Power credit data security access control method and system based on blockchain

Abstract

The present disclosure provides a blockchain-based power credit data security access control method and system, which relates to the field of blockchain technology. By combining authorization authentication with proxy re-encryption, the data subject's control over the use of the owned data is guaranteed, and the deterministic update of third-party access rights can be flexibly achieved. In addition, by combining attribute encryption with third-party data access rights, the data access scope of the data user can be flexibly adjusted based on the attribute list, meeting the user's fine-grained data access control needs, thereby achieving high data access efficiency while ensuring the security of power data access.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain technology, and in particular to a method and system for secure access control of power credit data based on blockchain. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] With the advancement of new power systems and electricity spot markets, user electricity bill payment records can serve as key information for assessing user creditworthiness, thereby facilitating the development of services such as "Electricity e-Loan" and "Electricity e-Invoice." However, cross-system and even cross-domain data sharing often presents significant data security risks. Therefore, implementing secure access control and authorized updates for electricity user credit assessment data has become a pressing issue. Blockchain technology plays a crucial role in the ongoing development of new infrastructure, including information infrastructure, which provides a solid foundation and guarantee for the pilot and development of the "Blockchain + Energy Internet" model. Blockchain technology integrates cryptography, consensus protocols, and smart contracts. By encapsulating data into a time-series blockchain table structure and broadcasting it across network nodes, it ensures the immutability of historical block data. Blockchain-based systems can overcome challenges in data exchange and collaborative business processing between different departments and even different domains, thereby enhancing data sharing.

[0004] However, blockchain technology itself has certain flaws. In particular, storing data in a distributed, shared global ledger makes it difficult to achieve a balance between privacy protection and usability. Furthermore, as data owners, electricity users must fully safeguard their ownership and control over their data. Therefore, secure access to on-chain data, control over permission grants, and dynamic adjustments are urgently needed. Furthermore, full nodes in a blockchain network need to back up transaction data across the entire network. As electricity users increasingly share payment records, the flexible and efficient storage of on-chain data presents a challenge in practical applications. Summary of the Invention

[0005] In order to solve the above problems, the present disclosure proposes a blockchain-based power credit data security access control method and system. By combining authorization authentication with proxy re-encryption, the data subject's control over the use of the owned data is guaranteed, and the deterministic update of third-party access rights can be flexibly achieved. In addition, by combining attribute encryption with third-party data access rights, the data access scope of the data user can be flexibly adjusted based on the attribute list, meeting the user's fine-grained data access control needs, thereby achieving high data access efficiency while ensuring the security of power data access.

[0006] According to some embodiments, the present disclosure adopts the following technical solutions:

[0007] The blockchain-based power credit data security access control method includes:

[0008] The authorization manager requests the data owner to obtain data authorization permission, and the data user sends a data access request to the data owner and sends its own attribute list to the data owner and the authorization manager;

[0009] The data owner sends their own re-encryption key to the authorization manager as authorization authentication. After receiving the dual authorization authentication from the data owner, the authorization manager verifies the re-encryption key based on the public and private key pair of the data owner stored in the manager, and updates the authorization list based on the verification result.

[0010] The data owner encrypts the electricity user credit assessment data to form an initial encrypted ciphertext, and sends the initial encrypted ciphertext and all re-encryption keys to the blockchain network. The distributed data processing nodes in the blockchain network obtain this authorized transaction according to the incentive mechanism, and respond to or reject the smart contract. The final data user decrypts the re-encrypted electricity user credit assessment data in the smart contract based on the execution process after responding to the smart contract, and obtains the plaintext of the electricity user's credit assessment data.

[0011] According to some embodiments, the present disclosure adopts the following technical solutions:

[0012] The blockchain-based power credit data security access control system includes:

[0013] Authorization module, used to authorize managers to request data authorization permissions from data owners, and data users to send data access requests to data owners and send their own attribute lists to the data owners and authorization managers;

[0014] The data owner sends their own re-encryption key to the authorization manager as authorization authentication. After receiving the dual authorization authentication from the data owner, the authorization manager verifies the re-encryption key based on the public and private key pair of the data owner stored in the manager, and updates the authorization list based on the verification result.

[0015] The access control module is used for the data owner to encrypt the power user credit assessment data to form an initial encrypted ciphertext, and send the initial encrypted ciphertext and all re-encryption keys to the blockchain network. The distributed data processing nodes in the blockchain network obtain this authorized transaction according to the incentive mechanism, and respond to or reject the smart contract. The final data user decrypts the re-encrypted power user credit assessment data in the smart contract based on the execution process after responding to the smart contract, and obtains the plaintext of the power user's credit assessment data.

[0016] Compared with the prior art, the present invention has the following beneficial effects:

[0017] In the blockchain-based power credit data security access control method disclosed in the present invention, in response to the problems of the growing demand for sharing power credit assessment data and the difficulty in flexible changes in authorization and authentication, double re-encryption technology is adopted. When the access authorization is changed, there is no need to re-encrypt the power user's power credit assessment data. Only the re-encryption key needs to be calculated to complete the data access control update. In addition, the access control update must obtain the authentication of the data owner's double encryption key, fully protecting the data subject's ownership and use control over the data.

