Blockchain-based industrial internet multi-level identification resolution method

Abstract

The application discloses a kind of industrial internet multistage identification resolution methods based on blockchain, as shown in figure 1, method includes the following steps: step 1: identifier generation;Step 2: identification registration;Step 3: identification mapping data entry;Step 4: resolve user attribute registration;Step 5: identification resolution;Step 6: identification verification.The application is based on blockchain and FH-CP-ABE algorithm, strengthens the fine-grained access control of identifier owner to identifier, and then makes the resolution user with different attributes resolve the same identifier to obtain different levels of identification mapping information.

Description

TECHNICAL FIELD

[0001] The present application relates to a kind of industrial internet multistage identification resolution method based on blockchain, belong to industrial internet and blockchain technical field. BACKGROUND

[0002] With the development of industrial internet, traditional industry is facing the challenge of transformation and upgrading. The identification resolution system is the key infrastructure of industrial internet, and the industrial enterprises use identification resolution technology to realize the connection of each entity unit in the industrial production process by constructing the mapping relationship between identification and data, complete the seamless docking and linkage of industrial data, become the inevitable choice for enterprises to realize digitalization, intelligentization and sustainable development. Therefore, it has important practical significance to enhance the security, confidentiality and complex industrial process ability of identification resolution through blockchain, cryptography and other technologies.

[0003] Identification resolution technology can be divided into improved resolution technology based on DNS and innovative resolution technology not based on DNS. The former relies on the existing DNS architecture, has the advantages of convenient deployment and strong scalability, but it has the problems of bloated resolution service and excessive centralization, and cannot meet the high concurrency and differentiated scene needs in the new industrial internet environment. In order to alleviate the above problems, innovative resolution technology not based on DNS is becoming more and more mainstream.

[0004] The innovative non-DNS-based resolution technology has independent architecture deployment, resolution protocol and management mechanism. Specifically, the innovative non-DNS-based resolution technology adopts a top-down tree structure and is divided into five roles: international root node, national top node, secondary node, enterprise node and recursive node. The international root node is the top layer of the tree structure, is responsible for the addition, deletion and update operation of the subordinate national top node, and maintains the identifier prefix, identifier registration quantity, resolution quantity and IP address and other information of the subordinate national top node; the national top node is managed by the international root node upward, manages the addition, deletion and update of the subordinate secondary node downward, and maintains the registration and management information of the secondary node; the secondary node is generally divided according to the industry, is managed by the national top node upward, and maintains the registration and management information of the enterprise node in the industry domain downward; the enterprise node is the most basic role in the standard resolution system, especially responsible for the input and storage of product identifier mapping data, the enterprise node is managed by the secondary node of the industry domain, and is responsible for making a final response to the identifier resolution request initiated by the user; the recursive node has no subordinate relationship with other nodes, when receiving a resolution request, the recursive node completes recursive resolution service by accessing the other four roles from top to bottom. However, the existing identifier resolution technology pays excessive attention to the throughput of resolution and the integrity of identifier mapping data, ignores the confidentiality of identifier mapping data and the single problem of resolution result, and thus leads to that when facing a complex industrial production environment, the identifier owner refuses to input confidential data into the identifier, which greatly increases the limitation of the identifier resolution technology. SUMMARY

[0005] In order to solve the problems and deficiencies in the prior art, the present application proposes a multi-level identifier resolution method for industrial internet based on blockchain. The method introduces the FH-CP-ABE algorithm to encrypt the identifier mapping data in a hierarchical manner during the storage and transmission of the identifier mapping data, and sets access control policies by the identifier owner. Only the resolution user who meets the corresponding attributes in the access control policy can decrypt the ciphertext identifier mapping information of the corresponding level, realizing fine-grained access control of the identifier owner to the mapping data in the identifier. At the same time, the storage and transmission of the identifier mapping data in the form of ciphertext improve the confidentiality of the mapping data. Then, the combination of blockchain technology and IPFS cloud server technology realizes the distributed off-chain storage of the ciphertext of the identifier mapping data, and adds a verification mechanism to ensure the security and integrity of the resolution result after the resolution user completes the resolution.

