Industrial Internet data access control method, device, equipment and medium

Abstract

The present invention discloses an industrial Internet data access control method, device, equipment and medium, which receives a data access request sent by a client, matches the access control policy according to the access client identifier and the accessed resource identifier, and directly returns an access denial error when it is determined that there is no matching access control policy, and obtains the URL link of the accessed resource from the state database according to the accessed resource identifier when it is determined that there is a matching access control policy. The present invention realizes fine-grained access control, data isolation and integrity protection, real-time communication and scalable access management.

Description

Technical Field

[0001] The present invention relates to the field of industrial data security, and in particular to an industrial Internet data access control method, device, equipment and medium. Background Art

[0002] The Industrial Internet is an information technology infrastructure and platform built on the basis of industrial systems, realizing the deep integration of industrial systems and the Internet. In the Industrial Internet environment, a large number of industrial equipment and the entire manufacturing process will generate massive amounts of data. These data involve many core intellectual property rights and sensitive information of enterprises, and the security and privacy protection of data are extremely important.

[0003] Most of the existing industrial Internet data access control and data privacy protection methods rely on centralized servers, which have single point failure problems. In addition, the granularity of industrial Internet data access permission control in existing technologies is relatively coarse, and it is impossible to achieve fine-grained and dynamic access control for different data subjects and different roles, which makes it difficult to meet the needs of industrial Internet security supervision. Summary of the invention

[0004] In view of this, the present invention provides an industrial Internet data access control method to solve the technical problem that the granularity of industrial Internet data access permission control in the prior art is relatively coarse and cannot achieve fine-grained dynamic access control for different data subjects and different roles.

[0005] According to a first aspect of the present invention, there is provided an industrial Internet data access control method, comprising:

[0006] Receive a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

[0007] Match the access control policy according to the access client ID and the accessed resource ID;

[0008] When it is determined that there is no matching access control policy, an access denied error is directly returned;

[0009] When it is determined that there is a matching access control policy, the URL link of the accessed resource is obtained from the state database according to the accessed resource identifier.

[0010] According to a second aspect of the present invention, there is provided an industrial Internet data access control device, comprising:

[0011] A receiving module, configured to receive a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

[0012] A matching module, used to match access control policies according to the access client identifier and the accessed resource identifier;

[0013] The execution module is used to directly return an access denial error when it is determined that there is no matching access control policy; when it is determined that there is a matching access control policy, obtain the URL link of the accessed resource from the state database according to the accessed resource identifier.

[0014] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned industrial Internet data access control method when executing the computer program.

[0015] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of the above-mentioned industrial Internet data access control method are implemented.

[0016] By means of the above technical scheme, the present invention provides an industrial Internet data access control method, device, equipment and medium, which receives a data access request sent by a client, matches the access control policy according to the access client identifier and the accessed resource identifier, and directly returns an access denial error when it is determined that there is no matching access control policy, and obtains the URL link of the accessed resource from the state database according to the accessed resource identifier when it is determined that there is a matching access control policy. The present invention realizes fine-grained access control, data isolation and integrity protection, real-time communication and scalable access management.

[0017] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, and to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0019] Figure 1 A schematic diagram of an application scenario of industrial Internet data access control provided in an embodiment of the present invention is shown;

[0020] Figure 2 A schematic diagram of a process flow of an industrial Internet data access control method provided in an embodiment of the present invention is shown;

[0021] Figure 3 A structural schematic diagram of an industrial Internet data access control device provided in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0022] The specific implementation of the present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0023] An industrial Internet data access control method provided by an embodiment of the present invention can be applied to Figure 1 In the Hyperledger Fabric blockchain scenario, sensors 1 to 3 are schematic representations of the source of industrial data (in actual applications, they are not limited to sensors, for example, enterprise MES, ERP and other systems can be connected), the generated data may include production data, equipment data, sensor data, etc. Sensors 1-3 may also be accessed through smart gateways, and subscription clients 1-3 correspond to access clients of different institutions or organizations, and perform permission verification of access control policies on different channels (channels in Hyperledger Fabric blockchain are private subnetworks that allow multiple parties to trade with each other securely and confidentially. Channels allow different users / participants (organizations) to form alliances through anchor nodes. Channel ledgers can only be accessed by organizations belonging to the channel).