[0018] In response to the need for dynamic adjustment of access to power credit assessment data, an attribute-based encryption scheme is adopted. The data owner formulates the access control policy for data users based on all attributes, and according to the data users' data access needs, screens attributes to determine the data access range of their data users' keys to meet the fine-grained data access control needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which constitute a part of the present disclosure, are used to provide a further understanding of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation to the present disclosure.

[0020] Figure 1 This is a flowchart of the blockchain-based power user credit assessment data access control in an embodiment of the present disclosure;

[0021] Figure 2 A comparison chart of the timeliness of access authorization control according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0022] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0023] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present disclosure belongs.

[0024] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0025] Example 1

[0026] In one embodiment of the present disclosure, a blockchain-based power credit data security access control method is provided. In the present disclosure, power users and power companies are the owners of power user credit assessment data, i.e., data owners; third-party institutions are the users of power user credit assessment data, i.e., data users; and authorized managers are responsible for data rights management. The following specifically describes the blockchain-based power credit data security access control method from the perspectives of power users and power companies, third-party institutions, and authorized managers. The specific implementation process includes:

[0027] Step 1: As the owners of the credit assessment data of electricity users, the power users and power companies authorize the administrator to send registration information and distribute public and private key pairs to the power users and power companies;

[0028] Specifically, the authorized administrator sends registration information to power user A and power company B and distributes public and private key pairs;

[0029] The authorized manager registers power user A and power company B, randomly selects the security parameter κ, and obtains the prime numbers p, q, E, and G of κ bits;

[0030] Where p represents the size of the finite field; E represents the function defined in the finite field F. p The elliptic curve on E, P is a point on the elliptic curve E, and it is used as the generator of the group G, G is a q-order multiplicative cyclic group;

[0031] Define a set of hash functions H1, H2, H3, H4, where H1: {0, 1} * →{0,1} l , H3: {0,1} * →G, H4: {0,1} * →G, so the published parameters are pp = {p, q, E, G, P, H1, H2, H3, H4};

[0032] in, represents the value range of the multiplication cyclic group, and q represents the order of the multiplication cyclic group;

[0033] The authorized manager selects a random number based on the public parameter pp

[0034] Generate a public-private key pair for power user A: private key sk A =x A , public key pk A =x A P;

[0035] Generate the public and private key pair of Power Company B: private key sk B =x B , public key pkB =x B P;

[0036] The authorized administrator sends the generated public and private key pairs to power user B and power company A respectively.

[0037] Step 2: As the user of electricity user credit assessment data, the third-party agency sends data access requests to the electricity user and the power company respectively. At the same time, the third-party agency sends its own attribute list to the power company and the authorized manager.

[0038] Step 3: The authorized administrator registers and sends to the third-party organization a public-private key pair containing the attributes in its own attribute list, where its private key is the encrypted private key ciphertext;

[0039] Specifically, the authorized administrator registers and sends to the third-party organization D a public-private key pair containing the attributes in its own attribute list, where its private key is the encrypted private key ciphertext, including:

[0040] Step 31. The authorized manager randomly selects the third party organization D based on the attribute list L sent by the power company B.

[0041] Step 32. For any t∈{1,2,…,ξ}, calculate the group according to the attribute list L of the third-party organization D. D1=g r , let D t = <d0>,in

[0042] Where n is the number of system attributes, ξ is the number of attributes in the attribute set of the third-party organization, and α represents a terminal node. There exists t∈{1,2,…,ξ} such that L t ={l t,1 ,l t,2 ,…,l t,k }For any i∈{1,2,…,k}, Indicates that the attribute set of the third-party organization satisfies the access policy of the end node α.

[0043] Step 33. Output the third-party institution private key The public key of the third-party organization is pk L =sk L P.

[0044] Step 34. The authorized manager customizes the access policy W based on the data access requirements of the third-party organization and the attribute values ​​in the attribute list provided by the third-party organization, and encrypts the third-party organization's private key sk L After that, send the public key pair to the third party in is the private key sk L The ciphertext:

[0045] Furthermore, ① the authorized administrator customizes the access policy W based on the data access requirements of the third-party organization and the attribute values ​​in the attribute list provided by the third-party organization, and constructs the access tree T. The construction process is as follows:

[0046] Based on the attributes in the attribute list provided by the third party, the attribute set is defined as A={A1,A2,…,A n }, n is the number of total attributes. Attribute A i The value set of ∈A is n i Represents attribute A i The number of values ​​of ∈A. The attribute set of the third-party organization is L={l1,l2,…,l n }={L1,L2,…,L ξ }, where l i ∈A i . Assume that the access structure of a terminal node α is expressed as There exists t∈{1,2,…,ξ} such that L t ={l t,1 ,l t,2 ,…,l t,k }For any i∈{1,2,…,k}, The attribute set of the third-party organization is said to satisfy the access policy of the end node α.