[0006] To achieve the above purpose, the technical scheme of the present application is as follows: a multi-level identifier resolution method for industrial internet based on blockchain, comprising the following steps:

[0007] Step 1: Identifier generation. First, generate the identifier using hierarchical coding, which includes identity identification and product self-defined identification, separated by " / " between the two parts. The identity identification is the unique ID of the enterprise node, and the product self-defined identification is set by the identifier owner.

[0008] Step 2: Identifier registration. First, the enterprise node submits registration information to the secondary node of the industry domain, and the secondary node audits and allocates a unique ID and generates a FH-CP-ABE algorithm public key PK after verification. Then, the enterprise node sends the attribute set to the secondary node to request the generation of a private key SK related to the attribute, and the secondary node verifies the enterprise node's identity information and generates a private key SK corresponding to each attribute i i and returns it to the enterprise node.

[0009] Step 3: Identifier mapping data entry. First, the identifier owner divides the identifier mapping data M into L levels M = {m1, m2,..., m L} according to its own needs; second, generate L AES encryption keys ck = {ck1, ck2,..., ck L} and use ck to encrypt the hierarchical identifier mapping data M to generate symmetric encryption ciphertext and calculate the hash of the ciphertext; then the enterprise node stores the AES ciphertext E ck {M} in the IPFS network to obtain the storage information CID, and sends the complete identifier, the public key PK obtained by registering with the secondary node, the AES key ck, and the access control policy generated according to its own needs to the secondary node of the industry domain to apply for FH-CP-ABE encryption according to the access control policy; finally, the enterprise node receives the ciphertext CT and writes the complete identifier, CID, CP-ABE ciphertext CT, and AES ciphertext data hash to Fabric, and when the enterprise node receives the Fabric write success information, the identifier mapping data entry is completed.

[0010] Step 4: Analyze user attribute registration. To analyze the user's identity, the user needs to have corresponding attributes, so the analysis user needs to initiate an attribute registration application to the identifier owner. First, the analysis user submits identity registration information to the enterprise node (identifier owner), and the enterprise node records and returns its own attribute set After receiving the attribute set, the analysis user selects the attribute that meets its own requirements and initiates an attribute registration request. Finally, the enterprise node matches the attribute application and registration identity information, and if the match is correct, it sends the private key SK corresponding to the attribute i to the analysis user through a secure channel. i ​

[0011] Step 5: identification resolution. When the user completes the attribute registration, the identifier generated by the registered enterprise can be resolved to complete the identification resolution service. First, the user who obtains the resolution of the commodity identifier triggers the query smart contract to obtain the hash fingerprint CID in the IPFS of the AES ciphertext stored in the Fabric, the FH-CP-ABE ciphertext CT and the AES ciphertext hash; second, the user side uses the attribute private key SK i decrypt the ciphertext CT to obtain the AES key ck used to decrypt the AES ciphertext of the corresponding attribute level; then the user side queries the AES ciphertext in the IPFS network and downloads; finally, the user side uses ck to decrypt the AES ciphertext to obtain the plaintext identification mapping data corresponding to the attribute level, and the resolution is completed.

[0012] Step 6: identification verification. When the resolution user obtains the session key ck corresponding to the attribute level of itself and queries the identification mapping information of the corresponding level in the IPFS, the identification mapping data ciphertext is verified by triggering the verification smart contract of the Fabric. The verification process is asynchronous with the identification resolution, so as to greatly improve the throughput of the resolution technology.

[0013] Compared with the prior art, the advantages of the present application are as follows:

[0014] 1) The identification mapping data in the present application is encrypted by using AES in the transmission and storage process, which better protects the confidentiality of the identification mapping data compared with the traditional identification resolution technology.

