of the direct and recommended trust values. The final trust value obtained will be stored as an attribute on the blockchain.

[0078] In the present invention, the trust value is used as one of the user attributes. In the network, whether to grant access rights to the user is determined by comparing the access policy and the user's attributes (including the trust value). Generally, even if the user meets the requirements for obtaining access rights in other situations, the user still cannot obtain access rights if the trust value is lower than the set threshold.

[0079] (4) Access request chain code

[0080] The access request chaincode is used to receive user access requests, call access policies and user attributes for matching verification, and call the trust management chaincode to update the trust value based on the access results. It includes the following ports:

[0081] The AccessCheck() port is used to call the corresponding user attributes and access policies for matching verification based on the user ID and resource ID, and call the trust management chain code to update the trust value based on the access result.

[0082] The node initiates an access request to the resources stored in the main chain through the proxy node, which specifically includes the following steps:

[0083] S61: The user sends a request to the proxy node, including resource ID and operation attributes.

[0084] S62: The proxy node receives the user's request, operates the attributes based on the user ID and resource ID, and calls the attribute verification chain code to initiate a request for the resource;

[0085] S63: After receiving the request from the node, the attribute management chaincode on the blockchain calls the policy management chaincode and the attribute management chaincode to obtain the resource access policy and user attributes and perform verification;

[0086] S64: If the requesting node meets the access policy requirements, return the resource information to the user; otherwise, return an error if it does not meet the access policy requirements.

[0087] S65: Store the access result on the blockchain and call the trust management chain code to update the trust value.

[0088] In this embodiment, the trust value calculation is divided into three parts: direct trust value, recommended trust value, and comprehensive trust value. The direct trust value is calculated based on the access result of a user to a certain resource. The recommended trust value is calculated from the access results of the user and other resources. The comprehensive trust value is obtained by weighted summation of the direct trust value and the recommended trust value. The specific steps are as follows:

[0089] First, calculate the direct trust value DT ij It is expressed as:

[0090]

[0091]

[0092]

[0093] where t represents the current time, is the number of positive interactions of node i with resource j at time t q when interacting with resource j, is the time decay function, is the number of positive interactions of node i with resource j at time t q when interacting with resource j; in the present invention, the number of positive interactions refers to the number of interactions where the request successfully obtains a response, and the number of negative interactions refers to the number of interactions where the request fails to obtain a response, such as when the request is not responded to.

[0094] If the user has interacted with resources in M other domains, calculate the recommended trust value of the current user. The specific formula is as follows:

[0095]

[0096] where N j is the number of successful accesses of user i to resource j, M is the number of different resources accessed by user i, and DT ij is the corresponding direct trust value.

[0097] Perform a weighted summation of the direct trust value and the recommended trust value to obtain the final trust value T, and update the node attributes with the obtained trust value. The final trust value T is expressed as:

[0098]

[0099]

[0100] Among them, θ is the adaptive weight. If it is a positive interaction, the value of θ changes exponentially and increases with the increase in the number of interactions. In the case of negative interaction, let θ = 1, and update the trust value T through the equation T = min(DT ij , T). In this formula, T on the right side of the equal sign represents the trust value T before update, that is, setting the value of θ to 1 increases the proportion of the direct trust value. Moreover, take the minimum value between the trust value before direct update and the comprehensive trust value as the updated trust value to quickly reduce the trust value. Among them, z and k are constants, and their function is to limit the change of θ between 0 and 1.