[0047] ② Random selection of authorized managers As the secret value to be shared, according to the secret sharing value s and the access tree T, the secret sharing value of the end node α can be obtained as

[0048] ③ Assume that the access structure of the third-party organization is W α ,calculate Get the ciphertext C of the end node α α = <C0,C1,Γ α >.

[0049] ④ Encrypt the third-party institution’s private key skL, C = sk L ·Y s .

[0050] ⑤ Output the ciphertext of the third-party organization’s private key

[0051] Step 4: The power user and the power company send their respective re-encryption keys to the authorization manager as authorization verification;

[0052] Specifically, in step 41, the power company generates a proxy re-encryption key using the power company private key and the power user public key;

[0053] Power company B constructs the proxy re-encryption key parameter for power user A, namely β B→A ={x B pk B ,x B pk A The power company uses the proxy re-encryption key parameter β B→A And the authorization parameter χ defined by itself B , calculate the proxy re-encryption key rk for power user A B→A Upload to the blockchain network, i.e.

[0054]

[0055] Step 42. The proxy re-encryption key rk generated by the power company B→A Sent to the authorized manager as the authorization certificate for the power company to authorize the third-party agency D;

[0056] Step 43. The power user generates a proxy re-encryption key using its own private key and the third-party institution's public key;

[0057] Electricity user A constructs the proxy re-encryption key parameter for the third-party agency D, namely β A→L ={x A pk A ,x A pk L Power user based proxy re-encryption key parameter β A→L And the authorization parameter χ defined by itself A , calculate the proxy re-encryption key rk for the third-party organization D A→L Upload to the blockchain network, i.e.

[0058]

[0059] Step 44. The power user generates the proxy re-encryption key rk A→L Sent to the authorization manager as the authorization certificate for the power user to authorize the third-party agency.

[0060] Step 5: After receiving the dual authentication from the power user and the power company, the authorization manager performs re-encryption key verification based on the public and private key pairs of the power user and the power company stored by the manager. If the re-encryption keys are consistent, the third-party organization is added to the authorization list. If either the power user or the power company needs to delete the access rights of the third-party organization, either party sends an application to the other party and the authorization manager. After receiving the application, the other party encrypts the re-encryption key with its own private key and sends it to the authorization manager. The authorization manager performs verification based on the stored re-encryption key and private key. If the verification results are consistent, the access rights of the corresponding third-party organization in the authorization list are deleted. This allows the authorization list to be flexibly updated based on dual authorization authentication.

[0061] In a specific embodiment, electricity user A and power company B serve as joint data owners. Electricity user A only has access to his or her own electricity bill payment data and electricity credit assessment data, while power company B has access to the electricity bill payment data and electricity credit assessment data of all electricity users in the power supply area. Third-party institution D, as a user of electricity credit assessment data, must obtain authorization from electricity user A and power company B before obtaining access to electricity credit assessment data. The distributed data processing nodes on the blockchain store the electricity user credit assessment ciphertext data and re-encryption keys, and decide whether to double-encrypt the initial ciphertext of the electricity user credit assessment data and send it to third-party institution D based on the verification results of the authorization management node. Table 1 shows an example of updating the authorization list in this embodiment:

[0062] Table 1 Authorization list update example

[0063]

[0064] As shown in Table 1, electricity users A1 and A2 and third-party organizations D1, D2, and D3 are initially defined. Based on specific business data access requirements such as "Electricity e-Loan" and "Electricity e-Invoice," third-party organizations D1 and D2 require access to A1's electricity credit assessment data, while third-party organization D3 requires access to A2's electricity credit assessment data. If only A1 and power company B authorize third-party organizations D1 and D2 for A1's electricity credit assessment data, then D1 and D2 can access and obtain A1's electricity credit assessment data. Third-party organization D3, which is unauthorized or has only received authorization from the power company, can only see the encrypted electricity credit assessment data for A1. When a new third-party organization D4 needs to access blockchain-based electricity credit assessment data, it needs access to the electricity credit assessment data of both A1 and A3. D4 can interact with power company B, A1, A3, and the blockchain authorization administrator to update the authorization list L, thereby enabling quick updates to electricity credit data access control. The specific steps are as follows.

[0065] Step 51. Power company B and power user A1 must both authorize third-party institution D4 to access power user A1's power credit assessment data. Power company B and power user A3 must both authorize third-party institution D4 to access power user A3's power credit assessment data. The power company constructs the corresponding re-encryption key. Sent to the authorized administrator, power user A1 constructs the corresponding re-encryption key Sent to the authorized manager and power user A3 to construct the corresponding re-encryption key The blockchain authorization manager verifies the re-encryption key obtained, that is, generates a re-encryption key based on the public and private key pairs of B, A1, and A3 stored by the authorization manager. If the re-encryption key is consistent with the received key, the authorization list L is updated after verification, and the third-party agency D4 in the authorization list is added to the authorization list to authorize the access rights to the power credit assessment data of power users A1 and A3.