[0015] 2) The present application combines the FH-CP-ABE encryption algorithm, classifies the identification mapping data, and FH-CP-ABE encrypts the AES key ck used for symmetric encryption of the classified data according to the access control strategy set by the identifier owner. Only the resolution user who meets the access control strategy corresponding to the attribute can resolve the session key ck of the corresponding level, which realizes the fine-grained access control of the identifier by the identifier owner while ensuring the resolution performance.

[0016] 3) The present application stores the identification mapping data ciphertext in the IPFS cloud server, instead of the traditional database storage mode, so that the identification mapping data realizes decentralized storage, effectively solves the problem of loss of identification mapping data caused by single node failure. And through the Fabric, the verification mechanism is realized, which effectively guarantees the integrity of the identification mapping data.

[0017] 4) The method proposed in the present application does not need to change the existing identification resolution architecture, so it is simple to deploy, has strong scalability and wide applicability. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is the overall flowchart of the embodiment of the present application.

[0019] Figure 2 Figure for identifier format of embodiment of the present application.

[0020] Figure 3 Figure for identifier registration of embodiment of the present application.

[0021] Figure 4 Figure for identifier mapping data entry of embodiment of the present application.

[0022] Figure 5 Figure for parsing user attribute registration of embodiment of the present application.

[0023] Figure 6 Figure for identifier parsing of embodiment of the present application.

[0024] Figure 7 Figure for identifier verification of embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to deepen the understanding and understanding of the present application, the present application will be further illustrated below in combination with specific embodiments.

[0026] Embodiment 1: A multi-level identifier parsing method of industrial internet based on blockchain, the method first step, see Figure 2 , the format of the identifier is introduced; the second step, see Figure 3 , the enterprise node registers to the secondary node to generate the enterprise unique identity ID, and obtains the required parameters for setting the access control policy; the third step, see Figure 4 , the identifier owner classifies and encrypts the product information according to the access control policy and enters it into the identifier; the fourth step, see Figure 5 , the parsing user attribute registration, the parsing user registers the attribute according to its own identity, only the corresponding attribute in the access control policy can successfully parse the corresponding level identifier mapping information; the fifth step identifier parsing, see Figure 6 , the parsing user parses the identifier according to its own registered attribute and the access control policy set by the identifier owner to obtain the product information; the sixth step, see Figure 7 , in order to ensure the integrity of the ciphertext product information obtained by the parsing user from the IPFS, the Fabric is used to add a verification mechanism, and the integrity check of the identifier mapping data is completed asynchronously while the parsing user is parsing. The detailed implementation steps are as follows:

[0027] Step 1: Identifier structure setting. The identifier structure of the present application adopts hierarchical coding, each identifier is divided into two parts of identity identification and commodity self-defined identification, and the two parts are separated by " / ". The first part is identity identification, which is obtained by the enterprise participating in the identification analysis system to register and apply to the second node. The identity identification of each enterprise is unique, which is divided into three parts of top node code, second node code and enterprise node code, and the three parts are separated by ".". Among them, the top node code represents the country and region to which the identifier owner belongs, which is represented by three fixed-length strings; the second node code represents the industry domain to which the identifier owner belongs, which is represented by three fixed-length strings; and the enterprise node code represents the unique identity ID of the identifier owner in the system, which is represented by an indefinite-length string to ensure the scalability of the present application.

[0028] The second part is the commodity self-defined identification, which is set by the identifier owner and divided into two parts of grade code and self-defined individual code, and the two parts are separated by ".". The grade code represents that the user divides the mapping data into levels, which is represented by two strings. When the string is "01", it means that there is only one level of information in the mapping data, and any user can access the full mapping data; and the self-defined individual code segment is the mapping of specific product information, which is defined by the identifier owner according to the needs of the self-defined bit length.