[0024] In the Hyperledger Fabric blockchain network, the ledger consists of two different but related parts, namely the world state and the blockchain ledger. The world state refers to a database that stores a set of current values ​​(for example, LevelDB or CouchDB). Access control policies can be stored in the blockchain's state database (SDB). The blockchain ledger records every transaction that produces a state change. In the hyperledger, there is not only one blockchain, but a block network that can include multiple channels. A channel is a subnetwork (subledger) in a block network, and the smart contract (chaincode) loaded in the subledger has a world state. The data in the same chain code is in the same namespace. Hyperledger Fabric uses a public key infrastructure (PKI) to verify the behavior of all network participants. Transactions submitted by each node, network administrator, and user need to have a public certificate and private key to verify their identity. These identities must have a valid root of trust, which is issued by the CA as the authorized server in the network. In actual applications, transaction proposals are sent to endorsement peers, who simulate transactions and verify their correctness according to smart contracts. If endorsed, the endorsement peer signs it and sends it back to the client. The endorsed transactions are combined into blocks and then sent to the sorting service. The sorting service receives endorsed transactions from peer nodes, sorts them into blocks (creates blocks), and then broadcasts them to all peer nodes in the network (transacts blocks to each peer node). The sorting service uses a consensus algorithm to ensure that all nodes in the network agree on the order of blocks. This ensures the consistency of the ledgers between all nodes. The nodes check the validity of the digital signatures and endorsement policies of the blocks and the transactions they contain. If the blocks are valid, the transactions will be submitted to the ledger. The blockchain decentralization of hash blocks ensures data integrity. Configuring industrial Internet devices as direct blockchain nodes enhances data reliability, eliminates manual intervention and external system dependence. This method strengthens the integrity of industrial Internet of Things data and builds a secure and trusted environment. Hyperledger Fabric separates transaction execution and transactions. This split improves scalability and performance and reduces node workload. Unlike other blockchain designs, Hyperledger Fabric introduces parallel transaction processing to solve the non-deterministic problem of smart contracts, which brings higher throughput and lower latency. This approach promotes privacy, trust, scalability, and access control in secure IoT data systems, laying the foundation for secure information exchange while maintaining privacy and trust.

[0025] In such Figure 1In the scenario, the industrial Internet data access control method executed by the Hyperledger Fabric blockchain network receives a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier; matches the access control policy according to the access client identifier and the accessed resource identifier; when it is determined that there is no matching access control policy, directly returns an access denial error; when it is determined that there is a matching access control policy, the URL link of the accessed resource is obtained from the state database according to the accessed resource identifier, and the URL link of the accessed resource is equivalent to the subscription topic of MQTT, and the accessed resource can be an industrial Internet of Things device such as a sensor. The embodiment of the present invention realizes fine-grained access control, data isolation and integrity protection, real-time communication and scalable access management. The blockchain solution based on Hyperledger Fabric and MQTT solves these technical problems by combining technical means such as certificate mechanism, channel isolation, and smart contracts, and realizes fine-grained access control, data isolation and integrity protection, real-time communication and scalable access management.

[0026] The present invention is described in detail below through specific embodiments.

[0027] Embodiment 1

[0028] like Figure 2 As shown, an industrial Internet data access control method provided in an embodiment of the present invention includes:

[0029] Step 201: receiving a data access request sent by a client;

[0030] The data access request carries an access client identifier and an accessed resource identifier;

[0031] Step 202: Match the access control policy according to the access client identifier and the accessed resource identifier;

[0032] Wherein, step 202 may include:

[0033] Step 202-1: Call the smart contract chaincode through the chaincode interface, and obtain the client role and accessed resource attributes according to the client ID and accessed resource ID.