[0066] Step 52. During the authorization list update process, if Power Company B needs to cancel the access permission of the third-party agency D4 to the power credit assessment data of Power User A1, Power Company B sends a cancellation application to the authorization management agency and Power User A1, and Power User A1 sends the encrypted version of its own private key. To the authorized manager, the authorized manager can access the stored The data is encrypted with the private key of A1 and the consistency is verified with the data sent by the power user A1. If they are consistent, the access right of the third-party agency D4 to the power credit assessment data of the power user A1 is deleted from the authorization list, thereby effectively protecting the power user A1's right to use and control the electricity consumption data.

[0067] Step 6: The power company uses the power company's public key to encrypt the power user's credit assessment data to form an initial encrypted ciphertext, and sends the power user's credit assessment initial encrypted ciphertext and the re-encryption key generated by the power company obtained in step 4 to the blockchain network;

[0068] Specifically, the initial encryption of electricity user credit assessment data: Encrypt(M,pk B )→C B The power company uses its own public key pk B Encrypt message M, the length of M is l, select a random number i∈G, and the initial encryption operation of the plaintext is as follows:

[0069] r=H2(i) (3)

[0070] C1=rP=(x0,y0) (4)

[0071] rpk B =(x B ,y B ) (5)

[0072] t=H1(x B ||y B ) (6)

[0073]

[0074] C3=H3(x B ||M||y B ) (8)

[0075] C4=H4(M||C1||C3) (9)

[0076] C B =(C1, C2, C3, C4) (10)

[0077] The initial encrypted ciphertext C after the initial encryption of the power user credit assessment data B The re-encryption key generated by the power company obtained in step 41 is uploaded to the blockchain for broadcasting.

[0078] Step 7: The power user's re-encryption key rk generated in step 43 A→L Send to the blockchain network;

[0079] Step 8: The distributed data processing node in the blockchain network obtains this transaction according to the incentive mechanism and sends a third-party authority verification request to the authorization manager. The authorization manager verifies the identity of the third-party organization according to the authorization list and sends feedback verification information to the distributed data processing node;

[0080] Obtain the distributed data processing node in the blockchain network of this transaction, send a third-party agency permission verification request to the authorization manager, and the authorization management node checks whether the third-party agency D has access rights according to the authorization list L. If the third-party agency D is not in the authorization list L, it sends a message to the distributed data processing node that the third-party agency D does not have access rights; if the third-party agency D exists in the authorization list L, it sends a verification message to the distributed data processing node;

[0081] Step 9: If the third party does not have access rights, the distributed data processing node refuses to respond to the smart contract and generates an access rejection record, which is played to the blockchain network. If the third party has access rights, the distributed data processing node responds to the smart contract and enters step 10. At the same time, the authorized administrator removes the access structure W and decryption parameter χ of the leaf node. A Send to third-party agency D;

[0082] Step 10: The distributed data processing node re-encrypts the initial encrypted ciphertext using the re-encryption key generated by the power company and the re-encryption key generated by the power user, generating a double-encrypted power user credit assessment ciphertext that can be decrypted by the private key of the third-party institution;

[0083] Specifically, step 101. The distributed data processing node uses the re-encryption key rk generated by the power company according to the smart contract B→A For the initial encrypted ciphertext C B Re-encrypt to generate the power user credit assessment re-encrypted ciphertext C that can be decrypted by the power user's private key A ;

[0084] The distributed data processing nodes in the blockchain network initially encrypt the ciphertext C of the electricity user credit assessment data. B The proxy re-encryption is calculated as follows:

[0085] C1′=C1 (11)

[0086]

[0087] C′3=C3 (13)

[0088] C′4=C4 (14)

[0089] C A =(C1′,C2′,C3′,C4′) (15)

[0090] Step 102. The distributed data processing node uses the re-encryption key rk generated by the power user A→L Re-encrypt the ciphertext C for the credit assessment of electricity users A Perform secondary re-encryption to generate a double-encrypted ciphertext C′ of the power user credit assessment that can be decrypted by the private key of a third-party institution;

[0091] The distributed data processing nodes in the blockchain network re-encrypt the ciphertext C for the credit assessment of electricity users A The proxy re-encryption is calculated as follows:

[0092] C1″=C1′ (16)

[0093]

[0094] C″3=C3′ (18)

[0095] C4″=C4′ (19)

[0096] C′=(C1″, C2″, C3″, C4″) (20)

[0097] Step 11: The distributed data processing node sends the double-encrypted electricity user credit assessment ciphertext C′ to the third-party agency D. After completion, the transaction record is broadcast to the entire network;

[0098] Step 12: The third party agency obtains the access structure without the leaf nodes and the private key ciphertext of the third-party organization Combined with the attributes in the attribute list provided to the power company, the private key ciphertext of the third party agency Decrypt and obtain the private key sk L Then, combined with the decryption parameter χ A The double-encrypted power user credit assessment ciphertext C′ is decrypted to obtain the power user's credit assessment data plaintext M.