[0029] Step 2: Identifier registration, which generates the unique identity ID of the enterprise node and generates the parameters required for setting the access control strategy, which can be divided into the following sub-steps:

[0030] Sub-step 2-1: industry domain initialization, which generates the necessary parameters for the second node to generate the public and private keys of the enterprise node. Let 1 K be a security parameter, be a bilinear multiplication group with prime order p. Parameter K determines the size of the multiplication group. e: be a bilinear mapping, and g be the generator in . The second node sets the security parameter K and constructs two random hash functions: H1: H2: Select a random number Generate the master key MSK:

[0031] MSK = {α, g β} (1)

[0032] Sub-step 2-2: enterprise registration. When the enterprise submits the registration information to the second node, the second node registers its identity information and generates the enterprise public key PK:

[0033]

[0034] After the enterprise identity information is written into the blockchain, a unique identity ID is generated for it according to the identifier format of step 1, and it is returned to the enterprise node with the PK.

[0035] Substep 2-3: Enterprise access control policy setting. When the enterprise completes identity registration, the access control policy and the attribute set used in setting the access control policy are sent to the secondary node together, and the secondary node generates a random number for each user and each attribute according to the formula 2 . Then generate the private key SK according to formula 3 i . Generate the FH-CP-ABE private key SK i and return it to the enterprise node:

[0036]

[0037] Step 3: Identity mapping data entry. In this step, the enterprise node classifies and encrypts product information into the identifier, which can be implemented in the following substeps:

[0038] Substep 3-1: Complete identifier generation. The identity owner (enterprise node) generates a custom identifier for the product according to the structure of step 1 to form a complete identifier for the product.

[0039] Substep 3-2: Product information classification and encryption. First, the enterprise node divides the product information M into L different privacy levels to generate M = {m1, m2,..., m L}; then randomly generates L AES symmetric encryption keys ck = {ck1, ck2,..., ck L} to encrypt M to generate AES encrypted ciphertext and calculate the hash of the ciphertext; finally, store E ck {M} in the IPFS network and wait for its return storage information CID.

[0040] Substep 3-3: Hierarchical session key ck encryption: After the IPFS returns the hash fingerprint CID of the ciphertext data, the enterprise node sends the complete identifier, the public key PK obtained by registering with the secondary node, the AES key ck, and the access control policy generated according to its own needs to the secondary node in the industry domain to apply for FH-CP-ABE encryption according to the access control policy. After receiving the request from the enterprise in the industry domain, the secondary node first verifies the legality of the public key, and after verification, selects L random numbers as secret values to generate ciphertext CT and return:

[0041] ​​

[0042] where (x, y) is a node of the integrated control tree τ corresponding to the access control policy set by the enterprise, the leaf nodes of the integrated control tree τ are attributes identified by the owner, each secret value s is placed at a level node, l is a node that is not a leaf node among the child nodes of (x, y) when (x, y) is a level node, q (x，y) The construction polynomial of node (x, y) is as follows:

[0043]

[0044]

[0045]

[0046]

[0047]

[0048] Substep 3-4: Data entry. After the enterprise node receives the ciphertext CT, the complete identifier, CID, FH-CP-ABE ciphertext CT and AES ciphertext data hash are written into the Fabric together. When the enterprise node receives the information that the Fabric writes successfully, the identifier mapping data entry is completed.

[0049] Step 4: Analyzing user attribute registration. In order to complete the identity resolution, the user needs to have the corresponding attribute, so the user needs to initiate an attribute registration application to the identity owner. First, the user submits the identity registration information to the enterprise node (identity owner), and the enterprise node records it and returns the complete set of its own attributes Then, the user selects the attribute that meets the requirements after receiving the attribute set and initiates an attribute registration request. Finally, the enterprise node matches the application attribute and the registered identity information, and sends the private key SK i .

[0050] Step 5: Identity resolution. After the user completes the attribute registration, the identity resolution service for the identifier generated by the registered enterprise can be completed, which can be divided into the following substeps:

[0051] Substep 5-1: Identifier query. The user who obtains the commodity identifier triggers the query smart contract to obtain the AES ciphertext hash fingerprint CID, ciphertext CT and AES ciphertext hash stored in the Fabric.