[0101] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A trust-based cross-domain access control method for the Internet of Things, characterized in that, Specifically, it includes the following steps: S1. Build a blockchain main chain platform based on the Hyperledger Fabric framework and initialize the blockchain network. The initialization includes creating certificates for users in the network; S2. Write chain codes in golang on the main chain platform, including resource information management chain code, trust management chain code, access request chain code, and attribute management chain code. Install the chain codes onto the blockchain and initialize them; S3. Blockchain platforms in different Internet of Things domains need to select proxy nodes to join the main chain; S4. Users send user registration requests to the attribute authentication agency, obtain the user's attribute values, and the attribute authentication agency uploads them to the blockchain; S5. Users upload resources to the IPFS network to obtain a storage address Addr, and then upload the resource information and access policies to the main chain; S6. Users send request messages to the proxy nodes. The request messages include resource ids and operation attributes. After receiving the request messages, the proxy nodes initiate access requests through the main blockchain and calculate and update the trust values based on the access results. The process of calculating the trust values includes the following steps: Calculate the direct trust value DT based on the user access request behavior stored in the blockchain. Calculate the direct trust value of the current node according to the recent n access situations of node i to resource j. The direct trust value DT of node i to resource j ij is expressed as: where t represents the current time, is the number of positive interactions of node i with resource j at time t q when interacting with resource j, is the time decay function, is the number of positive interactions of node i with resource j at time t q when interacting with resource j; Obtain the user's access request behavior from the blockchain and calculate the recommended trust value RT. If the user has interacted with resources in M other domains, the calculation of the recommended trust value for the current user includes: where N j is the number of successful accesses by user i to resource j, and M is the number of different resources accessed by user i; Perform a weighted sum of the direct trust value and the recommended trust value to obtain the final trust value T, and update the node attributes with the obtained trust value. The final trust value T is expressed as: Among them, θ is the adaptive weight. If it is a positive interaction, the value of θ changes exponentially and increases with the increase in the number of interactions. In the case of negative interaction, θ = 1 and T = min(DT ij , T), setting the value of θ to 1 increases the proportion of the direct trust value.

2. The method for cross-domain access control of the Internet of Things based on trust according to claim 1, characterized in that, The policy management chain code is used to implement the upload of the user's resource information and the access policies set by the user for the resources. This chain code includes the following interfaces: The AddPolicy() interface is used to add new resource information and corresponding access policies to the blockchain; The UpdatePolicy() interface is used to receive the resource id and the corresponding new access policy, and overwrite the old one with the new access policy to achieve the effect of updating the access control policy; The DeletePolicy() interface is used to delete the resource information and the corresponding access control policy stored in the blockchain; The QueryPolicy() interface is used to implement the function of searching for the corresponding access policy using the resource id as an index.

3. A trust-based cross-domain access control method for the Internet of Things according to claim 1, characterized in that, The attribute management chain code receives the user id and the attribute set transmitted from the attribute authentication center. The attribute set includes the user's identity, position, and address. This chain code includes the following interfaces: The AddAttribute() interface is used to receive and store the user identity identifier and the attribute set from the attribute authorization agency; The UpdateAttribute() interface is used to receive the new attribute set transmitted from the attribute authorization agency, and overwrite the old one according to the resource id and the new attribute set to achieve the effect of attribute update; The DeleteAttribute() interface is used to delete the attribute set corresponding to the user id; The QueryAttribute() interface is used to obtain the corresponding user attributes from the blockchain based on the identity identifier, and this interface can only be called by the access request chain code.

4. A trust-based cross-domain access control method for the Internet of Things according to claim 1, characterized in that, The trust management chaincode is used to calculate the trust values of different users in different IoT domains, including the TrustCaculate() port, which calculates the direct trust value and recommended trust value based on the access behavior of nodes stored in the blockchain. The weighted sum of the direct trust value and the recommended trust value is then stored as an attribute on the blockchain.

5. A trust-based cross-domain access control method for the Internet of Things according to claim 1, characterized in that The access request chaincode is used to receive the user's access request, call the access policy and user attributes for matching verification, and call the trust management chaincode to update the trust value based on the access result. It includes the AccessCheck() port, which is used to call the corresponding user attributes and access policy according to the user ID and resource ID for matching verification, and call the trust management chaincode to update the trust value based on the access result.

6. A trust-based cross-domain access control method for the Internet of Things according to claim 1, characterized in that User attributes include subject attributes, object attributes, operation attributes, and environment attributes. The subject attributes include the user's ID, role, organization, trust value, and domain; the object attributes include resource ID and validity period; the operation attributes include read, write, and execute operations; and the environment attributes, i.e., the contextual conditions required by the policy, include time, location, and security level.

7. A trust-based cross-domain access control method for the Internet of Things according to claim 1, characterized in that The process of a user requesting access to resources in the main chain through a proxy node includes: S61: The user sends a request message to the proxy node, which includes the resource ID and operation attributes. S61: The proxy node receives the user's request information and calls the attribute verification chain code to initiate a request for the resource based on the user ID, resource ID, and operation attributes in the request information; S62: After receiving the request from the node, the attribute management chaincode on the blockchain calls the policy management chaincode and the attribute management chaincode to obtain the resource access policy and user attributes and perform verification; S63: If the requesting node meets the access policy requirements, the resource information is returned to the user; if not, an error is returned. S64: Store the access result on the blockchain and call the trust management chain code to update the trust value.

Images