[0099] Specifically, step 121. The third party agency obtains the access structure of the leaf node and private key ciphertext Combined with the attributes in the attribute list provided to the power company, the encrypted private key ciphertext Decrypt and obtain the private key

[0100] Third-party agency D based on For the terminal internal node α in the , the decryption function is defined as:

[0101]

[0102] for For other internal nodes β in , Child(β,i) represents the child node of β with sequence number i, Op(β) represents the relationship represented by β, and the decryption function is defined as:

[0103]

[0104] Among them, μ is the number of child nodes of node β, θ is the threshold value, Δ i,x (0) is the Lagrange interpolation function.

[0105] ① Calculate the secret value of each terminal internal node:

[0106]

[0107] If the attribute list of the third-party organization D satisfies the attribute expression of each leaf node in node α, then the verification is passed. Get Φ α =1; otherwise Φ α is a random value. Since the verification process is performed on an internal node basis, the third-party organization D cannot confirm the specific attribute value that satisfies the policy.

[0108] ② Bring in the secret value of each terminal internal node and perform recursive calculation on the internal nodes. If the organizational structure of the access tree is satisfied, the secret value of the root node Root(T) of the access tree T can be obtained: Decnode(Root(T)) = e(G, G) s .

[0109] ③Calculate the key plaintext

[0110] Step 122. The third party agency decrypts the parameter x A And the decrypted private key sk L , decrypt the double-encrypted power user credit assessment ciphertext C′ to obtain the power user's credit assessment data M. The calculation process is as follows:

[0111]

[0112] k=H4(M″||C1″||C3″) (25)

[0113] If k=C4″, then M=M″, and the third-party agency D obtains the plaintext M of the electricity user credit assessment data that it can access.

[0114] In order to illustrate the performance of the method disclosed in the present invention, a third-party agency D1 and a third-party agency D2 are selected to access the credit assessment data of the same batch of different electricity users in turn, and the access timeliness is compared by changing the size of the plaintext of the electricity credit assessment data of the electricity users. In the embodiments, 128B, 512B, and 1024B are taken respectively, and the access request frequency of the third-party agency D1 to the electricity credit assessment data of different electricity users gradually increases from 100 pieces / s. After reaching the highest access request frequency of 1000 pieces / s, the access request frequency of the third-party agency D2 to the electricity credit assessment data of the same batch of different electricity users is increased, and also gradually increases from 100 pieces / s to the highest access request frequency of 1000 pieces / s. The keys are all 256 bits, as shown in FIG. Figure 2 The comparison of access timeliness of the patented method and that of the traditional method is shown.

[0115] Since the decryption phase is performed on the local server equipment of the third-party organization, it does not occupy the resources of the prototype of the electricity bill collection risk analysis and credit assessment simulation system based on blockchain technology, so it is not included in the access time. The data access time of the embodiment is the average of 100 runs of the encryption phase, such as Figure 2 As shown, when the initial third-party agency D1 accesses the electricity credit assessment data of different electricity users, the disclosed method includes plaintext encryption, key re-encryption part and data chaining, and the traditional method includes plaintext encryption, dual authorization authentication and data chaining. The embodiment time shows that the disclosed method and the traditional method take similar time in the encryption stage. When the newly added third-party agency D2 sends an access request to the electricity credit assessment data of the same batch of different electricity users, the disclosed method only includes the key re-encryption part, updating the authorization list and re-encryption key data chaining, while the traditional method still includes plaintext encryption, dual authorization authentication and ciphertext data chaining. Therefore, the blue part represented by the disclosed method takes less time. When there are 1000 data access requests per second, it only takes 0.8 seconds to complete the access control processing of the electricity user credit assessment data, which is negligible compared to the traditional method. Therefore, the overall encryption time of the disclosed method is short and the computational overhead is small, which can realize the access control and dynamic change of the credit assessment data of electricity users obtained by third-party agencies based on blockchain technology.

[0116] Example 2

[0117] In one embodiment of the present disclosure, a blockchain-based power credit data security access control system is provided, comprising:

[0118] Authorization module, used to authorize managers to request data authorization permissions from data owners, and data users to send data access requests to data owners and send their own attribute lists to the data owners and authorization managers;

[0119] The data owner sends their own re-encryption key to the authorization manager as authorization authentication; after receiving the dual authorization authentication of the data owner, the authorization manager verifies the re-encryption key based on the public and private key pair of the data owner stored in its own storage, and updates the authorization list according to the verification result; the access control module is used for the data owner to encrypt the power user credit assessment data to form an initial encrypted ciphertext, and send the initial encrypted ciphertext and all re-encryption keys to the blockchain network. The distributed data processing nodes in the blockchain network obtain this authorization transaction according to the incentive mechanism, and respond to or reject the smart contract. Finally, the data user decrypts the re-encrypted power user credit assessment data in the smart contract based on the execution process after responding to the smart contract, and obtains the plaintext of the power user's credit assessment data.

[0120] Specifically, the above system specifically performs the following method steps:

[0121] A. As the owners of electricity user credit assessment data, electricity users and power companies authorize the administrator to send registration information and distribute public and private key pairs to electricity users and power companies;

[0122] B. As the user of electricity user credit assessment data, the third-party agency sends data access requests to the electricity user and the power company respectively, and at the same time sends its own attribute list to the power company;

[0123] C. The authorized administrator registers and sends to a third-party organization a public-private key pair containing the attributes in its own attribute list, where its private key is the encrypted private key ciphertext;

[0124] D. The power user and the power company send their respective re-encryption keys to the authorized manager as authorization verification. At the same time, the power company sends the attribute list of the third-party organization to the authorized manager.