[0052] Substep 5-2: Attribute decryption. The user uses the attribute private key SK iDecrypting the ciphertext CT yields the AES key ck used to decrypt the AES ciphertext of the corresponding attribute level. The specific decryption process is as follows:

[0053] 1) When (x, y) is a leaf node, if Where att(x, y) is the attribute of the leaf node (x, y), and S is the attribute set conforming to the ensemble control tree τ, then DecryptNode(CT, SK, (x, y)) = ⊥; if att(x, y) ∈ S, then the secret value of the leaf node is calculated as shown in Formula 10:

[0054]

[0055] 2) When (x, y) is a non-leaf node, define z as all child nodes of node (x, y), calculate DecryptNode(CT, SK, z), and define the function F. z S (x，y) k for z (x，y) An arbitrary set of size, where k (x，y) Let F be the threshold for node (x, y). If the set does not exist, then F... z =⊥, decryption failed. Define Lagrange parameters. If the set exists, then calculate F according to formula 11. (x,y) :

[0056]

[0057] Where i = index(z), S′ (x，y) ={index(z):z∈S (x，y)}

[0058] Next, F is calculated using formulas 12 and 13. L Obtain all levels k

[0059]

[0060] When (x) k y k When S is a level node of level k, and the set of attributes contained in S is a subset of the set of threshold gate nodes among the child nodes of the level node, F is recursively calculated using formula 13. (x,y)，l This allows us to calculate the corresponding node for each level.

[0061]

[0062] Based on formulas 12 and 13 above, all levels k are recursively calculated. Then, the session key ck for all levels is calculated according to Formula 14.k :

[0063]

[0064] Sub-step 5-3: Query and decrypt the corresponding level of ciphertext. The client queries the IPFS network for AES ciphertext matching the corresponding level based on the CID and downloads it; finally, the client uses ck k AES ciphertext Decryption yields the plaintext identifier mapping data corresponding to the attribute level, and parsing is complete.

[0065] Step 6: Identity Verification. When a user with level k completes identity resolution and obtains... and AES encrypted data of lower rank. It calculates The Fabric identifies the hash of the identifier mapping data uploaded by the owner. For comparison, if V ′ =V proves that the integrity check was successful and the data is reliable; if V ′ If the value is ≠V, it proves that the integrity check failed and the data has been tampered with.

[0066] Based on the same inventive concept, the present invention provides a blockchain-based multi-level identifier resolution method for the industrial internet, which includes identifier structure design, identifier registration, identifier mapping data input, parsing user attribute registration, identifier resolution, and identifier verification. When this process is applied to the industrial internet identifier resolution system, the above-mentioned blockchain-based multi-level identifier resolution method for the industrial internet is realized.

[0067] Those skilled in the art will recognize that the embodiments described herein are intended to help readers understand the principles of the invention. It should be understood that the embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. After reading this invention, any modifications of the invention in various equivalent forms by those skilled in the art will fall within the scope defined by the claims of this application.

Claims

1. A blockchain-based multi-level identifier resolution method for the industrial internet, characterized in that, The method includes the following steps: Step 1: Identifier structure setup, Step 2: Identifier Registration. This step generates a unique ID for the enterprise node and generates the parameters required to set access control policies for it. Specifically: Sub-step 2-1: Industry Domain Initialization; Sub-step 2-2: Enterprise Registration; Sub-step 2-3: Enterprise Access Control Policy Settings. Step 3: Identifier Mapping Data Entry. In this step, the enterprise node hierarchically and encrypts product information and enters it into the identifier. Specifically: Sub-step 3-1: Complete Identifier Generation; Sub-step 3-2: Product Information Hierarchical and Encryption; Sub-step 3-3: Hierarchical Session Key (ck) Encryption; Sub-step 3-4: Data Entry. Step 4: Parse user attribute registration. For a user to complete the identifier resolution, they must have corresponding attributes. Step 5: Identifier Resolution. After the user completes attribute registration, the identifier resolution service can be performed on the identifiers generated by the registered enterprise. Specifically, sub-steps 5-1, 5-2, and 5-3 are as follows: Sub-step 5-1: Identifier Query; Sub-step 5-2: Attribute Decryption; Sub-step 5-3: Query and Decrypt the Corresponding Level Ciphertext. Step 6: Verify the identifier to confirm whether the data has been tampered with; Step 1: Identifier Structure Setup. Specifically, the identifier structure uses hierarchical coding. Each identifier is divided into two parts: an identity identifier and a product-defined identifier, separated by a " / ". The first part is the identity identifier, which is obtained by participating enterprises through registration with the secondary nodes. Each enterprise's identity identifier is unique and is further divided into three parts: a top-level node code, a secondary node code, and an enterprise node code, separated by ".". The top-level node code represents the country / region of the identifier owner and is represented by a three-digit fixed-length string. The secondary node code represents the industry domain of the identifier owner and is also represented by a three-digit fixed-length string. The enterprise node code represents the unique identity ID of the identifier owner within the system and, for scalability, is represented by a variable-length string. The second part is the product's custom identifier, which is set by the identifier owner. It is divided into two parts: a level code and a custom individual code, separated by ".". The level code represents the user's specific classification of the identifier mapping data into levels, and is represented by a two-digit string. When this string is "01", it means that there is only level 1 information in the mapping data, and any user can access the full mapping data. The custom individual code segment maps the specific production information of the product, and the identifier owner defines the length of the code according to their own needs.