[0034] Step 202-2: Perform a permission check according to the client role and the accessed resource attributes and against the access control policy to determine whether the client has access rights;

[0035] In each interface of the chaincode, a permission check is performed against the access control policy definition to determine whether the caller has access rights, for example:

[0036] function auth(user,device,topic){

[0037] policy=getPolicyForDevice(device)

[0038] if! matchRole(user, policy.roles)){

[0039] return false

[0040] }

[0041] if! matchTopic(topic, policy.topics)){

[0042] return false

[0043] }

[0044] return true

[0045] }

[0046] In addition, the caller certificate needs to be passed when calling the chain code interface. The chain code determines the caller identity based on the certificate content. The certificate and user identity are bound in the Fabric network. Before step 202-2, it needs to include:

[0047] Authenticate the digital certificate (such as X.509 certificate) provided by the client, where the digital certificate is issued by the organization's certificate management center based on the organization's root certificate. An organization is set up for each type of participating entity, and each organization is assigned a root certificate. The digital certificate is automatically updated and maintained through the enterprise certificate management center.

[0048] Step 202-3: When the client has access rights, the access control policy is matched.

[0049] Step 203: When it is determined that there is no matching access control policy, an access denied error is directly returned;

[0050] Step 204: When it is determined that there is a matching access control policy, the URL link of the accessed resource is obtained from the state database according to the accessed resource identifier.

[0051] In order to implement the embodiment of the present invention, it is necessary to initialize and build the Hyperledger Fabric blockchain network in advance. Before step 201, the following steps are included:

[0052] Step 201-A: Generate certificates and key pairs, build a Hyperledger Fabric blockchain network, and set up channels and nodes;

[0053] Step 201-B: register the industrial Internet device in the Hyperledger Fabric blockchain network and assign a certificate to the device to complete device identity management;

[0054] Step 201-C: Generate access control policy and upload it to the Hyperledger Fabric blockchain network;

[0055] The access control policy is defined in JSON format and saved in the world state of the blockchain. The access control policy specifies access control rules such as devices, topics, and roles. An example of an access control policy is as follows:

[0056] {

[0057] "device1":{

[0058] "topics":["temp","humidity"],

[0059] "roles":["operator","manager"]

[0060] }

[0061] }

[0062] Step 201-D: deploying the smart contract chain code to a common node in the Hyperledger Fabric blockchain network, wherein the smart contract chain code is provided with a matching relationship between industrial Internet devices, topics, roles and access control policies;

[0063] The smart contract chaincode defines the business logic of access control, including interfaces such as device registration and subscription topic authorization. These interfaces will check the identity of the caller and determine whether they have access rights based on predefined policies.

[0064] Step 201-E: Set up an MQTT server to integrate the Hyperledger Fabric blockchain network with the MQTT server;

[0065] Step 201-F: publishing data to the MQTT server according to the set URL link of the accessed resource, wherein the accessed resource is an MQTT message queue publisher, and publishing data to the MQTT server according to the set URL link of the accessed resource.

[0066] Channels and organizational isolation are used to implement data privacy protection. The URL link of the accessed resource corresponds to the channel of the Hyperledger Fabric blockchain network, that is, different topics correspond to different channels, which effectively implements data isolation. The MQTT server is bound to a specific organization or access control policy through the Fabric channel. Publishers, subscribers, and publishing topics need to join the corresponding channels to build a topic-based isolation model.

[0067] Embodiment 2:

[0068] The existing Hyperledger Fabric blockchain network lacks a standard management and sharing mechanism for smart contracts, making it difficult for developers to search and reuse smart contracts, resulting in low efficiency. The command line operation of the existing Hyperledger Fabric blockchain network is complex and user-unfriendly, which increases the difficulty of using and deploying smart contracts. The Hyperledger Fabric blockchain network lacks a general interface similar to the REST API to call and execute chain codes, which limits integration with external applications, and cannot effectively compare and reuse the internal asset structure of smart contracts, and cannot be easily customized and secondary developed. In order to achieve the reusability, manageability and availability of smart contracts, a server for managing smart contract chain codes is added in the embodiment of the present invention, and an API interface is provided to respond to user queries, modifications, updates and other operations. To solve this technical problem, the step of deploying smart contract chain codes to ordinary nodes in the Hyperledger Fabric blockchain network in step 201-D includes:

[0069] Step 201-41, obtain the labels of all smart contract chain codes in the Hyperledger Fabric blockchain network and store them in the smart contract server, where the labels of the smart contract chain codes include the smart contract identifier, name, owner, description, platform type and basic authentication specification;

[0070] Among them, the label of the smart contract chain code can be in the following JSON format, as follows:

[0071] {

[0072] "id":"1",

[0073] "name":"ContractA" / / chain code name

[0074] "author":"AuthorA", / / chaincode developer

[0075] "uploaded":"2021-04-18", / / Chain code upload time

[0076] "description":"..." / / chain code description

[0077] "platform":"Hyperledger Fabric", / / The platform is specified as Hyperledger Fabric by default

[0078] "signature_policy":"MAJORITY", / / Signature policy

[0079] "chain_languages": [...] / / Development language Go or Nodejs

[0080] "app_languages":[...] / / Application development language

[0081] "versions":[...] / / version 号

[0082] }

[0083] Developers, i.e. users, can search for matching similar smart contract chain codes by searching the information in the above fields, which makes it easier for developers to reuse the development and then deploy it to the Hyperledger Fabric blockchain network with one click, greatly speeding up the development efficiency and deployment speed of smart contract chain codes.

[0084] Step 201-42, obtaining a query request for the smart contract chain code, and querying the corresponding smart contract chain code in the smart contract server, wherein the query request for the smart contract chain code carries the keyword in the label of the smart contract chain code;

[0085] Step 201-43: Generate a reusable smart contract chain code based on the queried smart contract chain code and deploy it to a common node in the Hyperledger Fabric blockchain network.

[0086] Among them, step 201-43 may specifically include:

[0087] Step 201-431, generate a reusable smart contract chain code according to the queried smart contract chain code;

[0088] Step 201-432, generating a first smart contract chain code according to the reusable smart contract chain code and the user modification instruction;

[0089] Step 201-433: automatically install and instantiate the first smart contract chain code on the Hyperledger Fabric blockchain node through the API interface.

[0090] This embodiment builds a smart contract management system and uses tags to record metadata information of smart contracts. A control interface is developed, and users can search, compare, upload and deploy smart contracts. A REST API interface is developed to connect to the blockchain network, such as querying and calling smart contracts. Users can search for similar smart contracts in the control interface, reuse or customize them, and deploy them to the blockchain.

[0091] Further, as Figure 1 The specific implementation of the method, the embodiment of the present invention provides an industrial Internet data access control device, such as Figure 3 As shown, the device comprises:

[0092] The receiving module 310 is used to receive a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

[0093] A matching module 320, used to match the access control policy according to the access client identifier and the accessed resource identifier;

[0094] The execution module 330 is used to directly return an access denial error when it is determined that there is no matching access control policy; when it is determined that there is a matching access control policy, obtain the URL link of the accessed resource from the state database according to the accessed resource identifier.

[0095] An embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0096] Receive a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

[0097] Match the access control policy according to the access client ID and the accessed resource ID;

[0098] When it is determined that there is no matching access control policy, an access denied error is directly returned;

[0099] When it is determined that there is a matching access control policy, the URL link of the accessed resource is obtained from the state database according to the accessed resource identifier.

[0100] In an embodiment of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0101] Receive a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

[0102] Match the access control policy according to the access client ID and the accessed resource ID;

[0103] When it is determined that there is no matching access control policy, an access denied error is directly returned;

[0104] When it is determined that there is a matching access control policy, the URL link of the accessed resource is obtained from the state database according to the accessed resource identifier.