[0125] E. After receiving dual authentication from the power user and the power company, the authorization manager performs re-encryption key verification based on the public and private key pairs of the power user and the power company stored by the manager. If the re-encryption keys are consistent, the third-party organization is added to the authorization list. If either the power user or the power company needs to delete the access rights of the third-party organization, either party sends a request to the other party and the authorization manager. After receiving the request, the other party encrypts the re-encryption key with its own private key and sends it to the authorization manager. The authorization manager performs verification based on the stored re-encryption key and private key. If the verification results are consistent, the access rights of the corresponding third-party organization in the authorization list are deleted. This allows the authorization list to be flexibly updated based on dual authorization authentication.

[0126] F. The power company uses the power company's public key to encrypt the power user's credit assessment data to form an initial encrypted ciphertext, and sends the power user's credit assessment initial encrypted ciphertext and the re-encryption key generated by the power company obtained in step D to the blockchain network;

[0127] G. The power user sends the re-encryption key generated in step D to the blockchain network;

[0128] H. The distributed data processing node in the blockchain network obtains this transaction based on the incentive mechanism, sends a third-party authority verification request to the authorization manager, and the authorization manager verifies the identity of the third-party organization based on the authorization list and sends feedback verification information to the distributed data processing node;

[0129] I. If the third-party organization does not have access rights, the distributed data processing node refuses to respond to the smart contract and generates an access denial record, which is broadcast to the blockchain network. If the third-party organization has access rights, the distributed data processing node responds to the smart contract and proceeds to step J. The authorized administrator also sends the access structure and decryption parameters, excluding the leaf nodes, to the third-party organization.

[0130] The smart contract is the data processing code of step J;

[0131] J. The distributed data processing node re-encrypts the initial encrypted ciphertext using the re-encryption key generated by the power company and the re-encryption key generated by the power user, generating a double-encrypted power user credit assessment ciphertext that can be decrypted by the private key of a third-party institution;

[0132] K. The distributed data processing node sends the double-encrypted electricity user credit assessment ciphertext to a third-party agency, and after completion, broadcasts the transaction record to the entire network;

[0133] L. The third-party agency decrypts the private key ciphertext of the third-party agency based on the obtained access structure excluding the leaf nodes and the private key ciphertext of the third-party agency, combined with the attributes in the attribute list provided to the power company. After obtaining the private key, the third-party agency decrypts the doubly encrypted power user credit assessment ciphertext in combination with the decryption parameters, thereby obtaining the credit assessment data plaintext of the power user.

[0134] In step C, the authorized administrator registers and sends to the third party a public-private key pair containing the attributes in its own attribute list, where its private key is the encrypted private key ciphertext. The specific process is:

[0135] C1. The authorized manager randomly selects a parameter based on the attribute list of the third-party agency sent by the power company;

[0136] C2. For any third-party organization's attributes, group the access values ​​corresponding to different end nodes according to the third-party organization's attribute list, and obtain the access policy of the end nodes that the third-party organization's attribute set satisfies;

[0137] C3. Output the third-party institution's private key and public key based on the access policy of the end node satisfied by the third-party institution's attribute set;

[0138] C4. The authorized administrator customizes the access policy based on the third-party organization's data access requirements and the attribute values ​​in the attribute list provided by the third-party organization. After encrypting the third-party organization's private key, the administrator sends the public key pair to the third-party organization, where the private key is the ciphertext of the private key.

[0139] In step D, the power user and the power company send their respective re-encryption keys to the authorized manager as authorization authentication, and the power company sends the attribute list of the third-party organization to the authorized manager. The specific process is as follows:

[0140] D1. The power company generates a proxy re-encryption key using the power company's private key and the power user's public key.

[0141] D2. The proxy re-encryption key generated by the power company is sent to the authorization administrator as the authorization certificate for the power company to authorize the third-party organization.

[0142] D3. The electricity user uses its own private key and the third-party institution's public key to generate a proxy re-encryption key;

[0143] D4. The proxy re-encryption key generated by the power user is sent to the authorization manager as the authorization certificate for the power user to the third-party organization;

[0144] In step E, the authorization list is flexibly updated based on the dual authorization authentication. The specific process is:

[0145] E1. The blockchain authorization manager verifies the received re-encryption key. This means generating a re-encryption key based on the public-private key pair stored by the authorization manager. If the re-encryption key is consistent with the received key, the authorization list is updated after verification, adding the third-party organization's access authorization to the power user's power credit assessment data.