2. The blockchain-based multi-level identifier resolution method for the industrial internet according to claim 1, characterized in that, Step 2: Identifier Registration. Specifically, this step generates a unique ID for the enterprise node and generates the parameters needed to set access control policies for it. Its implementation can be divided into the following sub-steps: Sub-step 2-1: Industry domain initialization, generating necessary parameters for the public and private keys of the enterprise node for the secondary node, let's say 1. K It is a safety parameter. It is a bilinear multiplicative group of prime order p, and the parameter K determines the size of the multiplicative group. It is a bilinear mapping, and g is In the generator, the second-level node sets the security parameter K and constructs two random hash functions: Select random number Generate master key MSK: MSK<{α,g β } (1) Sub-step 2-2: Enterprise registration. When an enterprise submits its registration information to the secondary node, the secondary node registers its identity information and generates an enterprise public key (PK) for it. After writing the enterprise identity information into the blockchain, a unique identity ID is generated for it according to the identifier format in step 1, and then returned to the enterprise node along with the PK. Sub-steps 2-3: Enterprise access control policy settings. After the enterprise completes identity registration, when setting up the access control policy, it is necessary to include the access control policy and the complete set of attributes used. Send them together to the secondary node, which then determines the appropriate action based on the data. For each user and for each attribute Generate random numbers Then, generate the private key SK according to formula 3. i Generate FH-CP-ABE private key SK i And return it to the enterprise node:

3. The blockchain-based multi-level identifier resolution method for the industrial internet according to claim 1, characterized in that, Step 3: Identifier Mapping Data Entry. In this step, the enterprise node hierarchically and encrypts product information and enters it into the identifier. Its implementation can be divided into the following sub-steps: Sub-step 3-1: Complete identifier generation. The identifier owner generates a custom identifier for the product based on the structure in step 1, thus forming the complete identifier for the product. Sub-step 3-2: Product information is classified and encrypted. First, the enterprise node divides the product information M into L different privacy levels, generating M = {m1, m2, ..., m}. L }; then randomly generate L AES symmetric encryption keys ck = {ck1, ck2, ..., ck3}. L } Encrypt M to generate AES encrypted ciphertext And calculate the hash of the ciphertext; finally, E ck {M} is stored in the IPFS network and the system waits for the return of the storage information CID. Sub-step 3-3: Hierarchical Session Key ck Encryption: After IPFS returns the hash fingerprint CID of the encrypted data, the enterprise node sends the complete identifier, the public key PK obtained from the secondary node registration, the AES key ck, and the access control policy generated according to its own needs to the secondary node of its industry domain to request FH-CP-ABE encryption according to the access control policy. After receiving the request from the enterprise in its industry domain, the secondary node first verifies the validity of its public key. If the verification is correct, it selects L random numbers. Generate ciphertext CT as the secret value and return it: Where (x, y) represents the node of the integrated control tree τ corresponding to the access control policy set by the enterprise, the leaf nodes of the integrated control tree τ are the attributes set by the owner, each secret value s is placed at the level node, l is the node that is not a leaf node among its child nodes when (x, y) is a level node, and q (x,y) The constructive polynomial for node (x, y) is calculated as follows: Sub-steps 3-4: Data entry. After receiving the encrypted CT, the enterprise node writes the complete identifier, CID, FH-CP-ABE encrypted CT, and AES encrypted data hash together into the Fabric. When the enterprise node receives the Fabric write success message, the identifier mapping data entry is complete.