[0105] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0106] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0107] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0108] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. An industrial Internet data access control method, characterized in that: include: Generate certificates and key pairs, build Hyperledger Fabric blockchain network, and set up channels and nodes; Register industrial Internet devices in the Hyperledger Fabric blockchain network and assign certificates to the devices to complete device identity management; Generate access control policies and upload them to the Hyperledger Fabric blockchain network; Deploy smart contract chain code to ordinary nodes in the Hyperledger Fabric blockchain network, wherein the smart contract chain code is provided with a matching relationship between industrial Internet devices, topics, roles and access control policies, and the deployment of smart contract chain code to ordinary nodes in the Hyperledger Fabric blockchain network specifically includes obtaining labels of all smart contract chain codes in the Hyperledger Fabric blockchain network and storing them in the smart contract server, wherein the labels of the smart contract chain code include smart contract identifier, name, owner, description, platform type and basic identity authentication specification; obtaining a query request for the smart contract chain code, and querying the corresponding smart contract chain code in the smart contract server, wherein the query request for the smart contract chain code carries the keywords in the label of the smart contract chain code; generating a reusable smart contract chain code according to the queried smart contract chain code, and deploying it to ordinary nodes in the Hyperledger Fabric blockchain network; Set up the MQTT server to integrate the Hyperledger Fabric blockchain network with the MQTT server; Publish data to the MQTT server according to the set URL link of the accessed resource, wherein the accessed resource is the MQTT message queue publisher; Receiving a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier; Call the smart contract chaincode through the chaincode interface, and obtain the client role and the accessed resource attribute according to the access client identifier and the accessed resource identifier; According to the client role and the accessed resource attributes, a permission check is performed against the access control policy to determine whether the client has access rights; When the client has access rights, the access control policy is matched; When it is determined that there is no matching access control policy, an access denied error is directly returned; When it is determined that there is a matching access control policy, a URL link of the accessed resource is obtained from a state database according to the accessed resource identifier, wherein the URL link of the accessed resource corresponds to a channel of the Hyperledger Fabric blockchain network.

2. The industrial Internet data access control method according to claim 1 is characterized in that: Before the step of performing permission check according to the client role and the accessed resource attribute and comparing the access control policy, the method includes: The digital certificate provided by the client is authenticated, wherein the digital certificate is issued by the organization's certificate management center based on the organization's root certificate, an organization is set up for each type of participating entity, and each organization is assigned a root certificate. The digital certificate is automatically updated and maintained through the enterprise certificate management center.

3. According to the industrial Internet data access control method of claim 1, the step of generating a reusable smart contract chain code based on the queried smart contract chain code and deploying it to a common node in the Hyperledger Fabric blockchain network comprises: Generate reusable smart contract chain code based on the queried smart contract chain code; Generate a first smart contract chain code according to the reusable smart contract chain code and the user modification instruction; The first smart contract chain code is automatically installed and instantiated on the Hyperledger Fabric blockchain node through the API interface.

4. An industrial Internet data access control device, characterized in that: include: A receiving module is used to receive a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier. Before receiving the data access request sent by the client, it includes generating a certificate and a key pair, building a Hyperledger Fabric blockchain network, setting channels and nodes; registering industrial Internet devices in the Hyperledger Fabric blockchain network and assigning certificates to the devices to complete device identity management; generating access control policies and uploading them to the Hyperledger Fabric blockchain network; deploying smart contract chain codes to ordinary nodes in the Hyperledger Fabric blockchain network, wherein the matching relationship between industrial Internet devices, topics, roles and access control policies is set in the smart contract chain code, and the deployment of smart contract chain codes to ordinary nodes in the Hyperledger Fabric blockchain network specifically includes obtaining Hyperledger The tags of all smart contract chain codes in the Fabric blockchain network are stored in the smart contract server, where the tags of the smart contract chain codes include smart contract identifiers, names, owners, descriptions, platform types, and basic authentication specifications; a query request for the smart contract chain code is obtained, and the corresponding smart contract chain code is queried in the smart contract server, where the query request for the smart contract chain code carries the keywords in the tags of the smart contract chain code; a reusable smart contract chain code is generated based on the queried smart contract chain code, and deployed to a common node in the Hyperledger Fabric blockchain network; an MQTT server is set to realize the integration of the Hyperledger Fabric blockchain network and the MQTT server; data is published to the MQTT server according to the URL link of the accessed resource set, where the accessed resource is an MQTT message queue publisher; A matching module is used to call the smart contract chain code through the chain code interface, obtain the client role and the accessed resource attribute according to the access client identifier and the accessed resource identifier; perform a permission check against the access control policy according to the client role and the accessed resource attribute to determine whether the client has access rights; and match the access control policy when the client has access rights; The execution module is used to directly return an access denied error when it is determined that there is no matching access control policy; when it is determined that there is a matching access control policy, obtain a URL link of the accessed resource from the state database according to the accessed resource identifier, wherein the URL link of the accessed resource corresponds to a channel of the Hyperledger Fabric blockchain network.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the industrial Internet data access control method as described in any one of claims 1 to 3 are implemented.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the industrial Internet data access control method as described in any one of claims 1 to 3 are implemented.

Images