[0146] E2. During the authorization list update process, if the power company needs to revoke a third-party agency's access rights to a specific power user's electricity credit assessment data, the power company will send a cancellation request to the authorization management agency and the specific power user. The specific power user will use its own private key to encrypt the re-encryption key generated by the corresponding third-party agency and send it to the authorization manager. The authorization manager will encrypt the stored re-encryption key and the power user's private key in the same way and verify the consistency with the data sent by the power user. If they are consistent, the third-party agency's access rights to the specific power user's electricity credit assessment data will be deleted from the authorization list, effectively protecting the power user's right to use and control electricity usage data.

[0147] In step J, the distributed data processing node re-encrypts the initial encrypted ciphertext using the re-encryption key generated by the power company and the re-encryption key generated by the power user, generating a double-encrypted power user credit assessment ciphertext that can be decrypted by the private key of a third-party institution. The specific process is as follows:

[0148] J1. The distributed data processing node re-encrypts the initial encrypted ciphertext using the re-encryption key generated by the power company according to the smart contract, generating a re-encrypted ciphertext of the power user's credit assessment that can be decrypted by the power user's private key.

[0149] J2. The distributed data processing node re-encrypts the re-encrypted ciphertext of the power user's credit assessment using the re-encryption key generated by the power user, generating a double-encrypted ciphertext of the power user's credit assessment that can be decrypted by the third-party institution's private key.

[0150] In step L, the third-party institution decrypts the private key ciphertext based on the obtained access structure excluding the leaf nodes and the third-party institution's private key ciphertext, combined with the attributes in the attribute list provided to the power company. After obtaining the private key, the third-party institution decrypts the double-encrypted power user credit assessment ciphertext in combination with the decryption parameters, thereby obtaining the power user's credit assessment data in plain text. The specific process is as follows:

[0151] L1. The third party decrypts the private key ciphertext based on the obtained access structure excluding leaf nodes and the private key ciphertext, combined with the attributes in the attribute list provided to the power company, to obtain the private key.

[0152] L2. The third-party organization decrypts the double-encrypted electricity user credit assessment ciphertext based on the decryption parameters and the decrypted private key, thereby obtaining the electricity user's credit assessment data plaintext.

[0153] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0155] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Those skilled in the art should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A blockchain-based power credit data security access control method, characterized in that: include: The authorization manager requests the data owner to obtain data authorization permission. The data user sends a data access request to the data owner and sends its own attribute list to the data owner and the authorization manager. The authorization manager registers and sends to the data user a public-private key pair containing the attributes in its own attribute list, where the private key is the encrypted private key ciphertext. The data owner sends their own re-encryption key to the authorization manager as authorization authentication. After receiving the dual authorization authentication from the data owner, the authorization manager verifies the re-encryption key based on the public and private key pair of the data owner stored in the manager, and updates the authorization list based on the verification result. The process of updating the authorization list includes: performing re-encryption key verification. If the re-encryption keys are consistent, the data user is added to the authorization list. If any data owner needs to delete the data user's access rights, the data owner sends an application to other data owners and authorization managers. After receiving the application, the other data owners encrypt the re-encryption key with their own private key and send it to the authorization manager. The authorization manager verifies based on the stored re-encryption key and private key. If the verification results are consistent, the access rights of the corresponding data user in the authorization list are deleted, and the authorization list is updated based on the dual authorization authentication. The authorization manager also needs to register and send to the data user a public-private key pair containing the attributes in the data user's own attribute list, where the private key is the encrypted private key ciphertext, including: the authorization manager randomly selects a parameter based on the attribute list of the data user sent by the data owner; for any attribute of the data user, according to the data user attribute list, the access values ​​corresponding to different end nodes are grouped, and the access policy representing the end node that satisfies the attribute set of the data user is obtained; Encrypting the electricity user credit assessment data to form an initial encrypted ciphertext, sending the initial encrypted ciphertext and all re-encryption keys to the blockchain network, and the distributed data processing nodes in the blockchain network obtaining the authorized transaction according to the incentive mechanism, and responding to or rejecting the smart contract. The final data user decrypts the re-encrypted electricity user credit assessment data in the smart contract based on the execution process after responding to the smart contract, and obtains the plaintext of the electricity user's credit assessment data; When the distributed data processing node responds to the smart contract, the distributed data processing node re-encrypts the initial encrypted ciphertext using the respective re-encryption keys generated by the data owner, generating a double-encrypted power user credit assessment ciphertext that can be decrypted by the data user's private key; The distributed data processing node sends the doubly encrypted electricity user credit assessment ciphertext to the data user, and after completion, the transaction record is broadcast to the entire network; the data user decrypts the data user's private key ciphertext based on the obtained access structure excluding the leaf nodes and the data user's private key ciphertext, combined with the attributes in the attribute list provided to the data owner. After obtaining the private key, the doubly encrypted electricity user credit assessment ciphertext is decrypted in combination with the decryption parameters, thereby obtaining the electricity user's credit assessment data plaintext.

2. The blockchain-based power credit data security access control method according to claim 1, characterized in that: The authorization manager requests the data owner to obtain data authorization permission, which includes: the authorization manager sends registration information to the data owner and distributes a private key pair, and the data owner sends their own re-encryption key to the authorization manager to obtain permission.