4. The blockchain-based multi-level identifier resolution method for the industrial internet according to claim 1, characterized in that, Step 4: Parse user attribute registration. For a user to complete identifier resolution, they need to have corresponding attributes. Therefore, the user needs to initiate an attribute registration request to the identifier owner. First, the user submits their identity registration information to the enterprise node, which records it and returns its complete set of attributes. Next, after parsing the set of attributes received by the user, the user selects the attribute that matches their identity and initiates an attribute registration request. Finally, the enterprise node matches the user's requested attribute with their registered identity information. If the match is correct, the enterprise node sends the private key corresponding to that attribute to the user via a secure channel. .

5. The blockchain-based multi-level identifier resolution method for the industrial internet according to claim 1, characterized in that, Step 5: Identifier Resolution. After the user completes attribute registration, the identifier resolution service can be completed for the identifiers generated by the registered enterprise. This can be implemented in the following sub-steps: Sub-step 5-1: Identifier Query. The user triggers a query smart contract to obtain the hash fingerprint (CID), ciphertext (CT), and AES ciphertext hash stored in Fabric and in IPFS. Sub-step 5-2: Attribute decryption, using the attribute private key SK distributed by the enterprise when the user registers the attribute. i Decrypting the ciphertext CT yields the AES key ck used to decrypt the AES ciphertext of the corresponding attribute level. The specific decryption process is as follows: 1) When (x,y) is a leaf node, if Where att(x,y) is the attribute of the leaf node (x,y), and S is the attribute set conforming to the ensemble control tree τ, then DecryptNode(CT,SK,(x,y))=⊥; if att(x,y)∈S, the secret value of the leaf node is calculated as shown in Formula 10: 2) When (x, y) is a non-leaf node, define z as all child nodes of node (x, y), calculate DecrptNode(CT, SK, z), and define the function F. z S (x,y) k for z (x,y) An arbitrary set of size, where k (x,y) The threshold for node (x, y) is F if the set does not exist. z =⊥, Decryption failed, define Lagrange parameters If the set exists, then calculate F according to formula 11. (x,y) : where i = index(z), S′ (x,y) = {index(z): z ∈ S (x,y)}, Next, F is calculated using formulas 12 and 13. L Obtain all levels k When (x) k ,y k When S is a level node of level k, and the set of attributes contained in S is a subset of the set of threshold gate nodes among the child nodes of the level node, F is recursively calculated using formula 13. (x,y),l This allows us to calculate the corresponding node for each level. Based on formulas 12 and 13 above, all levels k are recursively calculated. Then, the session key ck for all levels is calculated according to Formula 14. k : Sub-step 5-3: Query and decrypt the corresponding level of ciphertext. The client queries the IPFS network for AES ciphertext matching the corresponding level based on the CID and downloads it; finally, the client uses ck k AES ciphertext Decryption yields the plaintext identifier mapping data corresponding to the attribute level, and parsing is complete.

6. The blockchain-based multi-level identifier resolution method for the industrial internet according to claim 1, characterized in that, Step 6: Identifier Verification. When a user with level k completes identifier resolution and obtains... and AES encrypted data of lower rank. It calculates The Fabric identifies the hash of the identifier mapping data uploaded by the owner. For comparison, if V ′ =V proves that the integrity check was successful and the data is reliable; if V ′ If the value is ≠V, it proves that the integrity check failed and the data has been tampered with.

Images