3. The blockchain-based power credit data security access control method according to claim 1, characterized in that: The data owner uses his own public key to encrypt the electricity user credit assessment data to form an initial encrypted ciphertext, and then sends the initial encrypted ciphertext and the re-encryption key to the blockchain network. The distributed data processing nodes in the blockchain network obtain this transaction according to the incentive mechanism, and send a data user permission verification request to the authorization manager. The authorization manager authenticates the data user's identity according to the authorization list and sends feedback verification information to the distributed data processing nodes.

4. The blockchain-based power credit data security access control method according to claim 3 is characterized in that: If the data user does not have access rights, the distributed data processing node refuses to respond to the smart contract, generates an access denial record, and plays it to the blockchain network; if the data user has access rights, the distributed data processing node responds to the smart contract and authorizes the administrator to send the access structure and decryption parameters excluding the leaf nodes to the data user.

5. The blockchain-based power credit data security access control method according to claim 1, characterized in that: Based on the access policy of the terminal node satisfied by the attribute set of the data user, the data user's private key and public key are output; The authorized manager customizes the access policy based on the data user's data access requirements and the attribute values ​​in the attribute list provided by the data user, encrypts the data user's private key, and sends it to the data user's public key pair, where the private key is the private key ciphertext.

6. The blockchain-based power credit data security access control system is characterized by: include: Authorization module, used to authorize managers to request data authorization permissions from data owners, and data users to send data access requests to data owners and send their own attribute lists to the data owners and authorization managers; The data owner sends their own re-encryption key to the authorization manager as authorization authentication; After receiving the dual authorization authentication from the data owner, the authorization manager performs re-encryption key verification based on the public and private key pair of the data owner stored in the manager, and updates the authorization list based on the verification result. An access control module is configured to encrypt the electricity user credit assessment data to form an initial encrypted ciphertext, and send the initial encrypted ciphertext and all re-encryption keys to the blockchain network. Distributed data processing nodes in the blockchain network obtain the authorization transaction based on the incentive mechanism, and respond to or reject the smart contract. Ultimately, the data user decrypts the re-encrypted electricity user credit assessment data in the smart contract based on the execution process after responding to the smart contract, and obtains the plaintext of the electricity user's credit assessment data. The data user sends his own attribute list to the power company and the authorization manager. The authorization manager registers and sends to a third-party agency a public-private key pair containing the attributes in his own attribute list, where the private key is the encrypted private key ciphertext, including: the authorization manager randomly selects a parameter based on the attribute list of the data user sent by the data owner; for the attributes of any data user, according to the data user attribute list, the access values ​​corresponding to different terminal nodes are grouped, and the access policy of the terminal node that the attribute set of the data user satisfies is obtained; the process of updating the authorization list includes: performing re-encryption key verification. If the re-encryption keys are consistent, the data user is added to the authorization list. If any party among the data owners needs to delete the access rights of the data user, the party sends an application to other data owners and authorization managers. After receiving the application, the other data owners send the re-encryption key encrypted with their own private key and send it to the authorization manager. The authorization manager verifies based on the stored re-encryption key and private key. If the verification results are consistent, the access rights of the corresponding data user in the authorization list are deleted, and the authorization list is updated according to the double authorization authentication; When the distributed data processing node responds to the smart contract, the distributed data processing node re-encrypts the initial encrypted ciphertext using the respective re-encryption keys generated by the data owner, generating a double-encrypted power user credit assessment ciphertext that can be decrypted by the data user's private key; The distributed data processing node sends the doubly encrypted electricity user credit assessment ciphertext to the data user, and after completion, the transaction record is broadcast to the entire network; the data user decrypts the data user's private key ciphertext based on the obtained access structure excluding the leaf nodes and the data user's private key ciphertext, combined with the attributes in the attribute list provided to the data owner. After obtaining the private key, the doubly encrypted electricity user credit assessment ciphertext is decrypted in combination with the decryption parameters, thereby obtaining the electricity user's credit assessment data plaintext.

7. The blockchain-based power credit data security access control system according to claim 6, characterized in that: The authorization manager requests the data owner to obtain data authorization permission, which includes: the authorization manager sends registration information to the data owner and distributes a private key pair, and the data owner sends their own re-encryption key to the authorization manager to obtain permission.

8. The blockchain-based power credit data security access control system according to claim 6, characterized in that: The data owner uses his own public key to encrypt the electricity user credit assessment data to form an initial encrypted ciphertext, and then sends the initial encrypted ciphertext and the re-encryption key to the blockchain network. The distributed data processing nodes in the blockchain network obtain this transaction according to the incentive mechanism, and send a data user permission verification request to the authorization manager. The authorization manager authenticates the data user's identity according to the authorization list and sends feedback verification information to the distributed data processing nodes.

9. The blockchain-based power credit data security access control system according to claim 8, characterized in that: If the data user does not have access rights, the distributed data processing node refuses to respond to the smart contract, generates an access denial record, and plays it to the blockchain network; if the data user has access rights, the distributed data processing node responds to the smart contract and authorizes the administrator to send the access structure and decryption parameters excluding the leaf nodes to the data user.

Images